aws-cdk-lib 2.163.1__tar.gz → 2.164.0__tar.gz

{aws_cdk_lib-2.163.1/src/aws_cdk_lib.egg-info → aws_cdk_lib-2.164.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: aws-cdk-lib
-Version: 2.163.1
+Version: 2.164.0
 Summary: Version 2 of the AWS Cloud Development Kit library
 Home-page: https://github.com/aws/aws-cdk
 Author: Amazon Web Services

{aws_cdk_lib-2.163.1 → aws_cdk_lib-2.164.0}/setup.py

@@ -5,7 +5,7 @@ kwargs = json.loads(
     """
 {
     "name": "aws-cdk-lib",
-    "version": "2.163.1",
+    "version": "2.164.0",
     "description": "Version 2 of the AWS Cloud Development Kit library",
     "license": "Apache-2.0",
     "url": "https://github.com/aws/aws-cdk",
@@ -310,7 +310,7 @@ kwargs = json.loads(
     ],
     "package_data": {
         "aws_cdk._jsii": [
-            "aws-cdk-lib@2.163.1.jsii.tgz"
+            "aws-cdk-lib@2.164.0.jsii.tgz"
         ],
         "aws_cdk": [
             "py.typed"

{aws_cdk_lib-2.163.1 → aws_cdk_lib-2.164.0}/src/aws_cdk/_jsii/__init__.py

@@ -35,7 +35,7 @@ import aws_cdk.cloud_assembly_schema._jsii
 import constructs._jsii
 
 __jsii_assembly__ = jsii.JSIIAssembly.load(
-    "aws-cdk-lib", "2.163.1", __name__[0:-6], "aws-cdk-lib@2.163.1.jsii.tgz"
+    "aws-cdk-lib", "2.164.0", __name__[0:-6], "aws-cdk-lib@2.164.0.jsii.tgz"
 )
 
 __all__ = [

{aws_cdk_lib-2.163.1 → aws_cdk_lib-2.164.0}/src/aws_cdk/aws_bedrock/__init__.py

@@ -19650,6 +19650,12 @@ class FoundationModelIdentifier(
         '''Base model "anthropic.claude-3-5-sonnet-20240620-v1:0".'''
         return typing.cast("FoundationModelIdentifier", jsii.sget(cls, "ANTHROPIC_CLAUDE_3_5_SONNET_20240620_V1_0"))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ANTHROPIC_CLAUDE_3_5_SONNET_20241022_V2_0")
+    def ANTHROPIC_CLAUDE_3_5_SONNET_20241022_V2_0(cls) -> "FoundationModelIdentifier":
+        '''Base model "anthropic.claude-3-5-sonnet-20241022-v2:0".'''
+        return typing.cast("FoundationModelIdentifier", jsii.sget(cls, "ANTHROPIC_CLAUDE_3_5_SONNET_20241022_V2_0"))
+
     @jsii.python.classproperty
     @jsii.member(jsii_name="ANTHROPIC_CLAUDE_3_HAIKU_20240307_V1_0")
     def ANTHROPIC_CLAUDE_3_HAIKU_20240307_V1_0(cls) -> "FoundationModelIdentifier":

{aws_cdk_lib-2.163.1 → aws_cdk_lib-2.164.0}/src/aws_cdk/aws_cloudfront/experimental/__init__.py

@@ -242,7 +242,7 @@ class EdgeFunction(
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
-        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recursive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -1074,7 +1074,7 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
-        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recursive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -1734,7 +1734,7 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
     def recursive_loop(self) -> typing.Optional[_RecursiveLoop_fc293827]:
         '''Sets the Recursive Loop Protection for Lambda Function.
 
-        It lets Lambda detect and terminate unintended recusrive loops.
+        It lets Lambda detect and terminate unintended recursive loops.
 
         :default: RecursiveLoop.Terminate
         '''

{aws_cdk_lib-2.163.1 → aws_cdk_lib-2.164.0}/src/aws_cdk/aws_codebuild/__init__.py

@@ -1474,7 +1474,7 @@ class BuildEnvironment:
         privileged: typing.Optional[builtins.bool] = None,
     ) -> None:
         '''
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -1540,7 +1540,7 @@ class BuildEnvironment:
     def build_image(self) -> typing.Optional["IBuildImage"]:
         '''The image used for the builds.
 
-        :default: LinuxBuildImage.STANDARD_1_0
+        :default: LinuxBuildImage.STANDARD_7_0
         '''
         result = self._values.get("build_image")
         return typing.cast(typing.Optional["IBuildImage"], result)
@@ -7624,7 +7624,7 @@ class CommonProjectProps:
         :param concurrent_build_limit: Maximum number of concurrent builds. Minimum value is 1 and maximum is account build limit. Default: - no explicit limit is set
         :param description: A description of the project. Use the description to identify the purpose of the project. Default: - No description.
         :param encryption_key: Encryption key to use to read and write artifacts. Default: - The AWS-managed CMK for Amazon Simple Storage Service (Amazon S3) is used.
-        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         :param environment_variables: Additional environment variables to add to the build environment. Default: - No additional environment variables are specified.
         :param file_system_locations: An ProjectFileSystemLocation objects for a CodeBuild build project. A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint, and type of a file system created using Amazon Elastic File System. Default: - no file system locations
         :param grant_report_group_permissions: Add permissions to this project's role to create and use test report groups with name starting with the name of this project. That is the standard report group that gets created when a simple name (in contrast to an ARN) is used in the 'reports' section of the buildspec of this project. This is usually harmless, but you can turn these off if you don't plan on using test reports in this project. Default: true
@@ -7907,7 +7907,7 @@ class CommonProjectProps:
     def environment(self) -> typing.Optional[BuildEnvironment]:
         '''Build environment to use for the build.
 
-        :default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         '''
         result = self._values.get("environment")
         return typing.cast(typing.Optional[BuildEnvironment], result)
@@ -9273,7 +9273,7 @@ class IBuildImage(typing_extensions.Protocol):
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -9364,7 +9364,7 @@ class _IBuildImageProxy:
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -10849,7 +10849,7 @@ class LinuxArmBuildImage(
     ) -> typing.List[builtins.str]:
         '''Validates by checking the BuildEnvironments' images are not Lambda ComputeTypes.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -10972,7 +10972,7 @@ class LinuxArmLambdaBuildImage(
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -11292,7 +11292,7 @@ class LinuxBuildImage(
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -11536,7 +11536,7 @@ class LinuxLambdaBuildImage(
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -11977,7 +11977,7 @@ class MacBuildImage(
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -12148,7 +12148,7 @@ class PipelineProjectProps(CommonProjectProps):
         :param concurrent_build_limit: Maximum number of concurrent builds. Minimum value is 1 and maximum is account build limit. Default: - no explicit limit is set
         :param description: A description of the project. Use the description to identify the purpose of the project. Default: - No description.
         :param encryption_key: Encryption key to use to read and write artifacts. Default: - The AWS-managed CMK for Amazon Simple Storage Service (Amazon S3) is used.
-        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         :param environment_variables: Additional environment variables to add to the build environment. Default: - No additional environment variables are specified.
         :param file_system_locations: An ProjectFileSystemLocation objects for a CodeBuild build project. A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint, and type of a file system created using Amazon Elastic File System. Default: - no file system locations
         :param grant_report_group_permissions: Add permissions to this project's role to create and use test report groups with name starting with the name of this project. That is the standard report group that gets created when a simple name (in contrast to an ARN) is used in the 'reports' section of the buildspec of this project. This is usually harmless, but you can turn these off if you don't plan on using test reports in this project. Default: true
@@ -12389,7 +12389,7 @@ class PipelineProjectProps(CommonProjectProps):
     def environment(self) -> typing.Optional[BuildEnvironment]:
         '''Build environment to use for the build.
 
-        :default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         '''
         result = self._values.get("environment")
         return typing.cast(typing.Optional[BuildEnvironment], result)
@@ -12651,7 +12651,7 @@ class Project(
         :param concurrent_build_limit: Maximum number of concurrent builds. Minimum value is 1 and maximum is account build limit. Default: - no explicit limit is set
         :param description: A description of the project. Use the description to identify the purpose of the project. Default: - No description.
         :param encryption_key: Encryption key to use to read and write artifacts. Default: - The AWS-managed CMK for Amazon Simple Storage Service (Amazon S3) is used.
-        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         :param environment_variables: Additional environment variables to add to the build environment. Default: - No additional environment variables are specified.
         :param file_system_locations: An ProjectFileSystemLocation objects for a CodeBuild build project. A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint, and type of a file system created using Amazon Elastic File System. Default: - no file system locations
         :param grant_report_group_permissions: Add permissions to this project's role to create and use test report groups with name starting with the name of this project. That is the standard report group that gets created when a simple name (in contrast to an ARN) is used in the 'reports' section of the buildspec of this project. This is usually harmless, but you can turn these off if you don't plan on using test reports in this project. Default: true
@@ -13684,7 +13684,7 @@ class ProjectProps(CommonProjectProps):
         :param concurrent_build_limit: Maximum number of concurrent builds. Minimum value is 1 and maximum is account build limit. Default: - no explicit limit is set
         :param description: A description of the project. Use the description to identify the purpose of the project. Default: - No description.
         :param encryption_key: Encryption key to use to read and write artifacts. Default: - The AWS-managed CMK for Amazon Simple Storage Service (Amazon S3) is used.
-        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         :param environment_variables: Additional environment variables to add to the build environment. Default: - No additional environment variables are specified.
         :param file_system_locations: An ProjectFileSystemLocation objects for a CodeBuild build project. A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint, and type of a file system created using Amazon Elastic File System. Default: - no file system locations
         :param grant_report_group_permissions: Add permissions to this project's role to create and use test report groups with name starting with the name of this project. That is the standard report group that gets created when a simple name (in contrast to an ARN) is used in the 'reports' section of the buildspec of this project. This is usually harmless, but you can turn these off if you don't plan on using test reports in this project. Default: true
@@ -13902,7 +13902,7 @@ class ProjectProps(CommonProjectProps):
     def environment(self) -> typing.Optional[BuildEnvironment]:
         '''Build environment to use for the build.
 
-        :default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         '''
         result = self._values.get("environment")
         return typing.cast(typing.Optional[BuildEnvironment], result)
@@ -15487,7 +15487,7 @@ class WindowsBuildImage(
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -16905,7 +16905,7 @@ class LinuxGpuBuildImage(
     ) -> typing.List[builtins.str]:
         '''Allows the image a chance to validate whether the passed configuration is correct.
 
-        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_1_0
+        :param build_image: The image used for the builds. Default: LinuxBuildImage.STANDARD_7_0
         :param certificate: The location of the PEM-encoded certificate for the build project. Default: - No external certificate is added to the project
         :param compute_type: The type of compute to use for this build. See the ``ComputeType`` enum for the possible values. Default: taken from ``#buildImage#defaultComputeType``
         :param environment_variables: The environment variables that your builds can use.
@@ -17154,7 +17154,7 @@ class PipelineProject(
         :param concurrent_build_limit: Maximum number of concurrent builds. Minimum value is 1 and maximum is account build limit. Default: - no explicit limit is set
         :param description: A description of the project. Use the description to identify the purpose of the project. Default: - No description.
         :param encryption_key: Encryption key to use to read and write artifacts. Default: - The AWS-managed CMK for Amazon Simple Storage Service (Amazon S3) is used.
-        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_1_0
+        :param environment: Build environment to use for the build. Default: BuildEnvironment.LinuxBuildImage.STANDARD_7_0
         :param environment_variables: Additional environment variables to add to the build environment. Default: - No additional environment variables are specified.
         :param file_system_locations: An ProjectFileSystemLocation objects for a CodeBuild build project. A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint, and type of a file system created using Amazon Elastic File System. Default: - no file system locations
         :param grant_report_group_permissions: Add permissions to this project's role to create and use test report groups with name starting with the name of this project. That is the standard report group that gets created when a simple name (in contrast to an ARN) is used in the 'reports' section of the buildspec of this project. This is usually harmless, but you can turn these off if you don't plan on using test reports in this project. Default: true

{aws_cdk_lib-2.163.1 → aws_cdk_lib-2.164.0}/src/aws_cdk/aws_cognito/__init__.py

@@ -308,13 +308,17 @@ configure an MFA token and use it for sign in. It also allows for the users to u
 [time-based one time password
 (TOTP)](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa-totp.html).
 
+If you want to enable email-based MFA, set `email` propety to the Amazon SES email-sending configuration and set `advancedSecurityMode` to `AdvancedSecurity.ENFORCED` or `AdvancedSecurity.AUDIT`.
+For more information, see [Email MFA](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security-email-mfa.html).
+
 ```python
 cognito.UserPool(self, "myuserpool",
     # ...
     mfa=cognito.Mfa.REQUIRED,
     mfa_second_factor=cognito.MfaSecondFactor(
         sms=True,
-        otp=True
+        otp=True,
+        email=False
     )
 )
 ```
@@ -13633,7 +13637,8 @@ class Mfa(enum.Enum):
             mfa=cognito.Mfa.REQUIRED,
             mfa_second_factor=cognito.MfaSecondFactor(
                 sms=True,
-                otp=True
+                otp=True,
+                email=False
             )
         )
     '''
@@ -13649,14 +13654,21 @@ class Mfa(enum.Enum):
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_cognito.MfaSecondFactor",
     jsii_struct_bases=[],
-    name_mapping={"otp": "otp", "sms": "sms"},
+    name_mapping={"otp": "otp", "sms": "sms", "email": "email"},
 )
 class MfaSecondFactor:
-    def __init__(self, *, otp: builtins.bool, sms: builtins.bool) -> None:
+    def __init__(
+        self,
+        *,
+        otp: builtins.bool,
+        sms: builtins.bool,
+        email: typing.Optional[builtins.bool] = None,
+    ) -> None:
         '''The different ways in which a user pool can obtain their MFA token for sign in.
 
         :param otp: The MFA token is a time-based one time password that is generated by a hardware or software token. Default: false
         :param sms: The MFA token is sent to the user via SMS to their verified phone numbers. Default: true
+        :param email: The MFA token is sent to the user via EMAIL. To enable email-based MFA, set ``email`` property to the Amazon SES email-sending configuration and set ``advancedSecurityMode`` to ``AdvancedSecurity.ENFORCED`` or ``AdvancedSecurity.AUDIT`` Default: false
 
         :see: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa.html
         :exampleMetadata: infused
@@ -13668,7 +13680,8 @@ class MfaSecondFactor:
                 mfa=cognito.Mfa.REQUIRED,
                 mfa_second_factor=cognito.MfaSecondFactor(
                     sms=True,
-                    otp=True
+                    otp=True,
+                    email=False
                 )
             )
         '''
@@ -13676,10 +13689,13 @@ class MfaSecondFactor:
             type_hints = typing.get_type_hints(_typecheckingstub__cd702328c87129c710daf17c5d6eb94fe91bfd54ab5fe2157a787ca7021ea599)
             check_type(argname="argument otp", value=otp, expected_type=type_hints["otp"])
             check_type(argname="argument sms", value=sms, expected_type=type_hints["sms"])
+            check_type(argname="argument email", value=email, expected_type=type_hints["email"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "otp": otp,
             "sms": sms,
         }
+        if email is not None:
+            self._values["email"] = email
 
     @builtins.property
     def otp(self) -> builtins.bool:
@@ -13699,12 +13715,26 @@ class MfaSecondFactor:
 
         :default: true
 
-        :see: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa-sms-text-message.html
+        :see: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa-sms-email-message.html
         '''
         result = self._values.get("sms")
         assert result is not None, "Required property 'sms' is missing"
         return typing.cast(builtins.bool, result)
 
+    @builtins.property
+    def email(self) -> typing.Optional[builtins.bool]:
+        '''The MFA token is sent to the user via EMAIL.
+
+        To enable email-based MFA, set ``email`` property to the Amazon SES email-sending configuration
+        and set ``advancedSecurityMode`` to ``AdvancedSecurity.ENFORCED`` or ``AdvancedSecurity.AUDIT``
+
+        :default: false
+
+        :see: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa-sms-email-message.html
+        '''
+        result = self._values.get("email")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -16290,7 +16320,7 @@ class UserPool(
         :param lambda_triggers: Lambda functions to use for supported Cognito triggers. Default: - No Lambda triggers.
         :param mfa: Configure whether users of this user pool can or are required use MFA to sign in. Default: Mfa.OFF
         :param mfa_message: The SMS message template sent during MFA verification. Use '{####}' in the template where Cognito should insert the verification code. Default: 'Your authentication code is {####}.'
-        :param mfa_second_factor: Configure the MFA types that users can use in this user pool. Ignored if ``mfa`` is set to ``OFF``. Default: - { sms: true, otp: false }, if ``mfa`` is set to ``OPTIONAL`` or ``REQUIRED``. { sms: false, otp: false }, otherwise
+        :param mfa_second_factor: Configure the MFA types that users can use in this user pool. Ignored if ``mfa`` is set to ``OFF``. Default: - { sms: true, otp: false, email: false }, if ``mfa`` is set to ``OPTIONAL`` or ``REQUIRED``. { sms: false, otp: false, email:false }, otherwise
         :param password_policy: Password policy for this user pool. Default: - see defaults on each property of PasswordPolicy.
         :param removal_policy: Policy to apply when the user pool is removed from the stack. Default: RemovalPolicy.RETAIN
         :param self_sign_up_enabled: Whether self sign-up should be enabled. To configure self sign-up configuration use the ``userVerification`` property. Default: - false
@@ -17885,6 +17915,132 @@ class _UserPoolEmailProxy(UserPoolEmail):
 typing.cast(typing.Any, UserPoolEmail).__jsii_proxy_class__ = lambda : _UserPoolEmailProxy
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_cognito.UserPoolEmailConfig",
+    jsii_struct_bases=[],
+    name_mapping={
+        "configuration_set": "configurationSet",
+        "email_sending_account": "emailSendingAccount",
+        "from_": "from",
+        "reply_to_email_address": "replyToEmailAddress",
+        "source_arn": "sourceArn",
+    },
+)
+class UserPoolEmailConfig:
+    def __init__(
+        self,
+        *,
+        configuration_set: typing.Optional[builtins.str] = None,
+        email_sending_account: typing.Optional[builtins.str] = None,
+        from_: typing.Optional[builtins.str] = None,
+        reply_to_email_address: typing.Optional[builtins.str] = None,
+        source_arn: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''Result of binding email settings with a user pool.
+
+        :param configuration_set: The name of the configuration set in SES. Default: - none
+        :param email_sending_account: Specifies whether to use Cognito's built in email functionality or SES. Default: - Cognito built in email functionality
+        :param from_: Identifies either the sender's email address or the sender's name with their email address. If emailSendingAccount is DEVELOPER then this cannot be specified. Default: 'no-reply@verificationemail.com'
+        :param reply_to_email_address: The destination to which the receiver of the email should reply to. Default: - same as ``from``
+        :param source_arn: The ARN of a verified email address in Amazon SES. required if emailSendingAccount is DEVELOPER or if 'from' is provided. Default: - none
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_cognito as cognito
+            
+            user_pool_email_config = cognito.UserPoolEmailConfig(
+                configuration_set="configurationSet",
+                email_sending_account="emailSendingAccount",
+                from="from",
+                reply_to_email_address="replyToEmailAddress",
+                source_arn="sourceArn"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__e3ce90cb9624f22600c6b33192c8ad7ad7f3946d65d49e2cf22b46b1dca4339e)
+            check_type(argname="argument configuration_set", value=configuration_set, expected_type=type_hints["configuration_set"])
+            check_type(argname="argument email_sending_account", value=email_sending_account, expected_type=type_hints["email_sending_account"])
+            check_type(argname="argument from_", value=from_, expected_type=type_hints["from_"])
+            check_type(argname="argument reply_to_email_address", value=reply_to_email_address, expected_type=type_hints["reply_to_email_address"])
+            check_type(argname="argument source_arn", value=source_arn, expected_type=type_hints["source_arn"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if configuration_set is not None:
+            self._values["configuration_set"] = configuration_set
+        if email_sending_account is not None:
+            self._values["email_sending_account"] = email_sending_account
+        if from_ is not None:
+            self._values["from_"] = from_
+        if reply_to_email_address is not None:
+            self._values["reply_to_email_address"] = reply_to_email_address
+        if source_arn is not None:
+            self._values["source_arn"] = source_arn
+
+    @builtins.property
+    def configuration_set(self) -> typing.Optional[builtins.str]:
+        '''The name of the configuration set in SES.
+
+        :default: - none
+        '''
+        result = self._values.get("configuration_set")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def email_sending_account(self) -> typing.Optional[builtins.str]:
+        '''Specifies whether to use Cognito's built in email functionality or SES.
+
+        :default: - Cognito built in email functionality
+        '''
+        result = self._values.get("email_sending_account")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def from_(self) -> typing.Optional[builtins.str]:
+        '''Identifies either the sender's email address or the sender's name with their email address.
+
+        If emailSendingAccount is DEVELOPER then this cannot be specified.
+
+        :default: 'no-reply@verificationemail.com'
+        '''
+        result = self._values.get("from_")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def reply_to_email_address(self) -> typing.Optional[builtins.str]:
+        '''The destination to which the receiver of the email should reply to.
+
+        :default: - same as ``from``
+        '''
+        result = self._values.get("reply_to_email_address")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def source_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of a verified email address in Amazon SES.
+
+        required if emailSendingAccount is DEVELOPER or if
+        'from' is provided.
+
+        :default: - none
+        '''
+        result = self._values.get("source_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "UserPoolEmailConfig(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 class UserPoolIdentityProvider(
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_cognito.UserPoolIdentityProvider",
@@ -19107,7 +19263,7 @@ class UserPoolProps:
         :param lambda_triggers: Lambda functions to use for supported Cognito triggers. Default: - No Lambda triggers.
         :param mfa: Configure whether users of this user pool can or are required use MFA to sign in. Default: Mfa.OFF
         :param mfa_message: The SMS message template sent during MFA verification. Use '{####}' in the template where Cognito should insert the verification code. Default: 'Your authentication code is {####}.'
-        :param mfa_second_factor: Configure the MFA types that users can use in this user pool. Ignored if ``mfa`` is set to ``OFF``. Default: - { sms: true, otp: false }, if ``mfa`` is set to ``OPTIONAL`` or ``REQUIRED``. { sms: false, otp: false }, otherwise
+        :param mfa_second_factor: Configure the MFA types that users can use in this user pool. Ignored if ``mfa`` is set to ``OFF``. Default: - { sms: true, otp: false, email: false }, if ``mfa`` is set to ``OPTIONAL`` or ``REQUIRED``. { sms: false, otp: false, email:false }, otherwise
         :param password_policy: Password policy for this user pool. Default: - see defaults on each property of PasswordPolicy.
         :param removal_policy: Policy to apply when the user pool is removed from the stack. Default: RemovalPolicy.RETAIN
         :param self_sign_up_enabled: Whether self sign-up should be enabled. To configure self sign-up configuration use the ``userVerification`` property. Default: - false
@@ -19380,8 +19536,8 @@ class UserPoolProps:
 
         :default:
 
-        - { sms: true, otp: false }, if ``mfa`` is set to ``OPTIONAL`` or ``REQUIRED``.
-        { sms: false, otp: false }, otherwise
+        - { sms: true, otp: false, email: false }, if ``mfa`` is set to ``OPTIONAL`` or ``REQUIRED``.
+        { sms: false, otp: false, email:false }, otherwise
         '''
         result = self._values.get("mfa_second_factor")
         return typing.cast(typing.Optional[MfaSecondFactor], result)
@@ -21421,6 +21577,7 @@ __all__ = [
     "UserPoolDomainOptions",
     "UserPoolDomainProps",
     "UserPoolEmail",
+    "UserPoolEmailConfig",
     "UserPoolIdentityProvider",
     "UserPoolIdentityProviderAmazon",
     "UserPoolIdentityProviderAmazonProps",
@@ -23224,6 +23381,7 @@ def _typecheckingstub__cd702328c87129c710daf17c5d6eb94fe91bfd54ab5fe2157a787ca70
     *,
     otp: builtins.bool,
     sms: builtins.bool,
+    email: typing.Optional[builtins.bool] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -23660,6 +23818,17 @@ def _typecheckingstub__8bae3bcd6b2ec774cf9e4981de492abd05cc31118c8ca51bb996ae328
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__e3ce90cb9624f22600c6b33192c8ad7ad7f3946d65d49e2cf22b46b1dca4339e(
+    *,
+    configuration_set: typing.Optional[builtins.str] = None,
+    email_sending_account: typing.Optional[builtins.str] = None,
+    from_: typing.Optional[builtins.str] = None,
+    reply_to_email_address: typing.Optional[builtins.str] = None,
+    source_arn: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__9db3563a94587e916fce47561a9ad603b26f36fbcb7b72d5e133ddf1e77b76d6(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,