aws-cdk-lib 2.195.0__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/__init__.py

@@ -155,6 +155,76 @@ MyStack(app, "MyStack",
 For more information on bootstrapping accounts and customizing synthesis,
 see [Bootstrapping in the CDK Developer Guide](https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html).
 
+### STS Role Options
+
+You can configure STS options that instruct the CDK CLI on which configuration should it use when assuming
+the various roles that are involved in a deployment operation.
+
+Refer to [the bootstrapping guide](https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping-env.html#bootstrapping-env-roles) for further context.
+
+These options are available via the `DefaultStackSynthesizer` properties:
+
+```python
+class MyStack(Stack):
+    def __init__(self, scope, id, *, description=None, env=None, stackName=None, tags=None, notificationArns=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None, suppressTemplateIndentation=None, propertyInjectors=None):
+        super().__init__(scope, id,
+            (SpreadAssignment ...props
+              description=description, env=env, stackName=stackName, tags=tags, notificationArns=notificationArns, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary, suppressTemplateIndentation=suppressTemplateIndentation, propertyInjectors=propertyInjectors),
+            synthesizer=DefaultStackSynthesizer(
+                deploy_role_external_id="",
+                deploy_role_additional_options={},
+                file_asset_publishing_external_id="",
+                file_asset_publishing_role_additional_options={},
+                image_asset_publishing_external_id="",
+                image_asset_publishing_role_additional_options={},
+                lookup_role_external_id="",
+                lookup_role_additional_options={}
+            )
+        )
+```
+
+> Note that the `*additionalOptions` property does not allow passing `ExternalId` or `RoleArn`, as these options
+> have dedicated properties that configure them.
+
+#### Session Tags
+
+STS session tags are used to implement [Attribute-Based Access Control](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html) (ABAC).
+
+See [IAM tutorial: Define permissions to access AWS resources based on tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html).
+
+You can pass session tags for each [role created during bootstrap](https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping-env.html#bootstrapping-env-roles) via the `*additionalOptions` property:
+
+```python
+class MyStack(Stack):
+    def __init__(self, parent, id, *, description=None, env=None, stackName=None, tags=None, notificationArns=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None, suppressTemplateIndentation=None, propertyInjectors=None):
+        super().__init__(parent, id,
+            (SpreadAssignment ...props
+              description=description, env=env, stackName=stackName, tags=tags, notificationArns=notificationArns, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary, suppressTemplateIndentation=suppressTemplateIndentation, propertyInjectors=propertyInjectors),
+            synthesizer=DefaultStackSynthesizer(
+                deploy_role_additional_options={
+                    "Tags": [{"Key": "Department", "Value": "Engineering"}]
+                },
+                file_asset_publishing_role_additional_options={
+                    "Tags": [{"Key": "Department", "Value": "Engineering"}]
+                },
+                image_asset_publishing_role_additional_options={
+                    "Tags": [{"Key": "Department", "Value": "Engineering"}]
+                },
+                lookup_role_additional_options={
+                    "Tags": [{"Key": "Department", "Value": "Engineering"}]
+                }
+            )
+        )
+```
+
+This will cause the CDK CLI to include session tags when assuming each of these roles during deployment.
+Note that the trust policy of the role must contain permissions for the `sts:TagSession` action.
+
+Refer to the [IAM user guide on session tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_permissions-required).
+
+* If you are using a custom bootstrap template, make sure the template includes these permissions.
+* If you are using the default bootstrap template from a CDK version lower than XXXX, you will need to rebootstrap your enviroment (once).
+
 ## Nested Stacks
 
 [Nested stacks](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-nested-stacks.html) are stacks created as part of other stacks. You create a nested stack within another stack by using the `NestedStack` construct.
@@ -173,8 +243,8 @@ class MyNestedStack(cfn.NestedStack):
         s3.Bucket(self, "NestedBucket")
 
 class MyParentStack(Stack):
-    def __init__(self, scope, id, *, description=None, env=None, stackName=None, tags=None, notificationArns=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None, suppressTemplateIndentation=None):
-        super().__init__(scope, id, description=description, env=env, stackName=stackName, tags=tags, notificationArns=notificationArns, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary, suppressTemplateIndentation=suppressTemplateIndentation)
+    def __init__(self, scope, id, *, description=None, env=None, stackName=None, tags=None, notificationArns=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None, suppressTemplateIndentation=None, propertyInjectors=None):
+        super().__init__(scope, id, description=description, env=env, stackName=stackName, tags=tags, notificationArns=notificationArns, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary, suppressTemplateIndentation=suppressTemplateIndentation, propertyInjectors=propertyInjectors)
 
         MyNestedStack(self, "Nested1")
         MyNestedStack(self, "Nested2")
@@ -397,6 +467,8 @@ CloudFormation to re-read the secret.
 `SecretValue.ssmSecure()` is only supported for a limited set of resources.
 [Click here for a list of supported resources and properties](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#template-parameters-dynamic-patterns-resources).
 
+`SecretValue.cfnDynamicReferenceKey` takes the same parameters as `SecretValue.secretsManager` and returns a key which can be used within a [dynamic reference](#dynamic-references) to dynamically load a secret from AWS Secrets Manager.
+
 ## ARN manipulation
 
 Sometimes you will need to put together or pick apart Amazon Resource Names
@@ -521,6 +593,8 @@ CustomResource(self, "MyMagicalResource",
     resource_type="Custom::MyCustomResource",  # must start with 'Custom::'
 
     # the resource properties
+    # properties like serviceToken or serviceTimeout are ported into properties automatically
+    # try not to use key names similar to these or there will be a risk of overwriting those values
     properties={
         "Property1": "foo",
         "Property2": "bar"
@@ -529,7 +603,10 @@ CustomResource(self, "MyMagicalResource",
     # the ARN of the provider (SNS/Lambda) which handles
     # CREATE, UPDATE or DELETE events for this resource type
     # see next section for details
-    service_token="ARN"
+    service_token="ARN",
+
+    # the maximum time, in seconds, that can elapse before a custom resource operation times out.
+    service_timeout=Duration.seconds(60)
 )
 ```
 
@@ -559,7 +636,7 @@ Legend:
 * **Language**: which programming languages can be used to implement handlers.
 * **Footprint**: how many resources are used by the provider framework itself.
 
-**A NOTE ABOUT SINGLETONS**
+#### A note about singletons
 
 When defining resources for a custom resource provider, you will likely want to
 define them as a *stack singleton* so that only a single instance of the
@@ -824,6 +901,18 @@ CfnOutput(self, "OutputName",
 )
 ```
 
+You can also use the `exportValue` method to export values as stack outputs:
+
+```python
+# stack: Stack
+
+
+stack.export_value(my_bucket.bucket_name,
+    name="TheAwesomeBucket",
+    description="The name of an S3 bucket"
+)
+```
+
 ### Parameters
 
 CloudFormation templates support the use of [Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html) to
@@ -935,7 +1024,7 @@ The properties passed to the level 2 constructs `AutoScalingGroup` and `Instance
 `aws-ec2` module abstract what is passed into the `CfnOption` properties `resourceSignal` and
 `autoScalingCreationPolicy`, but when using level 1 constructs you can specify these yourself.
 
-The CfnWaitCondition resource from the `aws-cloudformation` module suppports the `resourceSignal`.
+The CfnWaitCondition resource from the `aws-cloudformation` module supports the `resourceSignal`.
 The format of the timeout is `PT#H#M#S`. In the example below AWS Cloudformation will wait for
 3 success signals to occur within 15 minutes before the status of the resource will be set to
 `CREATE_COMPLETE`.
@@ -1105,6 +1194,74 @@ references is done using the `CfnDynamicReference` class:
 CfnDynamicReference(CfnDynamicReferenceService.SECRETS_MANAGER, "secret-id:secret-string:json-key:version-stage:version-id")
 ```
 
+## RemovalPolicies
+
+The `RemovalPolicies` class provides a convenient way to manage removal policies for AWS CDK resources within a construct scope. It allows you to apply removal policies to multiple resources at once, with options to include or exclude specific resource types.
+
+```python
+# scope: Construct
+# parent: Construct
+# bucket: s3.CfnBucket
+
+
+# Apply DESTROY policy to all resources in a scope
+RemovalPolicies.of(scope).destroy()
+
+# Apply RETAIN policy to all resources in a scope
+RemovalPolicies.of(scope).retain()
+
+# Apply SNAPSHOT policy to all resources in a scope
+RemovalPolicies.of(scope).snapshot()
+
+# Apply RETAIN_ON_UPDATE_OR_DELETE policy to all resources in a scope
+RemovalPolicies.of(scope).retain_on_update_or_delete()
+
+# Apply RETAIN policy only to specific resource types
+RemovalPolicies.of(parent).retain(
+    apply_to_resource_types=["AWS::DynamoDB::Table", bucket.cfn_resource_type, rds.CfnDBInstance.CFN_RESOURCE_TYPE_NAME
+    ]
+)
+
+# Apply SNAPSHOT policy excluding specific resource types
+RemovalPolicies.of(scope).snapshot(
+    exclude_resource_types=["AWS::Test::Resource"]
+)
+```
+
+### RemovalPolicies vs MissingRemovalPolicies
+
+CDK provides two different classes for managing removal policies:
+
+* RemovalPolicies: Always applies the specified removal policy, overriding any existing policies.
+* MissingRemovalPolicies: Applies the removal policy only to resources that don't already have a policy set.
+
+```python
+# Override any existing policies
+RemovalPolicies.of(scope).retain()
+
+# Only apply to resources without existing policies
+MissingRemovalPolicies.of(scope).retain()
+```
+
+### Aspect Priority
+
+Both RemovalPolicies and MissingRemovalPolicies are implemented as [Aspects](#aspects). You can control the order in which they're applied using the priority parameter:
+
+```python
+# stack: Stack
+
+
+# Apply in a specific order based on priority
+RemovalPolicies.of(stack).retain(priority=100)
+RemovalPolicies.of(stack).destroy(priority=200)
+```
+
+For RemovalPolicies, the policies are applied in order of aspect execution, with the last applied policy overriding previous ones. The priority only affects the order in which aspects are applied during synthesis.
+
+#### Note
+
+When using MissingRemovalPolicies with priority, a warning will be issued as this can lead to unexpected behavior. This is because MissingRemovalPolicies only applies to resources without existing policies, making priority less relevant.
+
 ### Template Options & Transform
 
 CloudFormation templates support a number of options, including which Macros or
@@ -1194,6 +1351,27 @@ stack = Stack(app, "StackName",
 )
 ```
 
+### Receiving CloudFormation Stack Events
+
+You can add one or more SNS Topic ARNs to any Stack:
+
+```python
+stack = Stack(app, "StackName",
+    notification_arns=["arn:aws:sns:us-east-1:123456789012:Topic"]
+)
+```
+
+Stack events will be sent to any SNS Topics in this list. These ARNs are added to those specified using
+the `--notification-arns` command line option.
+
+Note that in order to do delete notification ARNs entirely, you must pass an empty array ([]) instead of omitting it.
+If you omit the property, no action on existing ARNs will take place.
+
+> [!NOTE]
+> Adding the `notificationArns` property (or using the `--notification-arns` CLI options) will **override**
+> any existing ARNs configured on the stack. If you have an external system managing notification ARNs,
+> either migrate to use this mechanism, or avoid specfying notification ARNs with the CDK.
+
 ### CfnJson
 
 `CfnJson` allows you to postpone the resolution of a JSON blob from
@@ -1296,7 +1474,7 @@ App(
 cdk synth --context @aws-cdk/core:newStyleStackSynthesis=true
 ```
 
-*cdk.json*
+#### `cdk.json`
 
 ```json
 {
@@ -1306,7 +1484,7 @@ cdk synth --context @aws-cdk/core:newStyleStackSynthesis=true
 }
 ```
 
-*cdk.context.json*
+#### `cdk.context.json`
 
 ```json
 {
@@ -1314,7 +1492,7 @@ cdk synth --context @aws-cdk/core:newStyleStackSynthesis=true
 }
 ```
 
-*~/.cdk.json*
+#### `~/.cdk.json`
 
 ```json
 {
@@ -1353,7 +1531,7 @@ generated CloudFormation templates against your policies immediately after
 synthesis. If there are any violations, the synthesis will fail and a report
 will be printed to the console or to a file (see below).
 
-> **Note**
+> [!NOTE]
 > This feature is considered experimental, and both the plugin API and the
 > format of the validation report are subject to change in the future.
 
@@ -1391,7 +1569,7 @@ validation.
 > etc. It's your responsibility as the consumer of a plugin to verify that it is
 > secure to use.
 
-By default, the report will be printed in a human readable format. If you want a
+By default, the report will be printed in a human-readable format. If you want a
 report in JSON format, enable it using the `@aws-cdk/core:validationReportJson`
 context passing it directly to the application:
 
@@ -1405,6 +1583,18 @@ Alternatively, you can set this context key-value pair using the `cdk.json` or
 `cdk.context.json` files in your project directory (see
 [Runtime context](https://docs.aws.amazon.com/cdk/v2/guide/context.html)).
 
+It is also possible to enable both JSON and human-readable formats by setting
+`@aws-cdk/core:validationReportPrettyPrint` context key explicitly:
+
+```python
+app = App(
+    context={
+        "@aws-cdk/core:validationReportJson": True,
+        "@aws-cdk/core:validationReportPrettyPrint": True
+    }
+)
+```
+
 If you choose the JSON format, the CDK will print the policy validation report
 to a file called `policy-validation-report.json` in the cloud assembly
 directory. For the default, human-readable format, the report will be printed to
@@ -1499,6 +1689,216 @@ warning by the `id`.
 Annotations.of(self).acknowledge_warning("IAM:Group:MaxPoliciesExceeded", "Account has quota increased to 20")
 ```
 
+### Acknowledging Infos
+
+Informational messages can also be emitted and acknowledged. Use `addInfoV2()`
+to add an info message that can later be suppressed with `acknowledgeInfo()`.
+Unlike warnings, info messages are not affected by the `--strict` mode and will never cause synthesis to fail.
+
+```python
+Annotations.of(self).add_info_v2("my-lib:Construct.someInfo", "Some message explaining the info")
+Annotations.of(self).acknowledge_info("my-lib:Construct.someInfo", "This info can be ignored")
+```
+
+## Aspects
+
+[Aspects](https://docs.aws.amazon.com/cdk/v2/guide/aspects.html) is a feature in CDK that allows you to apply operations or transformations across all
+constructs in a construct tree. Common use cases include tagging resources, enforcing encryption on S3 Buckets, or applying specific security or
+compliance rules to all resources in a stack.
+
+Conceptually, there are two types of Aspects:
+
+* **Read-only aspects** scan the construct tree but do not make changes to the tree. Common use cases of read-only aspects include performing validations
+  (for example, enforcing that all S3 Buckets have versioning enabled) and logging (for example, collecting information about all deployed resources for
+  audits or compliance).
+* **Mutating aspects** either (1.) add new nodes or (2.) mutate existing nodes of the tree in-place. One commonly used mutating Aspect is adding Tags to
+  resources. An example of an Aspect that adds a node is one that automatically adds a security group to every EC2 instance in the construct tree if
+  no default is specified.
+
+Here is a simple example of creating and applying an Aspect on a Stack to enable versioning on all S3 Buckets:
+
+```python
+@jsii.implements(IAspect)
+class EnableBucketVersioning:
+    def visit(self, node):
+        if node instanceof s3.CfnBucket:
+            node.versioning_configuration = s3.CfnBucket.VersioningConfigurationProperty(
+                status="Enabled"
+            )
+
+app = App()
+stack = MyStack(app, "MyStack")
+
+# Apply the aspect to enable versioning on all S3 Buckets
+Aspects.of(stack).add(EnableBucketVersioning())
+```
+
+### Aspect Stabilization
+
+The modern behavior is that Aspects automatically run on newly added nodes to the construct tree. This is controlled by the
+flag `@aws-cdk/core:aspectStabilization`, which is default for new projects (since version 2.172.0).
+
+The old behavior of Aspects (without stabilization) was that Aspect invocation runs once on the entire construct
+tree. This meant that nested Aspects (Aspects that create new Aspects) are not invoked and nodes created by Aspects at a higher level of the construct tree are not visited.
+
+To enable the stabilization behavior for older versions, use this feature by putting the following into your `cdk.context.json`:
+
+```json
+{
+  "@aws-cdk/core:aspectStabilization": true
+}
+```
+
+### Aspect Priorities
+
+Users can specify the order in which Aspects are applied on a construct by using the optional priority parameter when applying an Aspect. Priority
+values must be non-negative integers, where a higher number means the Aspect will be applied later, and a lower number means it will be applied sooner.
+
+By default, newly created nodes always inherit aspects. Priorities are mainly for ordering between mutating aspects on the construct tree.
+
+CDK provides standard priority values for mutating and readonly aspects to help ensure consistency across different construct libraries.
+Note that Aspects that have same priority value are not guaranteed to be executed
+in a consistent order.
+
+```python
+#
+# Default Priority values for Aspects.
+#
+class AspectPriority:
+```
+
+If no priority is provided, the default value will be 500. This ensures that aspects without a specified priority run after mutating aspects but before
+any readonly aspects.
+
+Correctly applying Aspects with priority values ensures that mutating aspects (such as adding tags or resources) run before validation aspects. This allows users to avoid misconfigurations and ensure that the final
+construct tree is fully validated before being synthesized.
+
+### Applying Aspects with Priority
+
+```python
+@jsii.implements(IAspect)
+class MutatingAspect:
+    def visit(self, node):
+        pass
+
+@jsii.implements(IAspect)
+class ValidationAspect:
+    def visit(self, node):
+        pass
+
+stack = Stack()
+
+Aspects.of(stack).add(MutatingAspect(), priority=AspectPriority.MUTATING) # Run first (mutating aspects)
+Aspects.of(stack).add(ValidationAspect(), priority=AspectPriority.READONLY)
+```
+
+### Inspecting applied aspects and changing priorities
+
+We also give customers the ability to view all of their applied aspects and override the priority on these aspects.
+The `AspectApplication` class represents an Aspect that is applied to a node of the construct tree with a priority.
+
+Users can access AspectApplications on a node by calling `applied` from the Aspects class as follows:
+
+```python
+# root: Construct
+
+app = App()
+stack = MyStack(app, "MyStack")
+
+Aspects.of(stack).add(MyAspect())
+
+aspect_applications = Aspects.of(root).applied
+
+for aspect_application in aspect_applications:
+    # The aspect we are applying
+    print(aspect_application.aspect)
+    # The construct we are applying the aspect to
+    print(aspect_application.construct)
+    # The priority it was applied with
+    print(aspect_application.priority)
+
+    # Change the priority
+    aspect_application.priority = 700
+```
+
+## Blueprint Property Injection
+
+The goal of Blueprint Property Injection is to provide builders an automatic way to set default property values.
+
+Construct authors can declare that a Construct can have it properties injected by adding `@propertyInjectable`
+class decorator and specifying `PROPERTY_INJECTION_ID` readonly property.
+All L2 Constructs will support Property Injection so organizations can write injectors to set their Construct Props.
+
+Organizations can set default property values to a Construct by writing Injectors for builders to consume.
+
+Here is a simple example of an Injector for APiKey that sets enabled to false.
+
+```python
+@jsii.implements(IPropertyInjector)
+class ApiKeyPropsInjector:
+
+    def __init__(self):
+        self.construct_unique_id = api.ApiKey.PROPERTY_INJECTION_ID
+
+    def inject(self, original_props, *, scope, id):
+        return api.ApiKeyProps(
+            enabled=False,
+            api_key_name=original_props.api_key_name,
+            customer_id=original_props.customer_id,
+            default_cors_preflight_options=original_props.default_cors_preflight_options,
+            default_integration=original_props.default_integration,
+            default_method_options=original_props.default_method_options,
+            description=original_props.description,
+            generate_distinct_id=original_props.generate_distinct_id,
+            resources=original_props.resources,
+            stages=original_props.stages,
+            value=original_props.value
+        )
+```
+
+Some notes:
+
+* ApiKey must have a `PROPERTY_INJECTION_ID` property, in addition to having `@propertyInjectable` class decorator.
+* We set ApiKeyProps.enabled to false, if it is not provided; otherwise it would use the value that was passed in.
+* It is also possible to force ApiKeyProps.enabled to false, and not provide a way for the builders to overwrite it.
+
+Here is an example of how builders can use the injector the org created.
+
+```python
+stack = Stack(app, "my-stack",
+    property_injectors=[ApiKeyPropsInjector()]
+)
+api.ApiKey(stack, "my-api-key")
+```
+
+This is equivalent to:
+
+```python
+stack = Stack(app, "my-stack")
+api.ApiKey(stack, "my-api-key",
+    enabled=False
+)
+```
+
+Some notes:
+
+* We attach the injectors to Stack in this example, but we can also attach them to App or Stage.
+* All the ApiKey created in the scope of stack will get `enabled: false`.
+* Builders can overwrite the default value with `new ApiKey(stack, 'my-api-key', {enabled: true});`
+
+If you specify two or more injectors for the same Constructs, the last one is in effect.  In the example below, `ApiKeyPropsInjector` will never be applied.
+
+```python
+stack = Stack(app, "my-stack",
+    property_injectors=[
+        ApiKeyPropsInjector(),
+        AnotherApiKeyPropsInjector()
+    ]
+)
+```
+
+For more information, please see the [RFC](https://github.com/aws/aws-cdk-rfcs/blob/main/text/0693-property-injection.md).
+
 <!--END CORE DOCUMENTATION-->
 '''
 from pkgutil import extend_path
@@ -1560,6 +1960,48 @@ from .cx_api import (
     CloudAssembly as _CloudAssembly_c693643e,
     CloudAssemblyBuilder as _CloudAssemblyBuilder_c90cccf3,
 )
+from .interfaces import (
+    IEnvironmentAware as _IEnvironmentAware_f39049ee,
+    ResourceEnvironment as _ResourceEnvironment_603baf00,
+)
+from .interfaces.aws_cloudformation import (
+    CustomResourceReference as _CustomResourceReference_d8e366c9,
+    GuardHookReference as _GuardHookReference_9ad20ca0,
+    HookDefaultVersionReference as _HookDefaultVersionReference_11df53e8,
+    HookTypeConfigReference as _HookTypeConfigReference_ed91f4cb,
+    HookVersionReference as _HookVersionReference_3688b53a,
+    ICustomResourceRef as _ICustomResourceRef_337851e1,
+    IGuardHookRef as _IGuardHookRef_e0640792,
+    IHookDefaultVersionRef as _IHookDefaultVersionRef_a4784949,
+    IHookTypeConfigRef as _IHookTypeConfigRef_7bc118dc,
+    IHookVersionRef as _IHookVersionRef_0d71a867,
+    ILambdaHookRef as _ILambdaHookRef_5ceec28e,
+    IMacroRef as _IMacroRef_e9ae4afa,
+    IModuleDefaultVersionRef as _IModuleDefaultVersionRef_8f5f90c3,
+    IModuleVersionRef as _IModuleVersionRef_76485182,
+    IPublicTypeVersionRef as _IPublicTypeVersionRef_554ddaba,
+    IPublisherRef as _IPublisherRef_43e14b13,
+    IResourceDefaultVersionRef as _IResourceDefaultVersionRef_6bcf9f85,
+    IResourceVersionRef as _IResourceVersionRef_8fc1bbae,
+    IStackRef as _IStackRef_f0f1d363,
+    IStackSetRef as _IStackSetRef_3a202137,
+    ITypeActivationRef as _ITypeActivationRef_95db49a7,
+    IWaitConditionHandleRef as _IWaitConditionHandleRef_6fbe7b4b,
+    IWaitConditionRef as _IWaitConditionRef_5bc95657,
+    LambdaHookReference as _LambdaHookReference_1c262218,
+    MacroReference as _MacroReference_2603df14,
+    ModuleDefaultVersionReference as _ModuleDefaultVersionReference_6e4498de,
+    ModuleVersionReference as _ModuleVersionReference_16e9080f,
+    PublicTypeVersionReference as _PublicTypeVersionReference_da345091,
+    PublisherReference as _PublisherReference_2058d21f,
+    ResourceDefaultVersionReference as _ResourceDefaultVersionReference_878c9c7f,
+    ResourceVersionReference as _ResourceVersionReference_a8ae93f7,
+    StackReference as _StackReference_15f8b984,
+    StackSetReference as _StackSetReference_c5c1f82d,
+    TypeActivationReference as _TypeActivationReference_03c77595,
+    WaitConditionHandleReference as _WaitConditionHandleReference_ba26e35b,
+    WaitConditionReference as _WaitConditionReference_e2d94a43,
+)
 
 
 @jsii.data_type(
@@ -1709,6 +2151,31 @@ class Annotations(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Annotations"):
             check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
         return typing.cast("Annotations", jsii.sinvoke(cls, "of", [scope]))
 
+    @jsii.member(jsii_name="acknowledgeInfo")
+    def acknowledge_info(
+        self,
+        id: builtins.str,
+        message: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''Acknowledge a info. When a info is acknowledged for a scope all infos that match the id will be ignored.
+
+        The acknowledgement will apply to all child scopes
+
+        :param id: - the id of the info message to acknowledge.
+        :param message: optional message to explain the reason for acknowledgement.
+
+        Example::
+
+            # my_construct: Construct
+            
+            Annotations.of(my_construct).acknowledge_info("SomeInfoId", "This info can be ignored because...")
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__71c75ad95e6c491e615a0c0a9cc9bc5b538f2d93e7057612251cfc9592380513)
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument message", value=message, expected_type=type_hints["message"])
+        return typing.cast(None, jsii.invoke(self, "acknowledgeInfo", [id, message]))
+
     @jsii.member(jsii_name="acknowledgeWarning")
     def acknowledge_warning(
         self,
@@ -1779,6 +2246,29 @@ class Annotations(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Annotations"):
             check_type(argname="argument message", value=message, expected_type=type_hints["message"])
         return typing.cast(None, jsii.invoke(self, "addInfo", [message]))
 
+    @jsii.member(jsii_name="addInfoV2")
+    def add_info_v2(self, id: builtins.str, message: builtins.str) -> None:
+        '''Adds an acknowledgeable info metadata entry to this construct.
+
+        The CLI will display the info when an app is synthesized.
+
+        If the info is acknowledged using ``acknowledgeInfo()``, it will not be shown by the CLI.
+
+        :param id: the unique identifier for the info. This can be used to acknowledge the info
+        :param message: The info message.
+
+        Example::
+
+            # my_construct: Construct
+            
+            Annotations.of(my_construct).add_info_v2("my-library:Construct.someInfo", "Some message explaining the info")
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__843fb7798b96b5a06278ca94ba80d2ae0fb300672c44f21b2ee4d759a04bdba9)
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument message", value=message, expected_type=type_hints["message"])
+        return typing.cast(None, jsii.invoke(self, "addInfoV2", [id, message]))
+
     @jsii.member(jsii_name="addWarning")
     def add_warning(self, message: builtins.str) -> None:
         '''Adds a warning metadata entry to this construct. Prefer using ``addWarningV2``.
@@ -1834,6 +2324,7 @@ class Annotations(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Annotations"):
         "outdir": "outdir",
         "policy_validation_beta1": "policyValidationBeta1",
         "post_cli_context": "postCliContext",
+        "property_injectors": "propertyInjectors",
         "stack_traces": "stackTraces",
         "tree_metadata": "treeMetadata",
     },
@@ -1849,6 +2340,7 @@ class AppProps:
         outdir: typing.Optional[builtins.str] = None,
         policy_validation_beta1: typing.Optional[typing.Sequence["IPolicyValidationPluginBeta1"]] = None,
         post_cli_context: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+        property_injectors: typing.Optional[typing.Sequence["IPropertyInjector"]] = None,
         stack_traces: typing.Optional[builtins.bool] = None,
         tree_metadata: typing.Optional[builtins.bool] = None,
     ) -> None:
@@ -1861,6 +2353,7 @@ class AppProps:
         :param outdir: The output directory into which to emit synthesized artifacts. You should never need to set this value. By default, the value you pass to the CLI's ``--output`` flag will be used, and if you change it to a different directory the CLI will fail to pick up the generated Cloud Assembly. This property is intended for internal and testing use. Default: - If this value is *not* set, considers the environment variable ``CDK_OUTDIR``. If ``CDK_OUTDIR`` is not defined, uses a temp directory.
         :param policy_validation_beta1: Validation plugins to run after synthesis. Default: - no validation plugins
         :param post_cli_context: Additional context values for the application. Context provided here has precedence over context set by: - The CLI via --context - The ``context`` key in ``cdk.json`` - The ``AppProps.context`` property This property is recommended over the ``AppProps.context`` property since you can make final decision over which context value to take in your app. Context can be read from any construct using ``node.getContext(key)``. Default: - no additional context
+        :param property_injectors: A list of IPropertyInjector attached to this App. Default: - no PropertyInjectors
         :param stack_traces: Include construct creation stack trace in the ``aws:cdk:trace`` metadata key of all constructs. Default: true stack traces are included unless ``aws:cdk:disable-stack-trace`` is set in the context.
         :param tree_metadata: Include construct tree metadata as part of the Cloud Assembly. Default: true
 
@@ -1875,7 +2368,11 @@ class AppProps:
                 default_stack_synthesizer=AppStagingSynthesizer.default_resources(
                     app_id="my-app-id",
                     staging_bucket_encryption=BucketEncryption.S3_MANAGED,
-                    deployment_identities=DeploymentIdentities.cli_credentials()
+                    deployment_identities=DeploymentIdentities.specify_roles(
+                        cloud_formation_execution_role=BootstrapRole.from_role_arn("arn:aws:iam::123456789012:role/Execute"),
+                        deployment_role=BootstrapRole.from_role_arn("arn:aws:iam::123456789012:role/Deploy"),
+                        lookup_role=BootstrapRole.from_role_arn("arn:aws:iam::123456789012:role/Lookup")
+                    )
                 )
             )
         '''
@@ -1888,6 +2385,7 @@ class AppProps:
             check_type(argname="argument outdir", value=outdir, expected_type=type_hints["outdir"])
             check_type(argname="argument policy_validation_beta1", value=policy_validation_beta1, expected_type=type_hints["policy_validation_beta1"])
             check_type(argname="argument post_cli_context", value=post_cli_context, expected_type=type_hints["post_cli_context"])
+            check_type(argname="argument property_injectors", value=property_injectors, expected_type=type_hints["property_injectors"])
             check_type(argname="argument stack_traces", value=stack_traces, expected_type=type_hints["stack_traces"])
             check_type(argname="argument tree_metadata", value=tree_metadata, expected_type=type_hints["tree_metadata"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
@@ -1905,6 +2403,8 @@ class AppProps:
             self._values["policy_validation_beta1"] = policy_validation_beta1
         if post_cli_context is not None:
             self._values["post_cli_context"] = post_cli_context
+        if property_injectors is not None:
+            self._values["property_injectors"] = property_injectors
         if stack_traces is not None:
             self._values["stack_traces"] = stack_traces
         if tree_metadata is not None:
@@ -2026,6 +2526,15 @@ class AppProps:
         result = self._values.get("post_cli_context")
         return typing.cast(typing.Optional[typing.Mapping[builtins.str, typing.Any]], result)
 
+    @builtins.property
+    def property_injectors(self) -> typing.Optional[typing.List["IPropertyInjector"]]:
+        '''A list of IPropertyInjector attached to this App.
+
+        :default: - no PropertyInjectors
+        '''
+        result = self._values.get("property_injectors")
+        return typing.cast(typing.Optional[typing.List["IPropertyInjector"]], result)
+
     @builtins.property
     def stack_traces(self) -> typing.Optional[builtins.bool]:
         '''Include construct creation stack trace in the ``aws:cdk:trace`` metadata key of all constructs.
@@ -2362,7 +2871,7 @@ class ArnFormat(enum.Enum):
     like in 'arn:aws:cognito-sync:region:account:identitypool/us-east-1:1a1a1a1a-ffff-1111-9999-12345678:bla'.
     '''
     SLASH_RESOURCE_SLASH_RESOURCE_NAME = "SLASH_RESOURCE_SLASH_RESOURCE_NAME"
-    '''This represents a format where the 'resource' and 'resourceName' parts are seperated with a slash, but there is also an additional slash after the colon separating 'account' from 'resource'.
+    '''This represents a format where the 'resource' and 'resourceName' parts are separated with a slash, but there is also an additional slash after the colon separating 'account' from 'resource'.
 
     Like in: 'arn:aws:service:region:account:/resource/resourceName'.
     Note that the leading slash is *not* included in the parsed 'resource' part.
@@ -2452,17 +2961,24 @@ class AspectOptions:
 
         :param priority: The priority value to apply on an Aspect. Priority must be a non-negative integer. Aspects that have same priority value are not guaranteed to be executed in a consistent order. Default: AspectPriority.DEFAULT
 
-        :exampleMetadata: fixture=_generated
+        :exampleMetadata: infused
 
         Example::
 
-            # The code below shows an example of how to instantiate this type.
-            # The values are placeholders you should change.
-            import aws_cdk as cdk
+            @jsii.implements(IAspect)
+            class MutatingAspect:
+                def visit(self, node):
+                    pass
             
-            aspect_options = cdk.AspectOptions(
-                priority=123
-            )
+            @jsii.implements(IAspect)
+            class ValidationAspect:
+                def visit(self, node):
+                    pass
+            
+            stack = Stack()
+            
+            Aspects.of(stack).add(MutatingAspect(), priority=AspectPriority.MUTATING) # Run first (mutating aspects)
+            Aspects.of(stack).add(ValidationAspect(), priority=AspectPriority.READONLY)
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__1761263abda35b4b2f599d4ff5122c0e7ad15a95af4498d9c6e04e78bc4a4b76)
@@ -3407,6 +3923,7 @@ class Aws(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Aws"):
     name_mapping={
         "cloud_formation_execution_role_arn": "cloudFormationExecutionRoleArn",
         "deploy_role_arn": "deployRoleArn",
+        "qualifier": "qualifier",
     },
 )
 class BootstraplessSynthesizerProps:
@@ -3415,11 +3932,13 @@ class BootstraplessSynthesizerProps:
         *,
         cloud_formation_execution_role_arn: typing.Optional[builtins.str] = None,
         deploy_role_arn: typing.Optional[builtins.str] = None,
+        qualifier: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Construction properties of ``BootstraplessSynthesizer``.
 
         :param cloud_formation_execution_role_arn: The CFN execution Role ARN to use. Default: - No CloudFormation role (use CLI credentials)
         :param deploy_role_arn: The deploy Role ARN to use. Default: - No deploy role (use CLI credentials)
+        :param qualifier: The qualifier used to specialize strings. Can be used to specify custom bootstrapped role names Default: 'hnb659fds'
 
         :exampleMetadata: fixture=_generated
 
@@ -3431,18 +3950,22 @@ class BootstraplessSynthesizerProps:
             
             bootstrapless_synthesizer_props = cdk.BootstraplessSynthesizerProps(
                 cloud_formation_execution_role_arn="cloudFormationExecutionRoleArn",
-                deploy_role_arn="deployRoleArn"
+                deploy_role_arn="deployRoleArn",
+                qualifier="qualifier"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__3f56ec309bd76e41562731f3b986025649d4592e71caa79fed875d7020f66bfc)
             check_type(argname="argument cloud_formation_execution_role_arn", value=cloud_formation_execution_role_arn, expected_type=type_hints["cloud_formation_execution_role_arn"])
             check_type(argname="argument deploy_role_arn", value=deploy_role_arn, expected_type=type_hints["deploy_role_arn"])
+            check_type(argname="argument qualifier", value=qualifier, expected_type=type_hints["qualifier"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
         if cloud_formation_execution_role_arn is not None:
             self._values["cloud_formation_execution_role_arn"] = cloud_formation_execution_role_arn
         if deploy_role_arn is not None:
             self._values["deploy_role_arn"] = deploy_role_arn
+        if qualifier is not None:
+            self._values["qualifier"] = qualifier
 
     @builtins.property
     def cloud_formation_execution_role_arn(self) -> typing.Optional[builtins.str]:
@@ -3462,6 +3985,17 @@ class BootstraplessSynthesizerProps:
         result = self._values.get("deploy_role_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def qualifier(self) -> typing.Optional[builtins.str]:
+        '''The qualifier used to specialize strings.
+
+        Can be used to specify custom bootstrapped role names
+
+        :default: 'hnb659fds'
+        '''
+        result = self._values.get("qualifier")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -5353,7 +5887,7 @@ class CfnGuardHookProps:
         :param log_bucket: Specifies the name of an S3 bucket to store the Guard output report. This report contains the results of your Guard rule validations.
         :param options: Specifies the S3 location of your input parameters.
         :param stack_filters: Specifies the stack level filters for the Hook. Example stack level filter in JSON: ``"StackFilters": {"FilteringCriteria": "ALL", "StackNames": {"Exclude": [ "stack-1", "stack-2"]}}`` Example stack level filter in YAML: ``StackFilters: FilteringCriteria: ALL StackNames: Exclude: - stack-1 - stack-2``
-        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "Create", "Update", "Delete" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
+        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-guardhook.html
         :exampleMetadata: fixture=_generated
@@ -5567,7 +6101,7 @@ class CfnGuardHookProps:
 
         Example target filter in JSON:
 
-        ``"TargetFilters": {"Actions": [ "Create", "Update", "Delete" ]}``
+        ``"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}``
 
         Example target filter in YAML:
 
@@ -5962,8 +6496,8 @@ class CfnHookVersionProps:
     ) -> None:
         '''Properties for defining a ``CfnHookVersion``.
 
-        :param schema_handler_package: A URL to the Amazon S3 bucket containing the Hook project package that contains the necessary files for the Hook you want to register. For information on generating a schema handler package, see `Modeling custom CloudFormation Hooks <https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-model.html>`_ in the *AWS CloudFormation Hooks User Guide* . .. epigraph:: To register the Hook, you must have ``s3:GetObject`` permissions to access the S3 objects.
-        :param type_name: The unique name for your hook. Specifies a three-part namespace for your hook, with a recommended pattern of ``Organization::Service::Hook`` . .. epigraph:: The following organization namespaces are reserved and can't be used in your hook type names: - ``Alexa`` - ``AMZN`` - ``Amazon`` - ``ASK`` - ``AWS`` - ``Custom`` - ``Dev``
+        :param schema_handler_package: A URL to the Amazon S3 bucket for the Hook project package that contains the necessary files for the Hook you want to register. For information on generating a schema handler package, see `Modeling custom CloudFormation Hooks <https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-model.html>`_ in the *AWS CloudFormation Hooks User Guide* . .. epigraph:: To register the Hook, you must have ``s3:GetObject`` permissions to access the S3 objects.
+        :param type_name: The unique name for your Hook. Specifies a three-part namespace for your Hook, with a recommended pattern of ``Organization::Service::Hook`` . .. epigraph:: The following organization namespaces are reserved and can't be used in your Hook type names: - ``Alexa`` - ``AMZN`` - ``Amazon`` - ``ASK`` - ``AWS`` - ``Custom`` - ``Dev``
         :param execution_role_arn: The Amazon Resource Name (ARN) of the task execution role that grants the Hook permission.
         :param logging_config: Contains logging configuration information for an extension.
 
@@ -6005,7 +6539,7 @@ class CfnHookVersionProps:
 
     @builtins.property
     def schema_handler_package(self) -> builtins.str:
-        '''A URL to the Amazon S3 bucket containing the Hook project package that contains the necessary files for the Hook you want to register.
+        '''A URL to the Amazon S3 bucket for the Hook project package that contains the necessary files for the Hook you want to register.
 
         For information on generating a schema handler package, see `Modeling custom CloudFormation Hooks <https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-model.html>`_ in the *AWS CloudFormation Hooks User Guide* .
         .. epigraph::
@@ -6020,12 +6554,12 @@ class CfnHookVersionProps:
 
     @builtins.property
     def type_name(self) -> builtins.str:
-        '''The unique name for your hook.
+        '''The unique name for your Hook.
 
-        Specifies a three-part namespace for your hook, with a recommended pattern of ``Organization::Service::Hook`` .
+        Specifies a three-part namespace for your Hook, with a recommended pattern of ``Organization::Service::Hook`` .
         .. epigraph::
 
-           The following organization namespaces are reserved and can't be used in your hook type names:
+           The following organization namespaces are reserved and can't be used in your Hook type names:
 
            - ``Alexa``
            - ``AMZN``
@@ -6167,7 +6701,7 @@ class CfnLambdaHookProps:
         :param lambda_function: Specifies the Lambda function for the Hook. You can use:. - The full Amazon Resource Name (ARN) without a suffix. - A qualified ARN with a version or alias suffix.
         :param target_operations: Specifies the list of operations the Hook is run against. For more information, see `Hook targets <https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-concepts.html#hook-terms-hook-target>`_ in the *AWS CloudFormation Hooks User Guide* . Valid values: ``STACK`` | ``RESOURCE`` | ``CHANGE_SET`` | ``CLOUD_CONTROL``
         :param stack_filters: Specifies the stack level filters for the Hook. Example stack level filter in JSON: ``"StackFilters": {"FilteringCriteria": "ALL", "StackNames": {"Exclude": [ "stack-1", "stack-2"]}}`` Example stack level filter in YAML: ``StackFilters: FilteringCriteria: ALL StackNames: Exclude: - stack-1 - stack-2``
-        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "Create", "Update", "Delete" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
+        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-lambdahook.html
         :exampleMetadata: fixture=_generated
@@ -6338,7 +6872,7 @@ class CfnLambdaHookProps:
 
         Example target filter in JSON:
 
-        ``"TargetFilters": {"Actions": [ "Create", "Update", "Delete" ]}``
+        ``"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}``
 
         Example target filter in YAML:
 
@@ -6679,7 +7213,7 @@ class CfnModuleVersionProps:
         '''Properties for defining a ``CfnModuleVersion``.
 
         :param module_name: The name of the module being registered.
-        :param module_package: A URL to the S3 bucket containing the package that contains the template fragment and schema files for the module version to register. For more information, see `Module structure and requirements <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/modules-structure.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the module version, you must have ``s3:GetObject`` permissions to access the S3 objects.
+        :param module_package: A URL to the S3 bucket for the package that contains the template fragment and schema files for the module version to register. For more information, see `Module structure and requirements <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/modules-structure.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the module version, you must have ``s3:GetObject`` permissions to access the S3 objects.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-moduleversion.html
         :exampleMetadata: fixture=_generated
@@ -6716,7 +7250,7 @@ class CfnModuleVersionProps:
 
     @builtins.property
     def module_package(self) -> builtins.str:
-        '''A URL to the S3 bucket containing the package that contains the template fragment and schema files for the module version to register.
+        '''A URL to the S3 bucket for the package that contains the template fragment and schema files for the module version to register.
 
         For more information, see `Module structure and requirements <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/modules-structure.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* .
         .. epigraph::
@@ -6788,7 +7322,7 @@ class CfnOutput(CfnElement, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnO
         export_name: typing.Optional[builtins.str] = None,
         key: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''Creates an CfnOutput value for this stack.
+        '''Creates a CfnOutput value for this stack.
 
         :param scope: The parent construct.
         :param id: -
@@ -8221,6 +8755,11 @@ class CfnResource(
         '''AWS resource type.'''
         return typing.cast(builtins.str, jsii.get(self, "cfnResourceType"))
 
+    @builtins.property
+    @jsii.member(jsii_name="env")
+    def env(self) -> _ResourceEnvironment_603baf00:
+        return typing.cast(_ResourceEnvironment_603baf00, jsii.get(self, "env"))
+
     @builtins.property
     @jsii.member(jsii_name="updatedProperites")
     def _updated_properites(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -8572,7 +9111,7 @@ class CfnResourceVersionProps:
     ) -> None:
         '''Properties for defining a ``CfnResourceVersion``.
 
-        :param schema_handler_package: A URL to the S3 bucket containing the resource project package that contains the necessary files for the resource you want to register. For information on generating a schema handler package, see `Modeling resource types to use with AWS CloudFormation <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-model.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the resource version, you must have ``s3:GetObject`` permissions to access the S3 objects.
+        :param schema_handler_package: A URL to the S3 bucket for the resource project package that contains the necessary files for the resource you want to register. For information on generating a schema handler package, see `Modeling resource types to use with AWS CloudFormation <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-model.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the resource version, you must have ``s3:GetObject`` permissions to access the S3 objects.
         :param type_name: The name of the resource being registered. We recommend that resource names adhere to the following pattern: *company_or_organization* :: *service* :: *type* . .. epigraph:: The following organization namespaces are reserved and can't be used in your resource names: - ``Alexa`` - ``AMZN`` - ``Amazon`` - ``AWS`` - ``Custom`` - ``Dev``
         :param execution_role_arn: The Amazon Resource Name (ARN) of the IAM role for CloudFormation to assume when invoking the resource. If your resource calls AWS APIs in any of its handlers, you must create an IAM execution role that includes the necessary permissions to call those AWS APIs, and provision that execution role in your account. When CloudFormation needs to invoke the resource type handler, CloudFormation assumes this execution role to create a temporary session token, which it then passes to the resource type handler, thereby supplying your resource type with the appropriate credentials.
         :param logging_config: Logging configuration information for a resource.
@@ -8615,7 +9154,7 @@ class CfnResourceVersionProps:
 
     @builtins.property
     def schema_handler_package(self) -> builtins.str:
-        '''A URL to the S3 bucket containing the resource project package that contains the necessary files for the resource you want to register.
+        '''A URL to the S3 bucket for the resource project package that contains the necessary files for the resource you want to register.
 
         For information on generating a schema handler package, see `Modeling resource types to use with AWS CloudFormation <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-model.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* .
         .. epigraph::
@@ -8941,7 +9480,7 @@ class CfnStackProps:
         :param notification_arns: The Amazon SNS topic ARNs to publish stack related events. You can find your Amazon SNS topic ARNs using the Amazon SNS console or your Command Line Interface (CLI).
         :param parameters: The set value pairs that represent the parameters passed to CloudFormation when this nested stack is created. Each parameter has a name corresponding to a parameter defined in the embedded template and a value representing the value that you want to set for the parameter. .. epigraph:: If you use the ``Ref`` function to pass a parameter value to a nested stack, comma-delimited list parameters must be of type ``String`` . In other words, you can't pass values that are of type ``CommaDelimitedList`` to nested stacks. Required if the nested stack requires input parameters. Whether an update causes interruptions depends on the resources that are being updated. An update never causes a nested stack to be replaced.
         :param tags: Key-value pairs to associate with this stack. CloudFormation also propagates these tags to the resources created in the stack. A maximum number of 50 tags can be specified.
-        :param template_url: The URL of a file containing the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket. The location for an Amazon S3 bucket must start with ``https://`` . Whether an update causes interruptions depends on the resources that are being updated. An update never causes a nested stack to be replaced.
+        :param template_url: The URL of a file that contains the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket. The location for an Amazon S3 bucket must start with ``https://`` . Whether an update causes interruptions depends on the resources that are being updated. An update never causes a nested stack to be replaced.
         :param timeout_in_minutes: The length of time, in minutes, that CloudFormation waits for the nested stack to reach the ``CREATE_COMPLETE`` state. The default is no timeout. When CloudFormation detects that the nested stack has reached the ``CREATE_COMPLETE`` state, it marks the nested stack resource as ``CREATE_COMPLETE`` in the parent stack and resumes creating the parent stack. If the timeout period expires before the nested stack reaches ``CREATE_COMPLETE`` , CloudFormation marks the nested stack as failed and rolls back both the nested stack and parent stack. Updates aren't supported.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stack.html
@@ -9029,7 +9568,7 @@ class CfnStackProps:
 
     @builtins.property
     def template_url(self) -> typing.Optional[builtins.str]:
-        '''The URL of a file containing the template body.
+        '''The URL of a file that contains the template body.
 
         The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket. The location for an Amazon S3 bucket must start with ``https://`` .
 
@@ -9108,21 +9647,21 @@ class CfnStackSetProps:
     ) -> None:
         '''Properties for defining a ``CfnStackSet``.
 
-        :param permission_model: Describes how the IAM roles required for stack set operations are created. - With ``SELF_MANAGED`` permissions, you must create the administrator and execution roles required to deploy to target accounts. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . - With ``SERVICE_MANAGED`` permissions, StackSets automatically creates the IAM roles required to deploy to accounts managed by AWS Organizations . For more information, see `Activate trusted access for stack sets with AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html>`_ in the *AWS CloudFormation User Guide* .
-        :param stack_set_name: The name to associate with the stack set. The name must be unique in the Region where you create your stack set.
-        :param administration_role_arn: The Amazon Resource Number (ARN) of the IAM role to use to create this stack set. Specify an IAM role only if you are using customized administrator roles to control which users or groups can manage specific stack sets within the same administrator account. Use customized administrator roles to control which users or groups can manage specific stack sets within the same administrator account. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . Valid only if the permissions model is ``SELF_MANAGED`` .
-        :param auto_deployment: Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target organization or organizational unit (OU). For more information, see `Manage automatic deployments for CloudFormation StackSets that use service-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.html>`_ in the *AWS CloudFormation User Guide* . Required if the permissions model is ``SERVICE_MANAGED`` . (Not used with self-managed permissions.)
-        :param call_as: Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. By default, ``SELF`` is specified. Use ``SELF`` for stack sets with self-managed permissions. - To create a stack set with service-managed permissions while signed in to the management account, specify ``SELF`` . - To create a stack set with service-managed permissions while signed in to a delegated administrator account, specify ``DELEGATED_ADMIN`` . Your AWS account must be registered as a delegated admin in the management account. For more information, see `Register a delegated administrator <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-delegated-admin.html>`_ in the *AWS CloudFormation User Guide* . Stack sets with service-managed permissions are created in the management account, including stack sets that are created by delegated administrators. Valid only if the permissions model is ``SERVICE_MANAGED`` .
-        :param capabilities: The capabilities that are allowed in the stack set. Some stack set templates might include resources that can affect permissions in your AWS account —for example, by creating new IAM users. For more information, see `Acknowledging IAM resources in CloudFormation templates <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html#using-iam-capabilities>`_ in the *AWS CloudFormation User Guide* .
-        :param description: A description of the stack set.
-        :param execution_role_name: The name of the IAM execution role to use to create the stack set. If you don't specify an execution role, CloudFormation uses the ``AWSCloudFormationStackSetExecutionRole`` role for the stack set operation. Valid only if the permissions model is ``SELF_MANAGED`` . *Pattern* : ``[a-zA-Z_0-9+=,.@-]+``
-        :param managed_execution: Describes whether StackSets performs non-conflicting operations concurrently and queues conflicting operations. When active, StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. .. epigraph:: If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. When inactive (default), StackSets performs one operation at a time in request order.
-        :param operation_preferences: The user-specified preferences for how CloudFormation performs a stack set operation.
-        :param parameters: The input parameters for the stack set template.
+        :param permission_model: Describes how the IAM roles required for StackSet operations are created. - With ``SELF_MANAGED`` permissions, you must create the administrator and execution roles required to deploy to target accounts. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . - With ``SERVICE_MANAGED`` permissions, StackSets automatically creates the IAM roles required to deploy to accounts managed by AWS Organizations . For more information, see `Activate trusted access for StackSets with AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html>`_ in the *AWS CloudFormation User Guide* .
+        :param stack_set_name: The name to associate with the StackSet. The name must be unique in the Region where you create your StackSet.
+        :param administration_role_arn: The Amazon Resource Number (ARN) of the IAM role to use to create this StackSet. Specify an IAM role only if you are using customized administrator roles to control which users or groups can manage specific StackSets within the same administrator account. Use customized administrator roles to control which users or groups can manage specific StackSets within the same administrator account. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . Valid only if the permissions model is ``SELF_MANAGED`` .
+        :param auto_deployment: Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target organization or organizational unit (OU). For more information, see `Enable or disable automatic deployments for StackSets in AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.html>`_ in the *AWS CloudFormation User Guide* . Required if the permissions model is ``SERVICE_MANAGED`` . (Not used with self-managed permissions.)
+        :param call_as: Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. By default, ``SELF`` is specified. Use ``SELF`` for StackSets with self-managed permissions. - To create a StackSet with service-managed permissions while signed in to the management account, specify ``SELF`` . - To create a StackSet with service-managed permissions while signed in to a delegated administrator account, specify ``DELEGATED_ADMIN`` . Your AWS account must be registered as a delegated admin in the management account. For more information, see `Register a delegated administrator <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-delegated-admin.html>`_ in the *AWS CloudFormation User Guide* . StackSets with service-managed permissions are created in the management account, including StackSets that are created by delegated administrators. Valid only if the permissions model is ``SERVICE_MANAGED`` .
+        :param capabilities: The capabilities that are allowed in the StackSet. Some StackSet templates might include resources that can affect permissions in your AWS account —for example, by creating new IAM users. For more information, see `Acknowledging IAM resources in CloudFormation templates <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html#using-iam-capabilities>`_ in the *AWS CloudFormation User Guide* .
+        :param description: A description of the StackSet.
+        :param execution_role_name: The name of the IAM execution role to use to create the StackSet. If you don't specify an execution role, CloudFormation uses the ``AWSCloudFormationStackSetExecutionRole`` role for the StackSet operation. Valid only if the permissions model is ``SELF_MANAGED`` . *Pattern* : ``[a-zA-Z_0-9+=,.@-]+``
+        :param managed_execution: Describes whether StackSets performs non-conflicting operations concurrently and queues conflicting operations. When active, StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. .. epigraph:: If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. You can't modify your StackSet's execution configuration while there are running or queued operations for that StackSet. When inactive (default), StackSets performs one operation at a time in request order.
+        :param operation_preferences: The user-specified preferences for how CloudFormation performs a StackSet operation.
+        :param parameters: The input parameters for the StackSet template.
         :param stack_instances_group: A group of stack instances with parameters in some specific accounts and Regions.
         :param tags: Key-value pairs to associate with this stack. CloudFormation also propagates these tags to supported resources in the stack. You can specify a maximum number of 50 tags. If you don't specify this parameter, CloudFormation doesn't modify the stack's tags. If you specify an empty value, CloudFormation removes all associated tags.
-        :param template_body: The structure that contains the template body, with a minimum length of 1 byte and a maximum length of 51,200 bytes. You must include either ``TemplateURL`` or ``TemplateBody`` in a StackSet, but you can't use both. Dynamic references in the ``TemplateBody`` may not work correctly in all cases. It's recommended to pass templates containing dynamic references through ``TemplateUrl`` instead.
-        :param template_url: The URL of a file containing the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket or a Systems Manager document. The location for an Amazon S3 bucket must start with ``https://`` . Conditional: You must specify only one of the following parameters: ``TemplateBody`` , ``TemplateURL`` .
+        :param template_body: The structure that contains the template body, with a minimum length of 1 byte and a maximum length of 51,200 bytes. You must include either ``TemplateURL`` or ``TemplateBody`` in a StackSet, but you can't use both. Dynamic references in the ``TemplateBody`` may not work correctly in all cases. It's recommended to pass templates that contain dynamic references through ``TemplateUrl`` instead.
+        :param template_url: The URL of a file that contains the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket or a Systems Manager document. The location for an Amazon S3 bucket must start with ``https://`` . Conditional: You must specify only one of the following parameters: ``TemplateBody`` , ``TemplateURL`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html
         :exampleMetadata: fixture=_generated
@@ -9236,10 +9775,10 @@ class CfnStackSetProps:
 
     @builtins.property
     def permission_model(self) -> builtins.str:
-        '''Describes how the IAM roles required for stack set operations are created.
+        '''Describes how the IAM roles required for StackSet operations are created.
 
         - With ``SELF_MANAGED`` permissions, you must create the administrator and execution roles required to deploy to target accounts. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* .
-        - With ``SERVICE_MANAGED`` permissions, StackSets automatically creates the IAM roles required to deploy to accounts managed by AWS Organizations . For more information, see `Activate trusted access for stack sets with AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html>`_ in the *AWS CloudFormation User Guide* .
+        - With ``SERVICE_MANAGED`` permissions, StackSets automatically creates the IAM roles required to deploy to accounts managed by AWS Organizations . For more information, see `Activate trusted access for StackSets with AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html>`_ in the *AWS CloudFormation User Guide* .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html#cfn-cloudformation-stackset-permissionmodel
         '''
@@ -9249,9 +9788,9 @@ class CfnStackSetProps:
 
     @builtins.property
     def stack_set_name(self) -> builtins.str:
-        '''The name to associate with the stack set.
+        '''The name to associate with the StackSet.
 
-        The name must be unique in the Region where you create your stack set.
+        The name must be unique in the Region where you create your StackSet.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html#cfn-cloudformation-stackset-stacksetname
         '''
@@ -9261,11 +9800,11 @@ class CfnStackSetProps:
 
     @builtins.property
     def administration_role_arn(self) -> typing.Optional[builtins.str]:
-        '''The Amazon Resource Number (ARN) of the IAM role to use to create this stack set.
+        '''The Amazon Resource Number (ARN) of the IAM role to use to create this StackSet.
 
-        Specify an IAM role only if you are using customized administrator roles to control which users or groups can manage specific stack sets within the same administrator account.
+        Specify an IAM role only if you are using customized administrator roles to control which users or groups can manage specific StackSets within the same administrator account.
 
-        Use customized administrator roles to control which users or groups can manage specific stack sets within the same administrator account. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* .
+        Use customized administrator roles to control which users or groups can manage specific StackSets within the same administrator account. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* .
 
         Valid only if the permissions model is ``SELF_MANAGED`` .
 
@@ -9280,7 +9819,7 @@ class CfnStackSetProps:
     ) -> typing.Optional[typing.Union["IResolvable", "CfnStackSet.AutoDeploymentProperty"]]:
         '''Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target organization or organizational unit (OU).
 
-        For more information, see `Manage automatic deployments for CloudFormation StackSets that use service-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.html>`_ in the *AWS CloudFormation User Guide* .
+        For more information, see `Enable or disable automatic deployments for StackSets in AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.html>`_ in the *AWS CloudFormation User Guide* .
 
         Required if the permissions model is ``SERVICE_MANAGED`` . (Not used with self-managed permissions.)
 
@@ -9293,14 +9832,14 @@ class CfnStackSetProps:
     def call_as(self) -> typing.Optional[builtins.str]:
         '''Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account.
 
-        By default, ``SELF`` is specified. Use ``SELF`` for stack sets with self-managed permissions.
+        By default, ``SELF`` is specified. Use ``SELF`` for StackSets with self-managed permissions.
 
-        - To create a stack set with service-managed permissions while signed in to the management account, specify ``SELF`` .
-        - To create a stack set with service-managed permissions while signed in to a delegated administrator account, specify ``DELEGATED_ADMIN`` .
+        - To create a StackSet with service-managed permissions while signed in to the management account, specify ``SELF`` .
+        - To create a StackSet with service-managed permissions while signed in to a delegated administrator account, specify ``DELEGATED_ADMIN`` .
 
         Your AWS account must be registered as a delegated admin in the management account. For more information, see `Register a delegated administrator <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-delegated-admin.html>`_ in the *AWS CloudFormation User Guide* .
 
-        Stack sets with service-managed permissions are created in the management account, including stack sets that are created by delegated administrators.
+        StackSets with service-managed permissions are created in the management account, including StackSets that are created by delegated administrators.
 
         Valid only if the permissions model is ``SERVICE_MANAGED`` .
 
@@ -9311,9 +9850,9 @@ class CfnStackSetProps:
 
     @builtins.property
     def capabilities(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''The capabilities that are allowed in the stack set.
+        '''The capabilities that are allowed in the StackSet.
 
-        Some stack set templates might include resources that can affect permissions in your AWS account —for example, by creating new IAM users. For more information, see `Acknowledging IAM resources in CloudFormation templates <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html#using-iam-capabilities>`_ in the *AWS CloudFormation User Guide* .
+        Some StackSet templates might include resources that can affect permissions in your AWS account —for example, by creating new IAM users. For more information, see `Acknowledging IAM resources in CloudFormation templates <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html#using-iam-capabilities>`_ in the *AWS CloudFormation User Guide* .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html#cfn-cloudformation-stackset-capabilities
         '''
@@ -9322,7 +9861,7 @@ class CfnStackSetProps:
 
     @builtins.property
     def description(self) -> typing.Optional[builtins.str]:
-        '''A description of the stack set.
+        '''A description of the StackSet.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html#cfn-cloudformation-stackset-description
         '''
@@ -9331,9 +9870,9 @@ class CfnStackSetProps:
 
     @builtins.property
     def execution_role_name(self) -> typing.Optional[builtins.str]:
-        '''The name of the IAM execution role to use to create the stack set.
+        '''The name of the IAM execution role to use to create the StackSet.
 
-        If you don't specify an execution role, CloudFormation uses the ``AWSCloudFormationStackSetExecutionRole`` role for the stack set operation.
+        If you don't specify an execution role, CloudFormation uses the ``AWSCloudFormationStackSetExecutionRole`` role for the StackSet operation.
 
         Valid only if the permissions model is ``SELF_MANAGED`` .
 
@@ -9353,7 +9892,7 @@ class CfnStackSetProps:
 
            If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting.
 
-           You can't modify your stack set's execution configuration while there are running or queued operations for that stack set.
+           You can't modify your StackSet's execution configuration while there are running or queued operations for that StackSet.
 
         When inactive (default), StackSets performs one operation at a time in request order.
 
@@ -9366,7 +9905,7 @@ class CfnStackSetProps:
     def operation_preferences(
         self,
     ) -> typing.Optional[typing.Union["IResolvable", "CfnStackSet.OperationPreferencesProperty"]]:
-        '''The user-specified preferences for how CloudFormation performs a stack set operation.
+        '''The user-specified preferences for how CloudFormation performs a StackSet operation.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html#cfn-cloudformation-stackset-operationpreferences
         '''
@@ -9377,7 +9916,7 @@ class CfnStackSetProps:
     def parameters(
         self,
     ) -> typing.Optional[typing.Union["IResolvable", typing.List[typing.Union["IResolvable", "CfnStackSet.ParameterProperty"]]]]:
-        '''The input parameters for the stack set template.
+        '''The input parameters for the StackSet template.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html#cfn-cloudformation-stackset-parameters
         '''
@@ -9412,7 +9951,7 @@ class CfnStackSetProps:
     def template_body(self) -> typing.Optional[builtins.str]:
         '''The structure that contains the template body, with a minimum length of 1 byte and a maximum length of 51,200 bytes.
 
-        You must include either ``TemplateURL`` or ``TemplateBody`` in a StackSet, but you can't use both. Dynamic references in the ``TemplateBody`` may not work correctly in all cases. It's recommended to pass templates containing dynamic references through ``TemplateUrl`` instead.
+        You must include either ``TemplateURL`` or ``TemplateBody`` in a StackSet, but you can't use both. Dynamic references in the ``TemplateBody`` may not work correctly in all cases. It's recommended to pass templates that contain dynamic references through ``TemplateUrl`` instead.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-stackset.html#cfn-cloudformation-stackset-templatebody
         '''
@@ -9421,7 +9960,7 @@ class CfnStackSetProps:
 
     @builtins.property
     def template_url(self) -> typing.Optional[builtins.str]:
-        '''The URL of a file containing the template body.
+        '''The URL of a file that contains the template body.
 
         The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket or a Systems Manager document. The location for an Amazon S3 bucket must start with ``https://`` .
 
@@ -9969,7 +10508,7 @@ class CfnTypeActivationProps:
         :param publisher_id: The ID of the extension publisher. Conditional: You must specify ``PublicTypeArn`` , or ``TypeName`` , ``Type`` , and ``PublisherId`` .
         :param type: The extension type. Conditional: You must specify ``PublicTypeArn`` , or ``TypeName`` , ``Type`` , and ``PublisherId`` .
         :param type_name: The name of the extension. Conditional: You must specify ``PublicTypeArn`` , or ``TypeName`` , ``Type`` , and ``PublisherId`` .
-        :param type_name_alias: An alias to assign to the public extension, in this account and Region. If you specify an alias for the extension, CloudFormation treats the alias as the extension type name within this account and Region. You must use the alias to refer to the extension in your templates, API calls, and CloudFormation console. An extension alias must be unique within a given account and Region. You can activate the same public resource multiple times in the same account and Region, using different type name aliases.
+        :param type_name_alias: An alias to assign to the public extension in this account and Region. If you specify an alias for the extension, CloudFormation treats the alias as the extension type name within this account and Region. You must use the alias to refer to the extension in your templates, API calls, and CloudFormation console. An extension alias must be unique within a given account and Region. You can activate the same public resource multiple times in the same account and Region, using different type name aliases.
         :param version_bump: Manually updates a previously-activated type to a new major or minor version, if available. You can also use this parameter to update the value of ``AutoUpdate`` . - ``MAJOR`` : CloudFormation updates the extension to the newest major version, if one is available. - ``MINOR`` : CloudFormation updates the extension to the newest minor version, if one is available.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-typeactivation.html
@@ -10125,7 +10664,7 @@ class CfnTypeActivationProps:
 
     @builtins.property
     def type_name_alias(self) -> typing.Optional[builtins.str]:
-        '''An alias to assign to the public extension, in this account and Region.
+        '''An alias to assign to the public extension in this account and Region.
 
         If you specify an alias for the extension, CloudFormation treats the alias as the extension type name within this account and Region. You must use the alias to refer to the extension in your templates, API calls, and CloudFormation console.
 
@@ -10378,7 +10917,7 @@ class CfnWaitConditionProps:
         '''Properties for defining a ``CfnWaitCondition``.
 
         :param count: The number of success signals that CloudFormation must receive before it continues the stack creation process. When the wait condition receives the requisite number of success signals, CloudFormation resumes the creation of the stack. If the wait condition doesn't receive the specified number of success signals before the Timeout period expires, CloudFormation assumes that the wait condition has failed and rolls the stack back. Updates aren't supported.
-        :param handle: A reference to the wait condition handle used to signal this wait condition. Use the ``Ref`` intrinsic function to specify an `AWS::CloudFormation::WaitConditionHandle <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-waitconditionhandle.html>`_ resource. Anytime you add a ``WaitCondition`` resource during a stack update, you must associate the wait condition with a new WaitConditionHandle resource. Don't reuse an old wait condition handle that has already been defined in the template. If you reuse a wait condition handle, the wait condition might evaluate old signals from a previous create or update stack command. Updates aren't supported.
+        :param handle: A reference to the wait condition handle used to signal this wait condition. Use the ``Ref`` intrinsic function to specify an `AWS::CloudFormation::WaitConditionHandle <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-waitconditionhandle.html>`_ resource. Anytime you add a ``WaitCondition`` resource during a stack update, you must associate the wait condition with a new WaitConditionHandle resource. Don't reuse an old wait condition handle that has already been defined in the template. If you reuse a wait condition handle, the wait condition might evaluate old signals from a previous create or update stack command. Updates aren't supported.
         :param timeout: The length of time (in seconds) to wait for the number of signals that the ``Count`` property specifies. ``Timeout`` is a minimum-bound property, meaning the timeout occurs no sooner than the time you specify, but can occur shortly thereafter. The maximum time that can be specified for this property is 12 hours (43200 seconds). Updates aren't supported.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-waitcondition.html
@@ -10426,7 +10965,7 @@ class CfnWaitConditionProps:
     def handle(self) -> typing.Optional[builtins.str]:
         '''A reference to the wait condition handle used to signal this wait condition.
 
-        Use the ``Ref`` intrinsic function to specify an `AWS::CloudFormation::WaitConditionHandle <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-waitconditionhandle.html>`_ resource.
+        Use the ``Ref`` intrinsic function to specify an `AWS::CloudFormation::WaitConditionHandle <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-waitconditionhandle.html>`_ resource.
 
         Anytime you add a ``WaitCondition`` resource during a stack update, you must associate the wait condition with a new WaitConditionHandle resource. Don't reuse an old wait condition handle that has already been defined in the template. If you reuse a wait condition handle, the wait condition might evaluate old signals from a previous create or update stack command.
 
@@ -10618,12 +11157,14 @@ class ContextProvider(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.ContextPro
         scope: _constructs_77d1e7e8.Construct,
         *,
         provider: builtins.str,
+        additional_cache_key: typing.Optional[builtins.str] = None,
         include_environment: typing.Optional[builtins.bool] = None,
         props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     ) -> "GetContextKeyResult":
         '''
         :param scope: -
         :param provider: The context provider to query.
+        :param additional_cache_key: Adds an additional discriminator to the ``cdk.context.json`` cache key. Default: - no additional cache key
         :param include_environment: Whether to include the stack's account and region automatically. Default: true
         :param props: Provider-specific properties.
 
@@ -10633,7 +11174,10 @@ class ContextProvider(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.ContextPro
             type_hints = typing.get_type_hints(_typecheckingstub__43574b9eb91c9a4b6203c6c4dae8ace9123c2746c25560e39a6b8a8db6ca67ff)
             check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
         options = GetContextKeyOptions(
-            provider=provider, include_environment=include_environment, props=props
+            provider=provider,
+            additional_cache_key=additional_cache_key,
+            include_environment=include_environment,
+            props=props,
         )
 
         return typing.cast("GetContextKeyResult", jsii.sinvoke(cls, "getKey", [scope, options]))
@@ -10648,6 +11192,7 @@ class ContextProvider(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.ContextPro
         ignore_error_on_missing_context: typing.Optional[builtins.bool] = None,
         must_exist: typing.Optional[builtins.bool] = None,
         provider: builtins.str,
+        additional_cache_key: typing.Optional[builtins.str] = None,
         include_environment: typing.Optional[builtins.bool] = None,
         props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     ) -> "GetContextValueResult":
@@ -10657,6 +11202,7 @@ class ContextProvider(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.ContextPro
         :param ignore_error_on_missing_context: (deprecated) Ignore a lookup failure and return the ``dummyValue`` instead. ``mustExist`` is the recommended alias for this deprecated property (note that its value is reversed). Default: false
         :param must_exist: Whether the resource must exist. If this is set (the default), the query fails if the value or resource we tried to look up doesn't exist. If this is ``false`` and the value we tried to look up could not be found, the failure is suppressed and ``dummyValue`` is officially returned instead. When this happens, ``dummyValue`` is encoded into cached context and it will never be refreshed anymore until the user runs ``cdk context --reset <key>``. Note that it is not possible for the CDK app code to make a distinction between "the lookup has not been performed yet" and "the lookup didn't find anything and we returned a default value instead". Context providers This feature must explicitly be supported by context providers. It is currently supported by: - KMS key provider - SSM parameter provider Note to implementors The dummy value should not be returned for all SDK lookup failures. For example, "no network" or "no credentials" or "malformed query" should not lead to the dummy value being returned. Only the case of "no such resource" should. Default: true
         :param provider: The context provider to query.
+        :param additional_cache_key: Adds an additional discriminator to the ``cdk.context.json`` cache key. Default: - no additional cache key
         :param include_environment: Whether to include the stack's account and region automatically. Default: true
         :param props: Provider-specific properties.
         '''
@@ -10668,6 +11214,7 @@ class ContextProvider(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.ContextPro
             ignore_error_on_missing_context=ignore_error_on_missing_context,
             must_exist=must_exist,
             provider=provider,
+            additional_cache_key=additional_cache_key,
             include_environment=include_environment,
             props=props,
         )
@@ -11461,11 +12008,18 @@ class CustomResourceProviderRuntime(enum.Enum):
     :stability: deprecated
     '''
     NODEJS_16_X = "NODEJS_16_X"
-    '''Node.js 16.x.'''
+    '''(deprecated) Node.js 16.x.
+
+    :deprecated: Use latest version
+
+    :stability: deprecated
+    '''
     NODEJS_18_X = "NODEJS_18_X"
     '''Node.js 18.x.'''
     NODEJS_20_X = "NODEJS_20_X"
     '''Node.js 20.x.'''
+    NODEJS_22_X = "NODEJS_22_X"
+    '''Node.js 22.x.'''
 
 
 @jsii.data_type(
@@ -11549,9 +12103,16 @@ class DefaultStackSynthesizerProps:
 
         Example::
 
-            MyStack(app, "MyStack",
+            # app: App
+            
+            
+            prod_stage = Stage(app, "ProdStage",
+                permissions_boundary=PermissionsBoundary.from_name("cdk-${Qualifier}-PermissionsBoundary-${AWS::AccountId}-${AWS::Region}")
+            )
+            
+            Stack(prod_stage, "ProdStack",
                 synthesizer=DefaultStackSynthesizer(
-                    file_assets_bucket_name="amzn-s3-demo-bucket"
+                    qualifier="custom"
                 )
             )
         '''
@@ -11916,6 +12477,7 @@ class DefaultStackSynthesizerProps:
         "cache_from": "cacheFrom",
         "cache_to": "cacheTo",
         "file": "file",
+        "network": "network",
         "platform": "platform",
         "target_stage": "targetStage",
     },
@@ -11929,6 +12491,7 @@ class DockerBuildOptions:
         cache_from: typing.Optional[typing.Sequence[typing.Union["DockerCacheOption", typing.Dict[builtins.str, typing.Any]]]] = None,
         cache_to: typing.Optional[typing.Union["DockerCacheOption", typing.Dict[builtins.str, typing.Any]]] = None,
         file: typing.Optional[builtins.str] = None,
+        network: typing.Optional[builtins.str] = None,
         platform: typing.Optional[builtins.str] = None,
         target_stage: typing.Optional[builtins.str] = None,
     ) -> None:
@@ -11939,6 +12502,7 @@ class DockerBuildOptions:
         :param cache_from: Cache from options to pass to the ``docker build`` command. Default: - no cache from args are passed
         :param cache_to: Cache to options to pass to the ``docker build`` command. Default: - no cache to args are passed
         :param file: Name of the Dockerfile, must relative to the docker build path. Default: ``Dockerfile``
+        :param network: Docker `Networking options <https://docs.docker.com/reference/cli/docker/buildx/build/#network>`_. Default: - no networking options
         :param platform: Set platform if server is multi-platform capable. *Requires Docker Engine API v1.38+*. Example value: ``linux/amd64`` Default: - no platform specified
         :param target_stage: Set build target for multi-stage container builds. Any stage defined afterwards will be ignored. Example value: ``build-env`` Default: - Build all stages defined in the Dockerfile
 
@@ -11970,6 +12534,7 @@ class DockerBuildOptions:
             check_type(argname="argument cache_from", value=cache_from, expected_type=type_hints["cache_from"])
             check_type(argname="argument cache_to", value=cache_to, expected_type=type_hints["cache_to"])
             check_type(argname="argument file", value=file, expected_type=type_hints["file"])
+            check_type(argname="argument network", value=network, expected_type=type_hints["network"])
             check_type(argname="argument platform", value=platform, expected_type=type_hints["platform"])
             check_type(argname="argument target_stage", value=target_stage, expected_type=type_hints["target_stage"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
@@ -11983,6 +12548,8 @@ class DockerBuildOptions:
             self._values["cache_to"] = cache_to
         if file is not None:
             self._values["file"] = file
+        if network is not None:
+            self._values["network"] = network
         if platform is not None:
             self._values["platform"] = platform
         if target_stage is not None:
@@ -12033,6 +12600,15 @@ class DockerBuildOptions:
         result = self._values.get("file")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def network(self) -> typing.Optional[builtins.str]:
+        '''Docker `Networking options <https://docs.docker.com/reference/cli/docker/buildx/build/#network>`_.
+
+        :default: - no networking options
+        '''
+        result = self._values.get("network")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def platform(self) -> typing.Optional[builtins.str]:
         '''Set platform if server is multi-platform capable. *Requires Docker Engine API v1.38+*.
@@ -12243,6 +12819,7 @@ class DockerImage(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.DockerImage"):
         cache_from: typing.Optional[typing.Sequence[typing.Union[DockerCacheOption, typing.Dict[builtins.str, typing.Any]]]] = None,
         cache_to: typing.Optional[typing.Union[DockerCacheOption, typing.Dict[builtins.str, typing.Any]]] = None,
         file: typing.Optional[builtins.str] = None,
+        network: typing.Optional[builtins.str] = None,
         platform: typing.Optional[builtins.str] = None,
         target_stage: typing.Optional[builtins.str] = None,
     ) -> "DockerImage":
@@ -12254,6 +12831,7 @@ class DockerImage(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.DockerImage"):
         :param cache_from: Cache from options to pass to the ``docker build`` command. Default: - no cache from args are passed
         :param cache_to: Cache to options to pass to the ``docker build`` command. Default: - no cache to args are passed
         :param file: Name of the Dockerfile, must relative to the docker build path. Default: ``Dockerfile``
+        :param network: Docker `Networking options <https://docs.docker.com/reference/cli/docker/buildx/build/#network>`_. Default: - no networking options
         :param platform: Set platform if server is multi-platform capable. *Requires Docker Engine API v1.38+*. Example value: ``linux/amd64`` Default: - no platform specified
         :param target_stage: Set build target for multi-stage container builds. Any stage defined afterwards will be ignored. Example value: ``build-env`` Default: - Build all stages defined in the Dockerfile
         '''
@@ -12266,6 +12844,7 @@ class DockerImage(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.DockerImage"):
             cache_from=cache_from,
             cache_to=cache_to,
             file=file,
+            network=network,
             platform=platform,
             target_stage=target_stage,
         )
@@ -13139,19 +13718,19 @@ class Duration(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Duration"):
 
     Example::
 
-        # my_role: iam.Role
+        import aws_cdk.aws_lambda as lambda_
         
-        cr.AwsCustomResource(self, "Customized",
-            role=my_role,  # must be assumable by the `lambda.amazonaws.com` service principal
-            timeout=Duration.minutes(10),  # defaults to 2 minutes
-            memory_size=1025,  # defaults to 512 if installLatestAwsSdk is true
-            log_group=logs.LogGroup(self, "AwsCustomResourceLogs",
-                retention=logs.RetentionDays.ONE_DAY
-            ),
-            function_name="my-custom-name",  # defaults to a CloudFormation generated name
-            removal_policy=RemovalPolicy.RETAIN,  # defaults to `RemovalPolicy.DESTROY`
-            policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
-                resources=cr.AwsCustomResourcePolicy.ANY_RESOURCE
+        # fn: lambda.Function
+        
+        fn_url = fn.add_function_url(auth_type=lambda_.FunctionUrlAuthType.NONE)
+        
+        cloudfront.Distribution(self, "Distribution",
+            default_behavior=cloudfront.BehaviorOptions(
+                origin=origins.FunctionUrlOrigin(fn_url,
+                    read_timeout=Duration.seconds(30),
+                    response_completion_timeout=Duration.seconds(90),
+                    keepalive_timeout=Duration.seconds(45)
+                )
             )
         )
     '''
@@ -13462,7 +14041,6 @@ class Environment:
         Example::
 
             import aws_cdk as cdk
-            import aws_cdk.aws_cloudwatch as cloudwatch
             
             
             app = cdk.App()
@@ -13470,18 +14048,10 @@ class Environment:
             
             global_table = dynamodb.TableV2(stack, "GlobalTable",
                 partition_key=dynamodb.Attribute(name="pk", type=dynamodb.AttributeType.STRING),
-                replicas=[dynamodb.ReplicaTableProps(region="us-east-1"), dynamodb.ReplicaTableProps(region="us-east-2")
-                ]
+                replicas=[dynamodb.ReplicaTableProps(region="us-east-1")]
             )
             
-            # metric is only for the table in us-west-2
-            metric = global_table.metric_consumed_read_capacity_units()
-            
-            cloudwatch.Alarm(self, "Alarm",
-                metric=metric,
-                evaluation_periods=1,
-                threshold=1
-            )
+            global_table.add_replica(region="us-east-2", deletion_protection=True)
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__779551ef0a4b144070fd2c3e88ff076e32ad12d30facdc65a940b7a8791f27c6)
@@ -13568,6 +14138,21 @@ class Errors(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Errors"):
             check_type(argname="argument x", value=x, expected_type=type_hints["x"])
         return typing.cast(builtins.bool, jsii.sinvoke(cls, "isAssertionError", [x]))
 
+    @jsii.member(jsii_name="isAssumptionError")
+    @builtins.classmethod
+    def is_assumption_error(cls, x: typing.Any) -> builtins.bool:
+        '''Test whether the given error is an AssumptionError.
+
+        An AssumptionError is thrown when a construct made an assumption somewhere that doesn't hold true.
+        This error always indicates a bug in the construct.
+
+        :param x: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__1c1f003fc36fb573df38915f709b99bb9c1a74aac84c52ba7fe12c54cf2cae8d)
+            check_type(argname="argument x", value=x, expected_type=type_hints["x"])
+        return typing.cast(builtins.bool, jsii.sinvoke(cls, "isAssumptionError", [x]))
+
     @jsii.member(jsii_name="isCloudAssemblyError")
     @builtins.classmethod
     def is_cloud_assembly_error(cls, x: typing.Any) -> builtins.bool:
@@ -13597,6 +14182,20 @@ class Errors(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Errors"):
             check_type(argname="argument x", value=x, expected_type=type_hints["x"])
         return typing.cast(builtins.bool, jsii.sinvoke(cls, "isConstructError", [x]))
 
+    @jsii.member(jsii_name="isExecutionError")
+    @builtins.classmethod
+    def is_execution_error(cls, x: typing.Any) -> builtins.bool:
+        '''Test whether the given error is an ExecutionError.
+
+        An ExecutionError is thrown if an externally executed script or code failed.
+
+        :param x: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__f2bf053437a17fa72244a5b0342af56acbb0f4ad4bc7fc877ac3974df0b811d3)
+            check_type(argname="argument x", value=x, expected_type=type_hints["x"])
+        return typing.cast(builtins.bool, jsii.sinvoke(cls, "isExecutionError", [x]))
+
     @jsii.member(jsii_name="isValidationError")
     @builtins.classmethod
     def is_validation_error(cls, x: typing.Any) -> builtins.bool:
@@ -13728,17 +14327,16 @@ class ExportValueOptions:
         :param description: The description of the outputs. Default: - No description
         :param name: The name of the export to create. Default: - A name is automatically chosen
 
-        :exampleMetadata: fixture=_generated
+        :exampleMetadata: infused
 
         Example::
 
-            # The code below shows an example of how to instantiate this type.
-            # The values are placeholders you should change.
-            import aws_cdk as cdk
+            # stack: Stack
             
-            export_value_options = cdk.ExportValueOptions(
-                description="description",
-                name="name"
+            
+            stack.export_value(my_bucket.bucket_name,
+                name="TheAwesomeBucket",
+                description="The name of an S3 bucket"
             )
         '''
         if __debug__:
@@ -15180,6 +15778,7 @@ class Fn(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Fn"):
     jsii_struct_bases=[],
     name_mapping={
         "provider": "provider",
+        "additional_cache_key": "additionalCacheKey",
         "include_environment": "includeEnvironment",
         "props": "props",
     },
@@ -15189,11 +15788,13 @@ class GetContextKeyOptions:
         self,
         *,
         provider: builtins.str,
+        additional_cache_key: typing.Optional[builtins.str] = None,
         include_environment: typing.Optional[builtins.bool] = None,
         props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     ) -> None:
         '''
         :param provider: The context provider to query.
+        :param additional_cache_key: Adds an additional discriminator to the ``cdk.context.json`` cache key. Default: - no additional cache key
         :param include_environment: Whether to include the stack's account and region automatically. Default: true
         :param props: Provider-specific properties.
 
@@ -15211,6 +15812,7 @@ class GetContextKeyOptions:
                 provider="provider",
             
                 # the properties below are optional
+                additional_cache_key="additionalCacheKey",
                 include_environment=False,
                 props={
                     "props_key": props
@@ -15220,11 +15822,14 @@ class GetContextKeyOptions:
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__4a3bc64bd38ef14ad5ebdf5807563d2355b26f4f0c446c315782c9818b76192a)
             check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
+            check_type(argname="argument additional_cache_key", value=additional_cache_key, expected_type=type_hints["additional_cache_key"])
             check_type(argname="argument include_environment", value=include_environment, expected_type=type_hints["include_environment"])
             check_type(argname="argument props", value=props, expected_type=type_hints["props"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "provider": provider,
         }
+        if additional_cache_key is not None:
+            self._values["additional_cache_key"] = additional_cache_key
         if include_environment is not None:
             self._values["include_environment"] = include_environment
         if props is not None:
@@ -15237,6 +15842,15 @@ class GetContextKeyOptions:
         assert result is not None, "Required property 'provider' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def additional_cache_key(self) -> typing.Optional[builtins.str]:
+        '''Adds an additional discriminator to the ``cdk.context.json`` cache key.
+
+        :default: - no additional cache key
+        '''
+        result = self._values.get("additional_cache_key")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def include_environment(self) -> typing.Optional[builtins.bool]:
         '''Whether to include the stack's account and region automatically.
@@ -15335,6 +15949,7 @@ class GetContextKeyResult:
     jsii_struct_bases=[GetContextKeyOptions],
     name_mapping={
         "provider": "provider",
+        "additional_cache_key": "additionalCacheKey",
         "include_environment": "includeEnvironment",
         "props": "props",
         "dummy_value": "dummyValue",
@@ -15347,6 +15962,7 @@ class GetContextValueOptions(GetContextKeyOptions):
         self,
         *,
         provider: builtins.str,
+        additional_cache_key: typing.Optional[builtins.str] = None,
         include_environment: typing.Optional[builtins.bool] = None,
         props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
         dummy_value: typing.Any,
@@ -15355,6 +15971,7 @@ class GetContextValueOptions(GetContextKeyOptions):
     ) -> None:
         '''
         :param provider: The context provider to query.
+        :param additional_cache_key: Adds an additional discriminator to the ``cdk.context.json`` cache key. Default: - no additional cache key
         :param include_environment: Whether to include the stack's account and region automatically. Default: true
         :param props: Provider-specific properties.
         :param dummy_value: The value to return if the lookup has not yet been performed. Upon first synthesis, the lookups has not yet been performed. The ``getValue()`` operation returns this value instead, so that synthesis can proceed. After synthesis completes the first time, the actual lookup will be performed and synthesis will run again with the *real* value. Dummy values should preferably have valid shapes so that downstream consumers of lookup values don't throw validation exceptions if they encounter a dummy value (or all possible downstream consumers need to effectively check for the well-known shape of the dummy value); throwing an exception would error out the synthesis operation and prevent the lookup and the second, real, synthesis from happening. Connection to mustExist ``dummyValue`` is also used as the official value to return if the lookup has failed and ``mustExist == false``.
@@ -15377,6 +15994,7 @@ class GetContextValueOptions(GetContextKeyOptions):
                 provider="provider",
             
                 # the properties below are optional
+                additional_cache_key="additionalCacheKey",
                 ignore_error_on_missing_context=False,
                 include_environment=False,
                 must_exist=False,
@@ -15388,6 +16006,7 @@ class GetContextValueOptions(GetContextKeyOptions):
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__16ea3024419c210903405ca05f7de1bb3fad517c101a7a84926fb5e09ac784ec)
             check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
+            check_type(argname="argument additional_cache_key", value=additional_cache_key, expected_type=type_hints["additional_cache_key"])
             check_type(argname="argument include_environment", value=include_environment, expected_type=type_hints["include_environment"])
             check_type(argname="argument props", value=props, expected_type=type_hints["props"])
             check_type(argname="argument dummy_value", value=dummy_value, expected_type=type_hints["dummy_value"])
@@ -15397,6 +16016,8 @@ class GetContextValueOptions(GetContextKeyOptions):
             "provider": provider,
             "dummy_value": dummy_value,
         }
+        if additional_cache_key is not None:
+            self._values["additional_cache_key"] = additional_cache_key
         if include_environment is not None:
             self._values["include_environment"] = include_environment
         if props is not None:
@@ -15413,6 +16034,15 @@ class GetContextValueOptions(GetContextKeyOptions):
         assert result is not None, "Required property 'provider' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def additional_cache_key(self) -> typing.Optional[builtins.str]:
+        '''Adds an additional discriminator to the ``cdk.context.json`` cache key.
+
+        :default: - no additional cache key
+        '''
+        result = self._values.get("additional_cache_key")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def include_environment(self) -> typing.Optional[builtins.bool]:
         '''Whether to include the stack's account and region automatically.
@@ -15938,6 +16568,50 @@ class _ICfnResourceOptionsProxy:
 typing.cast(typing.Any, ICfnResourceOptions).__jsii_proxy_class__ = lambda : _ICfnResourceOptionsProxy
 
 
+@jsii.interface(jsii_type="aws-cdk-lib.IEnvironmentAware")
+class IEnvironmentAware(typing_extensions.Protocol):
+    '''Used to indicate that a particular construct has an resource environment.'''
+
+    @builtins.property
+    @jsii.member(jsii_name="env")
+    def env(self) -> _ResourceEnvironment_603baf00:
+        '''The environment this resource belongs to.
+
+        For resources that are created and managed in a Stack (those created by
+        creating new class instances like ``new Role()``, ``new Bucket()``, etc.), this
+        is always the same as the environment of the stack they belong to.
+
+        For referenced resources (those obtained from referencing methods like
+        ``Role.fromRoleArn()``, ``Bucket.fromBucketName()``, etc.), they might be
+        different than the stack they were imported into.
+        '''
+        ...
+
+
+class _IEnvironmentAwareProxy:
+    '''Used to indicate that a particular construct has an resource environment.'''
+
+    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.IEnvironmentAware"
+
+    @builtins.property
+    @jsii.member(jsii_name="env")
+    def env(self) -> _ResourceEnvironment_603baf00:
+        '''The environment this resource belongs to.
+
+        For resources that are created and managed in a Stack (those created by
+        creating new class instances like ``new Role()``, ``new Bucket()``, etc.), this
+        is always the same as the environment of the stack they belong to.
+
+        For referenced resources (those obtained from referencing methods like
+        ``Role.fromRoleArn()``, ``Bucket.fromBucketName()``, etc.), they might be
+        different than the stack they were imported into.
+        '''
+        return typing.cast(_ResourceEnvironment_603baf00, jsii.get(self, "env"))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, IEnvironmentAware).__jsii_proxy_class__ = lambda : _IEnvironmentAwareProxy
+
+
 @jsii.interface(jsii_type="aws-cdk-lib.IFragmentConcatenator")
 class IFragmentConcatenator(typing_extensions.Protocol):
     '''Function used to concatenate symbols in the target document language.
@@ -16410,6 +17084,75 @@ class _IPostProcessorProxy:
 typing.cast(typing.Any, IPostProcessor).__jsii_proxy_class__ = lambda : _IPostProcessorProxy
 
 
+@jsii.interface(jsii_type="aws-cdk-lib.IPropertyInjector")
+class IPropertyInjector(typing_extensions.Protocol):
+    '''This interface define an inject function that operates on a Construct's Property.
+
+    The Construct must have a constructUniqueId to uniquely identify itself.
+    '''
+
+    @builtins.property
+    @jsii.member(jsii_name="constructUniqueId")
+    def construct_unique_id(self) -> builtins.str:
+        '''The unique Id of the Construct class.'''
+        ...
+
+    @jsii.member(jsii_name="inject")
+    def inject(
+        self,
+        original_props: typing.Any,
+        *,
+        id: builtins.str,
+        scope: _constructs_77d1e7e8.Construct,
+    ) -> typing.Any:
+        '''The injector to be applied to the constructor properties of the Construct.
+
+        :param original_props: -
+        :param id: id from the Construct constructor.
+        :param scope: scope from the constructor.
+        '''
+        ...
+
+
+class _IPropertyInjectorProxy:
+    '''This interface define an inject function that operates on a Construct's Property.
+
+    The Construct must have a constructUniqueId to uniquely identify itself.
+    '''
+
+    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.IPropertyInjector"
+
+    @builtins.property
+    @jsii.member(jsii_name="constructUniqueId")
+    def construct_unique_id(self) -> builtins.str:
+        '''The unique Id of the Construct class.'''
+        return typing.cast(builtins.str, jsii.get(self, "constructUniqueId"))
+
+    @jsii.member(jsii_name="inject")
+    def inject(
+        self,
+        original_props: typing.Any,
+        *,
+        id: builtins.str,
+        scope: _constructs_77d1e7e8.Construct,
+    ) -> typing.Any:
+        '''The injector to be applied to the constructor properties of the Construct.
+
+        :param original_props: -
+        :param id: id from the Construct constructor.
+        :param scope: scope from the constructor.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a84c13d89fffb1ee8026280d3071636f041aaa121bab44f9659e3255feca881d)
+            check_type(argname="argument original_props", value=original_props, expected_type=type_hints["original_props"])
+        context = InjectionContext(id=id, scope=scope)
+
+        return typing.cast(typing.Any, jsii.invoke(self, "inject", [original_props, context]))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, IPropertyInjector).__jsii_proxy_class__ = lambda : _IPropertyInjectorProxy
+
+
 @jsii.interface(jsii_type="aws-cdk-lib.IResolvable")
 class IResolvable(typing_extensions.Protocol):
     '''Interface for values that can be resolvable later.
@@ -16606,22 +17349,12 @@ typing.cast(typing.Any, IResolveContext).__jsii_proxy_class__ = lambda : _IResol
 
 
 @jsii.interface(jsii_type="aws-cdk-lib.IResource")
-class IResource(_constructs_77d1e7e8.IConstruct, typing_extensions.Protocol):
-    '''Interface for the Resource construct.'''
-
-    @builtins.property
-    @jsii.member(jsii_name="env")
-    def env(self) -> "ResourceEnvironment":
-        '''The environment this resource belongs to.
-
-        For resources that are created and managed by the CDK
-        (generally, those created by creating new class instances like Role, Bucket, etc.),
-        this is always the same as the environment of the stack they belong to;
-        however, for imported resources
-        (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
-        that might be different than the stack they were imported into.
-        '''
-        ...
+class IResource(
+    _constructs_77d1e7e8.IConstruct,
+    _IEnvironmentAware_f39049ee,
+    typing_extensions.Protocol,
+):
+    '''Interface for L2 Resource constructs.'''
 
     @builtins.property
     @jsii.member(jsii_name="stack")
@@ -16648,25 +17381,12 @@ class IResource(_constructs_77d1e7e8.IConstruct, typing_extensions.Protocol):
 
 class _IResourceProxy(
     jsii.proxy_for(_constructs_77d1e7e8.IConstruct), # type: ignore[misc]
+    jsii.proxy_for(_IEnvironmentAware_f39049ee), # type: ignore[misc]
 ):
-    '''Interface for the Resource construct.'''
+    '''Interface for L2 Resource constructs.'''
 
     __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.IResource"
 
-    @builtins.property
-    @jsii.member(jsii_name="env")
-    def env(self) -> "ResourceEnvironment":
-        '''The environment this resource belongs to.
-
-        For resources that are created and managed by the CDK
-        (generally, those created by creating new class instances like Role, Bucket, etc.),
-        this is always the same as the environment of the stack they belong to;
-        however, for imported resources
-        (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
-        that might be different than the stack they were imported into.
-        '''
-        return typing.cast("ResourceEnvironment", jsii.get(self, "env"))
-
     @builtins.property
     @jsii.member(jsii_name="stack")
     def stack(self) -> "Stack":
@@ -17665,6 +18385,22 @@ class IgnoreStrategy(
         '''
         ...
 
+    @jsii.member(jsii_name="completelyIgnores")
+    def completely_ignores(
+        self,
+        absolute_directory_path: builtins.str,
+    ) -> builtins.bool:
+        '''Determines whether a given directory path should be ignored and have all of its children ignored.
+
+        :param absolute_directory_path: absolute directory path to be assessed against the pattern.
+
+        :return: ``true`` if the directory and all of its children should be ignored
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__3a80a66d2944a2c289e3c51a3686487dddf7c755eb54d7726f3fd91652eddcde)
+            check_type(argname="argument absolute_directory_path", value=absolute_directory_path, expected_type=type_hints["absolute_directory_path"])
+        return typing.cast(builtins.bool, jsii.invoke(self, "completelyIgnores", [absolute_directory_path]))
+
     @jsii.member(jsii_name="ignores")
     @abc.abstractmethod
     def ignores(self, absolute_file_path: builtins.str) -> builtins.bool:
@@ -17708,6 +18444,74 @@ class _IgnoreStrategyProxy(IgnoreStrategy):
 typing.cast(typing.Any, IgnoreStrategy).__jsii_proxy_class__ = lambda : _IgnoreStrategyProxy
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.InjectionContext",
+    jsii_struct_bases=[],
+    name_mapping={"id": "id", "scope": "scope"},
+)
+class InjectionContext:
+    def __init__(
+        self,
+        *,
+        id: builtins.str,
+        scope: _constructs_77d1e7e8.Construct,
+    ) -> None:
+        '''This defines the values needed for Injection.
+
+        :param id: id from the Construct constructor.
+        :param scope: scope from the constructor.
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            import aws_cdk as cdk
+            import constructs as constructs
+            
+            # construct: constructs.Construct
+            
+            injection_context = cdk.InjectionContext(
+                id="id",
+                scope=construct
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__474d9096cc3297bd5f64e3e487372aedd71d529e93d80a946aa117f0e0f8bc5b)
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "id": id,
+            "scope": scope,
+        }
+
+    @builtins.property
+    def id(self) -> builtins.str:
+        '''id from the Construct constructor.'''
+        result = self._values.get("id")
+        assert result is not None, "Required property 'id' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def scope(self) -> _constructs_77d1e7e8.Construct:
+        '''scope from the  constructor.'''
+        result = self._values.get("scope")
+        assert result is not None, "Required property 'scope' is missing"
+        return typing.cast(_constructs_77d1e7e8.Construct, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "InjectionContext(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.implements(IResolvable)
 class Intrinsic(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Intrinsic"):
     '''Token subclass that represents values intrinsic to the target document language.
@@ -19344,6 +20148,92 @@ class PolicyViolationBeta1:
         )
 
 
+class PropertyInjectors(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.PropertyInjectors",
+):
+    '''This is a collection of ProjectInjectors assigned to this scope.
+
+    It is keyed by constructUniqueId.  There can be only one ProjectInjector for a constructUniqueId.
+
+    :exampleMetadata: fixture=_generated
+
+    Example::
+
+        # The code below shows an example of how to instantiate this type.
+        # The values are placeholders you should change.
+        import aws_cdk as cdk
+        
+        property_injectors = cdk.PropertyInjectors.of(self)
+    '''
+
+    @jsii.member(jsii_name="hasPropertyInjectors")
+    @builtins.classmethod
+    def has_property_injectors(cls, x: typing.Any) -> builtins.bool:
+        '''Return whether the given object has a PropertyInjectors property.
+
+        We do attribute detection since we can't reliably use 'instanceof'.
+
+        :param x: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4200e15e2cc09377aa6dd49e79c545a26e8c65589955f7210d145afb4881fcc5)
+            check_type(argname="argument x", value=x, expected_type=type_hints["x"])
+        return typing.cast(builtins.bool, jsii.sinvoke(cls, "hasPropertyInjectors", [x]))
+
+    @jsii.member(jsii_name="of")
+    @builtins.classmethod
+    def of(cls, scope: _constructs_77d1e7e8.IConstruct) -> "PropertyInjectors":
+        '''Returns the ``PropertyInjectors`` object associated with a construct scope.
+
+        If ``PropertyInjectors`` object doesn't exist on this scope, then it creates one and attaches it to scope.
+
+        :param scope: The scope for which these PropertyInjectors will apply.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__d558bd5d62319107ba8d7aec423cb982f18f533d7f90939b4576ae5cabe237e6)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+        return typing.cast("PropertyInjectors", jsii.sinvoke(cls, "of", [scope]))
+
+    @jsii.member(jsii_name="add")
+    def add(self, *props_injectors: IPropertyInjector) -> None:
+        '''Add a list of  IPropertyInjectors to this collection of PropertyInjectors.
+
+        :param props_injectors: - a list of IPropertyInjector.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b15ed456b528cac4ffc455783d09279b63e060419397678acf12dc8a07323ae9)
+            check_type(argname="argument props_injectors", value=props_injectors, expected_type=typing.Tuple[type_hints["props_injectors"], ...]) # pyright: ignore [reportGeneralTypeIssues]
+        return typing.cast(None, jsii.invoke(self, "add", [*props_injectors]))
+
+    @jsii.member(jsii_name="for")
+    def for_(self, unique_id: builtins.str) -> typing.Optional[IPropertyInjector]:
+        '''Get the PropertyInjector that is registered to the Construct's uniqueId.
+
+        :param unique_id: - the construct uniqueId.
+
+        :return: - the IPropertyInjector for that construct uniqueId
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__ba79b618f23d72687ff58834f8d791bcc5f41fb49c8301987bb45eee4378958b)
+            check_type(argname="argument unique_id", value=unique_id, expected_type=type_hints["unique_id"])
+        return typing.cast(typing.Optional[IPropertyInjector], jsii.invoke(self, "for", [unique_id]))
+
+    @jsii.member(jsii_name="supportedClasses")
+    def supported_classes(self) -> typing.List[builtins.str]:
+        '''This returns a list of the Constructs that are supporting by this PropertyInjectors.
+
+        :return: a list of string showing the supported Constructs.
+        '''
+        return typing.cast(typing.List[builtins.str], jsii.invoke(self, "supportedClasses", []))
+
+    @builtins.property
+    @jsii.member(jsii_name="scope")
+    def scope(self) -> _constructs_77d1e7e8.IConstruct:
+        '''The scope attached to Injectors.'''
+        return typing.cast(_constructs_77d1e7e8.IConstruct, jsii.get(self, "scope"))
+
+
 class Reference(
     Intrinsic,
     metaclass=jsii.JSIIAbstractClass,
@@ -19574,35 +20464,53 @@ class RemovalPolicy(enum.Enum):
        cfn_bucket = bucket.node.find_child("Resource")
        cfn_bucket.apply_removal_policy(RemovalPolicy.DESTROY)
 
-    :exampleMetadata: infused
+    :exampleMetadata: fixture=default infused
 
     Example::
 
-        # my_role: iam.Role
+        bucket = s3.Bucket(self, "memoryBucket",
+            bucket_name="test-memory",
+            removal_policy=cdk.RemovalPolicy.DESTROY,
+            auto_delete_objects=True
+        )
+        
+        topic = sns.Topic(self, "topic")
         
-        cr.AwsCustomResource(self, "Customized",
-            role=my_role,  # must be assumable by the `lambda.amazonaws.com` service principal
-            timeout=Duration.minutes(10),  # defaults to 2 minutes
-            memory_size=1025,  # defaults to 512 if installLatestAwsSdk is true
-            log_group=logs.LogGroup(self, "AwsCustomResourceLogs",
-                retention=logs.RetentionDays.ONE_DAY
+        # Create a custom semantic memory strategy
+        self_managed_strategy = agentcore.MemoryStrategy.using_self_managed(
+            name="selfManagedStrategy",
+            description="self managed memory strategy",
+            historical_context_window_size=5,
+            invocation_configuration=agentcore.InvocationConfiguration(
+                topic=topic,
+                s3_location=s3.Location(
+                    bucket_name=bucket.bucket_name,
+                    object_key="memory/"
+                )
             ),
-            function_name="my-custom-name",  # defaults to a CloudFormation generated name
-            removal_policy=RemovalPolicy.RETAIN,  # defaults to `RemovalPolicy.DESTROY`
-            policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
-                resources=cr.AwsCustomResourcePolicy.ANY_RESOURCE
+            trigger_conditions=agentcore.TriggerConditions(
+                message_based_trigger=1,
+                time_based_trigger=cdk.Duration.seconds(10),
+                token_based_trigger=100
             )
         )
+        
+        # Create memory with custom strategy
+        memory = agentcore.Memory(self, "MyMemory",
+            memory_name="my-custom-memory",
+            description="Memory with custom strategy",
+            expiration_duration=cdk.Duration.days(90),
+            memory_strategies=[self_managed_strategy]
+        )
     '''
 
     DESTROY = "DESTROY"
-    '''This is the default removal policy.
+    '''When this removal policy is applied, the resource will be physically destroyed when it is removed from the stack or when the stack is deleted.'''
+    RETAIN = "RETAIN"
+    '''This uses the 'Retain' DeletionPolicy, which will cause the resource to be retained in the account, but orphaned from the stack.
 
-    It means that when the resource is
-    removed from the app, it will be physically destroyed.
+    Most resources default to this removal policy.
     '''
-    RETAIN = "RETAIN"
-    '''This uses the 'Retain' DeletionPolicy, which will cause the resource to be retained in the account, but orphaned from the stack.'''
     SNAPSHOT = "SNAPSHOT"
     '''This retention policy deletes the resource, but saves a snapshot of its data before deleting, so that it can be re-created later.
 
@@ -19724,18 +20632,36 @@ class RemovalPolicyProps:
         :param exclude_resource_types: Exclude specific resource types from the removal policy. Can be a CloudFormation resource type string (e.g., 'AWS::S3::Bucket'). Default: - no exclusions
         :param priority: The priority to use when applying this policy. The priority affects only the order in which aspects are applied during synthesis. For RemovalPolicies, the last applied policy will override previous ones. NOTE: Priority does NOT determine which policy "wins" when there are conflicts. The order of application determines the final policy, with later policies overriding earlier ones. Default: - AspectPriority.MUTATING
 
-        :exampleMetadata: fixture=_generated
+        :exampleMetadata: infused
 
         Example::
 
-            # The code below shows an example of how to instantiate this type.
-            # The values are placeholders you should change.
-            import aws_cdk as cdk
+            # scope: Construct
+            # parent: Construct
+            # bucket: s3.CfnBucket
             
-            removal_policy_props = cdk.RemovalPolicyProps(
-                apply_to_resource_types=["applyToResourceTypes"],
-                exclude_resource_types=["excludeResourceTypes"],
-                priority=123
+            
+            # Apply DESTROY policy to all resources in a scope
+            RemovalPolicies.of(scope).destroy()
+            
+            # Apply RETAIN policy to all resources in a scope
+            RemovalPolicies.of(scope).retain()
+            
+            # Apply SNAPSHOT policy to all resources in a scope
+            RemovalPolicies.of(scope).snapshot()
+            
+            # Apply RETAIN_ON_UPDATE_OR_DELETE policy to all resources in a scope
+            RemovalPolicies.of(scope).retain_on_update_or_delete()
+            
+            # Apply RETAIN policy only to specific resource types
+            RemovalPolicies.of(parent).retain(
+                apply_to_resource_types=["AWS::DynamoDB::Table", bucket.cfn_resource_type, rds.CfnDBInstance.CFN_RESOURCE_TYPE_NAME
+                ]
+            )
+            
+            # Apply SNAPSHOT policy excluding specific resource types
+            RemovalPolicies.of(scope).snapshot(
+                exclude_resource_types=["AWS::Test::Resource"]
             )
         '''
         if __debug__:
@@ -20094,7 +21020,7 @@ class Resource(
     metaclass=jsii.JSIIAbstractClass,
     jsii_type="aws-cdk-lib.Resource",
 ):
-    '''A construct which represents an AWS resource.
+    '''An L2 construct which represents an AWS resource.
 
     :exampleMetadata: infused
 
@@ -20257,17 +21183,18 @@ class Resource(
 
     @builtins.property
     @jsii.member(jsii_name="env")
-    def env(self) -> "ResourceEnvironment":
+    def env(self) -> _ResourceEnvironment_603baf00:
         '''The environment this resource belongs to.
 
-        For resources that are created and managed by the CDK
-        (generally, those created by creating new class instances like Role, Bucket, etc.),
-        this is always the same as the environment of the stack they belong to;
-        however, for imported resources
-        (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
-        that might be different than the stack they were imported into.
+        For resources that are created and managed in a Stack (those created by
+        creating new class instances like ``new Role()``, ``new Bucket()``, etc.), this
+        is always the same as the environment of the stack they belong to.
+
+        For referenced resources (those obtained from referencing methods like
+        ``Role.fromRoleArn()``, ``Bucket.fromBucketName()``, etc.), they might be
+        different than the stack they were imported into.
         '''
-        return typing.cast("ResourceEnvironment", jsii.get(self, "env"))
+        return typing.cast(_ResourceEnvironment_603baf00, jsii.get(self, "env"))
 
     @builtins.property
     @jsii.member(jsii_name="physicalName")
@@ -20306,10 +21233,10 @@ class ResourceEnvironment:
     def __init__(self, *, account: builtins.str, region: builtins.str) -> None:
         '''Represents the environment a given resource lives in.
 
-        Used as the return value for the ``IResource.env`` property.
+        Used as the return value for the ``IEnvironmentAware.env`` property.
 
-        :param account: The AWS account ID that this resource belongs to. Since this can be a Token (for example, when the account is CloudFormation's AWS::AccountId intrinsic), make sure to use Token.compareStrings() instead of just comparing the values for equality.
-        :param region: The AWS region that this resource belongs to. Since this can be a Token (for example, when the region is CloudFormation's AWS::Region intrinsic), make sure to use Token.compareStrings() instead of just comparing the values for equality.
+        :param account: The AWS Account ID that this resource belongs to. Since this can be a Token (for example, when the account is CloudFormation's ``AWS::AccountId`` intrinsic), make sure to use ``Token.compareStrings()`` instead of comparing the values with direct string equality.
+        :param region: The AWS Region that this resource belongs to. Since this can be a Token (for example, when the region is CloudFormation's ``AWS::Region`` intrinsic), make sure to use ``Token.compareStrings()`` instead of comparing the values with direct string equality.
 
         :exampleMetadata: fixture=_generated
 
@@ -20319,7 +21246,7 @@ class ResourceEnvironment:
             # The values are placeholders you should change.
             import aws_cdk as cdk
             
-            resource_environment = cdk.ResourceEnvironment(
+            resource_environment = cdk.interfaces.ResourceEnvironment(
                 account="account",
                 region="region"
             )
@@ -20335,12 +21262,12 @@ class ResourceEnvironment:
 
     @builtins.property
     def account(self) -> builtins.str:
-        '''The AWS account ID that this resource belongs to.
+        '''The AWS Account ID that this resource belongs to.
 
-        Since this can be a Token
-        (for example, when the account is CloudFormation's AWS::AccountId intrinsic),
-        make sure to use Token.compareStrings()
-        instead of just comparing the values for equality.
+        Since this can be a Token (for example, when the account is
+        CloudFormation's ``AWS::AccountId`` intrinsic), make sure to use
+        ``Token.compareStrings()`` instead of comparing the values with direct
+        string equality.
         '''
         result = self._values.get("account")
         assert result is not None, "Required property 'account' is missing"
@@ -20348,12 +21275,11 @@ class ResourceEnvironment:
 
     @builtins.property
     def region(self) -> builtins.str:
-        '''The AWS region that this resource belongs to.
+        '''The AWS Region that this resource belongs to.
 
-        Since this can be a Token
-        (for example, when the region is CloudFormation's AWS::Region intrinsic),
-        make sure to use Token.compareStrings()
-        instead of just comparing the values for equality.
+        Since this can be a Token (for example, when the region is CloudFormation's
+        ``AWS::Region`` intrinsic), make sure to use ``Token.compareStrings()`` instead
+        of comparing the values with direct string equality.
         '''
         result = self._values.get("region")
         assert result is not None, "Required property 'region' is missing"
@@ -20741,16 +21667,20 @@ class SecretValue(
 
     Example::
 
-        # my_hosted_zone: route53.IPublicHostedZone
-        
-        
-        ses.EmailIdentity(self, "Identity",
-            identity=ses.Identity.public_hosted_zone(my_hosted_zone),
-            dkim_identity=ses.DkimIdentity.byo_dkim(
-                private_key=SecretValue.secrets_manager("dkim-private-key"),
-                public_key="...base64-encoded-public-key...",
-                selector="selector"
-            )
+        # Read the secret from Secrets Manager
+        pipeline = codepipeline.Pipeline(self, "MyPipeline")
+        source_output = codepipeline.Artifact()
+        source_action = codepipeline_actions.GitHubSourceAction(
+            action_name="GitHub_Source",
+            owner="awslabs",
+            repo="aws-cdk",
+            oauth_token=SecretValue.secrets_manager("my-github-token"),
+            output=source_output,
+            branch="develop"
+        )
+        pipeline.add_stage(
+            stage_name="Source",
+            actions=[source_action]
         )
     '''
 
@@ -20791,6 +21721,34 @@ class SecretValue(
             check_type(argname="argument ref", value=ref, expected_type=type_hints["ref"])
         return typing.cast("SecretValue", jsii.sinvoke(cls, "cfnDynamicReference", [ref]))
 
+    @jsii.member(jsii_name="cfnDynamicReferenceKey")
+    @builtins.classmethod
+    def cfn_dynamic_reference_key(
+        cls,
+        secret_id: builtins.str,
+        *,
+        json_field: typing.Optional[builtins.str] = None,
+        version_id: typing.Optional[builtins.str] = None,
+        version_stage: typing.Optional[builtins.str] = None,
+    ) -> builtins.str:
+        '''Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load a secret from AWS Secrets Manager.
+
+        :param secret_id: The ID or ARN of the secret.
+        :param json_field: The key of a JSON field to retrieve. This can only be used if the secret stores a JSON object. Default: - returns all the content stored in the Secrets Manager secret.
+        :param version_id: Specifies the unique identifier of the version of the secret you want to use. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+        :param version_stage: Specifies the secret version that you want to retrieve by the staging label attached to the version. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+
+        :see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__ba81ab5d0a7811c904f34d1d9805888e14bbd4da3987d73185cb1acbfc46df06)
+            check_type(argname="argument secret_id", value=secret_id, expected_type=type_hints["secret_id"])
+        options = SecretsManagerSecretOptions(
+            json_field=json_field, version_id=version_id, version_stage=version_stage
+        )
+
+        return typing.cast(builtins.str, jsii.sinvoke(cls, "cfnDynamicReferenceKey", [secret_id, options]))
+
     @jsii.member(jsii_name="cfnParameter")
     @builtins.classmethod
     def cfn_parameter(cls, param: CfnParameter) -> "SecretValue":
@@ -21071,24 +22029,24 @@ class Size(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Size"):
 
     Example::
 
-        # bucket: s3.Bucket
-        # Provide a Lambda function that will transform records before delivery, with custom
-        # buffering and retry configuration
-        lambda_function = lambda_.Function(self, "Processor",
-            runtime=lambda_.Runtime.NODEJS_LATEST,
-            handler="index.handler",
-            code=lambda_.Code.from_asset(path.join(__dirname, "process-records"))
-        )
-        lambda_processor = firehose.LambdaFunctionProcessor(lambda_function,
-            buffer_interval=Duration.minutes(5),
-            buffer_size=Size.mebibytes(5),
-            retries=5
-        )
-        s3_destination = firehose.S3Bucket(bucket,
-            processor=lambda_processor
-        )
-        firehose.DeliveryStream(self, "Delivery Stream",
-            destination=s3_destination
+        # my_file_system: efs.IFileSystem
+        # my_job_role: iam.Role
+        
+        my_file_system.grant_read(my_job_role)
+        
+        job_defn = batch.EcsJobDefinition(self, "JobDefn",
+            container=batch.EcsEc2ContainerDefinition(self, "containerDefn",
+                image=ecs.ContainerImage.from_registry("public.ecr.aws/amazonlinux/amazonlinux:latest"),
+                memory=cdk.Size.mebibytes(2048),
+                cpu=256,
+                volumes=[batch.EcsVolume.efs(
+                    name="myVolume",
+                    file_system=my_file_system,
+                    container_path="/Volumes/myVolume",
+                    use_job_role=True
+                )],
+                job_role=my_job_role
+            )
         )
     '''
 
@@ -21410,6 +22368,7 @@ class Stack(
         env: typing.Optional[typing.Union[Environment, typing.Dict[builtins.str, typing.Any]]] = None,
         notification_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
         permissions_boundary: typing.Optional[PermissionsBoundary] = None,
+        property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
         stack_name: typing.Optional[builtins.str] = None,
         suppress_template_indentation: typing.Optional[builtins.bool] = None,
         synthesizer: typing.Optional[IStackSynthesizer] = None,
@@ -21424,12 +22383,13 @@ class Stack(
         :param cross_region_references: Enable this flag to allow native cross region stack references. Enabling this will create a CloudFormation custom resource in both the producing stack and consuming stack in order to perform the export/import This feature is currently experimental Default: false
         :param description: A description of the stack. Default: - No description.
         :param env: The AWS environment (account/region) where this stack will be deployed. Set the ``region``/``account`` fields of ``env`` to either a concrete value to select the indicated environment (recommended for production stacks), or to the values of environment variables ``CDK_DEFAULT_REGION``/``CDK_DEFAULT_ACCOUNT`` to let the target environment depend on the AWS credentials/configuration that the CDK CLI is executed under (recommended for development stacks). If the ``Stack`` is instantiated inside a ``Stage``, any undefined ``region``/``account`` fields from ``env`` will default to the same field on the encompassing ``Stage``, if configured there. If either ``region`` or ``account`` are not set nor inherited from ``Stage``, the Stack will be considered "*environment-agnostic*"". Environment-agnostic stacks can be deployed to any environment but may not be able to take advantage of all features of the CDK. For example, they will not be able to use environmental context lookups such as ``ec2.Vpc.fromLookup`` and will not automatically translate Service Principals to the right format based on the environment's AWS partition, and other such enhancements. Default: - The environment of the containing ``Stage`` if available, otherwise create the stack will be environment-agnostic.
-        :param notification_arns: SNS Topic ARNs that will receive stack events. Default: - no notfication arns.
+        :param notification_arns: SNS Topic ARNs that will receive stack events. Default: - no notification arns.
         :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Default: - no permissions boundary is applied
+        :param property_injectors: A list of IPropertyInjector attached to this Stack. Default: - no PropertyInjectors
         :param stack_name: Name to deploy the stack with. Default: - Derived from construct path.
         :param suppress_template_indentation: Enable this flag to suppress indentation in generated CloudFormation templates. If not specified, the value of the ``@aws-cdk/core:suppressTemplateIndentation`` context key will be used. If that is not specified, then the default value ``false`` will be used. Default: - the value of ``@aws-cdk/core:suppressTemplateIndentation``, or ``false`` if that is not set.
         :param synthesizer: Synthesis method to use while deploying this stack. The Stack Synthesizer controls aspects of synthesis and deployment, like how assets are referenced and what IAM roles to use. For more information, see the README of the main CDK package. If not specified, the ``defaultStackSynthesizer`` from ``App`` will be used. If that is not specified, ``DefaultStackSynthesizer`` is used if ``@aws-cdk/core:newStyleStackSynthesis`` is set to ``true`` or the CDK major version is v2. In CDK v1 ``LegacyStackSynthesizer`` is the default if no other synthesizer is specified. Default: - The synthesizer specified on ``App``, or ``DefaultStackSynthesizer`` otherwise.
-        :param tags: Stack tags that will be applied to all the taggable resources and the stack itself. Default: {}
+        :param tags: Tags that will be applied to the Stack. These tags are applied to the CloudFormation Stack itself. They will not appear in the CloudFormation template. However, at deployment time, CloudFormation will apply these tags to all resources in the stack that support tagging. You will not be able to exempt resources from tagging (using the ``excludeResourceTypes`` property of ``Tags.of(...).add()``) for tags applied in this way. Default: {}
         :param termination_protection: Whether to enable termination protection for this stack. Default: false
         '''
         if __debug__:
@@ -21443,6 +22403,7 @@ class Stack(
             env=env,
             notification_arns=notification_arns,
             permissions_boundary=permissions_boundary,
+            property_injectors=property_injectors,
             stack_name=stack_name,
             suppress_template_indentation=suppress_template_indentation,
             synthesizer=synthesizer,
@@ -21517,6 +22478,21 @@ class Stack(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         return typing.cast(None, jsii.invoke(self, "addMetadata", [key, value]))
 
+    @jsii.member(jsii_name="addStackTag")
+    def add_stack_tag(self, tag_name: builtins.str, tag_value: builtins.str) -> None:
+        '''Configure a stack tag.
+
+        At deploy time, CloudFormation will automatically apply all stack tags to all resources in the stack.
+
+        :param tag_name: -
+        :param tag_value: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__c79ea9b0cd54830acfa2c93ac0786782e515591ac5cda10c42b42f8ff76457a0)
+            check_type(argname="argument tag_name", value=tag_name, expected_type=type_hints["tag_name"])
+            check_type(argname="argument tag_value", value=tag_value, expected_type=type_hints["tag_value"])
+        return typing.cast(None, jsii.invoke(self, "addStackTag", [tag_name, tag_value]))
+
     @jsii.member(jsii_name="addTransform")
     def add_transform(self, transform: builtins.str) -> None:
         '''Add a Transform to this stack. A Transform is a macro that AWS CloudFormation uses to process your template.
@@ -21788,6 +22764,19 @@ class Stack(
             check_type(argname="argument default_value", value=default_value, expected_type=type_hints["default_value"])
         return typing.cast(builtins.str, jsii.invoke(self, "regionalFact", [fact_name, default_value]))
 
+    @jsii.member(jsii_name="removeStackTag")
+    def remove_stack_tag(self, tag_name: builtins.str) -> None:
+        '''Remove a stack tag.
+
+        At deploy time, CloudFormation will automatically apply all stack tags to all resources in the stack.
+
+        :param tag_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__25f39c18a619c464f8e693cb5c5847cdf10f847438cac04672be8ba78d2b49d0)
+            check_type(argname="argument tag_name", value=tag_name, expected_type=type_hints["tag_name"])
+        return typing.cast(None, jsii.invoke(self, "removeStackTag", [tag_name]))
+
     @jsii.member(jsii_name="renameLogicalId")
     def rename_logical_id(self, old_id: builtins.str, new_id: builtins.str) -> None:
         '''Rename a generated logical identities.
@@ -22103,6 +23092,7 @@ class Stack(
         "env": "env",
         "notification_arns": "notificationArns",
         "permissions_boundary": "permissionsBoundary",
+        "property_injectors": "propertyInjectors",
         "stack_name": "stackName",
         "suppress_template_indentation": "suppressTemplateIndentation",
         "synthesizer": "synthesizer",
@@ -22120,6 +23110,7 @@ class StackProps:
         env: typing.Optional[typing.Union[Environment, typing.Dict[builtins.str, typing.Any]]] = None,
         notification_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
         permissions_boundary: typing.Optional[PermissionsBoundary] = None,
+        property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
         stack_name: typing.Optional[builtins.str] = None,
         suppress_template_indentation: typing.Optional[builtins.bool] = None,
         synthesizer: typing.Optional[IStackSynthesizer] = None,
@@ -22131,38 +23122,42 @@ class StackProps:
         :param cross_region_references: Enable this flag to allow native cross region stack references. Enabling this will create a CloudFormation custom resource in both the producing stack and consuming stack in order to perform the export/import This feature is currently experimental Default: false
         :param description: A description of the stack. Default: - No description.
         :param env: The AWS environment (account/region) where this stack will be deployed. Set the ``region``/``account`` fields of ``env`` to either a concrete value to select the indicated environment (recommended for production stacks), or to the values of environment variables ``CDK_DEFAULT_REGION``/``CDK_DEFAULT_ACCOUNT`` to let the target environment depend on the AWS credentials/configuration that the CDK CLI is executed under (recommended for development stacks). If the ``Stack`` is instantiated inside a ``Stage``, any undefined ``region``/``account`` fields from ``env`` will default to the same field on the encompassing ``Stage``, if configured there. If either ``region`` or ``account`` are not set nor inherited from ``Stage``, the Stack will be considered "*environment-agnostic*"". Environment-agnostic stacks can be deployed to any environment but may not be able to take advantage of all features of the CDK. For example, they will not be able to use environmental context lookups such as ``ec2.Vpc.fromLookup`` and will not automatically translate Service Principals to the right format based on the environment's AWS partition, and other such enhancements. Default: - The environment of the containing ``Stage`` if available, otherwise create the stack will be environment-agnostic.
-        :param notification_arns: SNS Topic ARNs that will receive stack events. Default: - no notfication arns.
+        :param notification_arns: SNS Topic ARNs that will receive stack events. Default: - no notification arns.
         :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Default: - no permissions boundary is applied
+        :param property_injectors: A list of IPropertyInjector attached to this Stack. Default: - no PropertyInjectors
         :param stack_name: Name to deploy the stack with. Default: - Derived from construct path.
         :param suppress_template_indentation: Enable this flag to suppress indentation in generated CloudFormation templates. If not specified, the value of the ``@aws-cdk/core:suppressTemplateIndentation`` context key will be used. If that is not specified, then the default value ``false`` will be used. Default: - the value of ``@aws-cdk/core:suppressTemplateIndentation``, or ``false`` if that is not set.
         :param synthesizer: Synthesis method to use while deploying this stack. The Stack Synthesizer controls aspects of synthesis and deployment, like how assets are referenced and what IAM roles to use. For more information, see the README of the main CDK package. If not specified, the ``defaultStackSynthesizer`` from ``App`` will be used. If that is not specified, ``DefaultStackSynthesizer`` is used if ``@aws-cdk/core:newStyleStackSynthesis`` is set to ``true`` or the CDK major version is v2. In CDK v1 ``LegacyStackSynthesizer`` is the default if no other synthesizer is specified. Default: - The synthesizer specified on ``App``, or ``DefaultStackSynthesizer`` otherwise.
-        :param tags: Stack tags that will be applied to all the taggable resources and the stack itself. Default: {}
+        :param tags: Tags that will be applied to the Stack. These tags are applied to the CloudFormation Stack itself. They will not appear in the CloudFormation template. However, at deployment time, CloudFormation will apply these tags to all resources in the stack that support tagging. You will not be able to exempt resources from tagging (using the ``excludeResourceTypes`` property of ``Tags.of(...).add()``) for tags applied in this way. Default: {}
         :param termination_protection: Whether to enable termination protection for this stack. Default: false
 
         :exampleMetadata: infused
 
         Example::
 
-            import aws_cdk as cdk
-            import aws_cdk.aws_cloudwatch as cloudwatch
-            
-            
-            app = cdk.App()
-            stack = cdk.Stack(app, "Stack", env=cdk.Environment(region="us-west-2"))
-            
-            global_table = dynamodb.TableV2(stack, "GlobalTable",
-                partition_key=dynamodb.Attribute(name="pk", type=dynamodb.AttributeType.STRING),
-                replicas=[dynamodb.ReplicaTableProps(region="us-east-1"), dynamodb.ReplicaTableProps(region="us-east-2")
-                ]
+            stack1 = Stack(app, "Stack1",
+                env=Environment(
+                    region="us-east-1"
+                ),
+                cross_region_references=True
+            )
+            cert = acm.Certificate(stack1, "Cert",
+                domain_name="*.example.com",
+                validation=acm.CertificateValidation.from_dns(route53.PublicHostedZone.from_hosted_zone_id(stack1, "Zone", "Z0329774B51CGXTDQV3X"))
             )
             
-            # metric is only for the table in us-west-2
-            metric = global_table.metric_consumed_read_capacity_units()
-            
-            cloudwatch.Alarm(self, "Alarm",
-                metric=metric,
-                evaluation_periods=1,
-                threshold=1
+            stack2 = Stack(app, "Stack2",
+                env=Environment(
+                    region="us-east-2"
+                ),
+                cross_region_references=True
+            )
+            cloudfront.Distribution(stack2, "Distribution",
+                default_behavior=cloudfront.BehaviorOptions(
+                    origin=origins.HttpOrigin("example.com")
+                ),
+                domain_names=["dev.example.com"],
+                certificate=cert
             )
         '''
         if isinstance(env, dict):
@@ -22175,6 +23170,7 @@ class StackProps:
             check_type(argname="argument env", value=env, expected_type=type_hints["env"])
             check_type(argname="argument notification_arns", value=notification_arns, expected_type=type_hints["notification_arns"])
             check_type(argname="argument permissions_boundary", value=permissions_boundary, expected_type=type_hints["permissions_boundary"])
+            check_type(argname="argument property_injectors", value=property_injectors, expected_type=type_hints["property_injectors"])
             check_type(argname="argument stack_name", value=stack_name, expected_type=type_hints["stack_name"])
             check_type(argname="argument suppress_template_indentation", value=suppress_template_indentation, expected_type=type_hints["suppress_template_indentation"])
             check_type(argname="argument synthesizer", value=synthesizer, expected_type=type_hints["synthesizer"])
@@ -22193,6 +23189,8 @@ class StackProps:
             self._values["notification_arns"] = notification_arns
         if permissions_boundary is not None:
             self._values["permissions_boundary"] = permissions_boundary
+        if property_injectors is not None:
+            self._values["property_injectors"] = property_injectors
         if stack_name is not None:
             self._values["stack_name"] = stack_name
         if suppress_template_indentation is not None:
@@ -22313,7 +23311,7 @@ class StackProps:
     def notification_arns(self) -> typing.Optional[typing.List[builtins.str]]:
         '''SNS Topic ARNs that will receive stack events.
 
-        :default: - no notfication arns.
+        :default: - no notification arns.
         '''
         result = self._values.get("notification_arns")
         return typing.cast(typing.Optional[typing.List[builtins.str]], result)
@@ -22327,6 +23325,15 @@ class StackProps:
         result = self._values.get("permissions_boundary")
         return typing.cast(typing.Optional[PermissionsBoundary], result)
 
+    @builtins.property
+    def property_injectors(self) -> typing.Optional[typing.List[IPropertyInjector]]:
+        '''A list of IPropertyInjector attached to this Stack.
+
+        :default: - no PropertyInjectors
+        '''
+        result = self._values.get("property_injectors")
+        return typing.cast(typing.Optional[typing.List[IPropertyInjector]], result)
+
     @builtins.property
     def stack_name(self) -> typing.Optional[builtins.str]:
         '''Name to deploy the stack with.
@@ -22370,7 +23377,15 @@ class StackProps:
 
     @builtins.property
     def tags(self) -> typing.Optional[typing.Mapping[builtins.str, builtins.str]]:
-        '''Stack tags that will be applied to all the taggable resources and the stack itself.
+        '''Tags that will be applied to the Stack.
+
+        These tags are applied to the CloudFormation Stack itself. They will not
+        appear in the CloudFormation template.
+
+        However, at deployment time, CloudFormation will apply these tags to all
+        resources in the stack that support tagging. You will not be able to exempt
+        resources from tagging (using the ``excludeResourceTypes`` property of
+        ``Tags.of(...).add()``) for tags applied in this way.
 
         :default: {}
         '''
@@ -22941,19 +23956,15 @@ class Stage(
 
         # pipeline: pipelines.CodePipeline
         
-        preprod = MyApplicationStage(self, "PreProd")
-        prod = MyApplicationStage(self, "Prod")
-        
-        pipeline.add_stage(preprod,
-            post=[
-                pipelines.ShellStep("Validate Endpoint",
-                    commands=["curl -Ssf https://my.webservice.com/"]
-                )
-            ]
-        )
-        pipeline.add_stage(prod,
-            pre=[pipelines.ManualApprovalStep("PromoteToProd")]
-        )
+        europe_wave = pipeline.add_wave("Europe")
+        europe_wave.add_stage(
+            MyApplicationStage(self, "Ireland",
+                env=cdk.Environment(region="eu-west-1")
+            ))
+        europe_wave.add_stage(
+            MyApplicationStage(self, "Germany",
+                env=cdk.Environment(region="eu-central-1")
+            ))
     '''
 
     def __init__(
@@ -22965,6 +23976,7 @@ class Stage(
         outdir: typing.Optional[builtins.str] = None,
         permissions_boundary: typing.Optional[PermissionsBoundary] = None,
         policy_validation_beta1: typing.Optional[typing.Sequence[IPolicyValidationPluginBeta1]] = None,
+        property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
         stage_name: typing.Optional[builtins.str] = None,
     ) -> None:
         '''
@@ -22974,6 +23986,7 @@ class Stage(
         :param outdir: The output directory into which to emit synthesized artifacts. Can only be specified if this stage is the root stage (the app). If this is specified and this stage is nested within another stage, an error will be thrown. Default: - for nested stages, outdir will be determined as a relative directory to the outdir of the app. For apps, if outdir is not specified, a temporary directory will be created.
         :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Be aware that this feature uses Aspects, and the Aspects are applied at the Stack level with a priority of ``MUTATING`` (if the feature flag ``@aws-cdk/core:aspectPrioritiesMutating`` is set) or ``DEFAULT`` (if the flag is not set). This is relevant if you are both using your own Aspects to assign Permissions Boundaries, as well as specifying this property. The Aspect added by this property will overwrite the Permissions Boundary assigned by your own Aspect if both: (a) your Aspect has a lower or equal priority to the automatic Aspect, and (b) your Aspect is applied *above* the Stack level. If either of those conditions are not true, your own Aspect will win. We recommend assigning Permissions Boundaries only using the provided APIs, and not using custom Aspects. Default: - no permissions boundary is applied
         :param policy_validation_beta1: Validation plugins to run during synthesis. If any plugin reports any violation, synthesis will be interrupted and the report displayed to the user. Default: - no validation plugins are used
+        :param property_injectors: A list of IPropertyInjector attached to this Stage. Default: - no PropertyInjectors
         :param stage_name: Name of this stage. Default: - Derived from the id.
         '''
         if __debug__:
@@ -22985,6 +23998,7 @@ class Stage(
             outdir=outdir,
             permissions_boundary=permissions_boundary,
             policy_validation_beta1=policy_validation_beta1,
+            property_injectors=property_injectors,
             stage_name=stage_name,
         )
 
@@ -23121,6 +24135,7 @@ class Stage(
         "outdir": "outdir",
         "permissions_boundary": "permissionsBoundary",
         "policy_validation_beta1": "policyValidationBeta1",
+        "property_injectors": "propertyInjectors",
         "stage_name": "stageName",
     },
 )
@@ -23132,6 +24147,7 @@ class StageProps:
         outdir: typing.Optional[builtins.str] = None,
         permissions_boundary: typing.Optional[PermissionsBoundary] = None,
         policy_validation_beta1: typing.Optional[typing.Sequence[IPolicyValidationPluginBeta1]] = None,
+        property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
         stage_name: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Initialization props for a stage.
@@ -23140,6 +24156,7 @@ class StageProps:
         :param outdir: The output directory into which to emit synthesized artifacts. Can only be specified if this stage is the root stage (the app). If this is specified and this stage is nested within another stage, an error will be thrown. Default: - for nested stages, outdir will be determined as a relative directory to the outdir of the app. For apps, if outdir is not specified, a temporary directory will be created.
         :param permissions_boundary: Options for applying a permissions boundary to all IAM Roles and Users created within this Stage. Be aware that this feature uses Aspects, and the Aspects are applied at the Stack level with a priority of ``MUTATING`` (if the feature flag ``@aws-cdk/core:aspectPrioritiesMutating`` is set) or ``DEFAULT`` (if the flag is not set). This is relevant if you are both using your own Aspects to assign Permissions Boundaries, as well as specifying this property. The Aspect added by this property will overwrite the Permissions Boundary assigned by your own Aspect if both: (a) your Aspect has a lower or equal priority to the automatic Aspect, and (b) your Aspect is applied *above* the Stack level. If either of those conditions are not true, your own Aspect will win. We recommend assigning Permissions Boundaries only using the provided APIs, and not using custom Aspects. Default: - no permissions boundary is applied
         :param policy_validation_beta1: Validation plugins to run during synthesis. If any plugin reports any violation, synthesis will be interrupted and the report displayed to the user. Default: - no validation plugins are used
+        :param property_injectors: A list of IPropertyInjector attached to this Stage. Default: - no PropertyInjectors
         :param stage_name: Name of this stage. Default: - Derived from the id.
 
         :exampleMetadata: infused
@@ -23171,6 +24188,7 @@ class StageProps:
             check_type(argname="argument outdir", value=outdir, expected_type=type_hints["outdir"])
             check_type(argname="argument permissions_boundary", value=permissions_boundary, expected_type=type_hints["permissions_boundary"])
             check_type(argname="argument policy_validation_beta1", value=policy_validation_beta1, expected_type=type_hints["policy_validation_beta1"])
+            check_type(argname="argument property_injectors", value=property_injectors, expected_type=type_hints["property_injectors"])
             check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
         if env is not None:
@@ -23181,6 +24199,8 @@ class StageProps:
             self._values["permissions_boundary"] = permissions_boundary
         if policy_validation_beta1 is not None:
             self._values["policy_validation_beta1"] = policy_validation_beta1
+        if property_injectors is not None:
+            self._values["property_injectors"] = property_injectors
         if stage_name is not None:
             self._values["stage_name"] = stage_name
 
@@ -23272,6 +24292,15 @@ class StageProps:
         result = self._values.get("policy_validation_beta1")
         return typing.cast(typing.Optional[typing.List[IPolicyValidationPluginBeta1]], result)
 
+    @builtins.property
+    def property_injectors(self) -> typing.Optional[typing.List[IPropertyInjector]]:
+        '''A list of IPropertyInjector attached to this Stage.
+
+        :default: - no PropertyInjectors
+        '''
+        result = self._values.get("property_injectors")
+        return typing.cast(typing.Optional[typing.List[IPropertyInjector]], result)
+
     @builtins.property
     def stage_name(self) -> typing.Optional[builtins.str]:
         '''Name of this stage.
@@ -24275,7 +25304,26 @@ class Tags(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.Tags"):
         include_resource_types: typing.Optional[typing.Sequence[builtins.str]] = None,
         priority: typing.Optional[jsii.Number] = None,
     ) -> None:
-        '''add tags to the node of a construct and all its the taggable children.
+        '''Add tags to the node of a construct and all its the taggable children.
+
+
+
+        Tagging and CloudFormation Stacks
+
+        If the feature flag ``@aws-cdk/core:explicitStackTags`` is set to ``true``
+        (recommended modern behavior), Stacks will not automatically be tagged.
+        Stack tags should be configured on Stacks directly (preferred), or
+        you must explicitly include the resource type ``aws:cdk:stack`` in the
+        ``includeResourceTypes`` array.
+
+        If the feature flag is set to ``false`` (legacy behavior) then both Stacks
+        and resources in the indicated scope will both be tagged by default, which
+        leads to tags being applied twice (once in the template, and then once
+        again automatically by CloudFormation as part of the stack deployment).
+        That behavior leads to loss of control as ``excludeResourceTypes`` will
+        prevent tags from appearing in the template, but they will still be
+        applied to the Stack and hence CloudFormation will still apply them
+        to the resource.
 
         :param key: -
         :param value: -
@@ -24388,25 +25436,25 @@ class TimeZone(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.TimeZone"):
 
     Example::
 
-        # target: targets.LambdaInvoke
+        from aws_cdk import TimeZone
+        # resource: SomeScalableResource
         
         
-        rate_based_schedule = Schedule(self, "Schedule",
-            schedule=ScheduleExpression.rate(Duration.minutes(10)),
-            target=target,
-            description="This is a test rate-based schedule"
+        capacity = resource.auto_scale_capacity(
+            min_capacity=1,
+            max_capacity=50
         )
         
-        cron_based_schedule = Schedule(self, "Schedule",
-            schedule=ScheduleExpression.cron(
-                minute="0",
-                hour="23",
-                day="20",
-                month="11",
-                time_zone=TimeZone.AMERICA_NEW_YORK
-            ),
-            target=target,
-            description="This is a test cron-based schedule that will run at 11:00 PM, on day 20 of the month, only in November in New York timezone"
+        capacity.scale_on_schedule("PrescaleInTheMorning",
+            schedule=appscaling.Schedule.cron(hour="8", minute="0"),
+            min_capacity=20,
+            time_zone=TimeZone.AMERICA_DENVER
+        )
+        
+        capacity.scale_on_schedule("AllowDownscalingAtNight",
+            schedule=appscaling.Schedule.cron(hour="20", minute="0"),
+            min_capacity=1,
+            time_zone=TimeZone.AMERICA_DENVER
         )
     '''
 
@@ -28334,6 +29382,7 @@ class App(Stage, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.App"):
         outdir: typing.Optional[builtins.str] = None,
         policy_validation_beta1: typing.Optional[typing.Sequence[IPolicyValidationPluginBeta1]] = None,
         post_cli_context: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+        property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
         stack_traces: typing.Optional[builtins.bool] = None,
         tree_metadata: typing.Optional[builtins.bool] = None,
     ) -> None:
@@ -28346,6 +29395,7 @@ class App(Stage, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.App"):
         :param outdir: The output directory into which to emit synthesized artifacts. You should never need to set this value. By default, the value you pass to the CLI's ``--output`` flag will be used, and if you change it to a different directory the CLI will fail to pick up the generated Cloud Assembly. This property is intended for internal and testing use. Default: - If this value is *not* set, considers the environment variable ``CDK_OUTDIR``. If ``CDK_OUTDIR`` is not defined, uses a temp directory.
         :param policy_validation_beta1: Validation plugins to run after synthesis. Default: - no validation plugins
         :param post_cli_context: Additional context values for the application. Context provided here has precedence over context set by: - The CLI via --context - The ``context`` key in ``cdk.json`` - The ``AppProps.context`` property This property is recommended over the ``AppProps.context`` property since you can make final decision over which context value to take in your app. Context can be read from any construct using ``node.getContext(key)``. Default: - no additional context
+        :param property_injectors: A list of IPropertyInjector attached to this App. Default: - no PropertyInjectors
         :param stack_traces: Include construct creation stack trace in the ``aws:cdk:trace`` metadata key of all constructs. Default: true stack traces are included unless ``aws:cdk:disable-stack-trace`` is set in the context.
         :param tree_metadata: Include construct tree metadata as part of the Cloud Assembly. Default: true
         '''
@@ -28357,6 +29407,7 @@ class App(Stage, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.App"):
             outdir=outdir,
             policy_validation_beta1=policy_validation_beta1,
             post_cli_context=post_cli_context,
+            property_injectors=property_injectors,
             stack_traces=stack_traces,
             tree_metadata=tree_metadata,
         )
@@ -28771,7 +29822,7 @@ class CfnCodeDeployBlueGreenHook(
         jsii.set(self, "trafficRoutingConfig", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _ICustomResourceRef_337851e1)
 class CfnCustomResource(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -28812,7 +29863,8 @@ class CfnCustomResource(
         service_token: builtins.str,
         service_timeout: typing.Optional[jsii.Number] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::CustomResource``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param service_token: The service token, such as an Amazon SNS topic ARN or Lambda function ARN. The service token must be from the same Region as the stack. Updates aren't supported.
@@ -28871,6 +29923,12 @@ class CfnCustomResource(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="customResourceRef")
+    def custom_resource_ref(self) -> _CustomResourceReference_d8e366c9:
+        '''A reference to a CustomResource resource.'''
+        return typing.cast(_CustomResourceReference_d8e366c9, jsii.get(self, "customResourceRef"))
+
     @builtins.property
     @jsii.member(jsii_name="serviceToken")
     def service_token(self) -> builtins.str:
@@ -28928,7 +29986,7 @@ class CfnDynamicReference(
         jsii.create(self.__class__, self, [service, key])
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IGuardHookRef_e0640792)
 class CfnGuardHook(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -29017,7 +30075,8 @@ class CfnGuardHook(
         stack_filters: typing.Optional[typing.Union[IResolvable, typing.Union["CfnGuardHook.StackFiltersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         target_filters: typing.Optional[typing.Union[IResolvable, typing.Union["CfnGuardHook.TargetFiltersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::GuardHook``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param alias: The type name alias for the Hook. This alias must be unique per account and Region. The alias must be in the form ``Name1::Name2::Name3`` and must not begin with ``AWS`` . For example, ``Private::Guard::MyTestHook`` .
@@ -29029,7 +30088,7 @@ class CfnGuardHook(
         :param log_bucket: Specifies the name of an S3 bucket to store the Guard output report. This report contains the results of your Guard rule validations.
         :param options: Specifies the S3 location of your input parameters.
         :param stack_filters: Specifies the stack level filters for the Hook. Example stack level filter in JSON: ``"StackFilters": {"FilteringCriteria": "ALL", "StackNames": {"Exclude": [ "stack-1", "stack-2"]}}`` Example stack level filter in YAML: ``StackFilters: FilteringCriteria: ALL StackNames: Exclude: - stack-1 - stack-2``
-        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "Create", "Update", "Delete" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
+        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__af8d2663a8bac5046ca50537b031b46f870c6edd4948ed8528ca4e3ff9367b17)
@@ -29094,6 +30153,12 @@ class CfnGuardHook(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="guardHookRef")
+    def guard_hook_ref(self) -> _GuardHookReference_9ad20ca0:
+        '''A reference to a GuardHook resource.'''
+        return typing.cast(_GuardHookReference_9ad20ca0, jsii.get(self, "guardHookRef"))
+
     @builtins.property
     @jsii.member(jsii_name="alias")
     def alias(self) -> builtins.str:
@@ -29415,7 +30480,7 @@ class CfnGuardHook(
         ) -> None:
             '''Specifies the S3 location where your Guard rules or input parameters are located.
 
-            :param uri: Specifies the S3 path to the file containing your Guard rules or input parameters (in the form ``s3://<bucket name>/<file name>`` ). For Guard rules, the object stored in S3 must have one of the following file extensions: ``.guard`` , ``.zip`` , or ``.tar.gz`` . For input parameters, the object stored in S3 must have one of the following file extensions: ``.yaml`` , ``.json`` , ``.zip`` , or ``.tar.gz`` .
+            :param uri: Specifies the S3 path to the file that contains your Guard rules or input parameters (in the form ``s3://<bucket name>/<file name>`` ). For Guard rules, the object stored in S3 must have one of the following file extensions: ``.guard`` , ``.zip`` , or ``.tar.gz`` . For input parameters, the object stored in S3 must have one of the following file extensions: ``.yaml`` , ``.json`` , ``.zip`` , or ``.tar.gz`` .
             :param version_id: For S3 buckets with versioning enabled, specifies the unique ID of the S3 object version to download your Guard rules or input parameters from. The Guard Hook downloads files from S3 every time the Hook is invoked. To prevent accidental changes or deletions, we recommend using a version when configuring your Guard Hook.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-guardhook-s3location.html
@@ -29446,7 +30511,7 @@ class CfnGuardHook(
 
         @builtins.property
         def uri(self) -> builtins.str:
-            '''Specifies the S3 path to the file containing your Guard rules or input parameters (in the form ``s3://<bucket name>/<file name>`` ).
+            '''Specifies the S3 path to the file that contains your Guard rules or input parameters (in the form ``s3://<bucket name>/<file name>`` ).
 
             For Guard rules, the object stored in S3 must have one of the following file extensions: ``.guard`` , ``.zip`` , or ``.tar.gz`` .
 
@@ -29860,7 +30925,7 @@ class CfnGuardHook(
             )
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IHookDefaultVersionRef_a4784949)
 class CfnHookDefaultVersion(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -29900,7 +30965,8 @@ class CfnHookDefaultVersion(
         type_version_arn: typing.Optional[builtins.str] = None,
         version_id: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::HookDefaultVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param type_name: The name of the Hook. You must specify either ``TypeVersionArn`` , or ``TypeName`` and ``VersionId`` .
@@ -29952,7 +31018,7 @@ class CfnHookDefaultVersion(
     @builtins.property
     @jsii.member(jsii_name="attrArn")
     def attr_arn(self) -> builtins.str:
-        '''The Amazon Resource Number (ARN) of the activated Hook, in this account and Region.
+        '''The Amazon Resource Number (ARN) of the activated Hook in this account and Region.
 
         :cloudformationAttribute: Arn
         '''
@@ -29963,6 +31029,12 @@ class CfnHookDefaultVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="hookDefaultVersionRef")
+    def hook_default_version_ref(self) -> _HookDefaultVersionReference_11df53e8:
+        '''A reference to a HookDefaultVersion resource.'''
+        return typing.cast(_HookDefaultVersionReference_11df53e8, jsii.get(self, "hookDefaultVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="typeName")
     def type_name(self) -> typing.Optional[builtins.str]:
@@ -30003,7 +31075,7 @@ class CfnHookDefaultVersion(
         jsii.set(self, "versionId", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IHookTypeConfigRef_7bc118dc)
 class CfnHookTypeConfig(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -30043,7 +31115,8 @@ class CfnHookTypeConfig(
         type_arn: typing.Optional[builtins.str] = None,
         type_name: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::HookTypeConfig``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param configuration: Specifies the activated Hook type configuration, in this AWS account and AWS Region . You must specify either ``TypeName`` and ``Configuration`` or ``TypeArn`` and ``Configuration`` .
@@ -30097,7 +31170,7 @@ class CfnHookTypeConfig(
     @builtins.property
     @jsii.member(jsii_name="attrConfigurationArn")
     def attr_configuration_arn(self) -> builtins.str:
-        '''The Amazon Resource Number (ARN) of the activated Hook type configuration, in this account and Region.
+        '''The Amazon Resource Number (ARN) of the activated Hook type configuration in this account and Region.
 
         :cloudformationAttribute: ConfigurationArn
         '''
@@ -30108,6 +31181,12 @@ class CfnHookTypeConfig(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="hookTypeConfigRef")
+    def hook_type_config_ref(self) -> _HookTypeConfigReference_ed91f4cb:
+        '''A reference to a HookTypeConfig resource.'''
+        return typing.cast(_HookTypeConfigReference_ed91f4cb, jsii.get(self, "hookTypeConfigRef"))
+
     @builtins.property
     @jsii.member(jsii_name="configuration")
     def configuration(self) -> builtins.str:
@@ -30161,7 +31240,7 @@ class CfnHookTypeConfig(
         jsii.set(self, "typeName", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IHookVersionRef_0d71a867)
 class CfnHookVersion(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -30206,11 +31285,12 @@ class CfnHookVersion(
         execution_role_arn: typing.Optional[builtins.str] = None,
         logging_config: typing.Optional[typing.Union[IResolvable, typing.Union["CfnHookVersion.LoggingConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::HookVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param schema_handler_package: A URL to the Amazon S3 bucket containing the Hook project package that contains the necessary files for the Hook you want to register. For information on generating a schema handler package, see `Modeling custom CloudFormation Hooks <https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-model.html>`_ in the *AWS CloudFormation Hooks User Guide* . .. epigraph:: To register the Hook, you must have ``s3:GetObject`` permissions to access the S3 objects.
-        :param type_name: The unique name for your hook. Specifies a three-part namespace for your hook, with a recommended pattern of ``Organization::Service::Hook`` . .. epigraph:: The following organization namespaces are reserved and can't be used in your hook type names: - ``Alexa`` - ``AMZN`` - ``Amazon`` - ``ASK`` - ``AWS`` - ``Custom`` - ``Dev``
+        :param schema_handler_package: A URL to the Amazon S3 bucket for the Hook project package that contains the necessary files for the Hook you want to register. For information on generating a schema handler package, see `Modeling custom CloudFormation Hooks <https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-model.html>`_ in the *AWS CloudFormation Hooks User Guide* . .. epigraph:: To register the Hook, you must have ``s3:GetObject`` permissions to access the S3 objects.
+        :param type_name: The unique name for your Hook. Specifies a three-part namespace for your Hook, with a recommended pattern of ``Organization::Service::Hook`` . .. epigraph:: The following organization namespaces are reserved and can't be used in your Hook type names: - ``Alexa`` - ``AMZN`` - ``Amazon`` - ``ASK`` - ``AWS`` - ``Custom`` - ``Dev``
         :param execution_role_arn: The Amazon Resource Name (ARN) of the task execution role that grants the Hook permission.
         :param logging_config: Contains logging configuration information for an extension.
         '''
@@ -30296,12 +31376,10 @@ class CfnHookVersion(
     @builtins.property
     @jsii.member(jsii_name="attrVisibility")
     def attr_visibility(self) -> builtins.str:
-        '''The scope at which the Hook is visible and usable in CloudFormation operations.
-
-        Valid values include:
+        '''The visibility level that determines who can see and use this Hook in CloudFormation operations:.
 
-        - ``PRIVATE`` : The extension (Hook) is only visible and usable within the account in which it's registered. CloudFormation marks any resources you register as ``PRIVATE`` .
-        - ``PUBLIC`` : The extension (Hook) is publicly visible and usable within any AWS account.
+        - ``PRIVATE`` : The Hook is only visible and usable within the account where it was registered. CloudFormation automatically marks any Hooks you register as ``PRIVATE`` .
+        - ``PUBLIC`` : The Hook is publicly visible and usable within any AWS account.
 
         :cloudformationAttribute: Visibility
         '''
@@ -30312,10 +31390,16 @@ class CfnHookVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="hookVersionRef")
+    def hook_version_ref(self) -> _HookVersionReference_3688b53a:
+        '''A reference to a HookVersion resource.'''
+        return typing.cast(_HookVersionReference_3688b53a, jsii.get(self, "hookVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="schemaHandlerPackage")
     def schema_handler_package(self) -> builtins.str:
-        '''A URL to the Amazon S3 bucket containing the Hook project package that contains the necessary files for the Hook you want to register.'''
+        '''A URL to the Amazon S3 bucket for the Hook project package that contains the necessary files for the Hook you want to register.'''
         return typing.cast(builtins.str, jsii.get(self, "schemaHandlerPackage"))
 
     @schema_handler_package.setter
@@ -30328,7 +31412,7 @@ class CfnHookVersion(
     @builtins.property
     @jsii.member(jsii_name="typeName")
     def type_name(self) -> builtins.str:
-        '''The unique name for your hook.'''
+        '''The unique name for your Hook.'''
         return typing.cast(builtins.str, jsii.get(self, "typeName"))
 
     @type_name.setter
@@ -30534,7 +31618,7 @@ class CfnJson(
         return typing.cast(Reference, jsii.get(self, "value"))
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _ILambdaHookRef_5ceec28e)
 class CfnLambdaHook(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -30607,7 +31691,8 @@ class CfnLambdaHook(
         stack_filters: typing.Optional[typing.Union[IResolvable, typing.Union["CfnLambdaHook.StackFiltersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         target_filters: typing.Optional[typing.Union[IResolvable, typing.Union["CfnLambdaHook.TargetFiltersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::LambdaHook``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param alias: The type name alias for the Hook. This alias must be unique per account and Region. The alias must be in the form ``Name1::Name2::Name3`` and must not begin with ``AWS`` . For example, ``Private::Lambda::MyTestHook`` .
@@ -30617,7 +31702,7 @@ class CfnLambdaHook(
         :param lambda_function: Specifies the Lambda function for the Hook. You can use:. - The full Amazon Resource Name (ARN) without a suffix. - A qualified ARN with a version or alias suffix.
         :param target_operations: Specifies the list of operations the Hook is run against. For more information, see `Hook targets <https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-concepts.html#hook-terms-hook-target>`_ in the *AWS CloudFormation Hooks User Guide* . Valid values: ``STACK`` | ``RESOURCE`` | ``CHANGE_SET`` | ``CLOUD_CONTROL``
         :param stack_filters: Specifies the stack level filters for the Hook. Example stack level filter in JSON: ``"StackFilters": {"FilteringCriteria": "ALL", "StackNames": {"Exclude": [ "stack-1", "stack-2"]}}`` Example stack level filter in YAML: ``StackFilters: FilteringCriteria: ALL StackNames: Exclude: - stack-1 - stack-2``
-        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "Create", "Update", "Delete" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
+        :param target_filters: Specifies the target filters for the Hook. Example target filter in JSON: ``"TargetFilters": {"Actions": [ "CREATE", "UPDATE", "DELETE" ]}`` Example target filter in YAML: ``TargetFilters: Actions: - CREATE - UPDATE - DELETE``
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__407b4a631e3a832f02376728222302ded8f1ba90d2538b0469e5b99641f17447)
@@ -30680,6 +31765,12 @@ class CfnLambdaHook(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="lambdaHookRef")
+    def lambda_hook_ref(self) -> _LambdaHookReference_1c262218:
+        '''A reference to a LambdaHook resource.'''
+        return typing.cast(_LambdaHookReference_1c262218, jsii.get(self, "lambdaHookRef"))
+
     @builtins.property
     @jsii.member(jsii_name="alias")
     def alias(self) -> builtins.str:
@@ -31272,7 +32363,7 @@ class CfnLambdaHook(
             )
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IMacroRef_e9ae4afa)
 class CfnMacro(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnMacro"):
     '''The ``AWS::CloudFormation::Macro`` resource is a CloudFormation resource type that creates a CloudFormation macro to perform custom processing on CloudFormation templates.
 
@@ -31310,7 +32401,8 @@ class CfnMacro(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnM
         log_group_name: typing.Optional[builtins.str] = None,
         log_role_arn: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::Macro``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param function_name: The Amazon Resource Name (ARN) of the underlying Lambda function that you want CloudFormation to invoke when the macro is run.
@@ -31366,7 +32458,8 @@ class CfnMacro(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnM
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''
+        '''Returns a unique identifier for the resource.
+
         :cloudformationAttribute: Id
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrId"))
@@ -31376,6 +32469,12 @@ class CfnMacro(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnM
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="macroRef")
+    def macro_ref(self) -> _MacroReference_2603df14:
+        '''A reference to a Macro resource.'''
+        return typing.cast(_MacroReference_2603df14, jsii.get(self, "macroRef"))
+
     @builtins.property
     @jsii.member(jsii_name="functionName")
     def function_name(self) -> builtins.str:
@@ -31534,7 +32633,7 @@ class CfnMapping(
         return typing.cast(None, jsii.invoke(self, "setValue", [key1, key2, value]))
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IModuleDefaultVersionRef_8f5f90c3)
 class CfnModuleDefaultVersion(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -31574,7 +32673,8 @@ class CfnModuleDefaultVersion(
         module_name: typing.Optional[builtins.str] = None,
         version_id: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::ModuleDefaultVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param arn: The Amazon Resource Name (ARN) of the module version to set as the default version. Conditional: You must specify either ``Arn`` , or ``ModuleName`` and ``VersionId`` .
@@ -31626,6 +32726,12 @@ class CfnModuleDefaultVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="moduleDefaultVersionRef")
+    def module_default_version_ref(self) -> _ModuleDefaultVersionReference_6e4498de:
+        '''A reference to a ModuleDefaultVersion resource.'''
+        return typing.cast(_ModuleDefaultVersionReference_6e4498de, jsii.get(self, "moduleDefaultVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="arn")
     def arn(self) -> typing.Optional[builtins.str]:
@@ -31666,7 +32772,7 @@ class CfnModuleDefaultVersion(
         jsii.set(self, "versionId", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IModuleVersionRef_76485182)
 class CfnModuleVersion(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -31704,11 +32810,12 @@ class CfnModuleVersion(
         module_name: builtins.str,
         module_package: builtins.str,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::ModuleVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param module_name: The name of the module being registered.
-        :param module_package: A URL to the S3 bucket containing the package that contains the template fragment and schema files for the module version to register. For more information, see `Module structure and requirements <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/modules-structure.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the module version, you must have ``s3:GetObject`` permissions to access the S3 objects.
+        :param module_package: A URL to the S3 bucket for the package that contains the template fragment and schema files for the module version to register. For more information, see `Module structure and requirements <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/modules-structure.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the module version, you must have ``s3:GetObject`` permissions to access the S3 objects.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__3d780aabbd07e1197c5165344069ba0f46d2e4740d74a296d922fbcbf26044c2)
@@ -31818,12 +32925,10 @@ class CfnModuleVersion(
     @builtins.property
     @jsii.member(jsii_name="attrVisibility")
     def attr_visibility(self) -> builtins.str:
-        '''The scope at which the module is visible and usable in CloudFormation operations.
-
-        Valid values include:
+        '''The visibility level that determines who can see and use this module in CloudFormation operations:.
 
-        - ``PRIVATE`` : The extension (module) is only visible and usable within the account in which it is registered. CloudFormation marks any extensions you register as ``PRIVATE`` .
-        - ``PUBLIC`` : The extension (module) is publicly visible and usable within any AWS account.
+        - ``PRIVATE`` : The module is only visible and usable within the account where it was registered. CloudFormation automatically marks any modules you register as ``PRIVATE`` .
+        - ``PUBLIC`` : The module is publicly visible and usable within any AWS account.
 
         :cloudformationAttribute: Visibility
         '''
@@ -31834,6 +32939,12 @@ class CfnModuleVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="moduleVersionRef")
+    def module_version_ref(self) -> _ModuleVersionReference_16e9080f:
+        '''A reference to a ModuleVersion resource.'''
+        return typing.cast(_ModuleVersionReference_16e9080f, jsii.get(self, "moduleVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="moduleName")
     def module_name(self) -> builtins.str:
@@ -31850,7 +32961,7 @@ class CfnModuleVersion(
     @builtins.property
     @jsii.member(jsii_name="modulePackage")
     def module_package(self) -> builtins.str:
-        '''A URL to the S3 bucket containing the package that contains the template fragment and schema files for the module version to register.'''
+        '''A URL to the S3 bucket for the package that contains the template fragment and schema files for the module version to register.'''
         return typing.cast(builtins.str, jsii.get(self, "modulePackage"))
 
     @module_package.setter
@@ -31861,7 +32972,7 @@ class CfnModuleVersion(
         jsii.set(self, "modulePackage", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IPublicTypeVersionRef_554ddaba)
 class CfnPublicTypeVersion(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -31912,7 +33023,8 @@ class CfnPublicTypeVersion(
         type: typing.Optional[builtins.str] = None,
         type_name: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::PublicTypeVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param arn: The Amazon Resource Number (ARN) of the extension. Conditional: You must specify ``Arn`` , or ``TypeName`` and ``Type`` .
@@ -31999,6 +33111,12 @@ class CfnPublicTypeVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="publicTypeVersionRef")
+    def public_type_version_ref(self) -> _PublicTypeVersionReference_da345091:
+        '''A reference to a PublicTypeVersion resource.'''
+        return typing.cast(_PublicTypeVersionReference_da345091, jsii.get(self, "publicTypeVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="arn")
     def arn(self) -> typing.Optional[builtins.str]:
@@ -32065,7 +33183,7 @@ class CfnPublicTypeVersion(
         jsii.set(self, "typeName", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IPublisherRef_43e14b13)
 class CfnPublisher(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -32103,7 +33221,8 @@ class CfnPublisher(
         accept_terms_and_conditions: typing.Union[builtins.bool, IResolvable],
         connection_arn: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::Publisher``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param accept_terms_and_conditions: Whether you accept the `Terms and Conditions <https://docs.aws.amazon.com/https://cloudformation-registry-documents.s3.amazonaws.com/Terms_and_Conditions_for_AWS_CloudFormation_Registry_Publishers.pdf>`_ for publishing extensions in the CloudFormation registry. You must accept the terms and conditions in order to register to publish public extensions to the CloudFormation registry. The default is ``false`` .
@@ -32193,6 +33312,12 @@ class CfnPublisher(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="publisherRef")
+    def publisher_ref(self) -> _PublisherReference_2058d21f:
+        '''A reference to a Publisher resource.'''
+        return typing.cast(_PublisherReference_2058d21f, jsii.get(self, "publisherRef"))
+
     @builtins.property
     @jsii.member(jsii_name="acceptTermsAndConditions")
     def accept_terms_and_conditions(self) -> typing.Union[builtins.bool, IResolvable]:
@@ -32223,7 +33348,7 @@ class CfnPublisher(
         jsii.set(self, "connectionArn", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IResourceDefaultVersionRef_6bcf9f85)
 class CfnResourceDefaultVersion(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -32261,7 +33386,8 @@ class CfnResourceDefaultVersion(
         type_version_arn: typing.Optional[builtins.str] = None,
         version_id: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::ResourceDefaultVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param type_name: The name of the resource. Conditional: You must specify either ``TypeVersionArn`` , or ``TypeName`` and ``VersionId`` .
@@ -32324,6 +33450,12 @@ class CfnResourceDefaultVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourceDefaultVersionRef")
+    def resource_default_version_ref(self) -> _ResourceDefaultVersionReference_878c9c7f:
+        '''A reference to a ResourceDefaultVersion resource.'''
+        return typing.cast(_ResourceDefaultVersionReference_878c9c7f, jsii.get(self, "resourceDefaultVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="typeName")
     def type_name(self) -> typing.Optional[builtins.str]:
@@ -32364,7 +33496,7 @@ class CfnResourceDefaultVersion(
         jsii.set(self, "versionId", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IResourceVersionRef_8fc1bbae)
 class CfnResourceVersion(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -32415,10 +33547,11 @@ class CfnResourceVersion(
         execution_role_arn: typing.Optional[builtins.str] = None,
         logging_config: typing.Optional[typing.Union[IResolvable, typing.Union["CfnResourceVersion.LoggingConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::ResourceVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param schema_handler_package: A URL to the S3 bucket containing the resource project package that contains the necessary files for the resource you want to register. For information on generating a schema handler package, see `Modeling resource types to use with AWS CloudFormation <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-model.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the resource version, you must have ``s3:GetObject`` permissions to access the S3 objects.
+        :param schema_handler_package: A URL to the S3 bucket for the resource project package that contains the necessary files for the resource you want to register. For information on generating a schema handler package, see `Modeling resource types to use with AWS CloudFormation <https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-model.html>`_ in the *AWS CloudFormation Command Line Interface (CLI) User Guide* . .. epigraph:: To register the resource version, you must have ``s3:GetObject`` permissions to access the S3 objects.
         :param type_name: The name of the resource being registered. We recommend that resource names adhere to the following pattern: *company_or_organization* :: *service* :: *type* . .. epigraph:: The following organization namespaces are reserved and can't be used in your resource names: - ``Alexa`` - ``AMZN`` - ``Amazon`` - ``AWS`` - ``Custom`` - ``Dev``
         :param execution_role_arn: The Amazon Resource Name (ARN) of the IAM role for CloudFormation to assume when invoking the resource. If your resource calls AWS APIs in any of its handlers, you must create an IAM execution role that includes the necessary permissions to call those AWS APIs, and provision that execution role in your account. When CloudFormation needs to invoke the resource type handler, CloudFormation assumes this execution role to create a temporary session token, which it then passes to the resource type handler, thereby supplying your resource type with the appropriate credentials.
         :param logging_config: Logging configuration information for a resource.
@@ -32493,7 +33626,7 @@ class CfnResourceVersion(
 
         CloudFormation determines the provisioning type during registration, based on the types of handlers in the schema handler package submitted.
 
-        Valid values include:
+        Possible values:
 
         - ``FULLY_MUTABLE`` : The resource type includes an update handler to process updates to the type during stack update operations.
         - ``IMMUTABLE`` : The resource type doesn't include an update handler, so the type can't be updated and must instead be replaced during stack update operations.
@@ -32529,12 +33662,10 @@ class CfnResourceVersion(
     @builtins.property
     @jsii.member(jsii_name="attrVisibility")
     def attr_visibility(self) -> builtins.str:
-        '''The scope at which the resource is visible and usable in CloudFormation operations.
+        '''The visibility level that determines who can see and use this resource in CloudFormation operations:.
 
-        Valid values include:
-
-        - ``PRIVATE`` : The extension (resource) is only visible and usable within the account in which it is registered. CloudFormation marks any extensions you register as ``PRIVATE`` .
-        - ``PUBLIC`` : The extension (resource) is publicly visible and usable within any AWS account.
+        - ``PRIVATE`` : The resource is only visible and usable within the account where it was registered. CloudFormation automatically marks any resources you register as ``PRIVATE`` .
+        - ``PUBLIC`` : The resource is publicly visible and usable within any AWS account.
 
         :cloudformationAttribute: Visibility
         '''
@@ -32545,10 +33676,16 @@ class CfnResourceVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourceVersionRef")
+    def resource_version_ref(self) -> _ResourceVersionReference_a8ae93f7:
+        '''A reference to a ResourceVersion resource.'''
+        return typing.cast(_ResourceVersionReference_a8ae93f7, jsii.get(self, "resourceVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="schemaHandlerPackage")
     def schema_handler_package(self) -> builtins.str:
-        '''A URL to the S3 bucket containing the resource project package that contains the necessary files for the resource you want to register.'''
+        '''A URL to the S3 bucket for the resource project package that contains the necessary files for the resource you want to register.'''
         return typing.cast(builtins.str, jsii.get(self, "schemaHandlerPackage"))
 
     @schema_handler_package.setter
@@ -32673,19 +33810,19 @@ class CfnResourceVersion(
             )
 
 
-@jsii.implements(IInspectable, ITaggable)
+@jsii.implements(IInspectable, _IStackRef_f0f1d363, ITaggable)
 class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnStack"):
     '''The ``AWS::CloudFormation::Stack`` resource nests a stack as a resource in a top-level template.
 
-    For more information, see `Embed stacks within other stacks using nested stacks <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-nested-stacks.html>`_ in the *AWS CloudFormation User Guide* .
+    For more information, see `Nested stacks <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-nested-stacks.html>`_ in the *AWS CloudFormation User Guide* .
 
-    You can add output values from a nested stack within the containing template. You use the `GetAtt <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html>`_ function with the nested stack's logical name and the name of the output value in the nested stack in the format ``Outputs. *NestedStackOutputName*`` .
+    You can add output values from a nested stack within the containing template. You use the `GetAtt <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html>`_ function with the nested stack's logical name and the name of the output value in the nested stack in the format ``Outputs. *NestedStackOutputName*`` .
 
     We strongly recommend that updates to nested stacks are run from the parent stack.
 
     When you apply template changes to update a top-level stack, CloudFormation updates the top-level stack and initiates an update to its nested stacks. CloudFormation updates the resources of modified nested stacks, but doesn't update the resources of unmodified nested stacks.
 
-    You must acknowledge IAM capabilities for nested stacks that contain IAM resources. Also, verify that you have cancel update stack permissions, which is required if an update rolls back. For more information about IAM and CloudFormation , see `Controlling access with AWS Identity and Access Management <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html>`_ in the *AWS CloudFormation User Guide* .
+    For stacks that contain IAM resources, you must acknowledge IAM capabilities. Also, make sure that you have cancel update stack permissions, which are required if an update rolls back. For more information about IAM and CloudFormation , see `Controlling access with AWS Identity and Access Management <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html>`_ in the *AWS CloudFormation User Guide* .
     .. epigraph::
 
        A subset of ``AWS::CloudFormation::Stack`` resource type properties listed below are available to customers using CloudFormation , AWS CDK , and Cloud Control  to configure.
@@ -32757,13 +33894,14 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
         template_url: typing.Optional[builtins.str] = None,
         timeout_in_minutes: typing.Optional[jsii.Number] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::Stack``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param notification_arns: The Amazon SNS topic ARNs to publish stack related events. You can find your Amazon SNS topic ARNs using the Amazon SNS console or your Command Line Interface (CLI).
         :param parameters: The set value pairs that represent the parameters passed to CloudFormation when this nested stack is created. Each parameter has a name corresponding to a parameter defined in the embedded template and a value representing the value that you want to set for the parameter. .. epigraph:: If you use the ``Ref`` function to pass a parameter value to a nested stack, comma-delimited list parameters must be of type ``String`` . In other words, you can't pass values that are of type ``CommaDelimitedList`` to nested stacks. Required if the nested stack requires input parameters. Whether an update causes interruptions depends on the resources that are being updated. An update never causes a nested stack to be replaced.
         :param tags: Key-value pairs to associate with this stack. CloudFormation also propagates these tags to the resources created in the stack. A maximum number of 50 tags can be specified.
-        :param template_url: The URL of a file containing the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket. The location for an Amazon S3 bucket must start with ``https://`` . Whether an update causes interruptions depends on the resources that are being updated. An update never causes a nested stack to be replaced.
+        :param template_url: The URL of a file that contains the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket. The location for an Amazon S3 bucket must start with ``https://`` . Whether an update causes interruptions depends on the resources that are being updated. An update never causes a nested stack to be replaced.
         :param timeout_in_minutes: The length of time, in minutes, that CloudFormation waits for the nested stack to reach the ``CREATE_COMPLETE`` state. The default is no timeout. When CloudFormation detects that the nested stack has reached the ``CREATE_COMPLETE`` state, it marks the nested stack resource as ``CREATE_COMPLETE`` in the parent stack and resumes creating the parent stack. If the timeout period expires before the nested stack reaches ``CREATE_COMPLETE`` , CloudFormation marks the nested stack as failed and rolls back both the nested stack and parent stack. Updates aren't supported.
         '''
         if __debug__:
@@ -32813,7 +33951,7 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
     @builtins.property
     @jsii.member(jsii_name="attrChangeSetId")
     def attr_change_set_id(self) -> builtins.str:
-        '''Returns the unique ID of the change set.
+        '''Returns the unique identifier of the change set.
 
         :cloudformationAttribute: ChangeSetId
         '''
@@ -32822,7 +33960,7 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
     @builtins.property
     @jsii.member(jsii_name="attrCreationTime")
     def attr_creation_time(self) -> builtins.str:
-        '''Returns The time at which the stack was created.
+        '''Returns the time the stack was created.
 
         :cloudformationAttribute: CreationTime
         '''
@@ -32851,7 +33989,7 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
     @builtins.property
     @jsii.member(jsii_name="attrParentId")
     def attr_parent_id(self) -> builtins.str:
-        '''For nested stacks--stacks created as resources for another stack--returns the stack ID of the direct parent of this stack.
+        '''For nested stacks, returns the stack ID of the direct parent of this stack.
 
         For the first level of nested stacks, the root stack is also the parent stack.
 
@@ -32862,7 +34000,7 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
     @builtins.property
     @jsii.member(jsii_name="attrRootId")
     def attr_root_id(self) -> builtins.str:
-        '''For nested stacks--stacks created as resources for another stack--returns the stack ID of the top-level stack to which the nested stack ultimately belongs.
+        '''For nested stacks, returns the stack ID of the top-level stack to which the nested stack ultimately belongs.
 
         :cloudformationAttribute: RootId
         '''
@@ -32891,6 +34029,12 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="stackRef")
+    def stack_ref(self) -> _StackReference_15f8b984:
+        '''A reference to a Stack resource.'''
+        return typing.cast(_StackReference_15f8b984, jsii.get(self, "stackRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> TagManager:
@@ -32947,7 +34091,7 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
     @builtins.property
     @jsii.member(jsii_name="templateUrl")
     def template_url(self) -> typing.Optional[builtins.str]:
-        '''The URL of a file containing the template body.'''
+        '''The URL of a file that contains the template body.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "templateUrl"))
 
     @template_url.setter
@@ -33076,15 +34220,15 @@ class CfnStack(CfnResource, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.CfnS
             )
 
 
-@jsii.implements(IInspectable, ITaggable)
+@jsii.implements(IInspectable, _IStackSetRef_3a202137, ITaggable)
 class CfnStackSet(
     CfnResource,
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.CfnStackSet",
 ):
-    '''The ``AWS::CloudFormation::StackSet`` resource enables you to provision stacks into AWS accounts and across Regions by using a single CloudFormation template.
+    '''The ``AWS::CloudFormation::StackSet`` resource contains information about a StackSet.
 
-    In the stack set, you specify the template to use, in addition to any parameters and capabilities that the template requires.
+    With StackSets, you can provision stacks across AWS accounts and Regions from a single CloudFormation template. Each stack is based on the same CloudFormation template, but you can customize individual stacks using parameters.
     .. epigraph::
 
        Run deployments to nested StackSets from the parent stack, not directly through the StackSet API.
@@ -33174,24 +34318,25 @@ class CfnStackSet(
         template_body: typing.Optional[builtins.str] = None,
         template_url: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::StackSet``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param permission_model: Describes how the IAM roles required for stack set operations are created. - With ``SELF_MANAGED`` permissions, you must create the administrator and execution roles required to deploy to target accounts. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . - With ``SERVICE_MANAGED`` permissions, StackSets automatically creates the IAM roles required to deploy to accounts managed by AWS Organizations . For more information, see `Activate trusted access for stack sets with AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html>`_ in the *AWS CloudFormation User Guide* .
-        :param stack_set_name: The name to associate with the stack set. The name must be unique in the Region where you create your stack set.
-        :param administration_role_arn: The Amazon Resource Number (ARN) of the IAM role to use to create this stack set. Specify an IAM role only if you are using customized administrator roles to control which users or groups can manage specific stack sets within the same administrator account. Use customized administrator roles to control which users or groups can manage specific stack sets within the same administrator account. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . Valid only if the permissions model is ``SELF_MANAGED`` .
-        :param auto_deployment: Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target organization or organizational unit (OU). For more information, see `Manage automatic deployments for CloudFormation StackSets that use service-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.html>`_ in the *AWS CloudFormation User Guide* . Required if the permissions model is ``SERVICE_MANAGED`` . (Not used with self-managed permissions.)
-        :param call_as: Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. By default, ``SELF`` is specified. Use ``SELF`` for stack sets with self-managed permissions. - To create a stack set with service-managed permissions while signed in to the management account, specify ``SELF`` . - To create a stack set with service-managed permissions while signed in to a delegated administrator account, specify ``DELEGATED_ADMIN`` . Your AWS account must be registered as a delegated admin in the management account. For more information, see `Register a delegated administrator <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-delegated-admin.html>`_ in the *AWS CloudFormation User Guide* . Stack sets with service-managed permissions are created in the management account, including stack sets that are created by delegated administrators. Valid only if the permissions model is ``SERVICE_MANAGED`` .
-        :param capabilities: The capabilities that are allowed in the stack set. Some stack set templates might include resources that can affect permissions in your AWS account —for example, by creating new IAM users. For more information, see `Acknowledging IAM resources in CloudFormation templates <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html#using-iam-capabilities>`_ in the *AWS CloudFormation User Guide* .
-        :param description: A description of the stack set.
-        :param execution_role_name: The name of the IAM execution role to use to create the stack set. If you don't specify an execution role, CloudFormation uses the ``AWSCloudFormationStackSetExecutionRole`` role for the stack set operation. Valid only if the permissions model is ``SELF_MANAGED`` . *Pattern* : ``[a-zA-Z_0-9+=,.@-]+``
-        :param managed_execution: Describes whether StackSets performs non-conflicting operations concurrently and queues conflicting operations. When active, StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. .. epigraph:: If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. When inactive (default), StackSets performs one operation at a time in request order.
-        :param operation_preferences: The user-specified preferences for how CloudFormation performs a stack set operation.
-        :param parameters: The input parameters for the stack set template.
+        :param permission_model: Describes how the IAM roles required for StackSet operations are created. - With ``SELF_MANAGED`` permissions, you must create the administrator and execution roles required to deploy to target accounts. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . - With ``SERVICE_MANAGED`` permissions, StackSets automatically creates the IAM roles required to deploy to accounts managed by AWS Organizations . For more information, see `Activate trusted access for StackSets with AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html>`_ in the *AWS CloudFormation User Guide* .
+        :param stack_set_name: The name to associate with the StackSet. The name must be unique in the Region where you create your StackSet.
+        :param administration_role_arn: The Amazon Resource Number (ARN) of the IAM role to use to create this StackSet. Specify an IAM role only if you are using customized administrator roles to control which users or groups can manage specific StackSets within the same administrator account. Use customized administrator roles to control which users or groups can manage specific StackSets within the same administrator account. For more information, see `Grant self-managed permissions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html>`_ in the *AWS CloudFormation User Guide* . Valid only if the permissions model is ``SELF_MANAGED`` .
+        :param auto_deployment: Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target organization or organizational unit (OU). For more information, see `Enable or disable automatic deployments for StackSets in AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.html>`_ in the *AWS CloudFormation User Guide* . Required if the permissions model is ``SERVICE_MANAGED`` . (Not used with self-managed permissions.)
+        :param call_as: Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. By default, ``SELF`` is specified. Use ``SELF`` for StackSets with self-managed permissions. - To create a StackSet with service-managed permissions while signed in to the management account, specify ``SELF`` . - To create a StackSet with service-managed permissions while signed in to a delegated administrator account, specify ``DELEGATED_ADMIN`` . Your AWS account must be registered as a delegated admin in the management account. For more information, see `Register a delegated administrator <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-delegated-admin.html>`_ in the *AWS CloudFormation User Guide* . StackSets with service-managed permissions are created in the management account, including StackSets that are created by delegated administrators. Valid only if the permissions model is ``SERVICE_MANAGED`` .
+        :param capabilities: The capabilities that are allowed in the StackSet. Some StackSet templates might include resources that can affect permissions in your AWS account —for example, by creating new IAM users. For more information, see `Acknowledging IAM resources in CloudFormation templates <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/control-access-with-iam.html#using-iam-capabilities>`_ in the *AWS CloudFormation User Guide* .
+        :param description: A description of the StackSet.
+        :param execution_role_name: The name of the IAM execution role to use to create the StackSet. If you don't specify an execution role, CloudFormation uses the ``AWSCloudFormationStackSetExecutionRole`` role for the StackSet operation. Valid only if the permissions model is ``SELF_MANAGED`` . *Pattern* : ``[a-zA-Z_0-9+=,.@-]+``
+        :param managed_execution: Describes whether StackSets performs non-conflicting operations concurrently and queues conflicting operations. When active, StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. .. epigraph:: If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. You can't modify your StackSet's execution configuration while there are running or queued operations for that StackSet. When inactive (default), StackSets performs one operation at a time in request order.
+        :param operation_preferences: The user-specified preferences for how CloudFormation performs a StackSet operation.
+        :param parameters: The input parameters for the StackSet template.
         :param stack_instances_group: A group of stack instances with parameters in some specific accounts and Regions.
         :param tags: Key-value pairs to associate with this stack. CloudFormation also propagates these tags to supported resources in the stack. You can specify a maximum number of 50 tags. If you don't specify this parameter, CloudFormation doesn't modify the stack's tags. If you specify an empty value, CloudFormation removes all associated tags.
-        :param template_body: The structure that contains the template body, with a minimum length of 1 byte and a maximum length of 51,200 bytes. You must include either ``TemplateURL`` or ``TemplateBody`` in a StackSet, but you can't use both. Dynamic references in the ``TemplateBody`` may not work correctly in all cases. It's recommended to pass templates containing dynamic references through ``TemplateUrl`` instead.
-        :param template_url: The URL of a file containing the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket or a Systems Manager document. The location for an Amazon S3 bucket must start with ``https://`` . Conditional: You must specify only one of the following parameters: ``TemplateBody`` , ``TemplateURL`` .
+        :param template_body: The structure that contains the template body, with a minimum length of 1 byte and a maximum length of 51,200 bytes. You must include either ``TemplateURL`` or ``TemplateBody`` in a StackSet, but you can't use both. Dynamic references in the ``TemplateBody`` may not work correctly in all cases. It's recommended to pass templates that contain dynamic references through ``TemplateUrl`` instead.
+        :param template_url: The URL of a file that contains the template body. The URL must point to a template (max size: 1 MB) that's located in an Amazon S3 bucket or a Systems Manager document. The location for an Amazon S3 bucket must start with ``https://`` . Conditional: You must specify only one of the following parameters: ``TemplateBody`` , ``TemplateURL`` .
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__18f5cbcbd69d140eff69172745aeef070057c3c18635b8197f16a411bf031298)
@@ -33250,7 +34395,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="attrStackSetId")
     def attr_stack_set_id(self) -> builtins.str:
-        '''The ID of the stack that you're creating.
+        '''Returns the unique identifier of the resource.
 
         :cloudformationAttribute: StackSetId
         '''
@@ -33261,6 +34406,12 @@ class CfnStackSet(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="stackSetRef")
+    def stack_set_ref(self) -> _StackSetReference_c5c1f82d:
+        '''A reference to a StackSet resource.'''
+        return typing.cast(_StackSetReference_c5c1f82d, jsii.get(self, "stackSetRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> TagManager:
@@ -33270,7 +34421,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="permissionModel")
     def permission_model(self) -> builtins.str:
-        '''Describes how the IAM roles required for stack set operations are created.'''
+        '''Describes how the IAM roles required for StackSet operations are created.'''
         return typing.cast(builtins.str, jsii.get(self, "permissionModel"))
 
     @permission_model.setter
@@ -33283,7 +34434,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="stackSetName")
     def stack_set_name(self) -> builtins.str:
-        '''The name to associate with the stack set.'''
+        '''The name to associate with the StackSet.'''
         return typing.cast(builtins.str, jsii.get(self, "stackSetName"))
 
     @stack_set_name.setter
@@ -33296,7 +34447,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="administrationRoleArn")
     def administration_role_arn(self) -> typing.Optional[builtins.str]:
-        '''The Amazon Resource Number (ARN) of the IAM role to use to create this stack set.'''
+        '''The Amazon Resource Number (ARN) of the IAM role to use to create this StackSet.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "administrationRoleArn"))
 
     @administration_role_arn.setter
@@ -33340,7 +34491,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="capabilities")
     def capabilities(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''The capabilities that are allowed in the stack set.'''
+        '''The capabilities that are allowed in the StackSet.'''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "capabilities"))
 
     @capabilities.setter
@@ -33353,7 +34504,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="description")
     def description(self) -> typing.Optional[builtins.str]:
-        '''A description of the stack set.'''
+        '''A description of the StackSet.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "description"))
 
     @description.setter
@@ -33366,7 +34517,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="executionRoleName")
     def execution_role_name(self) -> typing.Optional[builtins.str]:
-        '''The name of the IAM execution role to use to create the stack set.'''
+        '''The name of the IAM execution role to use to create the StackSet.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "executionRoleName"))
 
     @execution_role_name.setter
@@ -33394,7 +34545,7 @@ class CfnStackSet(
     def operation_preferences(
         self,
     ) -> typing.Optional[typing.Union[IResolvable, "CfnStackSet.OperationPreferencesProperty"]]:
-        '''The user-specified preferences for how CloudFormation performs a stack set operation.'''
+        '''The user-specified preferences for how CloudFormation performs a StackSet operation.'''
         return typing.cast(typing.Optional[typing.Union[IResolvable, "CfnStackSet.OperationPreferencesProperty"]], jsii.get(self, "operationPreferences"))
 
     @operation_preferences.setter
@@ -33412,7 +34563,7 @@ class CfnStackSet(
     def parameters(
         self,
     ) -> typing.Optional[typing.Union[IResolvable, typing.List[typing.Union[IResolvable, "CfnStackSet.ParameterProperty"]]]]:
-        '''The input parameters for the stack set template.'''
+        '''The input parameters for the StackSet template.'''
         return typing.cast(typing.Optional[typing.Union[IResolvable, typing.List[typing.Union[IResolvable, "CfnStackSet.ParameterProperty"]]]], jsii.get(self, "parameters"))
 
     @parameters.setter
@@ -33472,7 +34623,7 @@ class CfnStackSet(
     @builtins.property
     @jsii.member(jsii_name="templateUrl")
     def template_url(self) -> typing.Optional[builtins.str]:
-        '''The URL of a file containing the template body.'''
+        '''The URL of a file that contains the template body.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "templateUrl"))
 
     @template_url.setter
@@ -33497,7 +34648,9 @@ class CfnStackSet(
             enabled: typing.Optional[typing.Union[builtins.bool, IResolvable]] = None,
             retain_stacks_on_account_removal: typing.Optional[typing.Union[builtins.bool, IResolvable]] = None,
         ) -> None:
-            '''[ ``Service-managed`` permissions] Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target organizational unit (OU).
+            '''Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target organization or organizational unit (OU).
+
+            For more information, see `Enable or disable automatic deployments for StackSets in AWS Organizations <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.html>`_ in the *AWS CloudFormation User Guide* .
 
             :param enabled: If set to ``true`` , StackSets automatically deploys additional stack instances to AWS Organizations accounts that are added to a target organization or organizational unit (OU) in the specified Regions. If an account is removed from a target organization or OU, StackSets deletes stack instances from the account in the specified Regions.
             :param retain_stacks_on_account_removal: If set to ``true`` , stack resources are retained when an account is removed from a target organization or OU. If set to ``false`` , stack resources are deleted. Specify only if ``Enabled`` is set to ``True`` .
@@ -33580,11 +34733,20 @@ class CfnStackSet(
             accounts_url: typing.Optional[builtins.str] = None,
             organizational_unit_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
         ) -> None:
-            '''The AWS OrganizationalUnitIds or Accounts for which to create stack instances in the specified Regions.
+            '''The AWS Organizations accounts or AWS accounts to deploy stacks to in the specified Regions.
+
+            When deploying to AWS Organizations accounts with ``SERVICE_MANAGED`` permissions:
+
+            - You must specify the ``OrganizationalUnitIds`` property.
+            - If you specify organizational units (OUs) for ``OrganizationalUnitIds`` and use either the ``Accounts`` or ``AccountsUrl`` property, you must also specify the ``AccountFilterType`` property.
+
+            When deploying to AWS accounts with ``SELF_MANAGED`` permissions:
+
+            - You must specify either the ``Accounts`` or ``AccountsUrl`` property, but not both.
 
-            :param account_filter_type: Limit deployment targets to individual accounts or include additional accounts with provided OUs. The following is a list of possible values for the ``AccountFilterType`` operation. - ``INTERSECTION`` : StackSet deploys to the accounts specified in the ``Accounts`` parameter. - ``DIFFERENCE`` : StackSet deploys to the OU, excluding the accounts specified in the ``Accounts`` parameter. - ``UNION`` StackSet deploys to the OU, and the accounts specified in the ``Accounts`` parameter. ``UNION`` is not supported for create operations when using StackSet as a resource.
+            :param account_filter_type: Refines which accounts to deploy stacks to by specifying how to use the ``Accounts`` and ``OrganizationalUnitIds`` properties together. The following values determine how CloudFormation selects target accounts: - ``INTERSECTION`` : StackSet deploys to the accounts specified in the ``Accounts`` property. - ``DIFFERENCE`` : StackSet deploys to the OU, excluding the accounts specified in the ``Accounts`` property. - ``UNION`` : StackSet deploys to the OU, and the accounts specified in the ``Accounts`` property. ``UNION`` is not supported for create operations when using StackSet as a resource or the ``CreateStackInstances`` API.
             :param accounts: The account IDs of the AWS accounts . If you have many account numbers, you can provide those accounts using the ``AccountsUrl`` property instead. *Pattern* : ``^[0-9]{12}$``
-            :param accounts_url: The Amazon S3 URL path to a file that contains a list of AWS account IDs. The file format must be either ``.csv`` or ``.txt`` , and the data can be comma-separated or new-line-separated. There is currently a 10MB limit for the data (approximately 800,000 accounts).
+            :param accounts_url: The Amazon S3 URL path to a file that contains a list of AWS account IDs. The file format must be either ``.csv`` or ``.txt`` , and the data can be comma-separated or new-line-separated. There is currently a 10MB limit for the data (approximately 800,000 accounts). This property serves the same purpose as ``Accounts`` but allows you to specify a large number of accounts.
             :param organizational_unit_ids: The organization root ID or organizational unit (OU) IDs. *Pattern* : ``^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})$``
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-deploymenttargets.html
@@ -33621,13 +34783,13 @@ class CfnStackSet(
 
         @builtins.property
         def account_filter_type(self) -> typing.Optional[builtins.str]:
-            '''Limit deployment targets to individual accounts or include additional accounts with provided OUs.
+            '''Refines which accounts to deploy stacks to by specifying how to use the ``Accounts`` and ``OrganizationalUnitIds`` properties together.
 
-            The following is a list of possible values for the ``AccountFilterType`` operation.
+            The following values determine how CloudFormation selects target accounts:
 
-            - ``INTERSECTION`` : StackSet deploys to the accounts specified in the ``Accounts`` parameter.
-            - ``DIFFERENCE`` : StackSet deploys to the OU, excluding the accounts specified in the ``Accounts`` parameter.
-            - ``UNION`` StackSet deploys to the OU, and the accounts specified in the ``Accounts`` parameter. ``UNION`` is not supported for create operations when using StackSet as a resource.
+            - ``INTERSECTION`` : StackSet deploys to the accounts specified in the ``Accounts`` property.
+            - ``DIFFERENCE`` : StackSet deploys to the OU, excluding the accounts specified in the ``Accounts`` property.
+            - ``UNION`` : StackSet deploys to the OU, and the accounts specified in the ``Accounts`` property. ``UNION`` is not supported for create operations when using StackSet as a resource or the ``CreateStackInstances`` API.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-deploymenttargets.html#cfn-cloudformation-stackset-deploymenttargets-accountfiltertype
             '''
@@ -33653,6 +34815,8 @@ class CfnStackSet(
 
             The file format must be either ``.csv`` or ``.txt`` , and the data can be comma-separated or new-line-separated. There is currently a 10MB limit for the data (approximately 800,000 accounts).
 
+            This property serves the same purpose as ``Accounts`` but allows you to specify a large number of accounts.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-deploymenttargets.html#cfn-cloudformation-stackset-deploymenttargets-accountsurl
             '''
             result = self._values.get("accounts_url")
@@ -33693,7 +34857,7 @@ class CfnStackSet(
         ) -> None:
             '''Describes whether StackSets performs non-conflicting operations concurrently and queues conflicting operations.
 
-            :param active: When ``true`` , StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. .. epigraph:: If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. When ``false`` (default), StackSets performs one operation at a time in request order.
+            :param active: When ``true`` , CloudFormation performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, CloudFormation starts queued operations in request order. .. epigraph:: If there are already running or queued operations, CloudFormation queues all incoming operations even if they are non-conflicting. You can't modify your StackSet's execution configuration while there are running or queued operations for that StackSet. When ``false`` (default), StackSets performs one operation at a time in request order.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-managedexecution.html
             :exampleMetadata: fixture=_generated
@@ -33717,14 +34881,14 @@ class CfnStackSet(
 
         @builtins.property
         def active(self) -> typing.Optional[typing.Union[builtins.bool, IResolvable]]:
-            '''When ``true`` , StackSets performs non-conflicting operations concurrently and queues conflicting operations.
+            '''When ``true`` , CloudFormation performs non-conflicting operations concurrently and queues conflicting operations.
 
-            After conflicting operations finish, StackSets starts queued operations in request order.
+            After conflicting operations finish, CloudFormation starts queued operations in request order.
             .. epigraph::
 
-               If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting.
+               If there are already running or queued operations, CloudFormation queues all incoming operations even if they are non-conflicting.
 
-               You can't modify your stack set's execution configuration while there are running or queued operations for that stack set.
+               You can't modify your StackSet's execution configuration while there are running or queued operations for that StackSet.
 
             When ``false`` (default), StackSets performs one operation at a time in request order.
 
@@ -33769,13 +34933,13 @@ class CfnStackSet(
             region_concurrency_type: typing.Optional[builtins.str] = None,
             region_order: typing.Optional[typing.Sequence[builtins.str]] = None,
         ) -> None:
-            '''The user-specified preferences for how CloudFormation performs a stack set operation.
+            '''The user-specified preferences for how CloudFormation performs a StackSet operation.
 
-            For more information on maximum concurrent accounts and failure tolerance, see `Stack set operation options <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html#stackset-ops-options>`_ in the *AWS CloudFormation User Guide* .
+            For more information on maximum concurrent accounts and failure tolerance, see `StackSet operation options <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html#stackset-ops-options>`_ in the *AWS CloudFormation User Guide* .
 
-            :param concurrency_mode: Specifies how the concurrency level behaves during the operation execution. - ``STRICT_FAILURE_TOLERANCE`` : This option dynamically lowers the concurrency level to ensure the number of failed accounts never exceeds the value of ``FailureToleranceCount`` +1. The initial actual concurrency is set to the lower of either the value of the ``MaxConcurrentCount`` , or the value of ``FailureToleranceCount`` +1. The actual concurrency is then reduced proportionally by the number of failures. This is the default behavior. If failure tolerance or Maximum concurrent accounts are set to percentages, the behavior is similar. - ``SOFT_FAILURE_TOLERANCE`` : This option decouples ``FailureToleranceCount`` from the actual concurrency. This allows stack set operations to run at the concurrency level set by the ``MaxConcurrentCount`` value, or ``MaxConcurrentPercentage`` , regardless of the number of failures.
-            :param failure_tolerance_count: The number of accounts, per Region, for which this operation can fail before CloudFormation stops the operation in that Region. If the operation is stopped in a Region, CloudFormation doesn't attempt the operation in any subsequent Regions. Conditional: You must specify either ``FailureToleranceCount`` or ``FailureTolerancePercentage`` (but not both).
-            :param failure_tolerance_percentage: The percentage of accounts, per Region, for which this stack operation can fail before CloudFormation stops the operation in that Region. If the operation is stopped in a Region, CloudFormation doesn't attempt the operation in any subsequent Regions. When calculating the number of accounts based on the specified percentage, CloudFormation rounds *down* to the next whole number. Conditional: You must specify either ``FailureToleranceCount`` or ``FailureTolerancePercentage`` , but not both.
+            :param concurrency_mode: Specifies how the concurrency level behaves during the operation execution. - ``STRICT_FAILURE_TOLERANCE`` : This option dynamically lowers the concurrency level to ensure the number of failed accounts never exceeds the value of ``FailureToleranceCount`` +1. The initial actual concurrency is set to the lower of either the value of the ``MaxConcurrentCount`` , or the value of ``FailureToleranceCount`` +1. The actual concurrency is then reduced proportionally by the number of failures. This is the default behavior. If failure tolerance or Maximum concurrent accounts are set to percentages, the behavior is similar. - ``SOFT_FAILURE_TOLERANCE`` : This option decouples ``FailureToleranceCount`` from the actual concurrency. This allows StackSet operations to run at the concurrency level set by the ``MaxConcurrentCount`` value, or ``MaxConcurrentPercentage`` , regardless of the number of failures.
+            :param failure_tolerance_count: The number of accounts per Region this operation can fail in before CloudFormation stops the operation in that Region. If the operation is stopped in a Region, CloudFormation doesn't attempt the operation in any subsequent Regions. Conditional: You must specify either ``FailureToleranceCount`` or ``FailureTolerancePercentage`` (but not both).
+            :param failure_tolerance_percentage: The percentage of accounts per Region this stack operation can fail in before CloudFormation stops the operation in that Region. If the operation is stopped in a Region, CloudFormation doesn't attempt the operation in any subsequent Regions. When calculating the number of accounts based on the specified percentage, CloudFormation rounds *down* to the next whole number. Conditional: You must specify either ``FailureToleranceCount`` or ``FailureTolerancePercentage`` , but not both.
             :param max_concurrent_count: The maximum number of accounts in which to perform this operation at one time. This is dependent on the value of ``FailureToleranceCount`` . ``MaxConcurrentCount`` is at most one more than the ``FailureToleranceCount`` . Note that this setting lets you specify the *maximum* for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. Conditional: You must specify either ``MaxConcurrentCount`` or ``MaxConcurrentPercentage`` , but not both.
             :param max_concurrent_percentage: The maximum percentage of accounts in which to perform this operation at one time. When calculating the number of accounts based on the specified percentage, CloudFormation rounds down to the next whole number. This is true except in cases where rounding down would result is zero. In this case, CloudFormation sets the number as one instead. Note that this setting lets you specify the *maximum* for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. Conditional: You must specify either ``MaxConcurrentCount`` or ``MaxConcurrentPercentage`` , but not both.
             :param region_concurrency_type: The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time.
@@ -33833,7 +34997,7 @@ class CfnStackSet(
 
             If failure tolerance or Maximum concurrent accounts are set to percentages, the behavior is similar.
 
-            - ``SOFT_FAILURE_TOLERANCE`` : This option decouples ``FailureToleranceCount`` from the actual concurrency. This allows stack set operations to run at the concurrency level set by the ``MaxConcurrentCount`` value, or ``MaxConcurrentPercentage`` , regardless of the number of failures.
+            - ``SOFT_FAILURE_TOLERANCE`` : This option decouples ``FailureToleranceCount`` from the actual concurrency. This allows StackSet operations to run at the concurrency level set by the ``MaxConcurrentCount`` value, or ``MaxConcurrentPercentage`` , regardless of the number of failures.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-operationpreferences.html#cfn-cloudformation-stackset-operationpreferences-concurrencymode
             '''
@@ -33842,7 +35006,7 @@ class CfnStackSet(
 
         @builtins.property
         def failure_tolerance_count(self) -> typing.Optional[jsii.Number]:
-            '''The number of accounts, per Region, for which this operation can fail before CloudFormation stops the operation in that Region.
+            '''The number of accounts per Region this operation can fail in before CloudFormation stops the operation in that Region.
 
             If the operation is stopped in a Region, CloudFormation doesn't attempt the operation in any subsequent Regions.
 
@@ -33855,7 +35019,7 @@ class CfnStackSet(
 
         @builtins.property
         def failure_tolerance_percentage(self) -> typing.Optional[jsii.Number]:
-            '''The percentage of accounts, per Region, for which this stack operation can fail before CloudFormation stops the operation in that Region.
+            '''The percentage of accounts per Region this stack operation can fail in before CloudFormation stops the operation in that Region.
 
             If the operation is stopped in a Region, CloudFormation doesn't attempt the operation in any subsequent Regions.
 
@@ -34022,9 +35186,9 @@ class CfnStackSet(
         ) -> None:
             '''Stack instances in some specific accounts and Regions.
 
-            :param deployment_targets: The AWS ``OrganizationalUnitIds`` or ``Accounts`` for which to create stack instances in the specified Regions.
+            :param deployment_targets: The AWS Organizations accounts or AWS accounts to deploy stacks to in the specified Regions.
             :param regions: The names of one or more Regions where you want to create stack instances using the specified AWS accounts .
-            :param parameter_overrides: A list of stack set parameters whose values you want to override in the selected stack instances.
+            :param parameter_overrides: A list of StackSet parameters whose values you want to override in the selected stack instances.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-stackinstances.html
             :exampleMetadata: fixture=_generated
@@ -34067,7 +35231,7 @@ class CfnStackSet(
         def deployment_targets(
             self,
         ) -> typing.Union[IResolvable, "CfnStackSet.DeploymentTargetsProperty"]:
-            '''The AWS ``OrganizationalUnitIds`` or ``Accounts`` for which to create stack instances in the specified Regions.
+            '''The AWS Organizations accounts or AWS accounts to deploy stacks to in the specified Regions.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-stackinstances.html#cfn-cloudformation-stackset-stackinstances-deploymenttargets
             '''
@@ -34089,7 +35253,7 @@ class CfnStackSet(
         def parameter_overrides(
             self,
         ) -> typing.Optional[typing.Union[IResolvable, typing.List[typing.Union[IResolvable, "CfnStackSet.ParameterProperty"]]]]:
-            '''A list of stack set parameters whose values you want to override in the selected stack instances.
+            '''A list of StackSet parameters whose values you want to override in the selected stack instances.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-stackinstances.html#cfn-cloudformation-stackset-stackinstances-parameteroverrides
             '''
@@ -34108,7 +35272,7 @@ class CfnStackSet(
             )
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _ITypeActivationRef_95db49a7)
 class CfnTypeActivation(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -34161,7 +35325,8 @@ class CfnTypeActivation(
         type_name_alias: typing.Optional[builtins.str] = None,
         version_bump: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::TypeActivation``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param auto_update: Whether to automatically update the extension in this account and Region when a new *minor* version is published by the extension publisher. Major versions released by the publisher must be manually updated. The default is ``true`` .
@@ -34172,7 +35337,7 @@ class CfnTypeActivation(
         :param publisher_id: The ID of the extension publisher. Conditional: You must specify ``PublicTypeArn`` , or ``TypeName`` , ``Type`` , and ``PublisherId`` .
         :param type: The extension type. Conditional: You must specify ``PublicTypeArn`` , or ``TypeName`` , ``Type`` , and ``PublisherId`` .
         :param type_name: The name of the extension. Conditional: You must specify ``PublicTypeArn`` , or ``TypeName`` , ``Type`` , and ``PublisherId`` .
-        :param type_name_alias: An alias to assign to the public extension, in this account and Region. If you specify an alias for the extension, CloudFormation treats the alias as the extension type name within this account and Region. You must use the alias to refer to the extension in your templates, API calls, and CloudFormation console. An extension alias must be unique within a given account and Region. You can activate the same public resource multiple times in the same account and Region, using different type name aliases.
+        :param type_name_alias: An alias to assign to the public extension in this account and Region. If you specify an alias for the extension, CloudFormation treats the alias as the extension type name within this account and Region. You must use the alias to refer to the extension in your templates, API calls, and CloudFormation console. An extension alias must be unique within a given account and Region. You can activate the same public resource multiple times in the same account and Region, using different type name aliases.
         :param version_bump: Manually updates a previously-activated type to a new major or minor version, if available. You can also use this parameter to update the value of ``AutoUpdate`` . - ``MAJOR`` : CloudFormation updates the extension to the newest major version, if one is available. - ``MINOR`` : CloudFormation updates the extension to the newest minor version, if one is available.
         '''
         if __debug__:
@@ -34227,7 +35392,7 @@ class CfnTypeActivation(
     @builtins.property
     @jsii.member(jsii_name="attrArn")
     def attr_arn(self) -> builtins.str:
-        '''The Amazon Resource Name (ARN) of the activated extension, in this account and Region.
+        '''The Amazon Resource Name (ARN) of the activated extension in this account and Region.
 
         :cloudformationAttribute: Arn
         '''
@@ -34238,6 +35403,12 @@ class CfnTypeActivation(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="typeActivationRef")
+    def type_activation_ref(self) -> _TypeActivationReference_03c77595:
+        '''A reference to a TypeActivation resource.'''
+        return typing.cast(_TypeActivationReference_03c77595, jsii.get(self, "typeActivationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="autoUpdate")
     def auto_update(self) -> typing.Optional[typing.Union[builtins.bool, IResolvable]]:
@@ -34353,7 +35524,7 @@ class CfnTypeActivation(
     @builtins.property
     @jsii.member(jsii_name="typeNameAlias")
     def type_name_alias(self) -> typing.Optional[builtins.str]:
-        '''An alias to assign to the public extension, in this account and Region.'''
+        '''An alias to assign to the public extension in this account and Region.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "typeNameAlias"))
 
     @type_name_alias.setter
@@ -34447,7 +35618,7 @@ class CfnTypeActivation(
             )
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IWaitConditionRef_5bc95657)
 class CfnWaitCondition(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -34455,7 +35626,7 @@ class CfnWaitCondition(
 ):
     '''The ``AWS::CloudFormation::WaitCondition`` resource provides a way to coordinate stack resource creation with configuration actions that are external to the stack creation or to track the status of a configuration process.
 
-    In these situations, we recommend that you associate a ``CreationPolicy`` attribute with the wait condition instead of using a wait condition handle. For more information and an example, see `CreationPolicy attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-creationpolicy.html>`_ in the *AWS CloudFormation User Guide* . If you use a ``CreationPolicy`` with a wait condition, don't specify any of the wait condition's properties.
+    In these situations, we recommend that you associate a ``CreationPolicy`` attribute with the wait condition instead of using a wait condition handle. For more information and an example, see `CreationPolicy attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-attribute-creationpolicy.html>`_ in the *AWS CloudFormation User Guide* . If you use a ``CreationPolicy`` with a wait condition, don't specify any of the wait condition's properties.
     .. epigraph::
 
        If you use AWS PrivateLink , resources in the VPC that respond to wait conditions must have access to CloudFormation , specific Amazon S3 buckets. Resources must send wait condition responses to a presigned Amazon S3 URL. If they can't send responses to Amazon S3 , CloudFormation won't receive a response and the stack operation fails. For more information, see `Access CloudFormation using an interface endpoint ( AWS PrivateLink ) <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/vpc-interface-endpoints.html>`_ in the *AWS CloudFormation User Guide* . > For Amazon EC2 and Auto Scaling resources, we recommend that you use a ``CreationPolicy`` attribute instead of wait conditions. Add a ``CreationPolicy`` attribute to those resources, and use the ``cfn-signal`` helper script to signal when an instance creation process has completed successfully.
@@ -34486,11 +35657,12 @@ class CfnWaitCondition(
         handle: typing.Optional[builtins.str] = None,
         timeout: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::WaitCondition``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param count: The number of success signals that CloudFormation must receive before it continues the stack creation process. When the wait condition receives the requisite number of success signals, CloudFormation resumes the creation of the stack. If the wait condition doesn't receive the specified number of success signals before the Timeout period expires, CloudFormation assumes that the wait condition has failed and rolls the stack back. Updates aren't supported.
-        :param handle: A reference to the wait condition handle used to signal this wait condition. Use the ``Ref`` intrinsic function to specify an `AWS::CloudFormation::WaitConditionHandle <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-waitconditionhandle.html>`_ resource. Anytime you add a ``WaitCondition`` resource during a stack update, you must associate the wait condition with a new WaitConditionHandle resource. Don't reuse an old wait condition handle that has already been defined in the template. If you reuse a wait condition handle, the wait condition might evaluate old signals from a previous create or update stack command. Updates aren't supported.
+        :param handle: A reference to the wait condition handle used to signal this wait condition. Use the ``Ref`` intrinsic function to specify an `AWS::CloudFormation::WaitConditionHandle <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-waitconditionhandle.html>`_ resource. Anytime you add a ``WaitCondition`` resource during a stack update, you must associate the wait condition with a new WaitConditionHandle resource. Don't reuse an old wait condition handle that has already been defined in the template. If you reuse a wait condition handle, the wait condition might evaluate old signals from a previous create or update stack command. Updates aren't supported.
         :param timeout: The length of time (in seconds) to wait for the number of signals that the ``Count`` property specifies. ``Timeout`` is a minimum-bound property, meaning the timeout occurs no sooner than the time you specify, but can occur shortly thereafter. The maximum time that can be specified for this property is 12 hours (43200 seconds). Updates aren't supported.
         '''
         if __debug__:
@@ -34542,7 +35714,8 @@ class CfnWaitCondition(
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''
+        '''Returns a unique identifier for the resource.
+
         :cloudformationAttribute: Id
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrId"))
@@ -34552,6 +35725,12 @@ class CfnWaitCondition(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="waitConditionRef")
+    def wait_condition_ref(self) -> _WaitConditionReference_e2d94a43:
+        '''A reference to a WaitCondition resource.'''
+        return typing.cast(_WaitConditionReference_e2d94a43, jsii.get(self, "waitConditionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="count")
     def count(self) -> typing.Optional[jsii.Number]:
@@ -34592,7 +35771,7 @@ class CfnWaitCondition(
         jsii.set(self, "timeout", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(IInspectable)
+@jsii.implements(IInspectable, _IWaitConditionHandleRef_6fbe7b4b)
 class CfnWaitConditionHandle(
     CfnResource,
     metaclass=jsii.JSIIMeta,
@@ -34622,7 +35801,8 @@ class CfnWaitConditionHandle(
     '''
 
     def __init__(self, scope: _constructs_77d1e7e8.Construct, id: builtins.str) -> None:
-        '''
+        '''Create a new ``AWS::CloudFormation::WaitConditionHandle``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         '''
@@ -34667,7 +35847,7 @@ class CfnWaitConditionHandle(
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''A unique identifier for the resource.
+        '''Returns a unique identifier for the resource.
 
         :cloudformationAttribute: Id
         '''
@@ -34678,6 +35858,12 @@ class CfnWaitConditionHandle(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="waitConditionHandleRef")
+    def wait_condition_handle_ref(self) -> _WaitConditionHandleReference_ba26e35b:
+        '''A reference to a WaitConditionHandle resource.'''
+        return typing.cast(_WaitConditionHandleReference_ba26e35b, jsii.get(self, "waitConditionHandleRef"))
+
 
 class CustomResource(
     Resource,
@@ -34792,6 +35978,12 @@ class CustomResource(
             check_type(argname="argument attribute_name", value=attribute_name, expected_type=type_hints["attribute_name"])
         return typing.cast(builtins.str, jsii.invoke(self, "getAttString", [attribute_name]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="ref")
     def ref(self) -> builtins.str:
@@ -35317,6 +36509,22 @@ class DockerIgnoreStrategy(
             check_type(argname="argument pattern", value=pattern, expected_type=type_hints["pattern"])
         return typing.cast(None, jsii.invoke(self, "add", [pattern]))
 
+    @jsii.member(jsii_name="completelyIgnores")
+    def completely_ignores(
+        self,
+        absolute_directory_path: builtins.str,
+    ) -> builtins.bool:
+        '''Determines whether a given directory path should be ignored and have all of its children ignored.
+
+        :param absolute_directory_path: absolute directory path to be assessed against the pattern.
+
+        :return: ``true`` if the directory and all of its children should be ignored
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4eeec3aad8660d3f77c7f5fd848b52abf32a847311801373080bbfe35642315a)
+            check_type(argname="argument absolute_directory_path", value=absolute_directory_path, expected_type=type_hints["absolute_directory_path"])
+        return typing.cast(builtins.bool, jsii.invoke(self, "completelyIgnores", [absolute_directory_path]))
+
     @jsii.member(jsii_name="ignores")
     def ignores(self, absolute_file_path: builtins.str) -> builtins.bool:
         '''Determines whether a given file path should be ignored or not.
@@ -35377,6 +36585,22 @@ class GitIgnoreStrategy(
             check_type(argname="argument pattern", value=pattern, expected_type=type_hints["pattern"])
         return typing.cast(None, jsii.invoke(self, "add", [pattern]))
 
+    @jsii.member(jsii_name="completelyIgnores")
+    def completely_ignores(
+        self,
+        absolute_directory_path: builtins.str,
+    ) -> builtins.bool:
+        '''Determines whether a given directory path should be ignored and have all of its children ignored.
+
+        :param absolute_directory_path: absolute directory path to be assessed against the pattern.
+
+        :return: ``true`` if the directory and all of its children should be ignored
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__e0e824f5e018cd48b279cd34fa185b0a533eed88eee2e88ebb3868389b89b517)
+            check_type(argname="argument absolute_directory_path", value=absolute_directory_path, expected_type=type_hints["absolute_directory_path"])
+        return typing.cast(builtins.bool, jsii.invoke(self, "completelyIgnores", [absolute_directory_path]))
+
     @jsii.member(jsii_name="ignores")
     def ignores(self, absolute_file_path: builtins.str) -> builtins.bool:
         '''Determines whether a given file path should be ignored or not.
@@ -35926,6 +37150,12 @@ class NestedStack(Stack, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.NestedS
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         return typing.cast(None, jsii.invoke(self, "setParameter", [name, value]))
 
+    @builtins.property
+    @jsii.member(jsii_name="bundlingRequired")
+    def bundling_required(self) -> builtins.bool:
+        '''Indicates whether the stack requires bundling or not.'''
+        return typing.cast(builtins.bool, jsii.get(self, "bundlingRequired"))
+
     @builtins.property
     @jsii.member(jsii_name="stackId")
     def stack_id(self) -> builtins.str:
@@ -36459,18 +37689,22 @@ class DefaultStackSynthesizer(
 
     Example::
 
-        # app: App
-        
-        
-        prod_stage = Stage(app, "ProdStage",
-            permissions_boundary=PermissionsBoundary.from_name("cdk-${Qualifier}-PermissionsBoundary-${AWS::AccountId}-${AWS::Region}")
-        )
-        
-        Stack(prod_stage, "ProdStack",
-            synthesizer=DefaultStackSynthesizer(
-                qualifier="custom"
-            )
-        )
+        class MyStack(Stack):
+            def __init__(self, scope, id, *, description=None, env=None, stackName=None, tags=None, notificationArns=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None, suppressTemplateIndentation=None, propertyInjectors=None):
+                super().__init__(scope, id,
+                    (SpreadAssignment ...props
+                      description=description, env=env, stackName=stackName, tags=tags, notificationArns=notificationArns, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary, suppressTemplateIndentation=suppressTemplateIndentation, propertyInjectors=propertyInjectors),
+                    synthesizer=DefaultStackSynthesizer(
+                        deploy_role_external_id="",
+                        deploy_role_additional_options={},
+                        file_asset_publishing_external_id="",
+                        file_asset_publishing_role_additional_options={},
+                        image_asset_publishing_external_id="",
+                        image_asset_publishing_role_additional_options={},
+                        lookup_role_external_id="",
+                        lookup_role_additional_options={}
+                    )
+                )
     '''
 
     def __init__(
@@ -36849,7 +38083,8 @@ class BootstraplessSynthesizer(
         
         bootstrapless_synthesizer = cdk.BootstraplessSynthesizer(
             cloud_formation_execution_role_arn="cloudFormationExecutionRoleArn",
-            deploy_role_arn="deployRoleArn"
+            deploy_role_arn="deployRoleArn",
+            qualifier="qualifier"
         )
     '''
 
@@ -36858,14 +38093,17 @@ class BootstraplessSynthesizer(
         *,
         cloud_formation_execution_role_arn: typing.Optional[builtins.str] = None,
         deploy_role_arn: typing.Optional[builtins.str] = None,
+        qualifier: typing.Optional[builtins.str] = None,
     ) -> None:
         '''
         :param cloud_formation_execution_role_arn: The CFN execution Role ARN to use. Default: - No CloudFormation role (use CLI credentials)
         :param deploy_role_arn: The deploy Role ARN to use. Default: - No deploy role (use CLI credentials)
+        :param qualifier: The qualifier used to specialize strings. Can be used to specify custom bootstrapped role names Default: 'hnb659fds'
         '''
         props = BootstraplessSynthesizerProps(
             cloud_formation_execution_role_arn=cloud_formation_execution_role_arn,
             deploy_role_arn=deploy_role_arn,
+            qualifier=qualifier,
         )
 
         jsii.create(self.__class__, self, [props])
@@ -37151,6 +38389,7 @@ __all__ = [
     "ICfnConditionExpression",
     "ICfnResourceOptions",
     "ICfnRuleConditionExpression",
+    "IEnvironmentAware",
     "IFragmentConcatenator",
     "IInspectable",
     "IListProducer",
@@ -37159,6 +38398,7 @@ __all__ = [
     "IPolicyValidationContextBeta1",
     "IPolicyValidationPluginBeta1",
     "IPostProcessor",
+    "IPropertyInjector",
     "IResolvable",
     "IResolveContext",
     "IResource",
@@ -37177,6 +38417,7 @@ __all__ = [
     "ITokenResolver",
     "IgnoreMode",
     "IgnoreStrategy",
+    "InjectionContext",
     "Intrinsic",
     "IntrinsicProps",
     "JsonNull",
@@ -37197,6 +38438,7 @@ __all__ = [
     "PolicyValidationReportStatusBeta1",
     "PolicyViolatingResourceBeta1",
     "PolicyViolationBeta1",
+    "PropertyInjectors",
     "Reference",
     "RemovalPolicies",
     "RemovalPolicy",
@@ -37246,6 +38488,7 @@ __all__ = [
     "assertions",
     "aws_accessanalyzer",
     "aws_acmpca",
+    "aws_aiops",
     "aws_amazonmq",
     "aws_amplify",
     "aws_amplifyuibuilder",
@@ -37265,6 +38508,7 @@ __all__ = [
     "aws_appsync",
     "aws_apptest",
     "aws_aps",
+    "aws_arcregionswitch",
     "aws_arczonalshift",
     "aws_athena",
     "aws_auditmanager",
@@ -37278,6 +38522,7 @@ __all__ = [
     "aws_batch",
     "aws_bcmdataexports",
     "aws_bedrock",
+    "aws_bedrockagentcore",
     "aws_billingconductor",
     "aws_budgets",
     "aws_cassandra",
@@ -37353,6 +38598,7 @@ __all__ = [
     "aws_events_targets",
     "aws_eventschemas",
     "aws_evidently",
+    "aws_evs",
     "aws_finspace",
     "aws_fis",
     "aws_fms",
@@ -37425,6 +38671,7 @@ __all__ = [
     "aws_mediastore",
     "aws_mediatailor",
     "aws_memorydb",
+    "aws_mpa",
     "aws_msk",
     "aws_mwaa",
     "aws_neptune",
@@ -37435,6 +38682,8 @@ __all__ = [
     "aws_notifications",
     "aws_notificationscontacts",
     "aws_oam",
+    "aws_observabilityadmin",
+    "aws_odb",
     "aws_omics",
     "aws_opensearchserverless",
     "aws_opensearchservice",
@@ -37474,6 +38723,7 @@ __all__ = [
     "aws_route53recoverycontrol",
     "aws_route53recoveryreadiness",
     "aws_route53resolver",
+    "aws_rtbfabric",
     "aws_rum",
     "aws_s3",
     "aws_s3_assets",
@@ -37483,6 +38733,7 @@ __all__ = [
     "aws_s3objectlambda",
     "aws_s3outposts",
     "aws_s3tables",
+    "aws_s3vectors",
     "aws_sagemaker",
     "aws_sam",
     "aws_scheduler",
@@ -37499,6 +38750,7 @@ __all__ = [
     "aws_shield",
     "aws_signer",
     "aws_simspaceweaver",
+    "aws_smsvoice",
     "aws_sns",
     "aws_sns_subscriptions",
     "aws_sqs",
@@ -37523,6 +38775,7 @@ __all__ = [
     "aws_wafv2",
     "aws_wisdom",
     "aws_workspaces",
+    "aws_workspacesinstances",
     "aws_workspacesthinclient",
     "aws_workspacesweb",
     "aws_xray",
@@ -37530,6 +38783,7 @@ __all__ = [
     "cloudformation_include",
     "custom_resources",
     "cx_api",
+    "interfaces",
     "lambda_layer_awscli",
     "lambda_layer_node_proxy_agent",
     "pipelines",
@@ -37544,6 +38798,7 @@ from . import alexa_ask
 from . import assertions
 from . import aws_accessanalyzer
 from . import aws_acmpca
+from . import aws_aiops
 from . import aws_amazonmq
 from . import aws_amplify
 from . import aws_amplifyuibuilder
@@ -37563,6 +38818,7 @@ from . import aws_appstream
 from . import aws_appsync
 from . import aws_apptest
 from . import aws_aps
+from . import aws_arcregionswitch
 from . import aws_arczonalshift
 from . import aws_athena
 from . import aws_auditmanager
@@ -37576,6 +38832,7 @@ from . import aws_backupgateway
 from . import aws_batch
 from . import aws_bcmdataexports
 from . import aws_bedrock
+from . import aws_bedrockagentcore
 from . import aws_billingconductor
 from . import aws_budgets
 from . import aws_cassandra
@@ -37651,6 +38908,7 @@ from . import aws_events
 from . import aws_events_targets
 from . import aws_eventschemas
 from . import aws_evidently
+from . import aws_evs
 from . import aws_finspace
 from . import aws_fis
 from . import aws_fms
@@ -37723,6 +38981,7 @@ from . import aws_mediapackagev2
 from . import aws_mediastore
 from . import aws_mediatailor
 from . import aws_memorydb
+from . import aws_mpa
 from . import aws_msk
 from . import aws_mwaa
 from . import aws_neptune
@@ -37733,6 +38992,8 @@ from . import aws_nimblestudio
 from . import aws_notifications
 from . import aws_notificationscontacts
 from . import aws_oam
+from . import aws_observabilityadmin
+from . import aws_odb
 from . import aws_omics
 from . import aws_opensearchserverless
 from . import aws_opensearchservice
@@ -37772,6 +39033,7 @@ from . import aws_route53profiles
 from . import aws_route53recoverycontrol
 from . import aws_route53recoveryreadiness
 from . import aws_route53resolver
+from . import aws_rtbfabric
 from . import aws_rum
 from . import aws_s3
 from . import aws_s3_assets
@@ -37781,6 +39043,7 @@ from . import aws_s3express
 from . import aws_s3objectlambda
 from . import aws_s3outposts
 from . import aws_s3tables
+from . import aws_s3vectors
 from . import aws_sagemaker
 from . import aws_sam
 from . import aws_scheduler
@@ -37797,6 +39060,7 @@ from . import aws_ses_actions
 from . import aws_shield
 from . import aws_signer
 from . import aws_simspaceweaver
+from . import aws_smsvoice
 from . import aws_sns
 from . import aws_sns_subscriptions
 from . import aws_sqs
@@ -37821,6 +39085,7 @@ from . import aws_wafregional
 from . import aws_wafv2
 from . import aws_wisdom
 from . import aws_workspaces
+from . import aws_workspacesinstances
 from . import aws_workspacesthinclient
 from . import aws_workspacesweb
 from . import aws_xray
@@ -37828,6 +39093,7 @@ from . import cloud_assembly_schema
 from . import cloudformation_include
 from . import custom_resources
 from . import cx_api
+from . import interfaces
 from . import lambda_layer_awscli
 from . import lambda_layer_node_proxy_agent
 from . import pipelines
@@ -37854,6 +39120,13 @@ def _typecheckingstub__cfddeb4c359528028785fb7ca8a01e86bcda81d53c82cdaef6ad18dd0
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__71c75ad95e6c491e615a0c0a9cc9bc5b538f2d93e7057612251cfc9592380513(
+    id: builtins.str,
+    message: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__58bb467dabbe29a0334a62f44fa1a8a9b59742b9dfac031624ed782055bf0ada(
     id: builtins.str,
     message: typing.Optional[builtins.str] = None,
@@ -37880,6 +39153,13 @@ def _typecheckingstub__42febf8c4cbec6748c47fab1f601511d3bc57ef5bc415cb489e10605f
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__843fb7798b96b5a06278ca94ba80d2ae0fb300672c44f21b2ee4d759a04bdba9(
+    id: builtins.str,
+    message: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e2fdcebb577d63295330a53b495fc6906cfbd98497144c53b1cb802e3e082f72(
     message: builtins.str,
 ) -> None:
@@ -37902,6 +39182,7 @@ def _typecheckingstub__ef2fee5e91b22ed9e2b91aa309be73835ddfb834f19eb3d41540c7e38
     outdir: typing.Optional[builtins.str] = None,
     policy_validation_beta1: typing.Optional[typing.Sequence[IPolicyValidationPluginBeta1]] = None,
     post_cli_context: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
+    property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
     stack_traces: typing.Optional[builtins.bool] = None,
     tree_metadata: typing.Optional[builtins.bool] = None,
 ) -> None:
@@ -38081,6 +39362,7 @@ def _typecheckingstub__3f56ec309bd76e41562731f3b986025649d4592e71caa79fed875d702
     *,
     cloud_formation_execution_role_arn: typing.Optional[builtins.str] = None,
     deploy_role_arn: typing.Optional[builtins.str] = None,
+    qualifier: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -38872,6 +40154,7 @@ def _typecheckingstub__43574b9eb91c9a4b6203c6c4dae8ace9123c2746c25560e39a6b8a8db
     scope: _constructs_77d1e7e8.Construct,
     *,
     provider: builtins.str,
+    additional_cache_key: typing.Optional[builtins.str] = None,
     include_environment: typing.Optional[builtins.bool] = None,
     props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
 ) -> None:
@@ -38885,6 +40168,7 @@ def _typecheckingstub__cbcd83febe5237c988f26712b8a838ca5d2e34ea47490d008757c21a6
     ignore_error_on_missing_context: typing.Optional[builtins.bool] = None,
     must_exist: typing.Optional[builtins.bool] = None,
     provider: builtins.str,
+    additional_cache_key: typing.Optional[builtins.str] = None,
     include_environment: typing.Optional[builtins.bool] = None,
     props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
 ) -> None:
@@ -38994,6 +40278,7 @@ def _typecheckingstub__e285633ad5a50949fcc0277b0b38d3679a006cdac41feaef60665b393
     cache_from: typing.Optional[typing.Sequence[typing.Union[DockerCacheOption, typing.Dict[builtins.str, typing.Any]]]] = None,
     cache_to: typing.Optional[typing.Union[DockerCacheOption, typing.Dict[builtins.str, typing.Any]]] = None,
     file: typing.Optional[builtins.str] = None,
+    network: typing.Optional[builtins.str] = None,
     platform: typing.Optional[builtins.str] = None,
     target_stage: typing.Optional[builtins.str] = None,
 ) -> None:
@@ -39029,6 +40314,7 @@ def _typecheckingstub__ee160dc0667b6e8f45df2c2f176a77d9d6a3ece4b83cdf7804625adf8
     cache_from: typing.Optional[typing.Sequence[typing.Union[DockerCacheOption, typing.Dict[builtins.str, typing.Any]]]] = None,
     cache_to: typing.Optional[typing.Union[DockerCacheOption, typing.Dict[builtins.str, typing.Any]]] = None,
     file: typing.Optional[builtins.str] = None,
+    network: typing.Optional[builtins.str] = None,
     platform: typing.Optional[builtins.str] = None,
     target_stage: typing.Optional[builtins.str] = None,
 ) -> None:
@@ -39173,6 +40459,12 @@ def _typecheckingstub__4b06766267738419297aaf93a2368e0c38c274adc14053ce29fd653d6
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__1c1f003fc36fb573df38915f709b99bb9c1a74aac84c52ba7fe12c54cf2cae8d(
+    x: typing.Any,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__1cadecf7c75d3f55ff2fcddf8a0d000d9f8e54b48218f1336d97358901d38c0b(
     x: typing.Any,
 ) -> None:
@@ -39185,6 +40477,12 @@ def _typecheckingstub__0c62bc5a6fe032556ae3c32e105ddaad3f4ca89286fd26884af6347d3
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__f2bf053437a17fa72244a5b0342af56acbb0f4ad4bc7fc877ac3974df0b811d3(
+    x: typing.Any,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__c9afe20487c547932befb7a2f6567c38793e8d7df55f47046e1cfb408408d733(
     x: typing.Any,
 ) -> None:
@@ -39519,6 +40817,7 @@ def _typecheckingstub__1aa84b6f7c7da29afeaf8cce6ea2a4aee978df497c5cb6d4432224b24
 def _typecheckingstub__4a3bc64bd38ef14ad5ebdf5807563d2355b26f4f0c446c315782c9818b76192a(
     *,
     provider: builtins.str,
+    additional_cache_key: typing.Optional[builtins.str] = None,
     include_environment: typing.Optional[builtins.bool] = None,
     props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
 ) -> None:
@@ -39536,6 +40835,7 @@ def _typecheckingstub__8870c87947d551a1842549591423e81e319fe3185c0ae81f67b67b1bf
 def _typecheckingstub__16ea3024419c210903405ca05f7de1bb3fad517c101a7a84926fb5e09ac784ec(
     *,
     provider: builtins.str,
+    additional_cache_key: typing.Optional[builtins.str] = None,
     include_environment: typing.Optional[builtins.bool] = None,
     props: typing.Optional[typing.Mapping[builtins.str, typing.Any]] = None,
     dummy_value: typing.Any,
@@ -39671,6 +40971,15 @@ def _typecheckingstub__421f2755d7e81609d225eb32560b6f8749147026d0e9c4a8130c5421a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__a84c13d89fffb1ee8026280d3071636f041aaa121bab44f9659e3255feca881d(
+    original_props: typing.Any,
+    *,
+    id: builtins.str,
+    scope: _constructs_77d1e7e8.Construct,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__09341b9d2d6a06b3937530fa96a1bcb7562ccdf5246e5563a8a552ec1f8c0fa5(
     context: IResolveContext,
 ) -> None:
@@ -39814,6 +41123,12 @@ def _typecheckingstub__eece2ad7e2f3cbe035a92302343ee656a4e8438489e1b15a43554b124
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__3a80a66d2944a2c289e3c51a3686487dddf7c755eb54d7726f3fd91652eddcde(
+    absolute_directory_path: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__30e8e458c385d1db329cfc0c45f966d2d15c1b0166b3e7cfe8a57c7809196bf5(
     pattern: builtins.str,
 ) -> None:
@@ -39826,6 +41141,14 @@ def _typecheckingstub__639820bc3ab9fb78a31dec5d3d916a2befafc70af8c041b6e444ac075
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__474d9096cc3297bd5f64e3e487372aedd71d529e93d80a946aa117f0e0f8bc5b(
+    *,
+    id: builtins.str,
+    scope: _constructs_77d1e7e8.Construct,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__4fdfa4eddae987229a9f6236b6c0b78b4d7e291c17d32a624ad710cd632917ff(
     value: typing.Any,
     *,
@@ -40046,6 +41369,30 @@ def _typecheckingstub__2f965066f077908d4839609b519c39167a0b14e83374fbf4bb1601ab5
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__4200e15e2cc09377aa6dd49e79c545a26e8c65589955f7210d145afb4881fcc5(
+    x: typing.Any,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d558bd5d62319107ba8d7aec423cb982f18f533d7f90939b4576ae5cabe237e6(
+    scope: _constructs_77d1e7e8.IConstruct,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__b15ed456b528cac4ffc455783d09279b63e060419397678acf12dc8a07323ae9(
+    *props_injectors: IPropertyInjector,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__ba79b618f23d72687ff58834f8d791bcc5f41fb49c8301987bb45eee4378958b(
+    unique_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__151f083e00bfac139cbf164b9069ab02924a37639eb1b7b58edc3dee3fdf3279(
     value: typing.Any,
     target: _constructs_77d1e7e8.IConstruct,
@@ -40246,6 +41593,16 @@ def _typecheckingstub__42536acc3fbfb7962f85e1c13349d32667f2fd64146363d2d766a253d
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__ba81ab5d0a7811c904f34d1d9805888e14bbd4da3987d73185cb1acbfc46df06(
+    secret_id: builtins.str,
+    *,
+    json_field: typing.Optional[builtins.str] = None,
+    version_id: typing.Optional[builtins.str] = None,
+    version_stage: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__8241420a9f59d70313b0ea1bef892ebf8261a60f603687b732491bb889791322(
     param: CfnParameter,
 ) -> None:
@@ -40361,6 +41718,7 @@ def _typecheckingstub__835828a2dac25cb8eb22f32985554296e8bd61463c8cc32bb2df4c1f4
     env: typing.Optional[typing.Union[Environment, typing.Dict[builtins.str, typing.Any]]] = None,
     notification_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
     permissions_boundary: typing.Optional[PermissionsBoundary] = None,
+    property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
     stack_name: typing.Optional[builtins.str] = None,
     suppress_template_indentation: typing.Optional[builtins.bool] = None,
     synthesizer: typing.Optional[IStackSynthesizer] = None,
@@ -40396,6 +41754,13 @@ def _typecheckingstub__2747e69e9678b96621f1476e1bee4426100a530229cea9dce16210392
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__c79ea9b0cd54830acfa2c93ac0786782e515591ac5cda10c42b42f8ff76457a0(
+    tag_name: builtins.str,
+    tag_value: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__4b8bfc7ce675d439b6218b58ddc312a45cfe87ee7179a489f0cc18c67560faac(
     transform: builtins.str,
 ) -> None:
@@ -40439,6 +41804,12 @@ def _typecheckingstub__1f4a18c1188f55ad7c4058f8aace9f6ebb7b7e9b596dd51616883b350
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__25f39c18a619c464f8e693cb5c5847cdf10f847438cac04672be8ba78d2b49d0(
+    tag_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__363ae1d6a0b84b63acd48fd337e70f58cc140887b9d61b4f55f925b3a7e2cded(
     old_id: builtins.str,
     new_id: builtins.str,
@@ -40486,6 +41857,7 @@ def _typecheckingstub__a36aaf4edf2967c8ed36d2cad24d023f14778db721379dffbd74eb6dd
     env: typing.Optional[typing.Union[Environment, typing.Dict[builtins.str, typing.Any]]] = None,
     notification_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
     permissions_boundary: typing.Optional[PermissionsBoundary] = None,
+    property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
     stack_name: typing.Optional[builtins.str] = None,
     suppress_template_indentation: typing.Optional[builtins.bool] = None,
     synthesizer: typing.Optional[IStackSynthesizer] = None,
@@ -40573,6 +41945,7 @@ def _typecheckingstub__c0677d374e192ff51310cb5059d45186fd8a854f0c4f6485ff9ec9692
     outdir: typing.Optional[builtins.str] = None,
     permissions_boundary: typing.Optional[PermissionsBoundary] = None,
     policy_validation_beta1: typing.Optional[typing.Sequence[IPolicyValidationPluginBeta1]] = None,
+    property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
     stage_name: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -40596,6 +41969,7 @@ def _typecheckingstub__c519a1aa0534921a8dfdfa69ddc24b52c09a7eb52fc889f7fb96b737e
     outdir: typing.Optional[builtins.str] = None,
     permissions_boundary: typing.Optional[PermissionsBoundary] = None,
     policy_validation_beta1: typing.Optional[typing.Sequence[IPolicyValidationPluginBeta1]] = None,
+    property_injectors: typing.Optional[typing.Sequence[IPropertyInjector]] = None,
     stage_name: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -42373,6 +43747,12 @@ def _typecheckingstub__dce0fd20685d4b7457e08a1567eb5aa8c53335612222538272b7d69db
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__4eeec3aad8660d3f77c7f5fd848b52abf32a847311801373080bbfe35642315a(
+    absolute_directory_path: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__a94afdff9185f6eef56446b1ee12df7551a9ea60e1fd57e80213dc039cb3980c(
     absolute_file_path: builtins.str,
 ) -> None:
@@ -42392,6 +43772,12 @@ def _typecheckingstub__41215ad4567a0e20a39ebe81e961b4c04ce243413f01303ac836fdb48
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__e0e824f5e018cd48b279cd34fa185b0a533eed88eee2e88ebb3868389b89b517(
+    absolute_directory_path: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e836fbc1866005d0d4acf04190bb860cb94af53b18c0a2f12af8835f961ccedd(
     absolute_file_path: builtins.str,
 ) -> None:
@@ -42542,3 +43928,6 @@ def _typecheckingstub__47e469f0015340593bcbbe8474c853bc170a6dfd3bcb31e6795042408
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [IAnyProducer, IAspect, IAsset, IBoundStackSynthesizer, ICfnConditionExpression, ICfnResourceOptions, ICfnRuleConditionExpression, IEnvironmentAware, IFragmentConcatenator, IInspectable, IListProducer, ILocalBundling, INumberProducer, IPolicyValidationContextBeta1, IPolicyValidationPluginBeta1, IPostProcessor, IPropertyInjector, IResolvable, IResolveContext, IResource, IReusableStackSynthesizer, IStableAnyProducer, IStableListProducer, IStableNumberProducer, IStableStringProducer, IStackSynthesizer, IStringProducer, ISynthesisSession, ITaggable, ITaggableV2, ITemplateOptions, ITokenMapper, ITokenResolver]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])