aws-cdk-lib 2.189.0__tar.gz → 2.190.0__tar.gz

{aws_cdk_lib-2.189.0/src/aws_cdk_lib.egg-info → aws_cdk_lib-2.190.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: aws-cdk-lib
-Version: 2.189.0
+Version: 2.190.0
 Summary: Version 2 of the AWS Cloud Development Kit library
 Home-page: https://github.com/aws/aws-cdk
 Author: Amazon Web Services

{aws_cdk_lib-2.189.0 → aws_cdk_lib-2.190.0}/setup.py

@@ -5,7 +5,7 @@ kwargs = json.loads(
     """
 {
     "name": "aws-cdk-lib",
-    "version": "2.189.0",
+    "version": "2.190.0",
     "description": "Version 2 of the AWS Cloud Development Kit library",
     "license": "Apache-2.0",
     "url": "https://github.com/aws/aws-cdk",
@@ -319,7 +319,7 @@ kwargs = json.loads(
     ],
     "package_data": {
         "aws_cdk._jsii": [
-            "aws-cdk-lib@2.189.0.jsii.tgz"
+            "aws-cdk-lib@2.190.0.jsii.tgz"
         ],
         "aws_cdk": [
             "py.typed"

{aws_cdk_lib-2.189.0 → aws_cdk_lib-2.190.0}/src/aws_cdk/__init__.py

@@ -22975,7 +22975,7 @@ class Stage(
         :param id: -
         :param env: Default AWS environment (account/region) for ``Stack``s in this ``Stage``. Stacks defined inside this ``Stage`` with either ``region`` or ``account`` missing from its env will use the corresponding field given here. If either ``region`` or ``account``is is not configured for ``Stack`` (either on the ``Stack`` itself or on the containing ``Stage``), the Stack will be *environment-agnostic*. Environment-agnostic stacks can be deployed to any environment, may not be able to take advantage of all features of the CDK. For example, they will not be able to use environmental context lookups, will not automatically translate Service Principals to the right format based on the environment's AWS partition, and other such enhancements. Default: - The environments should be configured on the ``Stack``s.
         :param outdir: The output directory into which to emit synthesized artifacts. Can only be specified if this stage is the root stage (the app). If this is specified and this stage is nested within another stage, an error will be thrown. Default: - for nested stages, outdir will be determined as a relative directory to the outdir of the app. For apps, if outdir is not specified, a temporary directory will be created.
-        :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Default: - no permissions boundary is applied
+        :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Be aware that this feature uses Aspects, and the Aspects are applied at the Stack level with a priority of ``MUTATING`` (if the feature flag ``@aws-cdk/core:aspectPrioritiesMutating`` is set) or ``DEFAULT`` (if the flag is not set). This is relevant if you are both using your own Aspects to assign Permissions Boundaries, as well as specifying this property. The Aspect added by this property will overwrite the Permissions Boundary assigned by your own Aspect if both: (a) your Aspect has a lower or equal priority to the automatic Aspect, and (b) your Aspect is applied *above* the Stack level. If either of those conditions are not true, your own Aspect will win. We recommend assigning Permissions Boundaries only using the provided APIs, and not using custom Aspects. Default: - no permissions boundary is applied
         :param policy_validation_beta1: Validation plugins to run during synthesis. If any plugin reports any violation, synthesis will be interrupted and the report displayed to the user. Default: - no validation plugins are used
         :param stage_name: Name of this stage. Default: - Derived from the id.
         '''
@@ -23141,7 +23141,7 @@ class StageProps:
 
         :param env: Default AWS environment (account/region) for ``Stack``s in this ``Stage``. Stacks defined inside this ``Stage`` with either ``region`` or ``account`` missing from its env will use the corresponding field given here. If either ``region`` or ``account``is is not configured for ``Stack`` (either on the ``Stack`` itself or on the containing ``Stage``), the Stack will be *environment-agnostic*. Environment-agnostic stacks can be deployed to any environment, may not be able to take advantage of all features of the CDK. For example, they will not be able to use environmental context lookups, will not automatically translate Service Principals to the right format based on the environment's AWS partition, and other such enhancements. Default: - The environments should be configured on the ``Stack``s.
         :param outdir: The output directory into which to emit synthesized artifacts. Can only be specified if this stage is the root stage (the app). If this is specified and this stage is nested within another stage, an error will be thrown. Default: - for nested stages, outdir will be determined as a relative directory to the outdir of the app. For apps, if outdir is not specified, a temporary directory will be created.
-        :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Default: - no permissions boundary is applied
+        :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Be aware that this feature uses Aspects, and the Aspects are applied at the Stack level with a priority of ``MUTATING`` (if the feature flag ``@aws-cdk/core:aspectPrioritiesMutating`` is set) or ``DEFAULT`` (if the flag is not set). This is relevant if you are both using your own Aspects to assign Permissions Boundaries, as well as specifying this property. The Aspect added by this property will overwrite the Permissions Boundary assigned by your own Aspect if both: (a) your Aspect has a lower or equal priority to the automatic Aspect, and (b) your Aspect is applied *above* the Stack level. If either of those conditions are not true, your own Aspect will win. We recommend assigning Permissions Boundaries only using the provided APIs, and not using custom Aspects. Default: - no permissions boundary is applied
         :param policy_validation_beta1: Validation plugins to run during synthesis. If any plugin reports any violation, synthesis will be interrupted and the report displayed to the user. Default: - no validation plugins are used
         :param stage_name: Name of this stage. Default: - Derived from the id.
 
@@ -23242,6 +23242,20 @@ class StageProps:
     def permissions_boundary(self) -> typing.Optional[PermissionsBoundary]:
         '''Options for applying a permissions boundary to all IAM Roles and Users created within this Stage.
 
+        Be aware that this feature uses Aspects, and the Aspects are applied at the
+        Stack level with a priority of ``MUTATING`` (if the feature flag
+        ``@aws-cdk/core:aspectPrioritiesMutating`` is set) or ``DEFAULT`` (if the flag
+        is not set). This is relevant if you are both using your own Aspects to
+        assign Permissions Boundaries, as well as specifying this property.  The
+        Aspect added by this property will overwrite the Permissions Boundary
+        assigned by your own Aspect if both: (a) your Aspect has a lower or equal
+        priority to the automatic Aspect, and (b) your Aspect is applied *above*
+        the Stack level.  If either of those conditions are not true, your own
+        Aspect will win.
+
+        We recommend assigning Permissions Boundaries only using the provided APIs,
+        and not using custom Aspects.
+
         :default: - no permissions boundary is applied
         '''
         result = self._values.get("permissions_boundary")

{aws_cdk_lib-2.189.0 → aws_cdk_lib-2.190.0}/src/aws_cdk/_jsii/__init__.py

@@ -34,7 +34,7 @@ import aws_cdk.cloud_assembly_schema._jsii
 import constructs._jsii
 
 __jsii_assembly__ = jsii.JSIIAssembly.load(
-    "aws-cdk-lib", "2.189.0", __name__[0:-6], "aws-cdk-lib@2.189.0.jsii.tgz"
+    "aws-cdk-lib", "2.190.0", __name__[0:-6], "aws-cdk-lib@2.190.0.jsii.tgz"
 )
 
 __all__ = [

{aws_cdk_lib-2.189.0 → aws_cdk_lib-2.190.0}/src/aws_cdk/aws_acmpca/__init__.py

@@ -2311,7 +2311,7 @@ class CfnCertificateAuthority(
         :param subject: Structure that contains X.500 distinguished name information for your private CA.
         :param type: Type of your private CA.
         :param csr_extensions: Specifies information to be added to the extension section of the certificate signing request (CSR).
-        :param key_storage_security_standard: Specifies a cryptographic key management compliance standard used for handling CA keys. Default: FIPS_140_2_LEVEL_3_OR_HIGHER .. epigraph:: Some AWS Regions do not support the default. When creating a CA in these Regions, you must provide ``FIPS_140_2_LEVEL_2_OR_HIGHER`` as the argument for ``KeyStorageSecurityStandard`` . Failure to do this results in an ``InvalidArgsException`` with the message, "A certificate authority cannot be created in this region with the specified security standard." For information about security standard support in various Regions, see `Storage and security compliance of AWS Private CA private keys <https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys>`_ .
+        :param key_storage_security_standard: Specifies a cryptographic key management compliance standard for handling and protecting CA keys. Default: FIPS_140_2_LEVEL_3_OR_HIGHER .. epigraph:: Some AWS Regions don't support the default value. When you create a CA in these Regions, you must use ``CCPC_LEVEL_1_OR_HIGHER`` for the ``KeyStorageSecurityStandard`` parameter. If you don't, the operation returns an ``InvalidArgsException`` with this message: "A certificate authority cannot be created in this region with the specified security standard." For information about security standard support in different AWS Regions, see `Storage and security compliance of AWS Private CA private keys <https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys>`_ .
         :param revocation_configuration: Information about the Online Certificate Status Protocol (OCSP) configuration or certificate revocation list (CRL) created and maintained by your private CA.
         :param tags: Key-value pairs that will be attached to the new private CA. You can associate up to 50 tags with a private CA. For information using tags with IAM to manage permissions, see `Controlling Access Using IAM Tags <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html>`_ .
         :param usage_mode: Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. The default value is GENERAL_PURPOSE.
@@ -2471,7 +2471,7 @@ class CfnCertificateAuthority(
     @builtins.property
     @jsii.member(jsii_name="keyStorageSecurityStandard")
     def key_storage_security_standard(self) -> typing.Optional[builtins.str]:
-        '''Specifies a cryptographic key management compliance standard used for handling CA keys.'''
+        '''Specifies a cryptographic key management compliance standard for handling and protecting CA keys.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "keyStorageSecurityStandard"))
 
     @key_storage_security_standard.setter
@@ -4575,7 +4575,7 @@ class CfnCertificateAuthorityProps:
         :param subject: Structure that contains X.500 distinguished name information for your private CA.
         :param type: Type of your private CA.
         :param csr_extensions: Specifies information to be added to the extension section of the certificate signing request (CSR).
-        :param key_storage_security_standard: Specifies a cryptographic key management compliance standard used for handling CA keys. Default: FIPS_140_2_LEVEL_3_OR_HIGHER .. epigraph:: Some AWS Regions do not support the default. When creating a CA in these Regions, you must provide ``FIPS_140_2_LEVEL_2_OR_HIGHER`` as the argument for ``KeyStorageSecurityStandard`` . Failure to do this results in an ``InvalidArgsException`` with the message, "A certificate authority cannot be created in this region with the specified security standard." For information about security standard support in various Regions, see `Storage and security compliance of AWS Private CA private keys <https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys>`_ .
+        :param key_storage_security_standard: Specifies a cryptographic key management compliance standard for handling and protecting CA keys. Default: FIPS_140_2_LEVEL_3_OR_HIGHER .. epigraph:: Some AWS Regions don't support the default value. When you create a CA in these Regions, you must use ``CCPC_LEVEL_1_OR_HIGHER`` for the ``KeyStorageSecurityStandard`` parameter. If you don't, the operation returns an ``InvalidArgsException`` with this message: "A certificate authority cannot be created in this region with the specified security standard." For information about security standard support in different AWS Regions, see `Storage and security compliance of AWS Private CA private keys <https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys>`_ .
         :param revocation_configuration: Information about the Online Certificate Status Protocol (OCSP) configuration or certificate revocation list (CRL) created and maintained by your private CA.
         :param tags: Key-value pairs that will be attached to the new private CA. You can associate up to 50 tags with a private CA. For information using tags with IAM to manage permissions, see `Controlling Access Using IAM Tags <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html>`_ .
         :param usage_mode: Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. The default value is GENERAL_PURPOSE.
@@ -4694,14 +4694,14 @@ class CfnCertificateAuthorityProps:
 
     @builtins.property
     def key_storage_security_standard(self) -> typing.Optional[builtins.str]:
-        '''Specifies a cryptographic key management compliance standard used for handling CA keys.
+        '''Specifies a cryptographic key management compliance standard for handling and protecting CA keys.
 
         Default: FIPS_140_2_LEVEL_3_OR_HIGHER
         .. epigraph::
 
-           Some AWS Regions do not support the default. When creating a CA in these Regions, you must provide ``FIPS_140_2_LEVEL_2_OR_HIGHER`` as the argument for ``KeyStorageSecurityStandard`` . Failure to do this results in an ``InvalidArgsException`` with the message, "A certificate authority cannot be created in this region with the specified security standard."
+           Some AWS Regions don't support the default value. When you create a CA in these Regions, you must use ``CCPC_LEVEL_1_OR_HIGHER`` for the ``KeyStorageSecurityStandard`` parameter. If you don't, the operation returns an ``InvalidArgsException`` with this message: "A certificate authority cannot be created in this region with the specified security standard."
 
-           For information about security standard support in various Regions, see `Storage and security compliance of AWS Private CA private keys <https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys>`_ .
+           For information about security standard support in different AWS Regions, see `Storage and security compliance of AWS Private CA private keys <https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys>`_ .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-acmpca-certificateauthority.html#cfn-acmpca-certificateauthority-keystoragesecuritystandard
         '''