aws-cdk-lib 2.176.0__py3-none-any.whl → 2.178.0__py3-none-any.whl

aws_cdk/aws_cloudfront_origins/__init__.py

@@ -74,7 +74,7 @@ cloudfront.Distribution(self, "myDist",
 
 When creating a standard S3 origin using `origins.S3BucketOrigin.withOriginAccessControl()`, an [Origin Access Control resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html) is automatically created with the origin type set to `s3` and signing behavior set to `always`.
 
-You can grant read, write or delete access to the OAC using the `originAccessLevels` property:
+You can grant read, list, write or delete access to the OAC using the `originAccessLevels` property:
 
 ```python
 my_bucket = s3.Bucket(self, "myBucket")
@@ -83,6 +83,8 @@ s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
 )
 ```
 
+For details of list permission, see [Setting up OAC with LIST permission](#setting-up-oac-with-list-permission).
+
 You can also pass in a custom S3 origin access control:
 
 ```python
@@ -336,6 +338,29 @@ See CloudFront docs on [Giving the origin access control permission to access th
 > Note: If your bucket previously used OAI, you will need to manually remove the policy statement
 > that gives the OAI access to your bucket after setting up OAC.
 
+#### Setting up OAC with LIST permission
+
+By default, S3 origin returns 403 Forbidden HTTP response when the requested object does not exist.
+When you want to receive 404 Not Found, specify `AccessLevel.LIST` in `originAccessLevels` to add `s3:ListBucket` permission in the bucket policy.
+
+This is useful to distinguish between responses blocked by WAF (403) and responses where the file does not exist (404).
+
+```python
+my_bucket = s3.Bucket(self, "myBucket")
+s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
+    origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.LIST]
+)
+cloudfront.Distribution(self, "distribution",
+    default_behavior=cloudfront.BehaviorOptions(
+        origin=s3_origin
+    ),
+    default_root_object="index.html"
+)
+```
+
+When the origin is associated to the default behavior, it is highly recommended to specify `defaultRootObject` distribution property.
+Without it, the root path `https://xxxx.cloudfront.net/` will return the list of the S3 object keys.
+
 #### Setting up an OAI (legacy)
 
 Setup an S3 origin with origin access identity (legacy) as follows:
@@ -595,6 +620,24 @@ cloudfront.Distribution(self, "myDist",
 )
 ```
 
+### Selection Criteria: Media Quality Based with AWS Elemental MediaPackageV2
+
+You can setup your origin group to be configured for media quality based failover with your AWS Elemental MediaPackageV2 endpoints.
+You can achieve this behavior in the CDK, again using the `OriginGroup` class:
+
+```python
+cloudfront.Distribution(self, "myDist",
+    default_behavior=cloudfront.BehaviorOptions(
+        origin=origins.OriginGroup(
+            primary_origin=origins.HttpOrigin("<AWS Elemental MediaPackageV2 origin 1>"),
+            fallback_origin=origins.HttpOrigin("<AWS Elemental MediaPackageV2 origin 2>"),
+            fallback_status_codes=[404],
+            selection_criteria=cloudfront.OriginSelectionCriteria.MEDIA_QUALITY_BASED
+        )
+    )
+)
+```
+
 ## From an API Gateway REST API
 
 Origins can be created from an API Gateway REST API. It is recommended to use a
@@ -727,6 +770,7 @@ from ..aws_cloudfront import (
     OriginBindOptions as _OriginBindOptions_088c2b51,
     OriginProps as _OriginProps_0675928d,
     OriginProtocolPolicy as _OriginProtocolPolicy_967ed73c,
+    OriginSelectionCriteria as _OriginSelectionCriteria_ba6d3e21,
     OriginSslPolicy as _OriginSslPolicy_d65cede2,
 )
 from ..aws_elasticloadbalancingv2 import ILoadBalancerV2 as _ILoadBalancerV2_4c5c0fbb
@@ -2311,16 +2355,19 @@ class OriginGroup(
         fallback_origin: _IOrigin_83d4c1fa,
         primary_origin: _IOrigin_83d4c1fa,
         fallback_status_codes: typing.Optional[typing.Sequence[jsii.Number]] = None,
+        selection_criteria: typing.Optional[_OriginSelectionCriteria_ba6d3e21] = None,
     ) -> None:
         '''
         :param fallback_origin: The fallback origin that should serve requests when the primary fails.
         :param primary_origin: The primary origin that should serve requests for this group.
         :param fallback_status_codes: The list of HTTP status codes that, when returned from the primary origin, would cause querying the fallback origin. Default: - 500, 502, 503 and 504
+        :param selection_criteria: The selection criteria for the origin group. Default: - OriginSelectionCriteria.DEFAULT
         '''
         props = OriginGroupProps(
             fallback_origin=fallback_origin,
             primary_origin=primary_origin,
             fallback_status_codes=fallback_status_codes,
+            selection_criteria=selection_criteria,
         )
 
         jsii.create(self.__class__, self, [props])
@@ -2356,6 +2403,7 @@ class OriginGroup(
         "fallback_origin": "fallbackOrigin",
         "primary_origin": "primaryOrigin",
         "fallback_status_codes": "fallbackStatusCodes",
+        "selection_criteria": "selectionCriteria",
     },
 )
 class OriginGroupProps:
@@ -2365,12 +2413,14 @@ class OriginGroupProps:
         fallback_origin: _IOrigin_83d4c1fa,
         primary_origin: _IOrigin_83d4c1fa,
         fallback_status_codes: typing.Optional[typing.Sequence[jsii.Number]] = None,
+        selection_criteria: typing.Optional[_OriginSelectionCriteria_ba6d3e21] = None,
     ) -> None:
         '''Construction properties for ``OriginGroup``.
 
         :param fallback_origin: The fallback origin that should serve requests when the primary fails.
         :param primary_origin: The primary origin that should serve requests for this group.
         :param fallback_status_codes: The list of HTTP status codes that, when returned from the primary origin, would cause querying the fallback origin. Default: - 500, 502, 503 and 504
+        :param selection_criteria: The selection criteria for the origin group. Default: - OriginSelectionCriteria.DEFAULT
 
         :exampleMetadata: infused
 
@@ -2393,12 +2443,15 @@ class OriginGroupProps:
             check_type(argname="argument fallback_origin", value=fallback_origin, expected_type=type_hints["fallback_origin"])
             check_type(argname="argument primary_origin", value=primary_origin, expected_type=type_hints["primary_origin"])
             check_type(argname="argument fallback_status_codes", value=fallback_status_codes, expected_type=type_hints["fallback_status_codes"])
+            check_type(argname="argument selection_criteria", value=selection_criteria, expected_type=type_hints["selection_criteria"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "fallback_origin": fallback_origin,
             "primary_origin": primary_origin,
         }
         if fallback_status_codes is not None:
             self._values["fallback_status_codes"] = fallback_status_codes
+        if selection_criteria is not None:
+            self._values["selection_criteria"] = selection_criteria
 
     @builtins.property
     def fallback_origin(self) -> _IOrigin_83d4c1fa:
@@ -2423,6 +2476,17 @@ class OriginGroupProps:
         result = self._values.get("fallback_status_codes")
         return typing.cast(typing.Optional[typing.List[jsii.Number]], result)
 
+    @builtins.property
+    def selection_criteria(self) -> typing.Optional[_OriginSelectionCriteria_ba6d3e21]:
+        '''The selection criteria for the origin group.
+
+        :default: - OriginSelectionCriteria.DEFAULT
+
+        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html#concept_origin_groups.creating
+        '''
+        result = self._values.get("selection_criteria")
+        return typing.cast(typing.Optional[_OriginSelectionCriteria_ba6d3e21], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -3171,7 +3235,13 @@ class S3BucketOriginWithOACProps(S3BucketOriginBaseProps):
 
             my_bucket = s3.Bucket(self, "myBucket")
             s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
-                origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.WRITE, cloudfront.AccessLevel.DELETE]
+                origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.LIST]
+            )
+            cloudfront.Distribution(self, "distribution",
+                default_behavior=cloudfront.BehaviorOptions(
+                    origin=s3_origin
+                ),
+                default_root_object="index.html"
             )
         '''
         if __debug__:
@@ -4404,6 +4474,7 @@ def _typecheckingstub__3d6baf80fcac5a22fc2c985c83f9022e23b11075b338c076ac86172ff
     fallback_origin: _IOrigin_83d4c1fa,
     primary_origin: _IOrigin_83d4c1fa,
     fallback_status_codes: typing.Optional[typing.Sequence[jsii.Number]] = None,
+    selection_criteria: typing.Optional[_OriginSelectionCriteria_ba6d3e21] = None,
 ) -> None:
     """Type checking stubs"""
     pass

aws_cdk/aws_cloudtrail/__init__.py

@@ -1170,7 +1170,7 @@ class CfnDashboard(
             *,
             query_statement: builtins.str,
             query_parameters: typing.Optional[typing.Sequence[builtins.str]] = None,
-            view_properties: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, builtins.str]]] = None,
+            view_properties: typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]] = None,
         ) -> None:
             '''Contains information about a widget on a CloudTrail Lake dashboard.
 
@@ -1239,7 +1239,7 @@ class CfnDashboard(
         @builtins.property
         def view_properties(
             self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, builtins.str]]]:
+        ) -> typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]]:
             '''The view properties for the widget.
 
             For more information about view properties, see `View properties for widgets <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-widget-properties.html>`_ in the *AWS CloudTrail User Guide* .
@@ -1247,7 +1247,7 @@ class CfnDashboard(
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-dashboard-widget.html#cfn-cloudtrail-dashboard-widget-viewproperties
             '''
             result = self._values.get("view_properties")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, builtins.str]]], result)
+            return typing.cast(typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -5277,7 +5277,7 @@ def _typecheckingstub__dc8abf1361e0023c8b0a4cba28dced78eff4f36aa3c868efa3feed153
     *,
     query_statement: builtins.str,
     query_parameters: typing.Optional[typing.Sequence[builtins.str]] = None,
-    view_properties: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, builtins.str]]] = None,
+    view_properties: typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]] = None,
 ) -> None:
     """Type checking stubs"""
     pass

aws_cdk/aws_cloudwatch/__init__.py

@@ -1194,7 +1194,7 @@ class AlarmStatusWidgetProps:
         :param alarms: CloudWatch Alarms to show in widget.
         :param height: Height of the widget. Default: 3
         :param sort_by: Specifies how to sort the alarms in the widget. Default: - alphabetical order
-        :param states: Use this field to filter the list of alarms displayed in the widget to only those alarms currently in the specified states. You can specify one or more alarm states in the value for this field. The alarm states that you can specify are ALARM, INSUFFICIENT_DATA, and OK. If you omit this field or specify an empty array, all the alarms specifed in alarms are displayed. Default: - all the alarms specified in alarms are displayed.
+        :param states: Use this field to filter the list of alarms displayed in the widget to only those alarms currently in the specified states. You can specify one or more alarm states in the value for this field. The alarm states that you can specify are ALARM, INSUFFICIENT_DATA, and OK. If you omit this field or specify an empty array, all the alarms specified in alarms are displayed. Default: - all the alarms specified in alarms are displayed.
         :param title: The title of the widget. Default: 'Alarm Status'
         :param width: Width of the widget, in a grid of 24 units wide. Default: 6
 
@@ -1265,7 +1265,7 @@ class AlarmStatusWidgetProps:
         You can specify one or more alarm states in the value for this field.
         The alarm states that you can specify are ALARM, INSUFFICIENT_DATA, and OK.
 
-        If you omit this field or specify an empty array, all the alarms specifed in alarms are displayed.
+        If you omit this field or specify an empty array, all the alarms specified in alarms are displayed.
 
         :default: - all the alarms specified in alarms are displayed.
         '''
@@ -10847,19 +10847,23 @@ class Statistic(enum.Enum):
 
     Example::
 
-        # matchmaking_rule_set: gamelift.MatchmakingRuleSet
+        import aws_cdk.aws_cloudwatch as cloudwatch
         
-        # Alarm that triggers when the per-second average of not placed matches exceed 10%
-        rule_evaluation_ratio = cloudwatch.MathExpression(
-            expression="1 - (ruleEvaluationsPassed / ruleEvaluationsFailed)",
+        # delivery_stream: firehose.DeliveryStream
+        
+        
+        # Alarm that triggers when the per-second average of incoming bytes exceeds 90% of the current service limit
+        incoming_bytes_percent_of_limit = cloudwatch.MathExpression(
+            expression="incomingBytes / 300 / bytePerSecLimit",
             using_metrics={
-                "rule_evaluations_passed": matchmaking_rule_set.metric_rule_evaluations_passed(statistic=cloudwatch.Statistic.SUM),
-                "rule_evaluations_failed": matchmaking_rule_set.metric("ruleEvaluationsFailed")
+                "incoming_bytes": delivery_stream.metric_incoming_bytes(statistic=cloudwatch.Statistic.SUM),
+                "byte_per_sec_limit": delivery_stream.metric("BytesPerSecondLimit")
             }
         )
+        
         cloudwatch.Alarm(self, "Alarm",
-            metric=rule_evaluation_ratio,
-            threshold=0.1,
+            metric=incoming_bytes_percent_of_limit,
+            threshold=0.9,
             evaluation_periods=3
         )
     '''
@@ -12590,31 +12594,29 @@ class AlarmProps(CreateAlarmOptions):
 
         Example::
 
-            import aws_cdk.aws_cloudwatch as cloudwatch
+            # log_group: logs.LogGroup
             
-            # alias: lambda.Alias
+            mf = logs.MetricFilter(self, "MetricFilter",
+                log_group=log_group,
+                metric_namespace="MyApp",
+                metric_name="Latency",
+                filter_pattern=logs.FilterPattern.exists("$.latency"),
+                metric_value="$.latency",
+                dimensions={
+                    "ErrorCode": "$.errorCode"
+                },
+                unit=cloudwatch.Unit.MILLISECONDS
+            )
             
-            # or add alarms to an existing group
-            # blue_green_alias: lambda.Alias
+            # expose a metric from the metric filter
+            metric = mf.metric()
             
-            alarm = cloudwatch.Alarm(self, "Errors",
-                comparison_operator=cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-                threshold=1,
-                evaluation_periods=1,
-                metric=alias.metric_errors()
-            )
-            deployment_group = codedeploy.LambdaDeploymentGroup(self, "BlueGreenDeployment",
-                alias=alias,
-                deployment_config=codedeploy.LambdaDeploymentConfig.LINEAR_10PERCENT_EVERY_1MINUTE,
-                alarms=[alarm
-                ]
+            # you can use the metric to create a new alarm
+            cloudwatch.Alarm(self, "alarm from metric filter",
+                metric=metric,
+                threshold=100,
+                evaluation_periods=2
             )
-            deployment_group.add_alarm(cloudwatch.Alarm(self, "BlueGreenErrors",
-                comparison_operator=cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-                threshold=1,
-                evaluation_periods=1,
-                metric=blue_green_alias.metric_errors()
-            ))
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b2e7c873c118fbc1f6cf26e1bb5bd3d8549040c626a6450f2d686bb07b87266b)
@@ -14628,7 +14630,7 @@ class AlarmStatusWidget(
         :param alarms: CloudWatch Alarms to show in widget.
         :param height: Height of the widget. Default: 3
         :param sort_by: Specifies how to sort the alarms in the widget. Default: - alphabetical order
-        :param states: Use this field to filter the list of alarms displayed in the widget to only those alarms currently in the specified states. You can specify one or more alarm states in the value for this field. The alarm states that you can specify are ALARM, INSUFFICIENT_DATA, and OK. If you omit this field or specify an empty array, all the alarms specifed in alarms are displayed. Default: - all the alarms specified in alarms are displayed.
+        :param states: Use this field to filter the list of alarms displayed in the widget to only those alarms currently in the specified states. You can specify one or more alarm states in the value for this field. The alarm states that you can specify are ALARM, INSUFFICIENT_DATA, and OK. If you omit this field or specify an empty array, all the alarms specified in alarms are displayed. Default: - all the alarms specified in alarms are displayed.
         :param title: The title of the widget. Default: 'Alarm Status'
         :param width: Width of the widget, in a grid of 24 units wide. Default: 6
         '''
@@ -14859,31 +14861,29 @@ class Alarm(
 
     Example::
 
-        import aws_cdk.aws_cloudwatch as cloudwatch
+        # log_group: logs.LogGroup
         
-        # alias: lambda.Alias
+        mf = logs.MetricFilter(self, "MetricFilter",
+            log_group=log_group,
+            metric_namespace="MyApp",
+            metric_name="Latency",
+            filter_pattern=logs.FilterPattern.exists("$.latency"),
+            metric_value="$.latency",
+            dimensions={
+                "ErrorCode": "$.errorCode"
+            },
+            unit=cloudwatch.Unit.MILLISECONDS
+        )
         
-        # or add alarms to an existing group
-        # blue_green_alias: lambda.Alias
+        # expose a metric from the metric filter
+        metric = mf.metric()
         
-        alarm = cloudwatch.Alarm(self, "Errors",
-            comparison_operator=cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-            threshold=1,
-            evaluation_periods=1,
-            metric=alias.metric_errors()
-        )
-        deployment_group = codedeploy.LambdaDeploymentGroup(self, "BlueGreenDeployment",
-            alias=alias,
-            deployment_config=codedeploy.LambdaDeploymentConfig.LINEAR_10PERCENT_EVERY_1MINUTE,
-            alarms=[alarm
-            ]
+        # you can use the metric to create a new alarm
+        cloudwatch.Alarm(self, "alarm from metric filter",
+            metric=metric,
+            threshold=100,
+            evaluation_periods=2
         )
-        deployment_group.add_alarm(cloudwatch.Alarm(self, "BlueGreenErrors",
-            comparison_operator=cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-            threshold=1,
-            evaluation_periods=1,
-            metric=blue_green_alias.metric_errors()
-        ))
     '''
 
     def __init__(

aws_cdk/aws_codedeploy/__init__.py

@@ -5893,7 +5893,7 @@ class EcsBlueGreenDeploymentConfig:
         :param listener: The load balancer listener used to serve production traffic and to shift production traffic from the 'blue' ECS task set to the 'green' ECS task set during a blue-green deployment.
         :param deployment_approval_wait_time: Specify how long CodeDeploy waits for approval to continue a blue-green deployment before it stops the deployment. After provisioning the 'green' ECS task set and re-routing test traffic, CodeDeploy can wait for approval before continuing the deployment and re-routing production traffic. During this wait time, validation such as manual testing or running integration tests can occur using the test traffic port, prior to exposing the new 'green' task set to production traffic. To approve the deployment, validation steps use the CodeDeploy [ContinueDeployment API(https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ContinueDeployment.html). If the ContinueDeployment API is not called within the wait time period, CodeDeploy will stop the deployment. By default, CodeDeploy will not wait for deployment approval. After re-routing test traffic to the 'green' ECS task set and running any 'AfterAllowTestTraffic' and 'BeforeAllowTraffic' lifecycle hooks, the deployment will immediately re-route production traffic to the 'green' ECS task set. Default: 0
         :param termination_wait_time: Specify how long CodeDeploy waits before it terminates the original 'blue' ECS task set when a blue-green deployment is complete. During this wait time, CodeDeploy will continue to monitor any CloudWatch alarms specified for the deployment group, and the deployment group can be configured to automatically roll back if those alarms fire. Once CodeDeploy begins to terminate the 'blue' ECS task set, the deployment can no longer be rolled back, manually or automatically. By default, the deployment will immediately terminate the 'blue' ECS task set after production traffic is successfully routed to the 'green' ECS task set. Default: 0
-        :param test_listener: The load balancer listener used to route test traffic to the 'green' ECS task set during a blue-green deployment. During a blue-green deployment, validation can occur after test traffic has been re-routed and before production traffic has been re-routed to the 'green' ECS task set. You can specify one or more Lambda funtions in the deployment's AppSpec file that run during the AfterAllowTestTraffic hook. The functions can run validation tests. If a validation test fails, a deployment rollback is triggered. If the validation tests succeed, the next hook in the deployment lifecycle, BeforeAllowTraffic, is triggered. If a test listener is not specified, the deployment will proceed to routing the production listener to the 'green' ECS task set and will skip the AfterAllowTestTraffic hook. Default: No test listener will be added
+        :param test_listener: The load balancer listener used to route test traffic to the 'green' ECS task set during a blue-green deployment. During a blue-green deployment, validation can occur after test traffic has been re-routed and before production traffic has been re-routed to the 'green' ECS task set. You can specify one or more Lambda functions in the deployment's AppSpec file that run during the AfterAllowTestTraffic hook. The functions can run validation tests. If a validation test fails, a deployment rollback is triggered. If the validation tests succeed, the next hook in the deployment lifecycle, BeforeAllowTraffic, is triggered. If a test listener is not specified, the deployment will proceed to routing the production listener to the 'green' ECS task set and will skip the AfterAllowTestTraffic hook. Default: No test listener will be added
 
         :see: https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-ecs
         :exampleMetadata: infused
@@ -6008,7 +6008,7 @@ class EcsBlueGreenDeploymentConfig:
         '''The load balancer listener used to route test traffic to the 'green' ECS task set during a blue-green deployment.
 
         During a blue-green deployment, validation can occur after test traffic has been re-routed and before production
-        traffic has been re-routed to the 'green' ECS task set.  You can specify one or more Lambda funtions in the
+        traffic has been re-routed to the 'green' ECS task set.  You can specify one or more Lambda functions in the
         deployment's AppSpec file that run during the AfterAllowTestTraffic hook. The functions can run validation tests.
         If a validation test fails, a deployment rollback is triggered. If the validation tests succeed, the next hook in
         the deployment lifecycle, BeforeAllowTraffic, is triggered.