aws-cdk-lib 2.159.0__py3-none-any.whl → 2.160.0__py3-none-any.whl

aws_cdk/cloud_assembly_schema/__init__.py

@@ -88,123 +88,6 @@ def check_type(argname: str, value: object, expected_type: typing.Any) -> typing
 from .._jsii import *
 
 
-@jsii.data_type(
-    jsii_type="aws-cdk-lib.cloud_assembly_schema.AmiContextQuery",
-    jsii_struct_bases=[],
-    name_mapping={
-        "account": "account",
-        "filters": "filters",
-        "region": "region",
-        "lookup_role_arn": "lookupRoleArn",
-        "owners": "owners",
-    },
-)
-class AmiContextQuery:
-    def __init__(
-        self,
-        *,
-        account: builtins.str,
-        filters: typing.Mapping[builtins.str, typing.Sequence[builtins.str]],
-        region: builtins.str,
-        lookup_role_arn: typing.Optional[builtins.str] = None,
-        owners: typing.Optional[typing.Sequence[builtins.str]] = None,
-    ) -> None:
-        '''Query to AMI context provider.
-
-        :param account: Account to query.
-        :param filters: Filters to DescribeImages call.
-        :param region: Region to query.
-        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
-        :param owners: Owners to DescribeImages call. Default: - All owners
-
-        :exampleMetadata: fixture=_generated
-
-        Example::
-
-            # The code below shows an example of how to instantiate this type.
-            # The values are placeholders you should change.
-            from aws_cdk import cloud_assembly_schema
-            
-            ami_context_query = AmiContextQuery(
-                account="account",
-                filters={
-                    "filters_key": ["filters"]
-                },
-                region="region",
-            
-                # the properties below are optional
-                lookup_role_arn="lookupRoleArn",
-                owners=["owners"]
-            )
-        '''
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__9ad6944b308c0d053938a9bf5ce1be77af5b529135dc35a4c245384840501111)
-            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
-            check_type(argname="argument filters", value=filters, expected_type=type_hints["filters"])
-            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
-            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
-            check_type(argname="argument owners", value=owners, expected_type=type_hints["owners"])
-        self._values: typing.Dict[builtins.str, typing.Any] = {
-            "account": account,
-            "filters": filters,
-            "region": region,
-        }
-        if lookup_role_arn is not None:
-            self._values["lookup_role_arn"] = lookup_role_arn
-        if owners is not None:
-            self._values["owners"] = owners
-
-    @builtins.property
-    def account(self) -> builtins.str:
-        '''Account to query.'''
-        result = self._values.get("account")
-        assert result is not None, "Required property 'account' is missing"
-        return typing.cast(builtins.str, result)
-
-    @builtins.property
-    def filters(self) -> typing.Mapping[builtins.str, typing.List[builtins.str]]:
-        '''Filters to DescribeImages call.'''
-        result = self._values.get("filters")
-        assert result is not None, "Required property 'filters' is missing"
-        return typing.cast(typing.Mapping[builtins.str, typing.List[builtins.str]], result)
-
-    @builtins.property
-    def region(self) -> builtins.str:
-        '''Region to query.'''
-        result = self._values.get("region")
-        assert result is not None, "Required property 'region' is missing"
-        return typing.cast(builtins.str, result)
-
-    @builtins.property
-    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
-        '''The ARN of the role that should be used to look up the missing values.
-
-        :default: - None
-        '''
-        result = self._values.get("lookup_role_arn")
-        return typing.cast(typing.Optional[builtins.str], result)
-
-    @builtins.property
-    def owners(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''Owners to DescribeImages call.
-
-        :default: - All owners
-        '''
-        result = self._values.get("owners")
-        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
-
-    def __eq__(self, rhs: typing.Any) -> builtins.bool:
-        return isinstance(rhs, self.__class__) and rhs._values == self._values
-
-    def __ne__(self, rhs: typing.Any) -> builtins.bool:
-        return not (rhs == self)
-
-    def __repr__(self) -> str:
-        return "AmiContextQuery(%s)" % ", ".join(
-            k + "=" + repr(v) for k, v in self._values.items()
-        )
-
-
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.ArtifactManifest",
     jsii_struct_bases=[],
@@ -245,6 +128,8 @@ class ArtifactManifest:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             artifact_manifest = ArtifactManifest(
                 type=cloud_assembly_schema.ArtifactType.NONE,
             
@@ -265,6 +150,9 @@ class ArtifactManifest:
                     template_file="templateFile",
             
                     # the properties below are optional
+                    assume_role_additional_options={
+                        "assume_role_additional_options_key": assume_role_additional_options
+                    },
                     assume_role_arn="assumeRoleArn",
                     assume_role_external_id="assumeRoleExternalId",
                     bootstrap_stack_version_ssm_parameter="bootstrapStackVersionSsmParameter",
@@ -273,10 +161,14 @@ class ArtifactManifest:
                         arn="arn",
             
                         # the properties below are optional
+                        assume_role_additional_options={
+                            "assume_role_additional_options_key": assume_role_additional_options
+                        },
                         assume_role_external_id="assumeRoleExternalId",
                         bootstrap_stack_version_ssm_parameter="bootstrapStackVersionSsmParameter",
                         requires_bootstrap_stack_version=123
                     ),
+                    notification_arns=["notificationArns"],
                     parameters={
                         "parameters_key": "parameters"
                     },
@@ -451,6 +343,8 @@ class AssemblyManifest:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             assembly_manifest = AssemblyManifest(
                 version="version",
             
@@ -476,6 +370,9 @@ class AssemblyManifest:
                             template_file="templateFile",
             
                             # the properties below are optional
+                            assume_role_additional_options={
+                                "assume_role_additional_options_key": assume_role_additional_options
+                            },
                             assume_role_arn="assumeRoleArn",
                             assume_role_external_id="assumeRoleExternalId",
                             bootstrap_stack_version_ssm_parameter="bootstrapStackVersionSsmParameter",
@@ -484,10 +381,14 @@ class AssemblyManifest:
                                 arn="arn",
             
                                 # the properties below are optional
+                                assume_role_additional_options={
+                                    "assume_role_additional_options_key": assume_role_additional_options
+                                },
                                 assume_role_external_id="assumeRoleExternalId",
                                 bootstrap_stack_version_ssm_parameter="bootstrapStackVersionSsmParameter",
                                 requires_bootstrap_stack_version=123
                             ),
+                            notification_arns=["notificationArns"],
                             parameters={
                                 "parameters_key": "parameters"
                             },
@@ -512,7 +413,11 @@ class AssemblyManifest:
                         region="region",
             
                         # the properties below are optional
+                        assume_role_additional_options={
+                            "assume_role_additional_options_key": assume_role_additional_options
+                        },
                         lookup_role_arn="lookupRoleArn",
+                        lookup_role_external_id="lookupRoleExternalId",
                         owners=["owners"]
                     ),
                     provider=cloud_assembly_schema.ContextProvider.AMI_PROVIDER
@@ -624,6 +529,8 @@ class AssetManifest:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             asset_manifest = AssetManifest(
                 version="version",
             
@@ -636,6 +543,9 @@ class AssetManifest:
                                 repository_name="repositoryName",
             
                                 # the properties below are optional
+                                assume_role_additional_options={
+                                    "assume_role_additional_options_key": assume_role_additional_options
+                                },
                                 assume_role_arn="assumeRoleArn",
                                 assume_role_external_id="assumeRoleExternalId",
                                 region="region"
@@ -684,6 +594,9 @@ class AssetManifest:
                                 object_key="objectKey",
             
                                 # the properties below are optional
+                                assume_role_additional_options={
+                                    "assume_role_additional_options_key": assume_role_additional_options
+                                },
                                 assume_role_arn="assumeRoleArn",
                                 assume_role_external_id="assumeRoleExternalId",
                                 region="region"
@@ -924,102 +837,18 @@ class AssetManifestProperties(AssetManifestOptions):
         )
 
 
-@jsii.data_type(
-    jsii_type="aws-cdk-lib.cloud_assembly_schema.AvailabilityZonesContextQuery",
-    jsii_struct_bases=[],
-    name_mapping={
-        "account": "account",
-        "region": "region",
-        "lookup_role_arn": "lookupRoleArn",
-    },
-)
-class AvailabilityZonesContextQuery:
-    def __init__(
-        self,
-        *,
-        account: builtins.str,
-        region: builtins.str,
-        lookup_role_arn: typing.Optional[builtins.str] = None,
-    ) -> None:
-        '''Query to availability zone context provider.
-
-        :param account: Query account.
-        :param region: Query region.
-        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
-
-        :exampleMetadata: fixture=_generated
-
-        Example::
-
-            # The code below shows an example of how to instantiate this type.
-            # The values are placeholders you should change.
-            from aws_cdk import cloud_assembly_schema
-            
-            availability_zones_context_query = AvailabilityZonesContextQuery(
-                account="account",
-                region="region",
-            
-                # the properties below are optional
-                lookup_role_arn="lookupRoleArn"
-            )
-        '''
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__e23cb5710241f65fda5e65504911a7340786a62ce9cf7c60c9cfc1d4d4a05753)
-            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
-            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
-            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
-        self._values: typing.Dict[builtins.str, typing.Any] = {
-            "account": account,
-            "region": region,
-        }
-        if lookup_role_arn is not None:
-            self._values["lookup_role_arn"] = lookup_role_arn
-
-    @builtins.property
-    def account(self) -> builtins.str:
-        '''Query account.'''
-        result = self._values.get("account")
-        assert result is not None, "Required property 'account' is missing"
-        return typing.cast(builtins.str, result)
-
-    @builtins.property
-    def region(self) -> builtins.str:
-        '''Query region.'''
-        result = self._values.get("region")
-        assert result is not None, "Required property 'region' is missing"
-        return typing.cast(builtins.str, result)
-
-    @builtins.property
-    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
-        '''The ARN of the role that should be used to look up the missing values.
-
-        :default: - None
-        '''
-        result = self._values.get("lookup_role_arn")
-        return typing.cast(typing.Optional[builtins.str], result)
-
-    def __eq__(self, rhs: typing.Any) -> builtins.bool:
-        return isinstance(rhs, self.__class__) and rhs._values == self._values
-
-    def __ne__(self, rhs: typing.Any) -> builtins.bool:
-        return not (rhs == self)
-
-    def __repr__(self) -> str:
-        return "AvailabilityZonesContextQuery(%s)" % ", ".join(
-            k + "=" + repr(v) for k, v in self._values.items()
-        )
-
-
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.AwsCloudFormationStackProperties",
     jsii_struct_bases=[],
     name_mapping={
         "template_file": "templateFile",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "assume_role_arn": "assumeRoleArn",
         "assume_role_external_id": "assumeRoleExternalId",
         "bootstrap_stack_version_ssm_parameter": "bootstrapStackVersionSsmParameter",
         "cloud_formation_execution_role_arn": "cloudFormationExecutionRoleArn",
         "lookup_role": "lookupRole",
+        "notification_arns": "notificationArns",
         "parameters": "parameters",
         "requires_bootstrap_stack_version": "requiresBootstrapStackVersion",
         "stack_name": "stackName",
@@ -1034,11 +863,13 @@ class AwsCloudFormationStackProperties:
         self,
         *,
         template_file: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         assume_role_arn: typing.Optional[builtins.str] = None,
         assume_role_external_id: typing.Optional[builtins.str] = None,
         bootstrap_stack_version_ssm_parameter: typing.Optional[builtins.str] = None,
         cloud_formation_execution_role_arn: typing.Optional[builtins.str] = None,
         lookup_role: typing.Optional[typing.Union["BootstrapRole", typing.Dict[builtins.str, typing.Any]]] = None,
+        notification_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
         parameters: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         requires_bootstrap_stack_version: typing.Optional[jsii.Number] = None,
         stack_name: typing.Optional[builtins.str] = None,
@@ -1050,11 +881,13 @@ class AwsCloudFormationStackProperties:
         '''Artifact properties for CloudFormation stacks.
 
         :param template_file: A file relative to the assembly root which contains the CloudFormation template for this stack.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the role. - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead. Default: - No additional options.
         :param assume_role_arn: The role that needs to be assumed to deploy the stack. Default: - No role is assumed (current credentials are used)
         :param assume_role_external_id: External ID to use when assuming role for cloudformation deployments. Default: - No external ID
         :param bootstrap_stack_version_ssm_parameter: SSM parameter where the bootstrap stack version number can be found. Only used if ``requiresBootstrapStackVersion`` is set. - If this value is not set, the bootstrap stack name must be known at deployment time so the stack version can be looked up from the stack outputs. - If this value is set, the bootstrap stack can have any name because we won't need to look it up. Default: - Bootstrap stack version number looked up
         :param cloud_formation_execution_role_arn: The role that is passed to CloudFormation to execute the change set. Default: - No role is passed (currently assumed role/credentials are used)
         :param lookup_role: The role to use to look up values from the target AWS account. Default: - No role is assumed (current credentials are used)
+        :param notification_arns: SNS Notification ARNs that should receive CloudFormation Stack Events. Default: - No notification arns
         :param parameters: Values for CloudFormation stack parameters that should be passed when the stack is deployed. Default: - No parameters
         :param requires_bootstrap_stack_version: Version of bootstrap stack required to deploy this stack. Default: - No bootstrap stack required
         :param stack_name: The name to use for the CloudFormation stack. Default: - name derived from artifact ID
@@ -1071,10 +904,15 @@ class AwsCloudFormationStackProperties:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             aws_cloud_formation_stack_properties = AwsCloudFormationStackProperties(
                 template_file="templateFile",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 assume_role_arn="assumeRoleArn",
                 assume_role_external_id="assumeRoleExternalId",
                 bootstrap_stack_version_ssm_parameter="bootstrapStackVersionSsmParameter",
@@ -1083,10 +921,14 @@ class AwsCloudFormationStackProperties:
                     arn="arn",
             
                     # the properties below are optional
+                    assume_role_additional_options={
+                        "assume_role_additional_options_key": assume_role_additional_options
+                    },
                     assume_role_external_id="assumeRoleExternalId",
                     bootstrap_stack_version_ssm_parameter="bootstrapStackVersionSsmParameter",
                     requires_bootstrap_stack_version=123
                 ),
+                notification_arns=["notificationArns"],
                 parameters={
                     "parameters_key": "parameters"
                 },
@@ -1105,11 +947,13 @@ class AwsCloudFormationStackProperties:
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__662c8e7475bc8ebd11512c676ac10ca4f84539770ce9a2a5d5d96a46956fe50e)
             check_type(argname="argument template_file", value=template_file, expected_type=type_hints["template_file"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument assume_role_arn", value=assume_role_arn, expected_type=type_hints["assume_role_arn"])
             check_type(argname="argument assume_role_external_id", value=assume_role_external_id, expected_type=type_hints["assume_role_external_id"])
             check_type(argname="argument bootstrap_stack_version_ssm_parameter", value=bootstrap_stack_version_ssm_parameter, expected_type=type_hints["bootstrap_stack_version_ssm_parameter"])
             check_type(argname="argument cloud_formation_execution_role_arn", value=cloud_formation_execution_role_arn, expected_type=type_hints["cloud_formation_execution_role_arn"])
             check_type(argname="argument lookup_role", value=lookup_role, expected_type=type_hints["lookup_role"])
+            check_type(argname="argument notification_arns", value=notification_arns, expected_type=type_hints["notification_arns"])
             check_type(argname="argument parameters", value=parameters, expected_type=type_hints["parameters"])
             check_type(argname="argument requires_bootstrap_stack_version", value=requires_bootstrap_stack_version, expected_type=type_hints["requires_bootstrap_stack_version"])
             check_type(argname="argument stack_name", value=stack_name, expected_type=type_hints["stack_name"])
@@ -1120,6 +964,8 @@ class AwsCloudFormationStackProperties:
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "template_file": template_file,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if assume_role_arn is not None:
             self._values["assume_role_arn"] = assume_role_arn
         if assume_role_external_id is not None:
@@ -1130,6 +976,8 @@ class AwsCloudFormationStackProperties:
             self._values["cloud_formation_execution_role_arn"] = cloud_formation_execution_role_arn
         if lookup_role is not None:
             self._values["lookup_role"] = lookup_role
+        if notification_arns is not None:
+            self._values["notification_arns"] = notification_arns
         if parameters is not None:
             self._values["parameters"] = parameters
         if requires_bootstrap_stack_version is not None:
@@ -1152,6 +1000,22 @@ class AwsCloudFormationStackProperties:
         assert result is not None, "Required property 'template_file' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def assume_role_arn(self) -> typing.Optional[builtins.str]:
         '''The role that needs to be assumed to deploy the stack.
@@ -1205,6 +1069,15 @@ class AwsCloudFormationStackProperties:
         result = self._values.get("lookup_role")
         return typing.cast(typing.Optional["BootstrapRole"], result)
 
+    @builtins.property
+    def notification_arns(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''SNS Notification ARNs that should receive CloudFormation Stack Events.
+
+        :default: - No notification arns
+        '''
+        result = self._values.get("notification_arns")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
     @builtins.property
     def parameters(self) -> typing.Optional[typing.Mapping[builtins.str, builtins.str]]:
         '''Values for CloudFormation stack parameters that should be passed when the stack is deployed.
@@ -1284,6 +1157,7 @@ class AwsCloudFormationStackProperties:
     jsii_type="aws-cdk-lib.cloud_assembly_schema.AwsDestination",
     jsii_struct_bases=[],
     name_mapping={
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "assume_role_arn": "assumeRoleArn",
         "assume_role_external_id": "assumeRoleExternalId",
         "region": "region",
@@ -1293,12 +1167,14 @@ class AwsDestination:
     def __init__(
         self,
         *,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         assume_role_arn: typing.Optional[builtins.str] = None,
         assume_role_external_id: typing.Optional[builtins.str] = None,
         region: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Destination for assets that need to be uploaded to AWS.
 
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the role. - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead. Default: - No additional options.
         :param assume_role_arn: The role that needs to be assumed while publishing this asset. Default: - No role will be assumed
         :param assume_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
         :param region: The region where this asset will need to be published. Default: - Current region
@@ -1311,7 +1187,12 @@ class AwsDestination:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             aws_destination = AwsDestination(
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 assume_role_arn="assumeRoleArn",
                 assume_role_external_id="assumeRoleExternalId",
                 region="region"
@@ -1319,10 +1200,13 @@ class AwsDestination:
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__e91cfad0a891b03534a612d02721f5d8d6378d9951a8f62fa2272323da013b6c)
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument assume_role_arn", value=assume_role_arn, expected_type=type_hints["assume_role_arn"])
             check_type(argname="argument assume_role_external_id", value=assume_role_external_id, expected_type=type_hints["assume_role_external_id"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if assume_role_arn is not None:
             self._values["assume_role_arn"] = assume_role_arn
         if assume_role_external_id is not None:
@@ -1330,6 +1214,22 @@ class AwsDestination:
         if region is not None:
             self._values["region"] = region
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def assume_role_arn(self) -> typing.Optional[builtins.str]:
         '''The role that needs to be assumed while publishing this asset.
@@ -1374,6 +1274,7 @@ class AwsDestination:
     jsii_struct_bases=[],
     name_mapping={
         "arn": "arn",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "assume_role_external_id": "assumeRoleExternalId",
         "bootstrap_stack_version_ssm_parameter": "bootstrapStackVersionSsmParameter",
         "requires_bootstrap_stack_version": "requiresBootstrapStackVersion",
@@ -1384,6 +1285,7 @@ class BootstrapRole:
         self,
         *,
         arn: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         assume_role_external_id: typing.Optional[builtins.str] = None,
         bootstrap_stack_version_ssm_parameter: typing.Optional[builtins.str] = None,
         requires_bootstrap_stack_version: typing.Optional[jsii.Number] = None,
@@ -1391,6 +1293,7 @@ class BootstrapRole:
         '''Information needed to access an IAM role created as part of the bootstrap process.
 
         :param arn: The ARN of the IAM role created as part of bootrapping e.g. lookupRoleArn.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the role. - ``RoleArn`` should not be used. Use the dedicated ``arn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead. Default: - No additional options.
         :param assume_role_external_id: External ID to use when assuming the bootstrap role. Default: - No external ID
         :param bootstrap_stack_version_ssm_parameter: Name of SSM parameter with bootstrap stack version. Default: - Discover SSM parameter by reading stack
         :param requires_bootstrap_stack_version: Version of bootstrap stack required to use this role. Default: - No bootstrap stack required
@@ -1403,10 +1306,15 @@ class BootstrapRole:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             bootstrap_role = BootstrapRole(
                 arn="arn",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 assume_role_external_id="assumeRoleExternalId",
                 bootstrap_stack_version_ssm_parameter="bootstrapStackVersionSsmParameter",
                 requires_bootstrap_stack_version=123
@@ -1415,12 +1323,15 @@ class BootstrapRole:
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__a573afe6fe73a260b78458b7d6ff4d548c9379eb945ffcadd64389efe9b6e65d)
             check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument assume_role_external_id", value=assume_role_external_id, expected_type=type_hints["assume_role_external_id"])
             check_type(argname="argument bootstrap_stack_version_ssm_parameter", value=bootstrap_stack_version_ssm_parameter, expected_type=type_hints["bootstrap_stack_version_ssm_parameter"])
             check_type(argname="argument requires_bootstrap_stack_version", value=requires_bootstrap_stack_version, expected_type=type_hints["requires_bootstrap_stack_version"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "arn": arn,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if assume_role_external_id is not None:
             self._values["assume_role_external_id"] = assume_role_external_id
         if bootstrap_stack_version_ssm_parameter is not None:
@@ -1435,6 +1346,22 @@ class BootstrapRole:
         assert result is not None, "Required property 'arn' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``arn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def assume_role_external_id(self) -> typing.Optional[builtins.str]:
         '''External ID to use when assuming the bootstrap role.
@@ -2114,16 +2041,145 @@ class ContainerImageAssetMetadataEntry:
         )
 
 
-@jsii.enum(jsii_type="aws-cdk-lib.cloud_assembly_schema.ContextProvider")
-class ContextProvider(enum.Enum):
-    '''Identifier for the context provider.'''
-
-    AMI_PROVIDER = "AMI_PROVIDER"
-    '''AMI provider.'''
-    AVAILABILITY_ZONE_PROVIDER = "AVAILABILITY_ZONE_PROVIDER"
-    '''AZ provider.'''
-    HOSTED_ZONE_PROVIDER = "HOSTED_ZONE_PROVIDER"
-    '''Route53 Hosted Zone provider.'''
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.cloud_assembly_schema.ContextLookupRoleOptions",
+    jsii_struct_bases=[],
+    name_mapping={
+        "account": "account",
+        "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
+        "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+    },
+)
+class ContextLookupRoleOptions:
+    def __init__(
+        self,
+        *,
+        account: builtins.str,
+        region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+        lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''Options for context lookup roles.
+
+        :param account: Query account.
+        :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
+        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import cloud_assembly_schema
+            
+            # assume_role_additional_options: Any
+            
+            context_lookup_role_options = ContextLookupRoleOptions(
+                account="account",
+                region="region",
+            
+                # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__426943c947fb44b9deefd019e7f66ce3401c1a856d9f2773d450cd96adae6f59)
+            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
+            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
+            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "account": account,
+            "region": region,
+        }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
+        if lookup_role_arn is not None:
+            self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
+
+    @builtins.property
+    def account(self) -> builtins.str:
+        '''Query account.'''
+        result = self._values.get("account")
+        assert result is not None, "Required property 'account' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def region(self) -> builtins.str:
+        '''Query region.'''
+        result = self._values.get("region")
+        assert result is not None, "Required property 'region' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
+    @builtins.property
+    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of the role that should be used to look up the missing values.
+
+        :default: - None
+        '''
+        result = self._values.get("lookup_role_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "ContextLookupRoleOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.enum(jsii_type="aws-cdk-lib.cloud_assembly_schema.ContextProvider")
+class ContextProvider(enum.Enum):
+    '''Identifier for the context provider.'''
+
+    AMI_PROVIDER = "AMI_PROVIDER"
+    '''AMI provider.'''
+    AVAILABILITY_ZONE_PROVIDER = "AVAILABILITY_ZONE_PROVIDER"
+    '''AZ provider.'''
+    HOSTED_ZONE_PROVIDER = "HOSTED_ZONE_PROVIDER"
+    '''Route53 Hosted Zone provider.'''
     SSM_PARAMETER_PROVIDER = "SSM_PARAMETER_PROVIDER"
     '''SSM Parameter Provider.'''
     VPC_PROVIDER = "VPC_PROVIDER"
@@ -4075,6 +4131,8 @@ class DockerImageAsset:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             docker_image_asset = DockerImageAsset(
                 destinations={
                     "destinations_key": DockerImageDestination(
@@ -4082,6 +4140,9 @@ class DockerImageAsset:
                         repository_name="repositoryName",
             
                         # the properties below are optional
+                        assume_role_additional_options={
+                            "assume_role_additional_options_key": assume_role_additional_options
+                        },
                         assume_role_arn="assumeRoleArn",
                         assume_role_external_id="assumeRoleExternalId",
                         region="region"
@@ -4163,6 +4224,7 @@ class DockerImageAsset:
     jsii_type="aws-cdk-lib.cloud_assembly_schema.DockerImageDestination",
     jsii_struct_bases=[AwsDestination],
     name_mapping={
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "assume_role_arn": "assumeRoleArn",
         "assume_role_external_id": "assumeRoleExternalId",
         "region": "region",
@@ -4174,6 +4236,7 @@ class DockerImageDestination(AwsDestination):
     def __init__(
         self,
         *,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         assume_role_arn: typing.Optional[builtins.str] = None,
         assume_role_external_id: typing.Optional[builtins.str] = None,
         region: typing.Optional[builtins.str] = None,
@@ -4182,6 +4245,7 @@ class DockerImageDestination(AwsDestination):
     ) -> None:
         '''Where to publish docker images.
 
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the role. - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead. Default: - No additional options.
         :param assume_role_arn: The role that needs to be assumed while publishing this asset. Default: - No role will be assumed
         :param assume_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
         :param region: The region where this asset will need to be published. Default: - Current region
@@ -4196,11 +4260,16 @@ class DockerImageDestination(AwsDestination):
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             docker_image_destination = DockerImageDestination(
                 image_tag="imageTag",
                 repository_name="repositoryName",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 assume_role_arn="assumeRoleArn",
                 assume_role_external_id="assumeRoleExternalId",
                 region="region"
@@ -4208,6 +4277,7 @@ class DockerImageDestination(AwsDestination):
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__01e136052f71999035d3e1605dff6c0878e98a56b1d1493de1cc03b20f38345a)
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument assume_role_arn", value=assume_role_arn, expected_type=type_hints["assume_role_arn"])
             check_type(argname="argument assume_role_external_id", value=assume_role_external_id, expected_type=type_hints["assume_role_external_id"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
@@ -4217,6 +4287,8 @@ class DockerImageDestination(AwsDestination):
             "image_tag": image_tag,
             "repository_name": repository_name,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if assume_role_arn is not None:
             self._values["assume_role_arn"] = assume_role_arn
         if assume_role_external_id is not None:
@@ -4224,6 +4296,22 @@ class DockerImageDestination(AwsDestination):
         if region is not None:
             self._values["region"] = region
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def assume_role_arn(self) -> typing.Optional[builtins.str]:
         '''The role that needs to be assumed while publishing this asset.
@@ -4574,29 +4662,35 @@ class DockerImageSource:
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.EndpointServiceAvailabilityZonesContextQuery",
-    jsii_struct_bases=[],
+    jsii_struct_bases=[ContextLookupRoleOptions],
     name_mapping={
         "account": "account",
         "region": "region",
-        "service_name": "serviceName",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+        "service_name": "serviceName",
     },
 )
-class EndpointServiceAvailabilityZonesContextQuery:
+class EndpointServiceAvailabilityZonesContextQuery(ContextLookupRoleOptions):
     def __init__(
         self,
         *,
         account: builtins.str,
         region: builtins.str,
-        service_name: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+        service_name: builtins.str,
     ) -> None:
         '''Query to endpoint service context provider.
 
         :param account: Query account.
         :param region: Query region.
-        :param service_name: Query service name.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
         :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param service_name: Query service name.
 
         :exampleMetadata: fixture=_generated
 
@@ -4606,28 +4700,40 @@ class EndpointServiceAvailabilityZonesContextQuery:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             endpoint_service_availability_zones_context_query = EndpointServiceAvailabilityZonesContextQuery(
                 account="account",
                 region="region",
                 service_name="serviceName",
             
                 # the properties below are optional
-                lookup_role_arn="lookupRoleArn"
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b028a59a345f6074485bae83f874fa7eca8081fea4616b491a43cfb788b0dd28)
             check_type(argname="argument account", value=account, expected_type=type_hints["account"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
-            check_type(argname="argument service_name", value=service_name, expected_type=type_hints["service_name"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+            check_type(argname="argument service_name", value=service_name, expected_type=type_hints["service_name"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "account": account,
             "region": region,
             "service_name": service_name,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if lookup_role_arn is not None:
             self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
 
     @builtins.property
     def account(self) -> builtins.str:
@@ -4644,11 +4750,20 @@ class EndpointServiceAvailabilityZonesContextQuery:
         return typing.cast(builtins.str, result)
 
     @builtins.property
-    def service_name(self) -> builtins.str:
-        '''Query service name.'''
-        result = self._values.get("service_name")
-        assert result is not None, "Required property 'service_name' is missing"
-        return typing.cast(builtins.str, result)
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
 
     @builtins.property
     def lookup_role_arn(self) -> typing.Optional[builtins.str]:
@@ -4659,6 +4774,22 @@ class EndpointServiceAvailabilityZonesContextQuery:
         result = self._values.get("lookup_role_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def service_name(self) -> builtins.str:
+        '''Query service name.'''
+        result = self._values.get("service_name")
+        assert result is not None, "Required property 'service_name' is missing"
+        return typing.cast(builtins.str, result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -4696,6 +4827,8 @@ class FileAsset:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             file_asset = FileAsset(
                 destinations={
                     "destinations_key": FileDestination(
@@ -4703,6 +4836,9 @@ class FileAsset:
                         object_key="objectKey",
             
                         # the properties below are optional
+                        assume_role_additional_options={
+                            "assume_role_additional_options_key": assume_role_additional_options
+                        },
                         assume_role_arn="assumeRoleArn",
                         assume_role_external_id="assumeRoleExternalId",
                         region="region"
@@ -4890,6 +5026,7 @@ class FileAssetPackaging(enum.Enum):
     jsii_type="aws-cdk-lib.cloud_assembly_schema.FileDestination",
     jsii_struct_bases=[AwsDestination],
     name_mapping={
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "assume_role_arn": "assumeRoleArn",
         "assume_role_external_id": "assumeRoleExternalId",
         "region": "region",
@@ -4901,6 +5038,7 @@ class FileDestination(AwsDestination):
     def __init__(
         self,
         *,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         assume_role_arn: typing.Optional[builtins.str] = None,
         assume_role_external_id: typing.Optional[builtins.str] = None,
         region: typing.Optional[builtins.str] = None,
@@ -4909,6 +5047,7 @@ class FileDestination(AwsDestination):
     ) -> None:
         '''Where in S3 a file asset needs to be published.
 
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the role. - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead. Default: - No additional options.
         :param assume_role_arn: The role that needs to be assumed while publishing this asset. Default: - No role will be assumed
         :param assume_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
         :param region: The region where this asset will need to be published. Default: - Current region
@@ -4923,11 +5062,16 @@ class FileDestination(AwsDestination):
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             file_destination = FileDestination(
                 bucket_name="bucketName",
                 object_key="objectKey",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 assume_role_arn="assumeRoleArn",
                 assume_role_external_id="assumeRoleExternalId",
                 region="region"
@@ -4935,6 +5079,7 @@ class FileDestination(AwsDestination):
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__482362971cab2cc43f5645dc6db216e662ebd818f06c2cdcac27f66423f068f7)
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument assume_role_arn", value=assume_role_arn, expected_type=type_hints["assume_role_arn"])
             check_type(argname="argument assume_role_external_id", value=assume_role_external_id, expected_type=type_hints["assume_role_external_id"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
@@ -4944,6 +5089,8 @@ class FileDestination(AwsDestination):
             "bucket_name": bucket_name,
             "object_key": object_key,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if assume_role_arn is not None:
             self._values["assume_role_arn"] = assume_role_arn
         if assume_role_external_id is not None:
@@ -4951,6 +5098,22 @@ class FileDestination(AwsDestination):
         if region is not None:
             self._values["region"] = region
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``assumeRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``assumeRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def assume_role_arn(self) -> typing.Optional[builtins.str]:
         '''The role that needs to be assumed while publishing this asset.
@@ -5204,33 +5367,39 @@ class Hooks:
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.HostedZoneContextQuery",
-    jsii_struct_bases=[],
+    jsii_struct_bases=[ContextLookupRoleOptions],
     name_mapping={
         "account": "account",
-        "domain_name": "domainName",
         "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+        "domain_name": "domainName",
         "private_zone": "privateZone",
         "vpc_id": "vpcId",
     },
 )
-class HostedZoneContextQuery:
+class HostedZoneContextQuery(ContextLookupRoleOptions):
     def __init__(
         self,
         *,
         account: builtins.str,
-        domain_name: builtins.str,
         region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+        domain_name: builtins.str,
         private_zone: typing.Optional[builtins.bool] = None,
         vpc_id: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Query to hosted zone context provider.
 
         :param account: Query account.
-        :param domain_name: The domain name e.g. example.com to lookup.
         :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
         :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param domain_name: The domain name e.g. example.com to lookup.
         :param private_zone: True if the zone you want to find is a private hosted zone. Default: false
         :param vpc_id: The VPC ID to that the private zone must be associated with. If you provide VPC ID and privateZone is false, this will return no results and raise an error. Default: - Required if privateZone=true
 
@@ -5242,13 +5411,19 @@ class HostedZoneContextQuery:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             hosted_zone_context_query = HostedZoneContextQuery(
                 account="account",
                 domain_name="domainName",
                 region="region",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId",
                 private_zone=False,
                 vpc_id="vpcId"
             )
@@ -5256,18 +5431,24 @@ class HostedZoneContextQuery:
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__479c87e6b7f0a4547d04d73de1bad2d396c1e1383975038b6ca8a7ee078e9ab8)
             check_type(argname="argument account", value=account, expected_type=type_hints["account"])
-            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
             check_type(argname="argument private_zone", value=private_zone, expected_type=type_hints["private_zone"])
             check_type(argname="argument vpc_id", value=vpc_id, expected_type=type_hints["vpc_id"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "account": account,
-            "domain_name": domain_name,
             "region": region,
+            "domain_name": domain_name,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if lookup_role_arn is not None:
             self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
         if private_zone is not None:
             self._values["private_zone"] = private_zone
         if vpc_id is not None:
@@ -5280,13 +5461,6 @@ class HostedZoneContextQuery:
         assert result is not None, "Required property 'account' is missing"
         return typing.cast(builtins.str, result)
 
-    @builtins.property
-    def domain_name(self) -> builtins.str:
-        '''The domain name e.g. example.com to lookup.'''
-        result = self._values.get("domain_name")
-        assert result is not None, "Required property 'domain_name' is missing"
-        return typing.cast(builtins.str, result)
-
     @builtins.property
     def region(self) -> builtins.str:
         '''Query region.'''
@@ -5294,6 +5468,22 @@ class HostedZoneContextQuery:
         assert result is not None, "Required property 'region' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def lookup_role_arn(self) -> typing.Optional[builtins.str]:
         '''The ARN of the role that should be used to look up the missing values.
@@ -5303,6 +5493,22 @@ class HostedZoneContextQuery:
         result = self._values.get("lookup_role_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def domain_name(self) -> builtins.str:
+        '''The domain name e.g. example.com to lookup.'''
+        result = self._values.get("domain_name")
+        assert result is not None, "Required property 'domain_name' is missing"
+        return typing.cast(builtins.str, result)
+
     @builtins.property
     def private_zone(self) -> typing.Optional[builtins.bool]:
         '''True if the zone you want to find is a private hosted zone.
@@ -5554,29 +5760,35 @@ class IntegManifest:
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.KeyContextQuery",
-    jsii_struct_bases=[],
+    jsii_struct_bases=[ContextLookupRoleOptions],
     name_mapping={
         "account": "account",
-        "alias_name": "aliasName",
         "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+        "alias_name": "aliasName",
     },
 )
-class KeyContextQuery:
+class KeyContextQuery(ContextLookupRoleOptions):
     def __init__(
         self,
         *,
         account: builtins.str,
-        alias_name: builtins.str,
         region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+        alias_name: builtins.str,
     ) -> None:
         '''Query input for looking up a KMS Key.
 
         :param account: Query account.
-        :param alias_name: Alias name used to search the Key.
         :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
         :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param alias_name: Alias name used to search the Key.
 
         :exampleMetadata: fixture=_generated
 
@@ -5586,28 +5798,40 @@ class KeyContextQuery:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             key_context_query = KeyContextQuery(
                 account="account",
                 alias_name="aliasName",
                 region="region",
             
                 # the properties below are optional
-                lookup_role_arn="lookupRoleArn"
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b738d31e8937d0dc914b364457cedd3794a0911b61fec9b17eb3f8ad72e53832)
             check_type(argname="argument account", value=account, expected_type=type_hints["account"])
-            check_type(argname="argument alias_name", value=alias_name, expected_type=type_hints["alias_name"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+            check_type(argname="argument alias_name", value=alias_name, expected_type=type_hints["alias_name"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "account": account,
-            "alias_name": alias_name,
             "region": region,
+            "alias_name": alias_name,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if lookup_role_arn is not None:
             self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
 
     @builtins.property
     def account(self) -> builtins.str:
@@ -5616,13 +5840,6 @@ class KeyContextQuery:
         assert result is not None, "Required property 'account' is missing"
         return typing.cast(builtins.str, result)
 
-    @builtins.property
-    def alias_name(self) -> builtins.str:
-        '''Alias name used to search the Key.'''
-        result = self._values.get("alias_name")
-        assert result is not None, "Required property 'alias_name' is missing"
-        return typing.cast(builtins.str, result)
-
     @builtins.property
     def region(self) -> builtins.str:
         '''Query region.'''
@@ -5630,6 +5847,22 @@ class KeyContextQuery:
         assert result is not None, "Required property 'region' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def lookup_role_arn(self) -> typing.Optional[builtins.str]:
         '''The ARN of the role that should be used to look up the missing values.
@@ -5639,6 +5872,22 @@ class KeyContextQuery:
         result = self._values.get("lookup_role_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def alias_name(self) -> builtins.str:
+        '''Alias name used to search the Key.'''
+        result = self._values.get("alias_name")
+        assert result is not None, "Required property 'alias_name' is missing"
+        return typing.cast(builtins.str, result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -5653,25 +5902,40 @@ class KeyContextQuery:
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.LoadBalancerFilter",
-    jsii_struct_bases=[],
+    jsii_struct_bases=[ContextLookupRoleOptions],
     name_mapping={
+        "account": "account",
+        "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
+        "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
         "load_balancer_type": "loadBalancerType",
         "load_balancer_arn": "loadBalancerArn",
         "load_balancer_tags": "loadBalancerTags",
     },
 )
-class LoadBalancerFilter:
+class LoadBalancerFilter(ContextLookupRoleOptions):
     def __init__(
         self,
         *,
+        account: builtins.str,
+        region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+        lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
         load_balancer_type: "LoadBalancerType",
         load_balancer_arn: typing.Optional[builtins.str] = None,
         load_balancer_tags: typing.Optional[typing.Sequence[typing.Union["Tag", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''Filters for selecting load balancers.
 
-        :param load_balancer_type: Filter load balancers by their type.
-        :param load_balancer_arn: Find by load balancer's ARN. Default: - does not search by load balancer arn
+        :param account: Query account.
+        :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
+        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param load_balancer_type: Filter load balancers by their type.
+        :param load_balancer_arn: Find by load balancer's ARN. Default: - does not search by load balancer arn
         :param load_balancer_tags: Match load balancer tags. Default: - does not match load balancers by tags
 
         :exampleMetadata: fixture=_generated
@@ -5682,30 +5946,100 @@ class LoadBalancerFilter:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             load_balancer_filter = LoadBalancerFilter(
+                account="account",
                 load_balancer_type=cloud_assembly_schema.LoadBalancerType.NETWORK,
+                region="region",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 load_balancer_arn="loadBalancerArn",
                 load_balancer_tags=[Tag(
                     key="key",
                     value="value"
-                )]
+                )],
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b57ff0c819ed8af3b684900df083604408f77b99e70f2dd2d12b1cc7e4a8e68c)
+            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
+            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
+            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
             check_type(argname="argument load_balancer_type", value=load_balancer_type, expected_type=type_hints["load_balancer_type"])
             check_type(argname="argument load_balancer_arn", value=load_balancer_arn, expected_type=type_hints["load_balancer_arn"])
             check_type(argname="argument load_balancer_tags", value=load_balancer_tags, expected_type=type_hints["load_balancer_tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
+            "account": account,
+            "region": region,
             "load_balancer_type": load_balancer_type,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
+        if lookup_role_arn is not None:
+            self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
         if load_balancer_arn is not None:
             self._values["load_balancer_arn"] = load_balancer_arn
         if load_balancer_tags is not None:
             self._values["load_balancer_tags"] = load_balancer_tags
 
+    @builtins.property
+    def account(self) -> builtins.str:
+        '''Query account.'''
+        result = self._values.get("account")
+        assert result is not None, "Required property 'account' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def region(self) -> builtins.str:
+        '''Query region.'''
+        result = self._values.get("region")
+        assert result is not None, "Required property 'region' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
+    @builtins.property
+    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of the role that should be used to look up the missing values.
+
+        :default: - None
+        '''
+        result = self._values.get("lookup_role_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def load_balancer_type(self) -> "LoadBalancerType":
         '''Filter load balancers by their type.'''
@@ -5747,42 +6081,48 @@ class LoadBalancerFilter:
     jsii_type="aws-cdk-lib.cloud_assembly_schema.LoadBalancerListenerContextQuery",
     jsii_struct_bases=[LoadBalancerFilter],
     name_mapping={
+        "account": "account",
+        "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
+        "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
         "load_balancer_type": "loadBalancerType",
         "load_balancer_arn": "loadBalancerArn",
         "load_balancer_tags": "loadBalancerTags",
-        "account": "account",
-        "region": "region",
         "listener_arn": "listenerArn",
         "listener_port": "listenerPort",
         "listener_protocol": "listenerProtocol",
-        "lookup_role_arn": "lookupRoleArn",
     },
 )
 class LoadBalancerListenerContextQuery(LoadBalancerFilter):
     def __init__(
         self,
         *,
+        account: builtins.str,
+        region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+        lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
         load_balancer_type: "LoadBalancerType",
         load_balancer_arn: typing.Optional[builtins.str] = None,
         load_balancer_tags: typing.Optional[typing.Sequence[typing.Union["Tag", typing.Dict[builtins.str, typing.Any]]]] = None,
-        account: builtins.str,
-        region: builtins.str,
         listener_arn: typing.Optional[builtins.str] = None,
         listener_port: typing.Optional[jsii.Number] = None,
         listener_protocol: typing.Optional["LoadBalancerListenerProtocol"] = None,
-        lookup_role_arn: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Query input for looking up a load balancer listener.
 
+        :param account: Query account.
+        :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
+        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
         :param load_balancer_type: Filter load balancers by their type.
         :param load_balancer_arn: Find by load balancer's ARN. Default: - does not search by load balancer arn
         :param load_balancer_tags: Match load balancer tags. Default: - does not match load balancers by tags
-        :param account: Query account.
-        :param region: Query region.
         :param listener_arn: Find by listener's arn. Default: - does not find by listener arn
         :param listener_port: Filter listeners by listener port. Default: - does not filter by a listener port
         :param listener_protocol: Filter by listener protocol. Default: - does not filter by listener protocol
-        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
 
         :exampleMetadata: fixture=_generated
 
@@ -5792,12 +6132,17 @@ class LoadBalancerListenerContextQuery(LoadBalancerFilter):
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             load_balancer_listener_context_query = LoadBalancerListenerContextQuery(
                 account="account",
                 load_balancer_type=cloud_assembly_schema.LoadBalancerType.NETWORK,
                 region="region",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 listener_arn="listenerArn",
                 listener_port=123,
                 listener_protocol=cloud_assembly_schema.LoadBalancerListenerProtocol.HTTP,
@@ -5806,25 +6151,34 @@ class LoadBalancerListenerContextQuery(LoadBalancerFilter):
                     key="key",
                     value="value"
                 )],
-                lookup_role_arn="lookupRoleArn"
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__0e0c4bf3a41978c03455699a53b8dc150feef48b4e8d1cb490e0e3cffa75ced7)
+            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
+            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
+            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
             check_type(argname="argument load_balancer_type", value=load_balancer_type, expected_type=type_hints["load_balancer_type"])
             check_type(argname="argument load_balancer_arn", value=load_balancer_arn, expected_type=type_hints["load_balancer_arn"])
             check_type(argname="argument load_balancer_tags", value=load_balancer_tags, expected_type=type_hints["load_balancer_tags"])
-            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
-            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
             check_type(argname="argument listener_arn", value=listener_arn, expected_type=type_hints["listener_arn"])
             check_type(argname="argument listener_port", value=listener_port, expected_type=type_hints["listener_port"])
             check_type(argname="argument listener_protocol", value=listener_protocol, expected_type=type_hints["listener_protocol"])
-            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
-            "load_balancer_type": load_balancer_type,
             "account": account,
             "region": region,
+            "load_balancer_type": load_balancer_type,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
+        if lookup_role_arn is not None:
+            self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
         if load_balancer_arn is not None:
             self._values["load_balancer_arn"] = load_balancer_arn
         if load_balancer_tags is not None:
@@ -5835,8 +6189,54 @@ class LoadBalancerListenerContextQuery(LoadBalancerFilter):
             self._values["listener_port"] = listener_port
         if listener_protocol is not None:
             self._values["listener_protocol"] = listener_protocol
-        if lookup_role_arn is not None:
-            self._values["lookup_role_arn"] = lookup_role_arn
+
+    @builtins.property
+    def account(self) -> builtins.str:
+        '''Query account.'''
+        result = self._values.get("account")
+        assert result is not None, "Required property 'account' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def region(self) -> builtins.str:
+        '''Query region.'''
+        result = self._values.get("region")
+        assert result is not None, "Required property 'region' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
+    @builtins.property
+    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of the role that should be used to look up the missing values.
+
+        :default: - None
+        '''
+        result = self._values.get("lookup_role_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
 
     @builtins.property
     def load_balancer_type(self) -> "LoadBalancerType":
@@ -5863,20 +6263,6 @@ class LoadBalancerListenerContextQuery(LoadBalancerFilter):
         result = self._values.get("load_balancer_tags")
         return typing.cast(typing.Optional[typing.List["Tag"]], result)
 
-    @builtins.property
-    def account(self) -> builtins.str:
-        '''Query account.'''
-        result = self._values.get("account")
-        assert result is not None, "Required property 'account' is missing"
-        return typing.cast(builtins.str, result)
-
-    @builtins.property
-    def region(self) -> builtins.str:
-        '''Query region.'''
-        result = self._values.get("region")
-        assert result is not None, "Required property 'region' is missing"
-        return typing.cast(builtins.str, result)
-
     @builtins.property
     def listener_arn(self) -> typing.Optional[builtins.str]:
         '''Find by listener's arn.
@@ -5904,15 +6290,6 @@ class LoadBalancerListenerContextQuery(LoadBalancerFilter):
         result = self._values.get("listener_protocol")
         return typing.cast(typing.Optional["LoadBalancerListenerProtocol"], result)
 
-    @builtins.property
-    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
-        '''The ARN of the role that should be used to look up the missing values.
-
-        :default: - None
-        '''
-        result = self._values.get("lookup_role_arn")
-        return typing.cast(typing.Optional[builtins.str], result)
-
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -6268,7 +6645,7 @@ class MissingContext:
         self,
         *,
         key: builtins.str,
-        props: typing.Union[typing.Union[AmiContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union[AvailabilityZonesContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union[HostedZoneContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["SSMParameterContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union["VpcContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union[EndpointServiceAvailabilityZonesContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["LoadBalancerContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union[LoadBalancerListenerContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["SecurityGroupContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union[KeyContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["PluginContextQuery", typing.Dict[builtins.str, typing.Any]]],
+        props: typing.Union[typing.Union["AmiContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union["AvailabilityZonesContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union[HostedZoneContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["SSMParameterContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union["VpcContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union[EndpointServiceAvailabilityZonesContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["LoadBalancerContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union[LoadBalancerListenerContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["SecurityGroupContextQuery", typing.Dict[builtins.str, typing.Any]], typing.Union[KeyContextQuery, typing.Dict[builtins.str, typing.Any]], typing.Union["PluginContextQuery", typing.Dict[builtins.str, typing.Any]]],
         provider: ContextProvider,
     ) -> None:
         '''Represents a missing piece of context.
@@ -6285,6 +6662,8 @@ class MissingContext:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             missing_context = MissingContext(
                 key="key",
                 props=AmiContextQuery(
@@ -6295,7 +6674,11 @@ class MissingContext:
                     region="region",
             
                     # the properties below are optional
+                    assume_role_additional_options={
+                        "assume_role_additional_options_key": assume_role_additional_options
+                    },
                     lookup_role_arn="lookupRoleArn",
+                    lookup_role_external_id="lookupRoleExternalId",
                     owners=["owners"]
                 ),
                 provider=cloud_assembly_schema.ContextProvider.AMI_PROVIDER
@@ -6322,11 +6705,11 @@ class MissingContext:
     @builtins.property
     def props(
         self,
-    ) -> typing.Union[AmiContextQuery, AvailabilityZonesContextQuery, HostedZoneContextQuery, "SSMParameterContextQuery", "VpcContextQuery", EndpointServiceAvailabilityZonesContextQuery, "LoadBalancerContextQuery", LoadBalancerListenerContextQuery, "SecurityGroupContextQuery", KeyContextQuery, "PluginContextQuery"]:
+    ) -> typing.Union["AmiContextQuery", "AvailabilityZonesContextQuery", HostedZoneContextQuery, "SSMParameterContextQuery", "VpcContextQuery", EndpointServiceAvailabilityZonesContextQuery, "LoadBalancerContextQuery", LoadBalancerListenerContextQuery, "SecurityGroupContextQuery", KeyContextQuery, "PluginContextQuery"]:
         '''A set of provider-specific options.'''
         result = self._values.get("props")
         assert result is not None, "Required property 'props' is missing"
-        return typing.cast(typing.Union[AmiContextQuery, AvailabilityZonesContextQuery, HostedZoneContextQuery, "SSMParameterContextQuery", "VpcContextQuery", EndpointServiceAvailabilityZonesContextQuery, "LoadBalancerContextQuery", LoadBalancerListenerContextQuery, "SecurityGroupContextQuery", KeyContextQuery, "PluginContextQuery"], result)
+        return typing.cast(typing.Union["AmiContextQuery", "AvailabilityZonesContextQuery", HostedZoneContextQuery, "SSMParameterContextQuery", "VpcContextQuery", EndpointServiceAvailabilityZonesContextQuery, "LoadBalancerContextQuery", LoadBalancerListenerContextQuery, "SecurityGroupContextQuery", KeyContextQuery, "PluginContextQuery"], result)
 
     @builtins.property
     def provider(self) -> ContextProvider:
@@ -6538,29 +6921,35 @@ class RuntimeInfo:
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.SSMParameterContextQuery",
-    jsii_struct_bases=[],
+    jsii_struct_bases=[ContextLookupRoleOptions],
     name_mapping={
         "account": "account",
-        "parameter_name": "parameterName",
         "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+        "parameter_name": "parameterName",
     },
 )
-class SSMParameterContextQuery:
+class SSMParameterContextQuery(ContextLookupRoleOptions):
     def __init__(
         self,
         *,
         account: builtins.str,
-        parameter_name: builtins.str,
         region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+        parameter_name: builtins.str,
     ) -> None:
         '''Query to SSM Parameter Context Provider.
 
         :param account: Query account.
-        :param parameter_name: Parameter name to query.
         :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
         :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param parameter_name: Parameter name to query.
 
         :exampleMetadata: fixture=_generated
 
@@ -6570,28 +6959,40 @@ class SSMParameterContextQuery:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             s_sMParameter_context_query = SSMParameterContextQuery(
                 account="account",
                 parameter_name="parameterName",
                 region="region",
             
                 # the properties below are optional
-                lookup_role_arn="lookupRoleArn"
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__684d2dfddbf9de1c9120fbcee643319c13ff10fa5e3227b4959d94fdac1463d5)
             check_type(argname="argument account", value=account, expected_type=type_hints["account"])
-            check_type(argname="argument parameter_name", value=parameter_name, expected_type=type_hints["parameter_name"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+            check_type(argname="argument parameter_name", value=parameter_name, expected_type=type_hints["parameter_name"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "account": account,
-            "parameter_name": parameter_name,
             "region": region,
+            "parameter_name": parameter_name,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if lookup_role_arn is not None:
             self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
 
     @builtins.property
     def account(self) -> builtins.str:
@@ -6600,13 +7001,6 @@ class SSMParameterContextQuery:
         assert result is not None, "Required property 'account' is missing"
         return typing.cast(builtins.str, result)
 
-    @builtins.property
-    def parameter_name(self) -> builtins.str:
-        '''Parameter name to query.'''
-        result = self._values.get("parameter_name")
-        assert result is not None, "Required property 'parameter_name' is missing"
-        return typing.cast(builtins.str, result)
-
     @builtins.property
     def region(self) -> builtins.str:
         '''Query region.'''
@@ -6614,6 +7008,22 @@ class SSMParameterContextQuery:
         assert result is not None, "Required property 'region' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def lookup_role_arn(self) -> typing.Optional[builtins.str]:
         '''The ARN of the role that should be used to look up the missing values.
@@ -6623,6 +7033,22 @@ class SSMParameterContextQuery:
         result = self._values.get("lookup_role_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def parameter_name(self) -> builtins.str:
+        '''Parameter name to query.'''
+        result = self._values.get("parameter_name")
+        assert result is not None, "Required property 'parameter_name' is missing"
+        return typing.cast(builtins.str, result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -6637,23 +7063,27 @@ class SSMParameterContextQuery:
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.SecurityGroupContextQuery",
-    jsii_struct_bases=[],
+    jsii_struct_bases=[ContextLookupRoleOptions],
     name_mapping={
         "account": "account",
         "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
         "security_group_id": "securityGroupId",
         "security_group_name": "securityGroupName",
         "vpc_id": "vpcId",
     },
 )
-class SecurityGroupContextQuery:
+class SecurityGroupContextQuery(ContextLookupRoleOptions):
     def __init__(
         self,
         *,
         account: builtins.str,
         region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
         security_group_id: typing.Optional[builtins.str] = None,
         security_group_name: typing.Optional[builtins.str] = None,
         vpc_id: typing.Optional[builtins.str] = None,
@@ -6662,7 +7092,9 @@ class SecurityGroupContextQuery:
 
         :param account: Query account.
         :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
         :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
         :param security_group_id: Security group id. Default: - None
         :param security_group_name: Security group name. Default: - None
         :param vpc_id: VPC ID. Default: - None
@@ -6675,12 +7107,18 @@ class SecurityGroupContextQuery:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             security_group_context_query = SecurityGroupContextQuery(
                 account="account",
                 region="region",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId",
                 security_group_id="securityGroupId",
                 security_group_name="securityGroupName",
                 vpc_id="vpcId"
@@ -6690,7 +7128,9 @@ class SecurityGroupContextQuery:
             type_hints = typing.get_type_hints(_typecheckingstub__ab27bdfc9deaaa99cc0b29d10214dea6da9d91e77b9d18d5a5f9a2b7f4578cb4)
             check_type(argname="argument account", value=account, expected_type=type_hints["account"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
             check_type(argname="argument security_group_id", value=security_group_id, expected_type=type_hints["security_group_id"])
             check_type(argname="argument security_group_name", value=security_group_name, expected_type=type_hints["security_group_name"])
             check_type(argname="argument vpc_id", value=vpc_id, expected_type=type_hints["vpc_id"])
@@ -6698,8 +7138,12 @@ class SecurityGroupContextQuery:
             "account": account,
             "region": region,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if lookup_role_arn is not None:
             self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
         if security_group_id is not None:
             self._values["security_group_id"] = security_group_id
         if security_group_name is not None:
@@ -6721,6 +7165,22 @@ class SecurityGroupContextQuery:
         assert result is not None, "Required property 'region' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def lookup_role_arn(self) -> typing.Optional[builtins.str]:
         '''The ARN of the role that should be used to look up the missing values.
@@ -6730,6 +7190,15 @@ class SecurityGroupContextQuery:
         result = self._values.get("lookup_role_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def security_group_id(self) -> typing.Optional[builtins.str]:
         '''Security group id.
@@ -7131,25 +7600,29 @@ class TreeArtifactProperties:
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.VpcContextQuery",
-    jsii_struct_bases=[],
+    jsii_struct_bases=[ContextLookupRoleOptions],
     name_mapping={
         "account": "account",
-        "filter": "filter",
         "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+        "filter": "filter",
         "return_asymmetric_subnets": "returnAsymmetricSubnets",
         "return_vpn_gateways": "returnVpnGateways",
         "subnet_group_name_tag": "subnetGroupNameTag",
     },
 )
-class VpcContextQuery:
+class VpcContextQuery(ContextLookupRoleOptions):
     def __init__(
         self,
         *,
         account: builtins.str,
-        filter: typing.Mapping[builtins.str, builtins.str],
         region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+        filter: typing.Mapping[builtins.str, builtins.str],
         return_asymmetric_subnets: typing.Optional[builtins.bool] = None,
         return_vpn_gateways: typing.Optional[builtins.bool] = None,
         subnet_group_name_tag: typing.Optional[builtins.str] = None,
@@ -7157,9 +7630,11 @@ class VpcContextQuery:
         '''Query input for looking up a VPC.
 
         :param account: Query account.
-        :param filter: Filters to apply to the VPC. Filter parameters are the same as passed to DescribeVpcs.
         :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
         :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param filter: Filters to apply to the VPC. Filter parameters are the same as passed to DescribeVpcs.
         :param return_asymmetric_subnets: Whether to populate the subnetGroups field of the ``VpcContextResponse``, which contains potentially asymmetric subnet groups. Default: false
         :param return_vpn_gateways: Whether to populate the ``vpnGatewayId`` field of the ``VpcContextResponse``, which contains the VPN Gateway ID, if one exists. You can explicitly disable this in order to avoid the lookup if you know the VPC does not have a VPN Gatway attached. Default: true
         :param subnet_group_name_tag: Optional tag for subnet group name. If not provided, we'll look at the aws-cdk:subnet-name tag. If the subnet does not have the specified tag, we'll use its type as the name. Default: 'aws-cdk:subnet-name'
@@ -7172,6 +7647,8 @@ class VpcContextQuery:
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             vpc_context_query = VpcContextQuery(
                 account="account",
                 filter={
@@ -7180,7 +7657,11 @@ class VpcContextQuery:
                 region="region",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId",
                 return_asymmetric_subnets=False,
                 return_vpn_gateways=False,
                 subnet_group_name_tag="subnetGroupNameTag"
@@ -7189,19 +7670,25 @@ class VpcContextQuery:
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__793c311275bf258c4baaae63fe63966f0fd334129e469b7dc83e548f2cbf5318)
             check_type(argname="argument account", value=account, expected_type=type_hints["account"])
-            check_type(argname="argument filter", value=filter, expected_type=type_hints["filter"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+            check_type(argname="argument filter", value=filter, expected_type=type_hints["filter"])
             check_type(argname="argument return_asymmetric_subnets", value=return_asymmetric_subnets, expected_type=type_hints["return_asymmetric_subnets"])
             check_type(argname="argument return_vpn_gateways", value=return_vpn_gateways, expected_type=type_hints["return_vpn_gateways"])
             check_type(argname="argument subnet_group_name_tag", value=subnet_group_name_tag, expected_type=type_hints["subnet_group_name_tag"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "account": account,
-            "filter": filter,
             "region": region,
+            "filter": filter,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
         if lookup_role_arn is not None:
             self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
         if return_asymmetric_subnets is not None:
             self._values["return_asymmetric_subnets"] = return_asymmetric_subnets
         if return_vpn_gateways is not None:
@@ -7216,18 +7703,6 @@ class VpcContextQuery:
         assert result is not None, "Required property 'account' is missing"
         return typing.cast(builtins.str, result)
 
-    @builtins.property
-    def filter(self) -> typing.Mapping[builtins.str, builtins.str]:
-        '''Filters to apply to the VPC.
-
-        Filter parameters are the same as passed to DescribeVpcs.
-
-        :see: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html
-        '''
-        result = self._values.get("filter")
-        assert result is not None, "Required property 'filter' is missing"
-        return typing.cast(typing.Mapping[builtins.str, builtins.str], result)
-
     @builtins.property
     def region(self) -> builtins.str:
         '''Query region.'''
@@ -7235,6 +7710,22 @@ class VpcContextQuery:
         assert result is not None, "Required property 'region' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
     @builtins.property
     def lookup_role_arn(self) -> typing.Optional[builtins.str]:
         '''The ARN of the role that should be used to look up the missing values.
@@ -7245,21 +7736,42 @@ class VpcContextQuery:
         return typing.cast(typing.Optional[builtins.str], result)
 
     @builtins.property
-    def return_asymmetric_subnets(self) -> typing.Optional[builtins.bool]:
-        '''Whether to populate the subnetGroups field of the ``VpcContextResponse``, which contains potentially asymmetric subnet groups.
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
 
-        :default: false
+        :default: - No ExternalId will be supplied
         '''
-        result = self._values.get("return_asymmetric_subnets")
-        return typing.cast(typing.Optional[builtins.bool], result)
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
 
     @builtins.property
-    def return_vpn_gateways(self) -> typing.Optional[builtins.bool]:
-        '''Whether to populate the ``vpnGatewayId`` field of the ``VpcContextResponse``, which contains the VPN Gateway ID, if one exists.
+    def filter(self) -> typing.Mapping[builtins.str, builtins.str]:
+        '''Filters to apply to the VPC.
 
-        You can explicitly
-        disable this in order to avoid the lookup if you know the VPC does not have
-        a VPN Gatway attached.
+        Filter parameters are the same as passed to DescribeVpcs.
+
+        :see: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html
+        '''
+        result = self._values.get("filter")
+        assert result is not None, "Required property 'filter' is missing"
+        return typing.cast(typing.Mapping[builtins.str, builtins.str], result)
+
+    @builtins.property
+    def return_asymmetric_subnets(self) -> typing.Optional[builtins.bool]:
+        '''Whether to populate the subnetGroups field of the ``VpcContextResponse``, which contains potentially asymmetric subnet groups.
+
+        :default: false
+        '''
+        result = self._values.get("return_asymmetric_subnets")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def return_vpn_gateways(self) -> typing.Optional[builtins.bool]:
+        '''Whether to populate the ``vpnGatewayId`` field of the ``VpcContextResponse``, which contains the VPN Gateway ID, if one exists.
+
+        You can explicitly
+        disable this in order to avoid the lookup if you know the VPC does not have
+        a VPN Gatway attached.
 
         :default: true
         '''
@@ -7291,37 +7803,332 @@ class VpcContextQuery:
         )
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.cloud_assembly_schema.AmiContextQuery",
+    jsii_struct_bases=[ContextLookupRoleOptions],
+    name_mapping={
+        "account": "account",
+        "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
+        "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+        "filters": "filters",
+        "owners": "owners",
+    },
+)
+class AmiContextQuery(ContextLookupRoleOptions):
+    def __init__(
+        self,
+        *,
+        account: builtins.str,
+        region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+        lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+        filters: typing.Mapping[builtins.str, typing.Sequence[builtins.str]],
+        owners: typing.Optional[typing.Sequence[builtins.str]] = None,
+    ) -> None:
+        '''Query to AMI context provider.
+
+        :param account: Query account.
+        :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
+        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param filters: Filters to DescribeImages call.
+        :param owners: Owners to DescribeImages call. Default: - All owners
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import cloud_assembly_schema
+            
+            # assume_role_additional_options: Any
+            
+            ami_context_query = AmiContextQuery(
+                account="account",
+                filters={
+                    "filters_key": ["filters"]
+                },
+                region="region",
+            
+                # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId",
+                owners=["owners"]
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9ad6944b308c0d053938a9bf5ce1be77af5b529135dc35a4c245384840501111)
+            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
+            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
+            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+            check_type(argname="argument filters", value=filters, expected_type=type_hints["filters"])
+            check_type(argname="argument owners", value=owners, expected_type=type_hints["owners"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "account": account,
+            "region": region,
+            "filters": filters,
+        }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
+        if lookup_role_arn is not None:
+            self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
+        if owners is not None:
+            self._values["owners"] = owners
+
+    @builtins.property
+    def account(self) -> builtins.str:
+        '''Query account.'''
+        result = self._values.get("account")
+        assert result is not None, "Required property 'account' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def region(self) -> builtins.str:
+        '''Query region.'''
+        result = self._values.get("region")
+        assert result is not None, "Required property 'region' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
+    @builtins.property
+    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of the role that should be used to look up the missing values.
+
+        :default: - None
+        '''
+        result = self._values.get("lookup_role_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def filters(self) -> typing.Mapping[builtins.str, typing.List[builtins.str]]:
+        '''Filters to DescribeImages call.'''
+        result = self._values.get("filters")
+        assert result is not None, "Required property 'filters' is missing"
+        return typing.cast(typing.Mapping[builtins.str, typing.List[builtins.str]], result)
+
+    @builtins.property
+    def owners(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''Owners to DescribeImages call.
+
+        :default: - All owners
+        '''
+        result = self._values.get("owners")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "AmiContextQuery(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.cloud_assembly_schema.AvailabilityZonesContextQuery",
+    jsii_struct_bases=[ContextLookupRoleOptions],
+    name_mapping={
+        "account": "account",
+        "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
+        "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+    },
+)
+class AvailabilityZonesContextQuery(ContextLookupRoleOptions):
+    def __init__(
+        self,
+        *,
+        account: builtins.str,
+        region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+        lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''Query to availability zone context provider.
+
+        :param account: Query account.
+        :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
+        :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import cloud_assembly_schema
+            
+            # assume_role_additional_options: Any
+            
+            availability_zones_context_query = AvailabilityZonesContextQuery(
+                account="account",
+                region="region",
+            
+                # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__e23cb5710241f65fda5e65504911a7340786a62ce9cf7c60c9cfc1d4d4a05753)
+            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
+            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
+            check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "account": account,
+            "region": region,
+        }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
+        if lookup_role_arn is not None:
+            self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
+
+    @builtins.property
+    def account(self) -> builtins.str:
+        '''Query account.'''
+        result = self._values.get("account")
+        assert result is not None, "Required property 'account' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def region(self) -> builtins.str:
+        '''Query region.'''
+        result = self._values.get("region")
+        assert result is not None, "Required property 'region' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
+    @builtins.property
+    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of the role that should be used to look up the missing values.
+
+        :default: - None
+        '''
+        result = self._values.get("lookup_role_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "AvailabilityZonesContextQuery(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.cloud_assembly_schema.LoadBalancerContextQuery",
     jsii_struct_bases=[LoadBalancerFilter],
     name_mapping={
-        "load_balancer_type": "loadBalancerType",
-        "load_balancer_arn": "loadBalancerArn",
-        "load_balancer_tags": "loadBalancerTags",
         "account": "account",
         "region": "region",
+        "assume_role_additional_options": "assumeRoleAdditionalOptions",
         "lookup_role_arn": "lookupRoleArn",
+        "lookup_role_external_id": "lookupRoleExternalId",
+        "load_balancer_type": "loadBalancerType",
+        "load_balancer_arn": "loadBalancerArn",
+        "load_balancer_tags": "loadBalancerTags",
     },
 )
 class LoadBalancerContextQuery(LoadBalancerFilter):
     def __init__(
         self,
         *,
-        load_balancer_type: LoadBalancerType,
-        load_balancer_arn: typing.Optional[builtins.str] = None,
-        load_balancer_tags: typing.Optional[typing.Sequence[typing.Union[Tag, typing.Dict[builtins.str, typing.Any]]]] = None,
         account: builtins.str,
         region: builtins.str,
+        assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         lookup_role_arn: typing.Optional[builtins.str] = None,
+        lookup_role_external_id: typing.Optional[builtins.str] = None,
+        load_balancer_type: LoadBalancerType,
+        load_balancer_arn: typing.Optional[builtins.str] = None,
+        load_balancer_tags: typing.Optional[typing.Sequence[typing.Union[Tag, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''Query input for looking up a load balancer.
 
-        :param load_balancer_type: Filter load balancers by their type.
-        :param load_balancer_arn: Find by load balancer's ARN. Default: - does not search by load balancer arn
-        :param load_balancer_tags: Match load balancer tags. Default: - does not match load balancers by tags
         :param account: Query account.
         :param region: Query region.
+        :param assume_role_additional_options: Additional options to pass to STS when assuming the lookup role. - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead. - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead. Default: - No additional options.
         :param lookup_role_arn: The ARN of the role that should be used to look up the missing values. Default: - None
+        :param lookup_role_external_id: The ExternalId that needs to be supplied while assuming this role. Default: - No ExternalId will be supplied
+        :param load_balancer_type: Filter load balancers by their type.
+        :param load_balancer_arn: Find by load balancer's ARN. Default: - does not search by load balancer arn
+        :param load_balancer_tags: Match load balancer tags. Default: - does not match load balancers by tags
 
         :exampleMetadata: fixture=_generated
 
@@ -7331,39 +8138,99 @@ class LoadBalancerContextQuery(LoadBalancerFilter):
             # The values are placeholders you should change.
             from aws_cdk import cloud_assembly_schema
             
+            # assume_role_additional_options: Any
+            
             load_balancer_context_query = LoadBalancerContextQuery(
                 account="account",
                 load_balancer_type=cloud_assembly_schema.LoadBalancerType.NETWORK,
                 region="region",
             
                 # the properties below are optional
+                assume_role_additional_options={
+                    "assume_role_additional_options_key": assume_role_additional_options
+                },
                 load_balancer_arn="loadBalancerArn",
                 load_balancer_tags=[Tag(
                     key="key",
                     value="value"
                 )],
-                lookup_role_arn="lookupRoleArn"
+                lookup_role_arn="lookupRoleArn",
+                lookup_role_external_id="lookupRoleExternalId"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__684496ae759db19b352bca3cc225ef7242df94dfd04fc23412be9b315f601e9a)
-            check_type(argname="argument load_balancer_type", value=load_balancer_type, expected_type=type_hints["load_balancer_type"])
-            check_type(argname="argument load_balancer_arn", value=load_balancer_arn, expected_type=type_hints["load_balancer_arn"])
-            check_type(argname="argument load_balancer_tags", value=load_balancer_tags, expected_type=type_hints["load_balancer_tags"])
             check_type(argname="argument account", value=account, expected_type=type_hints["account"])
             check_type(argname="argument region", value=region, expected_type=type_hints["region"])
+            check_type(argname="argument assume_role_additional_options", value=assume_role_additional_options, expected_type=type_hints["assume_role_additional_options"])
             check_type(argname="argument lookup_role_arn", value=lookup_role_arn, expected_type=type_hints["lookup_role_arn"])
+            check_type(argname="argument lookup_role_external_id", value=lookup_role_external_id, expected_type=type_hints["lookup_role_external_id"])
+            check_type(argname="argument load_balancer_type", value=load_balancer_type, expected_type=type_hints["load_balancer_type"])
+            check_type(argname="argument load_balancer_arn", value=load_balancer_arn, expected_type=type_hints["load_balancer_arn"])
+            check_type(argname="argument load_balancer_tags", value=load_balancer_tags, expected_type=type_hints["load_balancer_tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
-            "load_balancer_type": load_balancer_type,
             "account": account,
             "region": region,
+            "load_balancer_type": load_balancer_type,
         }
+        if assume_role_additional_options is not None:
+            self._values["assume_role_additional_options"] = assume_role_additional_options
+        if lookup_role_arn is not None:
+            self._values["lookup_role_arn"] = lookup_role_arn
+        if lookup_role_external_id is not None:
+            self._values["lookup_role_external_id"] = lookup_role_external_id
         if load_balancer_arn is not None:
             self._values["load_balancer_arn"] = load_balancer_arn
         if load_balancer_tags is not None:
             self._values["load_balancer_tags"] = load_balancer_tags
-        if lookup_role_arn is not None:
-            self._values["lookup_role_arn"] = lookup_role_arn
+
+    @builtins.property
+    def account(self) -> builtins.str:
+        '''Query account.'''
+        result = self._values.get("account")
+        assert result is not None, "Required property 'account' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def region(self) -> builtins.str:
+        '''Query region.'''
+        result = self._values.get("region")
+        assert result is not None, "Required property 'region' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def assume_role_additional_options(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Any]]:
+        '''Additional options to pass to STS when assuming the lookup role.
+
+        - ``RoleArn`` should not be used. Use the dedicated ``lookupRoleArn`` property instead.
+        - ``ExternalId`` should not be used. Use the dedicated ``lookupRoleExternalId`` instead.
+
+        :default: - No additional options.
+
+        :see: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/STS.html#assumeRole-property
+        '''
+        result = self._values.get("assume_role_additional_options")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
+
+    @builtins.property
+    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of the role that should be used to look up the missing values.
+
+        :default: - None
+        '''
+        result = self._values.get("lookup_role_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def lookup_role_external_id(self) -> typing.Optional[builtins.str]:
+        '''The ExternalId that needs to be supplied while assuming this role.
+
+        :default: - No ExternalId will be supplied
+        '''
+        result = self._values.get("lookup_role_external_id")
+        return typing.cast(typing.Optional[builtins.str], result)
 
     @builtins.property
     def load_balancer_type(self) -> LoadBalancerType:
@@ -7390,29 +8257,6 @@ class LoadBalancerContextQuery(LoadBalancerFilter):
         result = self._values.get("load_balancer_tags")
         return typing.cast(typing.Optional[typing.List[Tag]], result)
 
-    @builtins.property
-    def account(self) -> builtins.str:
-        '''Query account.'''
-        result = self._values.get("account")
-        assert result is not None, "Required property 'account' is missing"
-        return typing.cast(builtins.str, result)
-
-    @builtins.property
-    def region(self) -> builtins.str:
-        '''Query region.'''
-        result = self._values.get("region")
-        assert result is not None, "Required property 'region' is missing"
-        return typing.cast(builtins.str, result)
-
-    @builtins.property
-    def lookup_role_arn(self) -> typing.Optional[builtins.str]:
-        '''The ARN of the role that should be used to look up the missing values.
-
-        :default: - None
-        '''
-        result = self._values.get("lookup_role_arn")
-        return typing.cast(typing.Optional[builtins.str], result)
-
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -7733,6 +8577,7 @@ __all__ = [
     "CdkCommands",
     "ContainerImageAssetCacheOption",
     "ContainerImageAssetMetadataEntry",
+    "ContextLookupRoleOptions",
     "ContextProvider",
     "DefaultCdkOptions",
     "DeployCommand",
@@ -7777,17 +8622,6 @@ __all__ = [
 
 publication.publish()
 
-def _typecheckingstub__9ad6944b308c0d053938a9bf5ce1be77af5b529135dc35a4c245384840501111(
-    *,
-    account: builtins.str,
-    filters: typing.Mapping[builtins.str, typing.Sequence[builtins.str]],
-    region: builtins.str,
-    lookup_role_arn: typing.Optional[builtins.str] = None,
-    owners: typing.Optional[typing.Sequence[builtins.str]] = None,
-) -> None:
-    """Type checking stubs"""
-    pass
-
 def _typecheckingstub__c0fe0dea35f8750630dc6eb16d5f979ef40079f01dc4afec1b7ebf62d6958505(
     *,
     type: ArtifactType,
@@ -7836,23 +8670,16 @@ def _typecheckingstub__c5d2e8772dd80ce81405cd98707a3f710c439c66cd9580fecad1be825
     """Type checking stubs"""
     pass
 
-def _typecheckingstub__e23cb5710241f65fda5e65504911a7340786a62ce9cf7c60c9cfc1d4d4a05753(
-    *,
-    account: builtins.str,
-    region: builtins.str,
-    lookup_role_arn: typing.Optional[builtins.str] = None,
-) -> None:
-    """Type checking stubs"""
-    pass
-
 def _typecheckingstub__662c8e7475bc8ebd11512c676ac10ca4f84539770ce9a2a5d5d96a46956fe50e(
     *,
     template_file: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     assume_role_arn: typing.Optional[builtins.str] = None,
     assume_role_external_id: typing.Optional[builtins.str] = None,
     bootstrap_stack_version_ssm_parameter: typing.Optional[builtins.str] = None,
     cloud_formation_execution_role_arn: typing.Optional[builtins.str] = None,
     lookup_role: typing.Optional[typing.Union[BootstrapRole, typing.Dict[builtins.str, typing.Any]]] = None,
+    notification_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
     parameters: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     requires_bootstrap_stack_version: typing.Optional[jsii.Number] = None,
     stack_name: typing.Optional[builtins.str] = None,
@@ -7866,6 +8693,7 @@ def _typecheckingstub__662c8e7475bc8ebd11512c676ac10ca4f84539770ce9a2a5d5d96a469
 
 def _typecheckingstub__e91cfad0a891b03534a612d02721f5d8d6378d9951a8f62fa2272323da013b6c(
     *,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     assume_role_arn: typing.Optional[builtins.str] = None,
     assume_role_external_id: typing.Optional[builtins.str] = None,
     region: typing.Optional[builtins.str] = None,
@@ -7876,6 +8704,7 @@ def _typecheckingstub__e91cfad0a891b03534a612d02721f5d8d6378d9951a8f62fa2272323d
 def _typecheckingstub__a573afe6fe73a260b78458b7d6ff4d548c9379eb945ffcadd64389efe9b6e65d(
     *,
     arn: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     assume_role_external_id: typing.Optional[builtins.str] = None,
     bootstrap_stack_version_ssm_parameter: typing.Optional[builtins.str] = None,
     requires_bootstrap_stack_version: typing.Optional[jsii.Number] = None,
@@ -7931,6 +8760,17 @@ def _typecheckingstub__a5331a5e47b1bb2aafb851bd548f765940424af583650927b525fa39d
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__426943c947fb44b9deefd019e7f66ce3401c1a856d9f2773d450cd96adae6f59(
+    *,
+    account: builtins.str,
+    region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+    lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__594ca36867231e310239038fdad0490ae5b2dfc45ce83bd893a483d4e4b5e150(
     *,
     all: typing.Optional[builtins.bool] = None,
@@ -8072,6 +8912,7 @@ def _typecheckingstub__18a2a085c0212f98043b6dccf8c92e1bdc5d9e20c7266a3be7bc908b8
 
 def _typecheckingstub__01e136052f71999035d3e1605dff6c0878e98a56b1d1493de1cc03b20f38345a(
     *,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     assume_role_arn: typing.Optional[builtins.str] = None,
     assume_role_external_id: typing.Optional[builtins.str] = None,
     region: typing.Optional[builtins.str] = None,
@@ -8104,8 +8945,10 @@ def _typecheckingstub__b028a59a345f6074485bae83f874fa7eca8081fea4616b491a43cfb78
     *,
     account: builtins.str,
     region: builtins.str,
-    service_name: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+    service_name: builtins.str,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -8133,6 +8976,7 @@ def _typecheckingstub__7fbb3412647192d09586c63a100c01b6e55569ecafd8e050b7588e9ed
 
 def _typecheckingstub__482362971cab2cc43f5645dc6db216e662ebd818f06c2cdcac27f66423f068f7(
     *,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     assume_role_arn: typing.Optional[builtins.str] = None,
     assume_role_external_id: typing.Optional[builtins.str] = None,
     region: typing.Optional[builtins.str] = None,
@@ -8164,9 +9008,11 @@ def _typecheckingstub__cbadd14eae9eb3722ca27183992f5c2cf9e9b0bb548e5a3a0ee7ac2d1
 def _typecheckingstub__479c87e6b7f0a4547d04d73de1bad2d396c1e1383975038b6ca8a7ee078e9ab8(
     *,
     account: builtins.str,
-    domain_name: builtins.str,
     region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+    domain_name: builtins.str,
     private_zone: typing.Optional[builtins.bool] = None,
     vpc_id: typing.Optional[builtins.str] = None,
 ) -> None:
@@ -8186,15 +9032,22 @@ def _typecheckingstub__5432524b6ab8526a1e8e021ba819e88be44f2dc6f4c9a47990f2c4936
 def _typecheckingstub__b738d31e8937d0dc914b364457cedd3794a0911b61fec9b17eb3f8ad72e53832(
     *,
     account: builtins.str,
-    alias_name: builtins.str,
     region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+    alias_name: builtins.str,
 ) -> None:
     """Type checking stubs"""
     pass
 
 def _typecheckingstub__b57ff0c819ed8af3b684900df083604408f77b99e70f2dd2d12b1cc7e4a8e68c(
     *,
+    account: builtins.str,
+    region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+    lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
     load_balancer_type: LoadBalancerType,
     load_balancer_arn: typing.Optional[builtins.str] = None,
     load_balancer_tags: typing.Optional[typing.Sequence[typing.Union[Tag, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -8204,15 +9057,17 @@ def _typecheckingstub__b57ff0c819ed8af3b684900df083604408f77b99e70f2dd2d12b1cc7e
 
 def _typecheckingstub__0e0c4bf3a41978c03455699a53b8dc150feef48b4e8d1cb490e0e3cffa75ced7(
     *,
+    account: builtins.str,
+    region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+    lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
     load_balancer_type: LoadBalancerType,
     load_balancer_arn: typing.Optional[builtins.str] = None,
     load_balancer_tags: typing.Optional[typing.Sequence[typing.Union[Tag, typing.Dict[builtins.str, typing.Any]]]] = None,
-    account: builtins.str,
-    region: builtins.str,
     listener_arn: typing.Optional[builtins.str] = None,
     listener_port: typing.Optional[jsii.Number] = None,
     listener_protocol: typing.Optional[LoadBalancerListenerProtocol] = None,
-    lookup_role_arn: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -8312,9 +9167,11 @@ def _typecheckingstub__b0d8ff22f74ddaf52e071d67dbc65d3080f622da186b8d675c5b21733
 def _typecheckingstub__684d2dfddbf9de1c9120fbcee643319c13ff10fa5e3227b4959d94fdac1463d5(
     *,
     account: builtins.str,
-    parameter_name: builtins.str,
     region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+    parameter_name: builtins.str,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -8323,7 +9180,9 @@ def _typecheckingstub__ab27bdfc9deaaa99cc0b29d10214dea6da9d91e77b9d18d5a5f9a2b7f
     *,
     account: builtins.str,
     region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
     security_group_id: typing.Optional[builtins.str] = None,
     security_group_name: typing.Optional[builtins.str] = None,
     vpc_id: typing.Optional[builtins.str] = None,
@@ -8361,9 +9220,11 @@ def _typecheckingstub__4f49fc9c74b07ac016f6f246ae2bfaa0eea6382d75f9ee62c77e3b244
 def _typecheckingstub__793c311275bf258c4baaae63fe63966f0fd334129e469b7dc83e548f2cbf5318(
     *,
     account: builtins.str,
-    filter: typing.Mapping[builtins.str, builtins.str],
     region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+    filter: typing.Mapping[builtins.str, builtins.str],
     return_asymmetric_subnets: typing.Optional[builtins.bool] = None,
     return_vpn_gateways: typing.Optional[builtins.bool] = None,
     subnet_group_name_tag: typing.Optional[builtins.str] = None,
@@ -8371,14 +9232,40 @@ def _typecheckingstub__793c311275bf258c4baaae63fe63966f0fd334129e469b7dc83e548f2
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__9ad6944b308c0d053938a9bf5ce1be77af5b529135dc35a4c245384840501111(
+    *,
+    account: builtins.str,
+    region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+    lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+    filters: typing.Mapping[builtins.str, typing.Sequence[builtins.str]],
+    owners: typing.Optional[typing.Sequence[builtins.str]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__e23cb5710241f65fda5e65504911a7340786a62ce9cf7c60c9cfc1d4d4a05753(
+    *,
+    account: builtins.str,
+    region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+    lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__684496ae759db19b352bca3cc225ef7242df94dfd04fc23412be9b315f601e9a(
     *,
-    load_balancer_type: LoadBalancerType,
-    load_balancer_arn: typing.Optional[builtins.str] = None,
-    load_balancer_tags: typing.Optional[typing.Sequence[typing.Union[Tag, typing.Dict[builtins.str, typing.Any]]]] = None,
     account: builtins.str,
     region: builtins.str,
+    assume_role_additional_options: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     lookup_role_arn: typing.Optional[builtins.str] = None,
+    lookup_role_external_id: typing.Optional[builtins.str] = None,
+    load_balancer_type: LoadBalancerType,
+    load_balancer_arn: typing.Optional[builtins.str] = None,
+    load_balancer_tags: typing.Optional[typing.Sequence[typing.Union[Tag, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass