aws-cdk-lib 2.185.0__py3-none-any.whl → 2.187.0__py3-none-any.whl

aws_cdk/aws_gamelift/__init__.py

@@ -478,7 +478,7 @@ class CfnBuild(
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: A descriptive label that is associated with a build. Build names do not need to be unique.
-        :param operating_system: The operating system that your game server binaries run on. This value determines the type of fleet resources that you use for this build. If your game build contains multiple executables, they all must run on the same operating system. You must specify a valid operating system in this request. There is no default value. You can't change a build's operating system later. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/https://aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
+        :param operating_system: The operating system that your game server binaries run on. This value determines the type of fleet resources that you use for this build. If your game build contains multiple executables, they all must run on the same operating system. You must specify a valid operating system in this request. There is no default value. You can't change a build's operating system later. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
         :param server_sdk_version: A server SDK version you used when integrating your game server build with Amazon GameLift Servers. For more information see `Integrate games with custom game servers <https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-custom-intro.html>`_ . By default Amazon GameLift Servers sets this value to ``4.0.2`` .
         :param storage_location: Information indicating where your game build files are stored. Use this parameter only when creating a build with files stored in an Amazon S3 bucket that you own. The storage location must specify an Amazon S3 bucket name and key. The location must also specify a role ARN that you set up to allow Amazon GameLift Servers to access your Amazon S3 bucket. The S3 bucket and your new build must be in the same Region. If a ``StorageLocation`` is specified, the size of your file can be found in your Amazon S3 bucket. Amazon GameLift Servers will report a ``SizeOnDisk`` of 0.
         :param version: Version information that is associated with this build. Version strings do not need to be unique.
@@ -750,7 +750,7 @@ class CfnBuildProps:
         '''Properties for defining a ``CfnBuild``.
 
         :param name: A descriptive label that is associated with a build. Build names do not need to be unique.
-        :param operating_system: The operating system that your game server binaries run on. This value determines the type of fleet resources that you use for this build. If your game build contains multiple executables, they all must run on the same operating system. You must specify a valid operating system in this request. There is no default value. You can't change a build's operating system later. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/https://aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
+        :param operating_system: The operating system that your game server binaries run on. This value determines the type of fleet resources that you use for this build. If your game build contains multiple executables, they all must run on the same operating system. You must specify a valid operating system in this request. There is no default value. You can't change a build's operating system later. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
         :param server_sdk_version: A server SDK version you used when integrating your game server build with Amazon GameLift Servers. For more information see `Integrate games with custom game servers <https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-custom-intro.html>`_ . By default Amazon GameLift Servers sets this value to ``4.0.2`` .
         :param storage_location: Information indicating where your game build files are stored. Use this parameter only when creating a build with files stored in an Amazon S3 bucket that you own. The storage location must specify an Amazon S3 bucket name and key. The location must also specify a role ARN that you set up to allow Amazon GameLift Servers to access your Amazon S3 bucket. The S3 bucket and your new build must be in the same Region. If a ``StorageLocation`` is specified, the size of your file can be found in your Amazon S3 bucket. Amazon GameLift Servers will report a ``SizeOnDisk`` of 0.
         :param version: Version information that is associated with this build. Version strings do not need to be unique.
@@ -816,7 +816,7 @@ class CfnBuildProps:
         This value determines the type of fleet resources that you use for this build. If your game build contains multiple executables, they all must run on the same operating system. You must specify a valid operating system in this request. There is no default value. You can't change a build's operating system later.
         .. epigraph::
 
-           Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/https://aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
+           Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-gamelift-build.html#cfn-gamelift-build-operatingsystem
         '''
@@ -2928,7 +2928,7 @@ class CfnContainerGroupDefinition(
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: A descriptive identifier for the container group definition. The name value is unique in an AWS Region.
-        :param operating_system: The platform that all containers in the container group definition run on. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/https://aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
+        :param operating_system: The platform that all containers in the container group definition run on. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
         :param total_memory_limit_mebibytes: The amount of memory (in MiB) on a fleet instance to allocate for the container group. All containers in the group share these resources. You can set a limit for each container definition in the group. If individual containers have limits, this total value must be greater than any individual container's memory limit.
         :param total_vcpu_limit: The amount of vCPU units on a fleet instance to allocate for the container group (1 vCPU is equal to 1024 CPU units). All containers in the group share these resources. You can set a limit for each container definition in the group. If individual containers have limits, this total value must be equal to or greater than the sum of the limits for each container in the group.
         :param container_group_type: The type of container group. Container group type determines how Amazon GameLift Servers deploys the container group on each fleet instance.
@@ -4278,7 +4278,7 @@ class CfnContainerGroupDefinitionProps:
         '''Properties for defining a ``CfnContainerGroupDefinition``.
 
         :param name: A descriptive identifier for the container group definition. The name value is unique in an AWS Region.
-        :param operating_system: The platform that all containers in the container group definition run on. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/https://aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
+        :param operating_system: The platform that all containers in the container group definition run on. .. epigraph:: Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
         :param total_memory_limit_mebibytes: The amount of memory (in MiB) on a fleet instance to allocate for the container group. All containers in the group share these resources. You can set a limit for each container definition in the group. If individual containers have limits, this total value must be greater than any individual container's memory limit.
         :param total_vcpu_limit: The amount of vCPU units on a fleet instance to allocate for the container group (1 vCPU is equal to 1024 CPU units). All containers in the group share these resources. You can set a limit for each container definition in the group. If individual containers have limits, this total value must be equal to or greater than the sum of the limits for each container in the group.
         :param container_group_type: The type of container group. Container group type determines how Amazon GameLift Servers deploys the container group on each fleet instance.
@@ -4433,7 +4433,7 @@ class CfnContainerGroupDefinitionProps:
 
         .. epigraph::
 
-           Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/https://aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
+           Amazon Linux 2 (AL2) will reach end of support on 6/30/2025. See more details in the `Amazon Linux 2 FAQs <https://docs.aws.amazon.com/aws.amazon.com/amazon-linux-2/faqs/>`_ . For game servers that are hosted on AL2 and use server SDK version 4.x for Amazon GameLift Servers, first update the game server build to server SDK 5.x, and then deploy to AL2023 instances. See `Migrate to server SDK version 5. <https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk5-migration.html>`_
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-gamelift-containergroupdefinition.html#cfn-gamelift-containergroupdefinition-operatingsystem
         '''
@@ -7897,7 +7897,7 @@ class CfnGameSessionQueue(
         :param player_latency_policies: A set of policies that enforce a sliding cap on player latency when processing game sessions placement requests. Use multiple policies to gradually relax the cap over time if Amazon GameLift Servers can't make a placement. Policies are evaluated in order starting with the lowest maximum latency value.
         :param priority_configuration: Custom settings to use when prioritizing destinations and locations for game session placements. This configuration replaces the FleetIQ default prioritization process. Priority types that are not explicitly named will be automatically applied at the end of the prioritization process.
         :param tags: A list of labels to assign to the new game session queue resource. Tags are developer-defined key-value pairs. Tagging AWS resources are useful for resource management, access management and cost allocation. For more information, see `Tagging AWS Resources <https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html>`_ in the *AWS General Reference* . Once the resource is created, you can use TagResource, UntagResource, and ListTagsForResource to add, remove, and view tags. The maximum tag limit may be lower than stated. See the AWS General Reference for actual tagging limits.
-        :param timeout_in_seconds: The maximum time, in seconds, that a new game session placement request remains in the queue. When a request exceeds this time, the game session placement changes to a ``TIMED_OUT`` status.
+        :param timeout_in_seconds: The maximum time, in seconds, that a new game session placement request remains in the queue. When a request exceeds this time, the game session placement changes to a ``TIMED_OUT`` status. If you don't specify a request timeout, the queue uses a default value.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__2435e37790a5987d49478948c0c1ac36c9e463fa29441c46ba0aa4d567f2c585)
@@ -8390,7 +8390,7 @@ class CfnGameSessionQueue(
             Changing the priority order will affect how game sessions are placed.
 
             :param location_order: The prioritization order to use for fleet locations, when the ``PriorityOrder`` property includes ``LOCATION`` . Locations can include AWS Region codes (such as ``us-west-2`` ), local zones, and custom locations (for Anywhere fleets). Each location must be listed only once. For details, see `Amazon GameLift Servers service locations. <https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-regions.html>`_
-            :param priority_order: A custom sequence to use when prioritizing where to place new game sessions. Each priority type is listed once. - ``LATENCY`` -- Amazon GameLift Servers prioritizes locations where the average player latency is lowest. Player latency data is provided in each game session placement request. - ``COST`` -- Amazon GameLift Servers prioritizes destinations with the lowest current hosting costs. Cost is evaluated based on the location, instance type, and fleet type (Spot or On-Demand) of each destination in the queue. - ``DESTINATION`` -- Amazon GameLift Servers prioritizes based on the list order of destinations in the queue configuration. - ``LOCATION`` -- Amazon GameLift Servers prioritizes based on the provided order of locations, as defined in ``LocationOrder`` .
+            :param priority_order: A custom sequence to use when prioritizing where to place new game sessions. Each priority type is listed once. - ``LATENCY`` -- Amazon GameLift Servers prioritizes locations where the average player latency is lowest. Player latency data is provided in each game session placement request. - ``COST`` -- Amazon GameLift Servers prioritizes queue destinations with the lowest current hosting costs. Cost is evaluated based on the destination's location, instance type, and fleet type (Spot or On-Demand). - ``DESTINATION`` -- Amazon GameLift Servers prioritizes based on the list order of destinations in the queue configuration. - ``LOCATION`` -- Amazon GameLift Servers prioritizes based on the provided order of locations, as defined in ``LocationOrder`` .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-gamelift-gamesessionqueue-priorityconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -8432,7 +8432,7 @@ class CfnGameSessionQueue(
             '''A custom sequence to use when prioritizing where to place new game sessions. Each priority type is listed once.
 
             - ``LATENCY`` -- Amazon GameLift Servers prioritizes locations where the average player latency is lowest. Player latency data is provided in each game session placement request.
-            - ``COST`` -- Amazon GameLift Servers prioritizes destinations with the lowest current hosting costs. Cost is evaluated based on the location, instance type, and fleet type (Spot or On-Demand) of each destination in the queue.
+            - ``COST`` -- Amazon GameLift Servers prioritizes queue destinations with the lowest current hosting costs. Cost is evaluated based on the destination's location, instance type, and fleet type (Spot or On-Demand).
             - ``DESTINATION`` -- Amazon GameLift Servers prioritizes based on the list order of destinations in the queue configuration.
             - ``LOCATION`` -- Amazon GameLift Servers prioritizes based on the provided order of locations, as defined in ``LocationOrder`` .
 
@@ -8492,7 +8492,7 @@ class CfnGameSessionQueueProps:
         :param player_latency_policies: A set of policies that enforce a sliding cap on player latency when processing game sessions placement requests. Use multiple policies to gradually relax the cap over time if Amazon GameLift Servers can't make a placement. Policies are evaluated in order starting with the lowest maximum latency value.
         :param priority_configuration: Custom settings to use when prioritizing destinations and locations for game session placements. This configuration replaces the FleetIQ default prioritization process. Priority types that are not explicitly named will be automatically applied at the end of the prioritization process.
         :param tags: A list of labels to assign to the new game session queue resource. Tags are developer-defined key-value pairs. Tagging AWS resources are useful for resource management, access management and cost allocation. For more information, see `Tagging AWS Resources <https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html>`_ in the *AWS General Reference* . Once the resource is created, you can use TagResource, UntagResource, and ListTagsForResource to add, remove, and view tags. The maximum tag limit may be lower than stated. See the AWS General Reference for actual tagging limits.
-        :param timeout_in_seconds: The maximum time, in seconds, that a new game session placement request remains in the queue. When a request exceeds this time, the game session placement changes to a ``TIMED_OUT`` status.
+        :param timeout_in_seconds: The maximum time, in seconds, that a new game session placement request remains in the queue. When a request exceeds this time, the game session placement changes to a ``TIMED_OUT`` status. If you don't specify a request timeout, the queue uses a default value.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-gamelift-gamesessionqueue.html
         :exampleMetadata: fixture=_generated
@@ -8660,7 +8660,7 @@ class CfnGameSessionQueueProps:
     def timeout_in_seconds(self) -> typing.Optional[jsii.Number]:
         '''The maximum time, in seconds, that a new game session placement request remains in the queue.
 
-        When a request exceeds this time, the game session placement changes to a ``TIMED_OUT`` status.
+        When a request exceeds this time, the game session placement changes to a ``TIMED_OUT`` status. If you don't specify a request timeout, the queue uses a default value.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-gamelift-gamesessionqueue.html#cfn-gamelift-gamesessionqueue-timeoutinseconds
         '''

aws_cdk/aws_iam/__init__.py

@@ -7378,6 +7378,87 @@ class Grant(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.aws_iam.Grant"):
         detach_grant = volume.grant_detach_volume_by_resource_tag(instance.grant_principal, [instance])
     '''
 
+    @jsii.member(jsii_name="addStatementToResourcePolicy")
+    @builtins.classmethod
+    def add_statement_to_resource_policy(
+        cls,
+        *,
+        statement: "PolicyStatement",
+        resource: "IResourceWithPolicy",
+        resource_self_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
+        actions: typing.Sequence[builtins.str],
+        grantee: "IGrantable",
+        resource_arns: typing.Sequence[builtins.str],
+        conditions: typing.Optional[typing.Mapping[builtins.str, typing.Mapping[builtins.str, typing.Any]]] = None,
+    ) -> "Grant":
+        '''Add a pre-constructed policy statement to the resource's policy.
+
+        This method provides direct, low-level control over the initial policy statement being added.
+        It is useful when you need to:
+
+        - Add complex policy statements that can't be expressed through other grant methods
+        - Specify the initial structure of the policy statement
+        - Add statements with custom conditions or other advanced IAM features
+
+        Important differences from other grant methods:
+
+        - Only modifies the resource policy, never modifies any principal's policy
+        - Takes a complete PolicyStatement rather than constructing one from parameters
+        - Always attempts to add the statement, regardless of principal type or account
+        - Does not attempt any automatic principal/resource policy selection logic
+
+        Note: The final form of the policy statement in the resource's policy may differ
+        from the provided statement, depending on the resource's implementation of
+        addToResourcePolicy.
+
+        :param statement: The policy statement to add to the resource's policy. This statement will be passed to the resource's addToResourcePolicy method. The actual handling of the statement depends on the specific IResourceWithPolicy implementation.
+        :param resource: The resource with a resource policy. The statement will be added to the resource policy if it couldn't be added to the principal policy.
+        :param resource_self_arns: When referring to the resource in a resource policy, use this as ARN. (Depending on the resource type, this needs to be '*' in a resource policy). Default: Same as regular resource ARNs
+        :param actions: The actions to grant.
+        :param grantee: The principal to grant to. Default: if principal is undefined, no work is done.
+        :param resource_arns: The resource ARNs to grant to.
+        :param conditions: Any conditions to attach to the grant. Default: - No conditions
+
+        :return: A Grant object representing the result of the operation
+
+        Example::
+
+            # grantee: iam.IGrantable
+            # actions: List[str]
+            # resource_arns: List[str]
+            # bucket: s3.Bucket
+            
+            
+            statement = iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                actions=actions,
+                principals=[iam.ServicePrincipal("lambda.amazonaws.com")],
+                conditions={
+                    "StringEquals": {
+                        "aws:SourceAccount": Stack.of(self).account
+                    }
+                }
+            )
+            iam.Grant.add_statement_to_resource_policy(
+                grantee=grantee,
+                actions=actions,
+                resource_arns=resource_arns,
+                resource=bucket,
+                statement=statement
+            )
+        '''
+        options = GrantPolicyWithResourceOptions(
+            statement=statement,
+            resource=resource,
+            resource_self_arns=resource_self_arns,
+            actions=actions,
+            grantee=grantee,
+            resource_arns=resource_arns,
+            conditions=conditions,
+        )
+
+        return typing.cast("Grant", jsii.sinvoke(cls, "addStatementToResourcePolicy", [options]))
+
     @jsii.member(jsii_name="addToPrincipal")
     @builtins.classmethod
     def add_to_principal(
@@ -12043,6 +12124,175 @@ class AccessKey(
         return typing.cast(_SecretValue_3dd0ddae, jsii.get(self, "secretAccessKey"))
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_iam.GrantPolicyWithResourceOptions",
+    jsii_struct_bases=[GrantWithResourceOptions],
+    name_mapping={
+        "actions": "actions",
+        "grantee": "grantee",
+        "resource_arns": "resourceArns",
+        "conditions": "conditions",
+        "resource": "resource",
+        "resource_self_arns": "resourceSelfArns",
+        "statement": "statement",
+    },
+)
+class GrantPolicyWithResourceOptions(GrantWithResourceOptions):
+    def __init__(
+        self,
+        *,
+        actions: typing.Sequence[builtins.str],
+        grantee: IGrantable,
+        resource_arns: typing.Sequence[builtins.str],
+        conditions: typing.Optional[typing.Mapping[builtins.str, typing.Mapping[builtins.str, typing.Any]]] = None,
+        resource: IResourceWithPolicy,
+        resource_self_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
+        statement: PolicyStatement,
+    ) -> None:
+        '''Options for a grant operation that directly adds a policy statement to a resource.
+
+        This differs from GrantWithResourceOptions in that it requires a pre-constructed
+        PolicyStatement rather than constructing one from individual permissions.
+        Use this when you need fine-grained control over the initial policy statement's contents.
+
+        :param actions: The actions to grant.
+        :param grantee: The principal to grant to. Default: if principal is undefined, no work is done.
+        :param resource_arns: The resource ARNs to grant to.
+        :param conditions: Any conditions to attach to the grant. Default: - No conditions
+        :param resource: The resource with a resource policy. The statement will be added to the resource policy if it couldn't be added to the principal policy.
+        :param resource_self_arns: When referring to the resource in a resource policy, use this as ARN. (Depending on the resource type, this needs to be '*' in a resource policy). Default: Same as regular resource ARNs
+        :param statement: The policy statement to add to the resource's policy. This statement will be passed to the resource's addToResourcePolicy method. The actual handling of the statement depends on the specific IResourceWithPolicy implementation.
+
+        :exampleMetadata: infused
+
+        Example::
+
+            # grantee: iam.IGrantable
+            # actions: List[str]
+            # resource_arns: List[str]
+            # bucket: s3.Bucket
+            
+            
+            statement = iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                actions=actions,
+                principals=[iam.ServicePrincipal("lambda.amazonaws.com")],
+                conditions={
+                    "StringEquals": {
+                        "aws:SourceAccount": Stack.of(self).account
+                    }
+                }
+            )
+            iam.Grant.add_statement_to_resource_policy(
+                grantee=grantee,
+                actions=actions,
+                resource_arns=resource_arns,
+                resource=bucket,
+                statement=statement
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0475ec23892b6dacf8e0426b204cca68a4091056bb08c20a72dbc06d2aedcf5e)
+            check_type(argname="argument actions", value=actions, expected_type=type_hints["actions"])
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+            check_type(argname="argument resource_arns", value=resource_arns, expected_type=type_hints["resource_arns"])
+            check_type(argname="argument conditions", value=conditions, expected_type=type_hints["conditions"])
+            check_type(argname="argument resource", value=resource, expected_type=type_hints["resource"])
+            check_type(argname="argument resource_self_arns", value=resource_self_arns, expected_type=type_hints["resource_self_arns"])
+            check_type(argname="argument statement", value=statement, expected_type=type_hints["statement"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "actions": actions,
+            "grantee": grantee,
+            "resource_arns": resource_arns,
+            "resource": resource,
+            "statement": statement,
+        }
+        if conditions is not None:
+            self._values["conditions"] = conditions
+        if resource_self_arns is not None:
+            self._values["resource_self_arns"] = resource_self_arns
+
+    @builtins.property
+    def actions(self) -> typing.List[builtins.str]:
+        '''The actions to grant.'''
+        result = self._values.get("actions")
+        assert result is not None, "Required property 'actions' is missing"
+        return typing.cast(typing.List[builtins.str], result)
+
+    @builtins.property
+    def grantee(self) -> IGrantable:
+        '''The principal to grant to.
+
+        :default: if principal is undefined, no work is done.
+        '''
+        result = self._values.get("grantee")
+        assert result is not None, "Required property 'grantee' is missing"
+        return typing.cast(IGrantable, result)
+
+    @builtins.property
+    def resource_arns(self) -> typing.List[builtins.str]:
+        '''The resource ARNs to grant to.'''
+        result = self._values.get("resource_arns")
+        assert result is not None, "Required property 'resource_arns' is missing"
+        return typing.cast(typing.List[builtins.str], result)
+
+    @builtins.property
+    def conditions(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, typing.Mapping[builtins.str, typing.Any]]]:
+        '''Any conditions to attach to the grant.
+
+        :default: - No conditions
+        '''
+        result = self._values.get("conditions")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Mapping[builtins.str, typing.Any]]], result)
+
+    @builtins.property
+    def resource(self) -> IResourceWithPolicy:
+        '''The resource with a resource policy.
+
+        The statement will be added to the resource policy if it couldn't be
+        added to the principal policy.
+        '''
+        result = self._values.get("resource")
+        assert result is not None, "Required property 'resource' is missing"
+        return typing.cast(IResourceWithPolicy, result)
+
+    @builtins.property
+    def resource_self_arns(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''When referring to the resource in a resource policy, use this as ARN.
+
+        (Depending on the resource type, this needs to be '*' in a resource policy).
+
+        :default: Same as regular resource ARNs
+        '''
+        result = self._values.get("resource_self_arns")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def statement(self) -> PolicyStatement:
+        '''The policy statement to add to the resource's policy.
+
+        This statement will be passed to the resource's addToResourcePolicy method.
+        The actual handling of the statement depends on the specific IResourceWithPolicy
+        implementation.
+        '''
+        result = self._values.get("statement")
+        assert result is not None, "Required property 'statement' is missing"
+        return typing.cast(PolicyStatement, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "GrantPolicyWithResourceOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.interface(jsii_type="aws-cdk-lib.aws_iam.IAssumeRolePrincipal")
 class IAssumeRolePrincipal(IPrincipal, typing_extensions.Protocol):
     '''A type of principal that has more control over its own representation in AssumeRolePolicyDocuments.
@@ -15106,6 +15356,7 @@ __all__ = [
     "Grant",
     "GrantOnPrincipalAndResourceOptions",
     "GrantOnPrincipalOptions",
+    "GrantPolicyWithResourceOptions",
     "GrantWithResourceOptions",
     "Group",
     "GroupProps",
@@ -16886,6 +17137,19 @@ def _typecheckingstub__604f514db426465dbc092293e7b2e46f5358ddb17770a96f51ef7e6a5
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__0475ec23892b6dacf8e0426b204cca68a4091056bb08c20a72dbc06d2aedcf5e(
+    *,
+    actions: typing.Sequence[builtins.str],
+    grantee: IGrantable,
+    resource_arns: typing.Sequence[builtins.str],
+    conditions: typing.Optional[typing.Mapping[builtins.str, typing.Mapping[builtins.str, typing.Any]]] = None,
+    resource: IResourceWithPolicy,
+    resource_self_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
+    statement: PolicyStatement,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__2773dd1c98b9bb45b356173892f3248a430e55c5ab0a22cb6e5df0bcdaa898a5(
     document: PolicyDocument,
 ) -> None:

aws_cdk/aws_identitystore/__init__.py

@@ -72,7 +72,7 @@ class CfnGroup(
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_identitystore.CfnGroup",
 ):
-    '''A group object, which contains a specified group’s metadata and attributes.
+    '''A group object that contains the metadata and attributes for a specified group.
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-identitystore-group.html
     :cloudformationResource: AWS::IdentityStore::Group
@@ -107,7 +107,7 @@ class CfnGroup(
         :param id: Construct identifier for this resource (unique in its scope).
         :param display_name: The display name value for the group. The length limit is 1,024 characters. This value can consist of letters, accented characters, symbols, numbers, punctuation, tab, new line, carriage return, space, and nonbreaking space in this attribute. This value is specified at the time the group is created and stored as an attribute of the group object in the identity store. Prefix search supports a maximum of 1,000 characters for the string.
         :param identity_store_id: The globally unique identifier for the identity store.
-        :param description: A string containing the description of the group.
+        :param description: A string containing a description of the specified group.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__37e27ff46dfa4082cad1981cc4ade1e2a9ce445cf9aad4a8eb75e162b9b429f1)
@@ -154,7 +154,7 @@ class CfnGroup(
     @builtins.property
     @jsii.member(jsii_name="attrGroupId")
     def attr_group_id(self) -> builtins.str:
-        '''The identifier of the newly created group in the identity store.
+        '''The identifier for a group in the identity store.
 
         :cloudformationAttribute: GroupId
         '''
@@ -194,7 +194,7 @@ class CfnGroup(
     @builtins.property
     @jsii.member(jsii_name="description")
     def description(self) -> typing.Optional[builtins.str]:
-        '''A string containing the description of the group.'''
+        '''A string containing a description of the specified group.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "description"))
 
     @description.setter
@@ -211,7 +211,9 @@ class CfnGroupMembership(
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_identitystore.CfnGroupMembership",
 ):
-    '''Contains the identifiers for a group, a group member, and a ``GroupMembership`` object in the identity store.
+    '''Creates a relationship between a member and a group.
+
+    The following identifiers must be specified: ``GroupId`` , ``IdentityStoreId`` , and ``MemberId`` .
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-identitystore-groupmembership.html
     :cloudformationResource: AWS::IdentityStore::GroupMembership
@@ -246,7 +248,7 @@ class CfnGroupMembership(
         :param id: Construct identifier for this resource (unique in its scope).
         :param group_id: The identifier for a group in the identity store.
         :param identity_store_id: The globally unique identifier for the identity store.
-        :param member_id: An object containing the identifier of a group member. Setting ``MemberId`` 's ``UserId`` field to a specific User's ID indicates we should consider that User as a group member.
+        :param member_id: An object that contains the identifier of a group member. Setting the ``UserID`` field to the specific identifier for a user indicates that the user is a member of the group.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__76d55a804ce565c6f3a413944bff86b3236786318808951cf53ad4eff71316db)
@@ -291,7 +293,7 @@ class CfnGroupMembership(
     @builtins.property
     @jsii.member(jsii_name="attrMembershipId")
     def attr_membership_id(self) -> builtins.str:
-        '''The identifier for a ``GroupMembership`` in the identity store.
+        '''The identifier for a ``GroupMembership`` object in an identity store.
 
         :cloudformationAttribute: MembershipId
         '''
@@ -333,7 +335,7 @@ class CfnGroupMembership(
     def member_id(
         self,
     ) -> typing.Union[_IResolvable_da3f097b, "CfnGroupMembership.MemberIdProperty"]:
-        '''An object containing the identifier of a group member.'''
+        '''An object that contains the identifier of a group member.'''
         return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnGroupMembership.MemberIdProperty"], jsii.get(self, "memberId"))
 
     @member_id.setter
@@ -353,9 +355,7 @@ class CfnGroupMembership(
     )
     class MemberIdProperty:
         def __init__(self, *, user_id: builtins.str) -> None:
-            '''An object that contains the identifier of a group member.
-
-            Setting the ``UserID`` field to the specific identifier for a user indicates that the user is a member of the group.
+            '''An object containing the identifier of a group member.
 
             :param user_id: An object containing the identifiers of resources that can be members.
 
@@ -422,7 +422,7 @@ class CfnGroupMembershipProps:
 
         :param group_id: The identifier for a group in the identity store.
         :param identity_store_id: The globally unique identifier for the identity store.
-        :param member_id: An object containing the identifier of a group member. Setting ``MemberId`` 's ``UserId`` field to a specific User's ID indicates we should consider that User as a group member.
+        :param member_id: An object that contains the identifier of a group member. Setting the ``UserID`` field to the specific identifier for a user indicates that the user is a member of the group.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-identitystore-groupmembership.html
         :exampleMetadata: fixture=_generated
@@ -476,9 +476,9 @@ class CfnGroupMembershipProps:
     def member_id(
         self,
     ) -> typing.Union[_IResolvable_da3f097b, CfnGroupMembership.MemberIdProperty]:
-        '''An object containing the identifier of a group member.
+        '''An object that contains the identifier of a group member.
 
-        Setting ``MemberId`` 's ``UserId`` field to a specific User's ID indicates we should consider that User as a group member.
+        Setting the ``UserID`` field to the specific identifier for a user indicates that the user is a member of the group.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-identitystore-groupmembership.html#cfn-identitystore-groupmembership-memberid
         '''
@@ -519,7 +519,7 @@ class CfnGroupProps:
 
         :param display_name: The display name value for the group. The length limit is 1,024 characters. This value can consist of letters, accented characters, symbols, numbers, punctuation, tab, new line, carriage return, space, and nonbreaking space in this attribute. This value is specified at the time the group is created and stored as an attribute of the group object in the identity store. Prefix search supports a maximum of 1,000 characters for the string.
         :param identity_store_id: The globally unique identifier for the identity store.
-        :param description: A string containing the description of the group.
+        :param description: A string containing a description of the specified group.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-identitystore-group.html
         :exampleMetadata: fixture=_generated
@@ -576,7 +576,7 @@ class CfnGroupProps:
 
     @builtins.property
     def description(self) -> typing.Optional[builtins.str]:
-        '''A string containing the description of the group.
+        '''A string containing a description of the specified group.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-identitystore-group.html#cfn-identitystore-group-description
         '''