aws-cdk-lib 2.154.0__py3-none-any.whl → 2.155.0__py3-none-any.whl

aws_cdk/aws_cloudfront/__init__.py

@@ -118,6 +118,16 @@ cloudfront.Distribution(self, "myDist",
 )
 ```
 
+#### Moving an alternate domain name to a different distribution
+
+When you try to add an alternate domain name to a distribution but the alternate domain name is already in use on a different distribution, you get a `CNAMEAlreadyExists` error (One or more of the CNAMEs you provided are already associated with a different resource).
+
+In that case, you might want to move the existing alternate domain name from one distribution (the source distribution) to another (the target distribution). The following steps are an overview of the process. For more information, see [Moving an alternate domain name to a different distribution](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/alternate-domain-names-move.html).
+
+1. Deploy the stack with the target distribution. The `certificate` property must be specified but the `domainNames` should be absent.
+2. Move the alternate domain name by running CloudFront `associate-alias` command. For the example and preconditions, see the AWS documentation above.
+3. Specify the `domainNames` property with the alternative domain name, then deploy the stack again to resolve the drift at the alternative domain name.
+
 #### Cross Region Certificates
 
 > **This feature is currently experimental**
@@ -2311,7 +2321,7 @@ class CachePolicyProps:
         '''Properties for creating a Cache Policy.
 
         :param cache_policy_name: A unique name to identify the cache policy. The name must only include '-', '_', or alphanumeric characters. Default: - generated from the ``id``
-        :param comment: A comment to describe the cache policy. Default: - no comment
+        :param comment: A comment to describe the cache policy. The comment cannot be longer than 128 characters. Default: - no comment
         :param cookie_behavior: Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheCookieBehavior.none()
         :param default_ttl: The default amount of time for objects to stay in the CloudFront cache. Only used when the origin does not send Cache-Control or Expires headers with the object. Default: - The greater of 1 day and ``minTtl``
         :param enable_accept_encoding_brotli: Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'br'. Default: false
@@ -2396,6 +2406,8 @@ class CachePolicyProps:
     def comment(self) -> typing.Optional[builtins.str]:
         '''A comment to describe the cache policy.
 
+        The comment cannot be longer than 128 characters.
+
         :default: - no comment
         '''
         result = self._values.get("comment")
@@ -15677,7 +15689,7 @@ class DistributionProps:
         :param certificate: A certificate to associate with the distribution. The certificate must be located in N. Virginia (us-east-1). Default: - the CloudFront wildcard certificate (*.cloudfront.net) will be used.
         :param comment: Any comments you want to include about the distribution. Default: - no comment
         :param default_root_object: The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/). Default: - no default root object
-        :param domain_names: Alternative domain names for this distribution. If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution. If you attach a certificate to the distribution, you must add (at least one of) the domain names of the certificate to this list. Default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
+        :param domain_names: Alternative domain names for this distribution. If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution. If you attach a certificate to the distribution, you should add (at least one of) the domain names of the certificate to this list. When you want to move a domain name between distributions, you can associate a certificate without specifying any domain names. For more information, see the *Moving an alternate domain name to a different distribution* section in the README. Default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
         :param enabled: Enable or disable the distribution. Default: true
         :param enable_ipv6: Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address. If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution. Default: true
         :param enable_logging: Enable access logging for the distribution. Default: - false, unless ``logBucket`` is specified.
@@ -15833,7 +15845,10 @@ class DistributionProps:
 
         If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name,
         you can add an alternate domain name to your distribution. If you attach a certificate to the distribution,
-        you must add (at least one of) the domain names of the certificate to this list.
+        you should add (at least one of) the domain names of the certificate to this list.
+
+        When you want to move a domain name between distributions, you can associate a certificate without specifying any domain names.
+        For more information, see the *Moving an alternate domain name to a different distribution* section in the README.
 
         :default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
         '''
@@ -22678,7 +22693,7 @@ class CachePolicy(
         :param scope: -
         :param id: -
         :param cache_policy_name: A unique name to identify the cache policy. The name must only include '-', '_', or alphanumeric characters. Default: - generated from the ``id``
-        :param comment: A comment to describe the cache policy. Default: - no comment
+        :param comment: A comment to describe the cache policy. The comment cannot be longer than 128 characters. Default: - no comment
         :param cookie_behavior: Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheCookieBehavior.none()
         :param default_ttl: The default amount of time for objects to stay in the CloudFront cache. Only used when the origin does not send Cache-Control or Expires headers with the object. Default: - The greater of 1 day and ``minTtl``
         :param enable_accept_encoding_brotli: Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'br'. Default: false
@@ -23044,7 +23059,7 @@ class Distribution(
         :param certificate: A certificate to associate with the distribution. The certificate must be located in N. Virginia (us-east-1). Default: - the CloudFront wildcard certificate (*.cloudfront.net) will be used.
         :param comment: Any comments you want to include about the distribution. Default: - no comment
         :param default_root_object: The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/). Default: - no default root object
-        :param domain_names: Alternative domain names for this distribution. If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution. If you attach a certificate to the distribution, you must add (at least one of) the domain names of the certificate to this list. Default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
+        :param domain_names: Alternative domain names for this distribution. If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution. If you attach a certificate to the distribution, you should add (at least one of) the domain names of the certificate to this list. When you want to move a domain name between distributions, you can associate a certificate without specifying any domain names. For more information, see the *Moving an alternate domain name to a different distribution* section in the README. Default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
         :param enabled: Enable or disable the distribution. Default: true
         :param enable_ipv6: Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address. If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution. Default: true
         :param enable_logging: Enable access logging for the distribution. Default: - false, unless ``logBucket`` is specified.

aws_cdk/aws_codebuild/__init__.py

@@ -309,15 +309,15 @@ a reserved capacity project. See [Fleet](#fleet) for more information.
 
 ## Images
 
-The CodeBuild library supports both Linux and Windows images via the
-`LinuxBuildImage` (or `LinuxArmBuildImage`), and `WindowsBuildImage` classes, respectively.
+The CodeBuild library supports Linux, Windows, and Mac images via the
+`LinuxBuildImage` (or `LinuxArmBuildImage`), `WindowsBuildImage`, and `MacBuildImage` classes, respectively.
 With the introduction of Lambda compute support, the `LinuxLambdaBuildImage ` (or `LinuxArmLambdaBuildImage`) class
 is available for specifying Lambda-compatible images.
 
 You can specify one of the predefined Windows/Linux images by using one
 of the constants such as `WindowsBuildImage.WIN_SERVER_CORE_2019_BASE`,
 `WindowsBuildImage.WINDOWS_BASE_2_0`, `LinuxBuildImage.STANDARD_2_0`,
-`LinuxBuildImage.AMAZON_LINUX_2_5`, `LinuxArmBuildImage.AMAZON_LINUX_2_ARM`,
+`LinuxBuildImage.AMAZON_LINUX_2_5`, `MacBuildImage.BASE_14`, `LinuxArmBuildImage.AMAZON_LINUX_2_ARM`,
 `LinuxLambdaBuildImage.AMAZON_LINUX_2_NODE_18` or `LinuxArmLambdaBuildImage.AMAZON_LINUX_2_NODE_18`.
 
 Alternatively, you can specify a custom image using one of the static methods on
@@ -336,6 +336,12 @@ or one of the corresponding methods on `WindowsBuildImage`:
 * `WindowsBuildImage.fromEcrRepository(repo[, tag, imageType])`
 * `WindowsBuildImage.fromAsset(parent, id, props, [, imageType])`
 
+or one of the corresponding methods on `MacBuildImage`:
+
+* `MacBuildImage.fromDockerRegistry(image[, { secretsManagerCredentials }, imageType])`
+* `MacBuildImage.fromEcrRepository(repo[, tag, imageType])`
+* `MacBuildImage.fromAsset(parent, id, props, [, imageType])`
+
 or one of the corresponding methods on `LinuxArmBuildImage`:
 
 * `LinuxArmBuildImage.fromDockerRegistry(image[, { secretsManagerCredentials }])`
@@ -2129,6 +2135,7 @@ class CfnFleet(
                 subnets=["subnets"],
                 vpc_id="vpcId"
             ),
+            image_id="imageId",
             name="name",
             overflow_behavior="overflowBehavior",
             tags=[CfnTag(
@@ -2148,6 +2155,7 @@ class CfnFleet(
         environment_type: typing.Optional[builtins.str] = None,
         fleet_service_role: typing.Optional[builtins.str] = None,
         fleet_vpc_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnFleet.VpcConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        image_id: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         overflow_behavior: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -2160,6 +2168,7 @@ class CfnFleet(
         :param environment_type: The environment type of the compute fleet. - The environment type ``ARM_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Singapore), Asia Pacific (Sydney), EU (Frankfurt), and South America (São Paulo). - The environment type ``LINUX_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), EU (Frankfurt), Asia Pacific (Tokyo), Asia Pacific (Singapore), Asia Pacific (Sydney), South America (São Paulo), and Asia Pacific (Mumbai). - The environment type ``LINUX_GPU_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), EU (Frankfurt), Asia Pacific (Tokyo), and Asia Pacific (Sydney). - The environment type ``WINDOWS_SERVER_2019_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Sydney), Asia Pacific (Tokyo), Asia Pacific (Mumbai) and EU (Ireland). - The environment type ``WINDOWS_SERVER_2022_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), EU (Frankfurt), Asia Pacific (Sydney), Asia Pacific (Singapore), Asia Pacific (Tokyo), South America (São Paulo) and Asia Pacific (Mumbai). For more information, see `Build environment compute types <https://docs.aws.amazon.com//codebuild/latest/userguide/build-env-ref-compute-types.html>`_ in the *AWS CodeBuild user guide* .
         :param fleet_service_role: The service role associated with the compute fleet. For more information, see `Allow a user to add a permission policy for a fleet service role <https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#customer-managed-policies-example-permission-policy-fleet-service-role.html>`_ in the *AWS CodeBuild User Guide* .
         :param fleet_vpc_config: Information about the VPC configuration that AWS CodeBuild accesses.
+        :param image_id: The Amazon Machine Image (AMI) of the compute fleet.
         :param name: The name of the compute fleet.
         :param overflow_behavior: The compute fleet overflow behavior. - For overflow behavior ``QUEUE`` , your overflow builds need to wait on the existing fleet instance to become available. - For overflow behavior ``ON_DEMAND`` , your overflow builds run on CodeBuild on-demand. .. epigraph:: If you choose to set your overflow behavior to on-demand while creating a VPC-connected fleet, make sure that you add the required VPC permissions to your project service role. For more information, see `Example policy statement to allow CodeBuild access to AWS services required to create a VPC network interface <https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#customer-managed-policies-example-create-vpc-network-interface>`_ .
         :param tags: A list of tag key and value pairs associated with this compute fleet. These tags are available for use by AWS services that support AWS CodeBuild compute fleet tags.
@@ -2174,6 +2183,7 @@ class CfnFleet(
             environment_type=environment_type,
             fleet_service_role=fleet_service_role,
             fleet_vpc_config=fleet_vpc_config,
+            image_id=image_id,
             name=name,
             overflow_behavior=overflow_behavior,
             tags=tags,
@@ -2304,6 +2314,19 @@ class CfnFleet(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "fleetVpcConfig", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="imageId")
+    def image_id(self) -> typing.Optional[builtins.str]:
+        '''The Amazon Machine Image (AMI) of the compute fleet.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "imageId"))
+
+    @image_id.setter
+    def image_id(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a33f552a37e35f306dfe760e51f68c6ca42ccd6b0ff4f2384f78f2d64f098f01)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "imageId", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="name")
     def name(self) -> typing.Optional[builtins.str]:
@@ -2442,6 +2465,7 @@ class CfnFleet(
         "environment_type": "environmentType",
         "fleet_service_role": "fleetServiceRole",
         "fleet_vpc_config": "fleetVpcConfig",
+        "image_id": "imageId",
         "name": "name",
         "overflow_behavior": "overflowBehavior",
         "tags": "tags",
@@ -2456,6 +2480,7 @@ class CfnFleetProps:
         environment_type: typing.Optional[builtins.str] = None,
         fleet_service_role: typing.Optional[builtins.str] = None,
         fleet_vpc_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFleet.VpcConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+        image_id: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         overflow_behavior: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -2467,6 +2492,7 @@ class CfnFleetProps:
         :param environment_type: The environment type of the compute fleet. - The environment type ``ARM_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Singapore), Asia Pacific (Sydney), EU (Frankfurt), and South America (São Paulo). - The environment type ``LINUX_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), EU (Frankfurt), Asia Pacific (Tokyo), Asia Pacific (Singapore), Asia Pacific (Sydney), South America (São Paulo), and Asia Pacific (Mumbai). - The environment type ``LINUX_GPU_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), EU (Frankfurt), Asia Pacific (Tokyo), and Asia Pacific (Sydney). - The environment type ``WINDOWS_SERVER_2019_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Sydney), Asia Pacific (Tokyo), Asia Pacific (Mumbai) and EU (Ireland). - The environment type ``WINDOWS_SERVER_2022_CONTAINER`` is available only in regions US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), EU (Frankfurt), Asia Pacific (Sydney), Asia Pacific (Singapore), Asia Pacific (Tokyo), South America (São Paulo) and Asia Pacific (Mumbai). For more information, see `Build environment compute types <https://docs.aws.amazon.com//codebuild/latest/userguide/build-env-ref-compute-types.html>`_ in the *AWS CodeBuild user guide* .
         :param fleet_service_role: The service role associated with the compute fleet. For more information, see `Allow a user to add a permission policy for a fleet service role <https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#customer-managed-policies-example-permission-policy-fleet-service-role.html>`_ in the *AWS CodeBuild User Guide* .
         :param fleet_vpc_config: Information about the VPC configuration that AWS CodeBuild accesses.
+        :param image_id: The Amazon Machine Image (AMI) of the compute fleet.
         :param name: The name of the compute fleet.
         :param overflow_behavior: The compute fleet overflow behavior. - For overflow behavior ``QUEUE`` , your overflow builds need to wait on the existing fleet instance to become available. - For overflow behavior ``ON_DEMAND`` , your overflow builds run on CodeBuild on-demand. .. epigraph:: If you choose to set your overflow behavior to on-demand while creating a VPC-connected fleet, make sure that you add the required VPC permissions to your project service role. For more information, see `Example policy statement to allow CodeBuild access to AWS services required to create a VPC network interface <https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#customer-managed-policies-example-create-vpc-network-interface>`_ .
         :param tags: A list of tag key and value pairs associated with this compute fleet. These tags are available for use by AWS services that support AWS CodeBuild compute fleet tags.
@@ -2490,6 +2516,7 @@ class CfnFleetProps:
                     subnets=["subnets"],
                     vpc_id="vpcId"
                 ),
+                image_id="imageId",
                 name="name",
                 overflow_behavior="overflowBehavior",
                 tags=[CfnTag(
@@ -2505,6 +2532,7 @@ class CfnFleetProps:
             check_type(argname="argument environment_type", value=environment_type, expected_type=type_hints["environment_type"])
             check_type(argname="argument fleet_service_role", value=fleet_service_role, expected_type=type_hints["fleet_service_role"])
             check_type(argname="argument fleet_vpc_config", value=fleet_vpc_config, expected_type=type_hints["fleet_vpc_config"])
+            check_type(argname="argument image_id", value=image_id, expected_type=type_hints["image_id"])
             check_type(argname="argument name", value=name, expected_type=type_hints["name"])
             check_type(argname="argument overflow_behavior", value=overflow_behavior, expected_type=type_hints["overflow_behavior"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
@@ -2519,6 +2547,8 @@ class CfnFleetProps:
             self._values["fleet_service_role"] = fleet_service_role
         if fleet_vpc_config is not None:
             self._values["fleet_vpc_config"] = fleet_vpc_config
+        if image_id is not None:
+            self._values["image_id"] = image_id
         if name is not None:
             self._values["name"] = name
         if overflow_behavior is not None:
@@ -2603,6 +2633,15 @@ class CfnFleetProps:
         result = self._values.get("fleet_vpc_config")
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFleet.VpcConfigProperty]], result)
 
+    @builtins.property
+    def image_id(self) -> typing.Optional[builtins.str]:
+        '''The Amazon Machine Image (AMI) of the compute fleet.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-codebuild-fleet.html#cfn-codebuild-fleet-imageid
+        '''
+        result = self._values.get("image_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def name(self) -> typing.Optional[builtins.str]:
         '''The name of the compute fleet.
@@ -8123,7 +8162,7 @@ class DockerImageOptions:
         *,
         secrets_manager_credentials: typing.Optional[_ISecret_6e020e6a] = None,
     ) -> None:
-        '''The options when creating a CodeBuild Docker build image using ``LinuxBuildImage.fromDockerRegistry`` or ``WindowsBuildImage.fromDockerRegistry``.
+        '''The options when creating a CodeBuild Docker build image using ``LinuxBuildImage.fromDockerRegistry``, ``WindowsBuildImage.fromDockerRegistry``, or ``MacBuildImage.fromDockerRegistry``.
 
         :param secrets_manager_credentials: The credentials, stored in Secrets Manager, used for accessing the repository holding the image, if the repository is private. Default: no credentials will be used (we assume the repository is public)
 
@@ -8301,6 +8340,8 @@ class EnvironmentType(enum.Enum):
     '''Windows Server 2019 container.'''
     WINDOWS_SERVER_2022_CONTAINER = "WINDOWS_SERVER_2022_CONTAINER"
     '''Windows Server 2022 container.'''
+    MAC_ARM = "MAC_ARM"
+    '''MacOS ARM container.'''
 
 
 @jsii.enum(jsii_type="aws-cdk-lib.aws_codebuild.EventAction")
@@ -11699,6 +11740,289 @@ class LoggingOptions:
         )
 
 
+@jsii.implements(IBuildImage)
+class MacBuildImage(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_codebuild.MacBuildImage",
+):
+    '''A CodeBuild image running ARM MacOS.
+
+    This class has a bunch of public constants that represent the most popular images.
+
+    You can also specify a custom image using one of the static methods:
+
+    - MacBuildImage.fromDockerRegistry(image[, { secretsManagerCredentials }])
+    - MacBuildImage.fromEcrRepository(repo[, tag])
+    - MacBuildImage.fromAsset(parent, id, props)
+
+    :see: https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html
+    :exampleMetadata: fixture=_generated
+
+    Example::
+
+        # The code below shows an example of how to instantiate this type.
+        # The values are placeholders you should change.
+        import aws_cdk as cdk
+        from aws_cdk import aws_codebuild as codebuild
+        from aws_cdk import aws_ecr_assets as ecr_assets
+        
+        # network_mode: ecr_assets.NetworkMode
+        # platform: ecr_assets.Platform
+        
+        mac_build_image = codebuild.MacBuildImage.from_asset(self, "MyMacBuildImage",
+            directory="directory",
+        
+            # the properties below are optional
+            asset_name="assetName",
+            build_args={
+                "build_args_key": "buildArgs"
+            },
+            build_secrets={
+                "build_secrets_key": "buildSecrets"
+            },
+            build_ssh="buildSsh",
+            cache_disabled=False,
+            cache_from=[ecr_assets.DockerCacheOption(
+                type="type",
+        
+                # the properties below are optional
+                params={
+                    "params_key": "params"
+                }
+            )],
+            cache_to=ecr_assets.DockerCacheOption(
+                type="type",
+        
+                # the properties below are optional
+                params={
+                    "params_key": "params"
+                }
+            ),
+            exclude=["exclude"],
+            extra_hash="extraHash",
+            file="file",
+            follow_symlinks=cdk.SymlinkFollowMode.NEVER,
+            ignore_mode=cdk.IgnoreMode.GLOB,
+            invalidation=ecr_assets.DockerImageAssetInvalidationOptions(
+                build_args=False,
+                build_secrets=False,
+                build_ssh=False,
+                extra_hash=False,
+                file=False,
+                network_mode=False,
+                outputs=False,
+                platform=False,
+                repository_name=False,
+                target=False
+            ),
+            network_mode=network_mode,
+            outputs=["outputs"],
+            platform=platform,
+            target="target"
+        )
+    '''
+
+    @jsii.member(jsii_name="fromAsset")
+    @builtins.classmethod
+    def from_asset(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        directory: builtins.str,
+        asset_name: typing.Optional[builtins.str] = None,
+        build_args: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+        build_secrets: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+        build_ssh: typing.Optional[builtins.str] = None,
+        cache_disabled: typing.Optional[builtins.bool] = None,
+        cache_from: typing.Optional[typing.Sequence[typing.Union[_DockerCacheOption_58ef18ca, typing.Dict[builtins.str, typing.Any]]]] = None,
+        cache_to: typing.Optional[typing.Union[_DockerCacheOption_58ef18ca, typing.Dict[builtins.str, typing.Any]]] = None,
+        file: typing.Optional[builtins.str] = None,
+        invalidation: typing.Optional[typing.Union[_DockerImageAssetInvalidationOptions_4deb8d45, typing.Dict[builtins.str, typing.Any]]] = None,
+        network_mode: typing.Optional[_NetworkMode_897e5081] = None,
+        outputs: typing.Optional[typing.Sequence[builtins.str]] = None,
+        platform: typing.Optional[_Platform_d16f3cf1] = None,
+        target: typing.Optional[builtins.str] = None,
+        extra_hash: typing.Optional[builtins.str] = None,
+        exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
+        follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
+        ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
+    ) -> IBuildImage:
+        '''Uses an Docker image asset as a ARM MacOS build image.
+
+        :param scope: -
+        :param id: -
+        :param directory: The directory where the Dockerfile is stored. Any directory inside with a name that matches the CDK output folder (cdk.out by default) will be excluded from the asset
+        :param asset_name: Unique identifier of the docker image asset and its potential revisions. Required if using AppScopedStagingSynthesizer. Default: - no asset name
+        :param build_args: Build args to pass to the ``docker build`` command. Since Docker build arguments are resolved before deployment, keys and values cannot refer to unresolved tokens (such as ``lambda.functionArn`` or ``queue.queueUrl``). Default: - no build args are passed
+        :param build_secrets: Build secrets. Docker BuildKit must be enabled to use build secrets. Default: - no build secrets
+        :param build_ssh: SSH agent socket or keys to pass to the ``docker build`` command. Docker BuildKit must be enabled to use the ssh flag Default: - no --ssh flag
+        :param cache_disabled: Disable the cache and pass ``--no-cache`` to the ``docker build`` command. Default: - cache is used
+        :param cache_from: Cache from options to pass to the ``docker build`` command. Default: - no cache from options are passed to the build command
+        :param cache_to: Cache to options to pass to the ``docker build`` command. Default: - no cache to options are passed to the build command
+        :param file: Path to the Dockerfile (relative to the directory). Default: 'Dockerfile'
+        :param invalidation: Options to control which parameters are used to invalidate the asset hash. Default: - hash all parameters
+        :param network_mode: Networking mode for the RUN commands during build. Support docker API 1.25+. Default: - no networking mode specified (the default networking mode ``NetworkMode.DEFAULT`` will be used)
+        :param outputs: Outputs to pass to the ``docker build`` command. Default: - no outputs are passed to the build command (default outputs are used)
+        :param platform: Platform to build for. *Requires Docker Buildx*. Default: - no platform specified (the current machine architecture will be used)
+        :param target: Docker target to build to. Default: - no target
+        :param extra_hash: Extra information to encode into the fingerprint (e.g. build instructions and other inputs). Default: - hash is only based on source content
+        :param exclude: File paths matching the patterns will be excluded. See ``ignoreMode`` to set the matching behavior. Has no effect on Assets bundled using the ``bundling`` property. Default: - nothing is excluded
+        :param follow_symlinks: A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER
+        :param ignore_mode: The ignore behavior to use for ``exclude`` patterns. Default: IgnoreMode.GLOB
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__aa924aa0600b9706b95a62c612f337f8dde0f0df7d5d3b8c5b48b72793d2f035)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = _DockerImageAssetProps_6897287d(
+            directory=directory,
+            asset_name=asset_name,
+            build_args=build_args,
+            build_secrets=build_secrets,
+            build_ssh=build_ssh,
+            cache_disabled=cache_disabled,
+            cache_from=cache_from,
+            cache_to=cache_to,
+            file=file,
+            invalidation=invalidation,
+            network_mode=network_mode,
+            outputs=outputs,
+            platform=platform,
+            target=target,
+            extra_hash=extra_hash,
+            exclude=exclude,
+            follow_symlinks=follow_symlinks,
+            ignore_mode=ignore_mode,
+        )
+
+        return typing.cast(IBuildImage, jsii.sinvoke(cls, "fromAsset", [scope, id, props]))
+
+    @jsii.member(jsii_name="fromDockerRegistry")
+    @builtins.classmethod
+    def from_docker_registry(
+        cls,
+        name: builtins.str,
+        *,
+        secrets_manager_credentials: typing.Optional[_ISecret_6e020e6a] = None,
+    ) -> IBuildImage:
+        '''Makes an ARM MacOS build image from a Docker Hub image.
+
+        :param name: -
+        :param secrets_manager_credentials: The credentials, stored in Secrets Manager, used for accessing the repository holding the image, if the repository is private. Default: no credentials will be used (we assume the repository is public)
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__3ced24ed51e6d3d02f373fa149177eaedab74dee6bcfb75fb774dc8c44de1400)
+            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+        options = DockerImageOptions(
+            secrets_manager_credentials=secrets_manager_credentials
+        )
+
+        return typing.cast(IBuildImage, jsii.sinvoke(cls, "fromDockerRegistry", [name, options]))
+
+    @jsii.member(jsii_name="fromEcrRepository")
+    @builtins.classmethod
+    def from_ecr_repository(
+        cls,
+        repository: _IRepository_e6004aa6,
+        tag_or_digest: typing.Optional[builtins.str] = None,
+    ) -> IBuildImage:
+        '''Makes an ARM MacOS build image from an ECR repository.
+
+        :param repository: -
+        :param tag_or_digest: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__86c63517f15ffab752d46ab62cdbf8292d45fa89a328c7481f83993a790eb5ee)
+            check_type(argname="argument repository", value=repository, expected_type=type_hints["repository"])
+            check_type(argname="argument tag_or_digest", value=tag_or_digest, expected_type=type_hints["tag_or_digest"])
+        return typing.cast(IBuildImage, jsii.sinvoke(cls, "fromEcrRepository", [repository, tag_or_digest]))
+
+    @jsii.member(jsii_name="runScriptBuildspec")
+    def run_script_buildspec(self, entrypoint: builtins.str) -> BuildSpec:
+        '''Make a buildspec to run the indicated script.
+
+        :param entrypoint: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__088f043d10fcd15701414055dc0a14f58d71044ecaba5c848f1c97225e6000fe)
+            check_type(argname="argument entrypoint", value=entrypoint, expected_type=type_hints["entrypoint"])
+        return typing.cast(BuildSpec, jsii.invoke(self, "runScriptBuildspec", [entrypoint]))
+
+    @jsii.member(jsii_name="validate")
+    def validate(
+        self,
+        *,
+        build_image: typing.Optional[IBuildImage] = None,
+        certificate: typing.Optional[typing.Union[BuildEnvironmentCertificate, typing.Dict[builtins.str, typing.Any]]] = None,
+        compute_type: typing.Optional[ComputeType] = None,
+        environment_variables: typing.Optional[typing.Mapping[builtins.str, typing.Union[BuildEnvironmentVariable, typing.Dict[builtins.str, typing.Any]]]] = None,
+        fleet: typing.Optional[IFleet] = None,
+        privileged: typing.Optional[builtins.bool] = None,
+    ) -> typing.List[builtins.str]:
+        '''Allows the image a chance to validate whether the passed configuration is correct.
+
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
+        :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
+        :param environment_variables: The environment variables that your builds can use.
+        :param fleet: Fleet resource for a reserved capacity CodeBuild project. Fleets allow for process builds or tests to run immediately and reduces build durations, by reserving compute resources for your projects. You will be charged for the resources in the fleet, even if they are idle. Default: - No fleet will be attached to the project, which will remain on-demand.
+        :param privileged: Indicates how the project builds Docker images. Specify true to enable running the Docker daemon inside a Docker container. This value must be set to true only if this build project will be used to build Docker images, and the specified build environment image is not one provided by AWS CodeBuild with Docker support. Otherwise, all associated builds that attempt to interact with the Docker daemon will fail. Default: false
+        '''
+        build_environment = BuildEnvironment(
+            build_image=build_image,
+            certificate=certificate,
+            compute_type=compute_type,
+            environment_variables=environment_variables,
+            fleet=fleet,
+            privileged=privileged,
+        )
+
+        return typing.cast(typing.List[builtins.str], jsii.invoke(self, "validate", [build_environment]))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="BASE_14")
+    def BASE_14(cls) -> IBuildImage:
+        '''Corresponds to the standard CodeBuild image ``aws/codebuild/macos-arm-base:14``.'''
+        return typing.cast(IBuildImage, jsii.sget(cls, "BASE_14"))
+
+    @builtins.property
+    @jsii.member(jsii_name="defaultComputeType")
+    def default_compute_type(self) -> ComputeType:
+        '''The default ``ComputeType`` to use with this image, if one was not specified in ``BuildEnvironment#computeType`` explicitly.'''
+        return typing.cast(ComputeType, jsii.get(self, "defaultComputeType"))
+
+    @builtins.property
+    @jsii.member(jsii_name="imageId")
+    def image_id(self) -> builtins.str:
+        '''The Docker image identifier that the build environment uses.'''
+        return typing.cast(builtins.str, jsii.get(self, "imageId"))
+
+    @builtins.property
+    @jsii.member(jsii_name="type")
+    def type(self) -> builtins.str:
+        '''The type of build environment.'''
+        return typing.cast(builtins.str, jsii.get(self, "type"))
+
+    @builtins.property
+    @jsii.member(jsii_name="imagePullPrincipalType")
+    def image_pull_principal_type(self) -> typing.Optional[ImagePullPrincipalType]:
+        '''The type of principal that CodeBuild will use to pull this build Docker image.'''
+        return typing.cast(typing.Optional[ImagePullPrincipalType], jsii.get(self, "imagePullPrincipalType"))
+
+    @builtins.property
+    @jsii.member(jsii_name="repository")
+    def repository(self) -> typing.Optional[_IRepository_e6004aa6]:
+        '''An optional ECR repository that the image is hosted in.'''
+        return typing.cast(typing.Optional[_IRepository_e6004aa6], jsii.get(self, "repository"))
+
+    @builtins.property
+    @jsii.member(jsii_name="secretsManagerCredentials")
+    def secrets_manager_credentials(self) -> typing.Optional[_ISecret_6e020e6a]:
+        '''The secretsManagerCredentials for access to a private registry.'''
+        return typing.cast(typing.Optional[_ISecret_6e020e6a], jsii.get(self, "secretsManagerCredentials"))
+
+
 class PhaseChangeEvent(
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_codebuild.PhaseChangeEvent",
@@ -17020,6 +17344,7 @@ __all__ = [
     "LinuxLambdaBuildImage",
     "LocalCacheMode",
     "LoggingOptions",
+    "MacBuildImage",
     "PhaseChangeEvent",
     "PipelineProject",
     "PipelineProjectProps",
@@ -17180,6 +17505,7 @@ def _typecheckingstub__081dd1a893dcfd34d3fe760e75a2377d2c6fbce3f4d815a8e141bcdc0
     environment_type: typing.Optional[builtins.str] = None,
     fleet_service_role: typing.Optional[builtins.str] = None,
     fleet_vpc_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFleet.VpcConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    image_id: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     overflow_behavior: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -17229,6 +17555,12 @@ def _typecheckingstub__c66d1798050c93d95746b1057fb5b75bf773869be3796e773defefc3a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__a33f552a37e35f306dfe760e51f68c6ca42ccd6b0ff4f2384f78f2d64f098f01(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__81a1c2090a083488d8e471132fa655912efe0a0fbc6ff93d4665fff305cc8b48(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -17263,6 +17595,7 @@ def _typecheckingstub__0f3b2fbc34cebb084c954d70b833a508d545b12a4280ff0f8020065e7
     environment_type: typing.Optional[builtins.str] = None,
     fleet_service_role: typing.Optional[builtins.str] = None,
     fleet_vpc_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFleet.VpcConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    image_id: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     overflow_behavior: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -18301,6 +18634,53 @@ def _typecheckingstub__8f582462b349e223e49bf3524c963794211ae94781bdfcfe2a00802c6
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__aa924aa0600b9706b95a62c612f337f8dde0f0df7d5d3b8c5b48b72793d2f035(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    directory: builtins.str,
+    asset_name: typing.Optional[builtins.str] = None,
+    build_args: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+    build_secrets: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+    build_ssh: typing.Optional[builtins.str] = None,
+    cache_disabled: typing.Optional[builtins.bool] = None,
+    cache_from: typing.Optional[typing.Sequence[typing.Union[_DockerCacheOption_58ef18ca, typing.Dict[builtins.str, typing.Any]]]] = None,
+    cache_to: typing.Optional[typing.Union[_DockerCacheOption_58ef18ca, typing.Dict[builtins.str, typing.Any]]] = None,
+    file: typing.Optional[builtins.str] = None,
+    invalidation: typing.Optional[typing.Union[_DockerImageAssetInvalidationOptions_4deb8d45, typing.Dict[builtins.str, typing.Any]]] = None,
+    network_mode: typing.Optional[_NetworkMode_897e5081] = None,
+    outputs: typing.Optional[typing.Sequence[builtins.str]] = None,
+    platform: typing.Optional[_Platform_d16f3cf1] = None,
+    target: typing.Optional[builtins.str] = None,
+    extra_hash: typing.Optional[builtins.str] = None,
+    exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
+    follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
+    ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__3ced24ed51e6d3d02f373fa149177eaedab74dee6bcfb75fb774dc8c44de1400(
+    name: builtins.str,
+    *,
+    secrets_manager_credentials: typing.Optional[_ISecret_6e020e6a] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__86c63517f15ffab752d46ab62cdbf8292d45fa89a328c7481f83993a790eb5ee(
+    repository: _IRepository_e6004aa6,
+    tag_or_digest: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__088f043d10fcd15701414055dc0a14f58d71044ecaba5c848f1c97225e6000fe(
+    entrypoint: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__cad18ebbb1c05a6adb06360d9baca4a0658b2f85c2078bc257ed8d4f8467c35e(
     *,
     allow_all_outbound: typing.Optional[builtins.bool] = None,