aws-cdk-lib 2.195.0__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_backup/__init__.py

@@ -86,6 +86,7 @@ plan.add_selection("Selection",
 To add rules to a plan, use `addRule()`:
 
 ```python
+from aws_cdk import TimeZone
 # plan: backup.BackupPlan
 
 plan.add_rule(backup.BackupPlanRule(
@@ -95,6 +96,7 @@ plan.add_rule(backup.BackupPlanRule(
         day="15",
         hour="3",
         minute="30"),
+    schedule_expression_timezone=TimeZone.ETC_UTC,
     move_to_cold_storage_after=Duration.days(30)
 ))
 ```
@@ -304,10 +306,10 @@ from .. import (
     RemovalPolicy as _RemovalPolicy_9f93c814,
     Resource as _Resource_45bc6135,
     TagManager as _TagManager_0a598cb3,
+    TimeZone as _TimeZone_cdd72ac9,
     TreeInspector as _TreeInspector_488e0dd5,
 )
 from ..aws_dynamodb import ITable as _ITable_504fd401
-from ..aws_ec2 import IInstance as _IInstance_ab239e7c
 from ..aws_efs import IFileSystem as _IFileSystem_b2d3a7cb
 from ..aws_events import Schedule as _Schedule_c151d01f
 from ..aws_iam import (
@@ -318,13 +320,32 @@ from ..aws_iam import (
     PolicyDocument as _PolicyDocument_3ac34393,
     PolicyStatement as _PolicyStatement_0fe33853,
 )
-from ..aws_kms import IKey as _IKey_5f11635f
 from ..aws_rds import (
     IDatabaseCluster as _IDatabaseCluster_6554c32b,
     IDatabaseInstance as _IDatabaseInstance_e4cb03a8,
     IServerlessCluster as _IServerlessCluster_adbbb720,
 )
 from ..aws_sns import ITopic as _ITopic_9eca4852
+from ..interfaces.aws_backup import (
+    BackupPlanReference as _BackupPlanReference_43879719,
+    BackupSelectionReference as _BackupSelectionReference_541c6985,
+    BackupVaultReference as _BackupVaultReference_228dbd3a,
+    FrameworkReference as _FrameworkReference_5ce10c24,
+    IBackupPlanRef as _IBackupPlanRef_754776b5,
+    IBackupSelectionRef as _IBackupSelectionRef_e9fbb7b2,
+    IBackupVaultRef as _IBackupVaultRef_c038ce00,
+    IFrameworkRef as _IFrameworkRef_dcbb25ea,
+    ILogicallyAirGappedBackupVaultRef as _ILogicallyAirGappedBackupVaultRef_94a8f212,
+    IReportPlanRef as _IReportPlanRef_2eb6ea89,
+    IRestoreTestingPlanRef as _IRestoreTestingPlanRef_3850185f,
+    IRestoreTestingSelectionRef as _IRestoreTestingSelectionRef_f3800013,
+    LogicallyAirGappedBackupVaultReference as _LogicallyAirGappedBackupVaultReference_53a7ab81,
+    ReportPlanReference as _ReportPlanReference_0a875581,
+    RestoreTestingPlanReference as _RestoreTestingPlanReference_99f8c406,
+    RestoreTestingSelectionReference as _RestoreTestingSelectionReference_05d8055b,
+)
+from ..interfaces.aws_ec2 import IInstanceRef as _IInstanceRef_b97803cb
+from ..interfaces.aws_kms import IKeyRef as _IKeyRef_d4fc6ef3
 
 
 @jsii.data_type(
@@ -557,6 +578,7 @@ class BackupPlanRule(
         recovery_point_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         rule_name: typing.Optional[builtins.str] = None,
         schedule_expression: typing.Optional[_Schedule_c151d01f] = None,
+        schedule_expression_timezone: typing.Optional[_TimeZone_cdd72ac9] = None,
         start_window: typing.Optional[_Duration_4839e8c3] = None,
     ) -> None:
         '''
@@ -569,6 +591,7 @@ class BackupPlanRule(
         :param recovery_point_tags: To help organize your resources, you can assign your own metadata to the resources that you create. Each tag is a key-value pair. Default: - no recovery point tags.
         :param rule_name: A display name for the backup rule. Default: - a CDK generated name
         :param schedule_expression: A CRON expression specifying when AWS Backup initiates a backup job. Default: - no schedule
+        :param schedule_expression_timezone: The timezone in which the schedule expression is set. Default: - UTC
         :param start_window: The duration after a backup is scheduled before a job is canceled if it doesn't start successfully. Default: - 8 hours
         '''
         props = BackupPlanRuleProps(
@@ -581,6 +604,7 @@ class BackupPlanRule(
             recovery_point_tags=recovery_point_tags,
             rule_name=rule_name,
             schedule_expression=schedule_expression,
+            schedule_expression_timezone=schedule_expression_timezone,
             start_window=start_window,
         )
 
@@ -681,6 +705,7 @@ class BackupPlanRule(
         "recovery_point_tags": "recoveryPointTags",
         "rule_name": "ruleName",
         "schedule_expression": "scheduleExpression",
+        "schedule_expression_timezone": "scheduleExpressionTimezone",
         "start_window": "startWindow",
     },
 )
@@ -697,6 +722,7 @@ class BackupPlanRuleProps:
         recovery_point_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         rule_name: typing.Optional[builtins.str] = None,
         schedule_expression: typing.Optional[_Schedule_c151d01f] = None,
+        schedule_expression_timezone: typing.Optional[_TimeZone_cdd72ac9] = None,
         start_window: typing.Optional[_Duration_4839e8c3] = None,
     ) -> None:
         '''Properties for a BackupPlanRule.
@@ -710,6 +736,7 @@ class BackupPlanRuleProps:
         :param recovery_point_tags: To help organize your resources, you can assign your own metadata to the resources that you create. Each tag is a key-value pair. Default: - no recovery point tags.
         :param rule_name: A display name for the backup rule. Default: - a CDK generated name
         :param schedule_expression: A CRON expression specifying when AWS Backup initiates a backup job. Default: - no schedule
+        :param schedule_expression_timezone: The timezone in which the schedule expression is set. Default: - UTC
         :param start_window: The duration after a backup is scheduled before a job is canceled if it doesn't start successfully. Default: - 8 hours
 
         :exampleMetadata: infused
@@ -738,6 +765,7 @@ class BackupPlanRuleProps:
             check_type(argname="argument recovery_point_tags", value=recovery_point_tags, expected_type=type_hints["recovery_point_tags"])
             check_type(argname="argument rule_name", value=rule_name, expected_type=type_hints["rule_name"])
             check_type(argname="argument schedule_expression", value=schedule_expression, expected_type=type_hints["schedule_expression"])
+            check_type(argname="argument schedule_expression_timezone", value=schedule_expression_timezone, expected_type=type_hints["schedule_expression_timezone"])
             check_type(argname="argument start_window", value=start_window, expected_type=type_hints["start_window"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
         if backup_vault is not None:
@@ -758,6 +786,8 @@ class BackupPlanRuleProps:
             self._values["rule_name"] = rule_name
         if schedule_expression is not None:
             self._values["schedule_expression"] = schedule_expression
+        if schedule_expression_timezone is not None:
+            self._values["schedule_expression_timezone"] = schedule_expression_timezone
         if start_window is not None:
             self._values["start_window"] = start_window
 
@@ -856,6 +886,15 @@ class BackupPlanRuleProps:
         result = self._values.get("schedule_expression")
         return typing.cast(typing.Optional[_Schedule_c151d01f], result)
 
+    @builtins.property
+    def schedule_expression_timezone(self) -> typing.Optional[_TimeZone_cdd72ac9]:
+        '''The timezone in which the schedule expression is set.
+
+        :default: - UTC
+        '''
+        result = self._values.get("schedule_expression_timezone")
+        return typing.cast(typing.Optional[_TimeZone_cdd72ac9], result)
+
     @builtins.property
     def start_window(self) -> typing.Optional[_Duration_4839e8c3]:
         '''The duration after a backup is scheduled before a job is canceled if it doesn't start successfully.
@@ -980,7 +1019,7 @@ class BackupResource(
 
     @jsii.member(jsii_name="fromEc2Instance")
     @builtins.classmethod
-    def from_ec2_instance(cls, instance: _IInstance_ab239e7c) -> "BackupResource":
+    def from_ec2_instance(cls, instance: _IInstanceRef_b97803cb) -> "BackupResource":
         '''An EC2 instance.
 
         :param instance: -
@@ -1160,6 +1199,12 @@ class BackupSelection(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="backupPlanId")
     def backup_plan_id(self) -> builtins.str:
@@ -1557,7 +1602,7 @@ class BackupVaultProps:
         access_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         backup_vault_name: typing.Optional[builtins.str] = None,
         block_recovery_point_deletion: typing.Optional[builtins.bool] = None,
-        encryption_key: typing.Optional[_IKey_5f11635f] = None,
+        encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         lock_configuration: typing.Optional[typing.Union["LockConfiguration", typing.Dict[builtins.str, typing.Any]]] = None,
         notification_events: typing.Optional[typing.Sequence[BackupVaultEvents]] = None,
         notification_topic: typing.Optional[_ITopic_9eca4852] = None,
@@ -1648,13 +1693,13 @@ class BackupVaultProps:
         return typing.cast(typing.Optional[builtins.bool], result)
 
     @builtins.property
-    def encryption_key(self) -> typing.Optional[_IKey_5f11635f]:
+    def encryption_key(self) -> typing.Optional[_IKeyRef_d4fc6ef3]:
         '''The server-side encryption key to use to protect your backups.
 
         :default: - an Amazon managed KMS key
         '''
         result = self._values.get("encryption_key")
-        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+        return typing.cast(typing.Optional[_IKeyRef_d4fc6ef3], result)
 
     @builtins.property
     def lock_configuration(self) -> typing.Optional["LockConfiguration"]:
@@ -1713,7 +1758,7 @@ class BackupVaultProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IBackupPlanRef_754776b5, _ITaggableV2_4e6798f8)
 class CfnBackupPlan(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1795,7 +1840,8 @@ class CfnBackupPlan(
         backup_plan: typing.Union[_IResolvable_da3f097b, typing.Union["CfnBackupPlan.BackupPlanResourceTypeProperty", typing.Dict[builtins.str, typing.Any]]],
         backup_plan_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::BackupPlan``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param backup_plan: Uniquely identifies the backup plan to be associated with the selection of resources.
@@ -1811,6 +1857,48 @@ class CfnBackupPlan(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromBackupPlanArn")
+    @builtins.classmethod
+    def from_backup_plan_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IBackupPlanRef_754776b5:
+        '''Creates a new IBackupPlanRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__19a621581dc951af9f595672bab4c44806829db988a9a543e73c82aa211347cc)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IBackupPlanRef_754776b5, jsii.sinvoke(cls, "fromBackupPlanArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromBackupPlanId")
+    @builtins.classmethod
+    def from_backup_plan_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        backup_plan_id: builtins.str,
+    ) -> _IBackupPlanRef_754776b5:
+        '''Creates a new IBackupPlanRef from a backupPlanId.
+
+        :param scope: -
+        :param id: -
+        :param backup_plan_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__c10f5f2e9e380d8e917a10f74122d09d2b555c99380ffa6da4e01197e1e097dd)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument backup_plan_id", value=backup_plan_id, expected_type=type_hints["backup_plan_id"])
+        return typing.cast(_IBackupPlanRef_754776b5, jsii.sinvoke(cls, "fromBackupPlanId", [scope, id, backup_plan_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1872,6 +1960,12 @@ class CfnBackupPlan(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrVersionId"))
 
+    @builtins.property
+    @jsii.member(jsii_name="backupPlanRef")
+    def backup_plan_ref(self) -> _BackupPlanReference_43879719:
+        '''A reference to a BackupPlan resource.'''
+        return typing.cast(_BackupPlanReference_43879719, jsii.get(self, "backupPlanRef"))
+
     @builtins.property
     @jsii.member(jsii_name="cdkTagManager")
     def cdk_tag_manager(self) -> _TagManager_0a598cb3:
@@ -2183,7 +2277,7 @@ class CfnBackupPlan(
             :param completion_window_minutes: A value in minutes after a backup job is successfully started before it must be completed or it is canceled by AWS Backup .
             :param copy_actions: An array of CopyAction objects, which contains the details of the copy operation.
             :param enable_continuous_backup: Enables continuous backup and point-in-time restores (PITR).
-            :param index_actions: 
+            :param index_actions: There can up to one IndexAction in each BackupRule, as each backup can have 0 or 1 backup index associated with it. Within the array is ResourceTypes. Only 1 resource type will be accepted for each BackupRule. Valid values: - ``EBS`` for Amazon Elastic Block Store - ``S3`` for Amazon Simple Storage Service (Amazon S3)
             :param lifecycle: The lifecycle defines when a protected resource is transitioned to cold storage and when it expires. AWS Backup transitions and expires backups automatically according to the lifecycle that you define.
             :param recovery_point_tags: The tags to assign to the resources.
             :param schedule_expression: A CRON expression specifying when AWS Backup initiates a backup job.
@@ -2325,7 +2419,13 @@ class CfnBackupPlan(
         def index_actions(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnBackupPlan.IndexActionsResourceTypeProperty"]]]]:
-            '''
+            '''There can up to one IndexAction in each BackupRule, as each backup can have 0 or 1 backup index associated with it.
+
+            Within the array is ResourceTypes. Only 1 resource type will be accepted for each BackupRule. Valid values:
+
+            - ``EBS`` for Amazon Elastic Block Store
+            - ``S3`` for Amazon Simple Storage Service (Amazon S3)
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-backup-backupplan-backupruleresourcetype.html#cfn-backup-backupplan-backupruleresourcetype-indexactions
             '''
             result = self._values.get("index_actions")
@@ -2496,8 +2596,9 @@ class CfnBackupPlan(
             *,
             resource_types: typing.Optional[typing.Sequence[builtins.str]] = None,
         ) -> None:
-            '''
-            :param resource_types: 
+            '''Specifies index actions.
+
+            :param resource_types: 0 or 1 index action will be accepted for each BackupRule. Valid values: - ``EBS`` for Amazon Elastic Block Store - ``S3`` for Amazon Simple Storage Service (Amazon S3)
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-backup-backupplan-indexactionsresourcetype.html
             :exampleMetadata: fixture=_generated
@@ -2521,7 +2622,13 @@ class CfnBackupPlan(
 
         @builtins.property
         def resource_types(self) -> typing.Optional[typing.List[builtins.str]]:
-            '''
+            '''0 or 1 index action will be accepted for each BackupRule.
+
+            Valid values:
+
+            - ``EBS`` for Amazon Elastic Block Store
+            - ``S3`` for Amazon Simple Storage Service (Amazon S3)
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-backup-backupplan-indexactionsresourcetype.html#cfn-backup-backupplan-indexactionsresourcetype-resourcetypes
             '''
             result = self._values.get("resource_types")
@@ -2557,8 +2664,8 @@ class CfnBackupPlan(
         ) -> None:
             '''Specifies an object containing an array of ``Transition`` objects that determine how long in days before a recovery point transitions to cold storage or is deleted.
 
-            :param delete_after_days: Specifies the number of days after creation that a recovery point is deleted. Must be greater than ``MoveToColdStorageAfterDays`` .
-            :param move_to_cold_storage_after_days: Specifies the number of days after creation that a recovery point is moved to cold storage.
+            :param delete_after_days: The number of days after creation that a recovery point is deleted. This value must be at least 90 days after the number of days specified in ``MoveToColdStorageAfterDays`` .
+            :param move_to_cold_storage_after_days: The number of days after creation that a recovery point is moved to cold storage.
             :param opt_in_to_archive_for_supported_resources: If the value is true, your backup plan transitions supported resources to archive (cold) storage tier in accordance with your lifecycle settings.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-backup-backupplan-lifecycleresourcetype.html
@@ -2591,9 +2698,9 @@ class CfnBackupPlan(
 
         @builtins.property
         def delete_after_days(self) -> typing.Optional[jsii.Number]:
-            '''Specifies the number of days after creation that a recovery point is deleted.
+            '''The number of days after creation that a recovery point is deleted.
 
-            Must be greater than ``MoveToColdStorageAfterDays`` .
+            This value must be at least 90 days after the number of days specified in ``MoveToColdStorageAfterDays`` .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-backup-backupplan-lifecycleresourcetype.html#cfn-backup-backupplan-lifecycleresourcetype-deleteafterdays
             '''
@@ -2602,7 +2709,7 @@ class CfnBackupPlan(
 
         @builtins.property
         def move_to_cold_storage_after_days(self) -> typing.Optional[jsii.Number]:
-            '''Specifies the number of days after creation that a recovery point is moved to cold storage.
+            '''The number of days after creation that a recovery point is moved to cold storage.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-backup-backupplan-lifecycleresourcetype.html#cfn-backup-backupplan-lifecycleresourcetype-movetocoldstorageafterdays
             '''
@@ -2754,7 +2861,7 @@ class CfnBackupPlanProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IBackupSelectionRef_e9fbb7b2)
 class CfnBackupSelection(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2803,7 +2910,8 @@ class CfnBackupSelection(
         backup_plan_id: builtins.str,
         backup_selection: typing.Union[_IResolvable_da3f097b, typing.Union["CfnBackupSelection.BackupSelectionResourceTypeProperty", typing.Dict[builtins.str, typing.Any]]],
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::BackupSelection``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param backup_plan_id: Uniquely identifies a backup plan.
@@ -2876,6 +2984,12 @@ class CfnBackupSelection(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrSelectionId"))
 
+    @builtins.property
+    @jsii.member(jsii_name="backupSelectionRef")
+    def backup_selection_ref(self) -> _BackupSelectionReference_541c6985:
+        '''A reference to a BackupSelection resource.'''
+        return typing.cast(_BackupSelectionReference_541c6985, jsii.get(self, "backupSelectionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -3483,7 +3597,7 @@ class CfnBackupSelectionProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IBackupVaultRef_c038ce00, _ITaggableV2_4e6798f8)
 class CfnBackupVault(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3544,7 +3658,8 @@ class CfnBackupVault(
         lock_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnBackupVault.LockConfigurationTypeProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         notifications: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnBackupVault.NotificationObjectTypeProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::BackupVault``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param backup_vault_name: The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the AWS Region where they are created.
@@ -3569,6 +3684,48 @@ class CfnBackupVault(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromBackupVaultArn")
+    @builtins.classmethod
+    def from_backup_vault_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IBackupVaultRef_c038ce00:
+        '''Creates a new IBackupVaultRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__2986d116c33dbb1dc995c507e7df9b0cf2f344f357d0a1404d0c2ece4c1fc5b2)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IBackupVaultRef_c038ce00, jsii.sinvoke(cls, "fromBackupVaultArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromBackupVaultName")
+    @builtins.classmethod
+    def from_backup_vault_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        backup_vault_name: builtins.str,
+    ) -> _IBackupVaultRef_c038ce00:
+        '''Creates a new IBackupVaultRef from a backupVaultName.
+
+        :param scope: -
+        :param id: -
+        :param backup_vault_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__cc137647a726cfa7058e572fdb03e73df8b9f52e786f61edcd64eb6c3fc59645)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument backup_vault_name", value=backup_vault_name, expected_type=type_hints["backup_vault_name"])
+        return typing.cast(_IBackupVaultRef_c038ce00, jsii.sinvoke(cls, "fromBackupVaultName", [scope, id, backup_vault_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -3621,6 +3778,12 @@ class CfnBackupVault(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrBackupVaultName"))
 
+    @builtins.property
+    @jsii.member(jsii_name="backupVaultRef")
+    def backup_vault_ref(self) -> _BackupVaultReference_228dbd3a:
+        '''A reference to a BackupVault resource.'''
+        return typing.cast(_BackupVaultReference_228dbd3a, jsii.get(self, "backupVaultRef"))
+
     @builtins.property
     @jsii.member(jsii_name="cdkTagManager")
     def cdk_tag_manager(self) -> _TagManager_0a598cb3:
@@ -4082,7 +4245,7 @@ class CfnBackupVaultProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IFrameworkRef_dcbb25ea, _ITaggableV2_4e6798f8)
 class CfnFramework(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -4138,7 +4301,8 @@ class CfnFramework(
         framework_name: typing.Optional[builtins.str] = None,
         framework_tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::Framework``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param framework_controls: Contains detailed information about all of the controls of a framework. Each framework must contain at least one control.
@@ -4240,6 +4404,12 @@ class CfnFramework(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="frameworkRef")
+    def framework_ref(self) -> _FrameworkReference_5ce10c24:
+        '''A reference to a Framework resource.'''
+        return typing.cast(_FrameworkReference_5ce10c24, jsii.get(self, "frameworkRef"))
+
     @builtins.property
     @jsii.member(jsii_name="frameworkControls")
     def framework_controls(
@@ -4716,7 +4886,7 @@ class CfnFrameworkProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _ILogicallyAirGappedBackupVaultRef_94a8f212, _ITaggableV2_4e6798f8)
 class CfnLogicallyAirGappedBackupVault(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -4751,6 +4921,7 @@ class CfnLogicallyAirGappedBackupVault(
             backup_vault_tags={
                 "backup_vault_tags_key": "backupVaultTags"
             },
+            mpa_approval_team_arn="mpaApprovalTeamArn",
             notifications=backup.CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty(
                 backup_vault_events=["backupVaultEvents"],
                 sns_topic_arn="snsTopicArn"
@@ -4768,9 +4939,11 @@ class CfnLogicallyAirGappedBackupVault(
         min_retention_days: jsii.Number,
         access_policy: typing.Any = None,
         backup_vault_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+        mpa_approval_team_arn: typing.Optional[builtins.str] = None,
         notifications: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::LogicallyAirGappedBackupVault``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param backup_vault_name: The name of a logical container where backups are stored. Logically air-gapped backup vaults are identified by names that are unique to the account used to create them and the Region where they are created.
@@ -4778,6 +4951,7 @@ class CfnLogicallyAirGappedBackupVault(
         :param min_retention_days: This setting specifies the minimum retention period that the vault retains its recovery points. The minimum value accepted is 7 days.
         :param access_policy: The backup vault access policy document in JSON format.
         :param backup_vault_tags: The tags to assign to the vault.
+        :param mpa_approval_team_arn: 
         :param notifications: Returns event notifications for the specified backup vault.
         '''
         if __debug__:
@@ -4790,11 +4964,33 @@ class CfnLogicallyAirGappedBackupVault(
             min_retention_days=min_retention_days,
             access_policy=access_policy,
             backup_vault_tags=backup_vault_tags,
+            mpa_approval_team_arn=mpa_approval_team_arn,
             notifications=notifications,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromBackupVaultName")
+    @builtins.classmethod
+    def from_backup_vault_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        backup_vault_name: builtins.str,
+    ) -> _ILogicallyAirGappedBackupVaultRef_94a8f212:
+        '''Creates a new ILogicallyAirGappedBackupVaultRef from a backupVaultName.
+
+        :param scope: -
+        :param id: -
+        :param backup_vault_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__e2d7a451581b8c789f1a800340871c2a6bccebe8622af1e2f5b447a3a98d1dbb)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument backup_vault_name", value=backup_vault_name, expected_type=type_hints["backup_vault_name"])
+        return typing.cast(_ILogicallyAirGappedBackupVaultRef_94a8f212, jsii.sinvoke(cls, "fromBackupVaultName", [scope, id, backup_vault_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -4828,7 +5024,8 @@ class CfnLogicallyAirGappedBackupVault(
     @builtins.property
     @jsii.member(jsii_name="attrBackupVaultArn")
     def attr_backup_vault_arn(self) -> builtins.str:
-        '''
+        '''The ARN of the backup vault.
+
         :cloudformationAttribute: BackupVaultArn
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrBackupVaultArn"))
@@ -4836,7 +5033,8 @@ class CfnLogicallyAirGappedBackupVault(
     @builtins.property
     @jsii.member(jsii_name="attrEncryptionKeyArn")
     def attr_encryption_key_arn(self) -> builtins.str:
-        '''
+        '''The ARN of the server-side encryption key.
+
         :cloudformationAttribute: EncryptionKeyArn
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrEncryptionKeyArn"))
@@ -4844,7 +5042,10 @@ class CfnLogicallyAirGappedBackupVault(
     @builtins.property
     @jsii.member(jsii_name="attrVaultState")
     def attr_vault_state(self) -> builtins.str:
-        '''
+        '''The vault state.
+
+        The possible values are ``CREATING`` , ``AVAILABLE`` , and ``FAILED`` .
+
         :cloudformationAttribute: VaultState
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrVaultState"))
@@ -4852,7 +5053,10 @@ class CfnLogicallyAirGappedBackupVault(
     @builtins.property
     @jsii.member(jsii_name="attrVaultType")
     def attr_vault_type(self) -> builtins.str:
-        '''
+        '''The vault type.
+
+        The possible values are ``BACKUP_VAULT`` and ``LOGICALLY_AIR_GAPPED_BACKUP_VAULT`` .
+
         :cloudformationAttribute: VaultType
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrVaultType"))
@@ -4868,6 +5072,14 @@ class CfnLogicallyAirGappedBackupVault(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="logicallyAirGappedBackupVaultRef")
+    def logically_air_gapped_backup_vault_ref(
+        self,
+    ) -> _LogicallyAirGappedBackupVaultReference_53a7ab81:
+        '''A reference to a LogicallyAirGappedBackupVault resource.'''
+        return typing.cast(_LogicallyAirGappedBackupVaultReference_53a7ab81, jsii.get(self, "logicallyAirGappedBackupVaultRef"))
+
     @builtins.property
     @jsii.member(jsii_name="backupVaultName")
     def backup_vault_name(self) -> builtins.str:
@@ -4938,6 +5150,18 @@ class CfnLogicallyAirGappedBackupVault(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "backupVaultTags", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="mpaApprovalTeamArn")
+    def mpa_approval_team_arn(self) -> typing.Optional[builtins.str]:
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "mpaApprovalTeamArn"))
+
+    @mpa_approval_team_arn.setter
+    def mpa_approval_team_arn(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__d69a75a0b7ce93d33d99d99ea46c6bed385bc4618297cfeb5204520844045d0e)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "mpaApprovalTeamArn", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="notifications")
     def notifications(
@@ -5041,6 +5265,7 @@ class CfnLogicallyAirGappedBackupVault(
         "min_retention_days": "minRetentionDays",
         "access_policy": "accessPolicy",
         "backup_vault_tags": "backupVaultTags",
+        "mpa_approval_team_arn": "mpaApprovalTeamArn",
         "notifications": "notifications",
     },
 )
@@ -5053,6 +5278,7 @@ class CfnLogicallyAirGappedBackupVaultProps:
         min_retention_days: jsii.Number,
         access_policy: typing.Any = None,
         backup_vault_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+        mpa_approval_team_arn: typing.Optional[builtins.str] = None,
         notifications: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''Properties for defining a ``CfnLogicallyAirGappedBackupVault``.
@@ -5062,6 +5288,7 @@ class CfnLogicallyAirGappedBackupVaultProps:
         :param min_retention_days: This setting specifies the minimum retention period that the vault retains its recovery points. The minimum value accepted is 7 days.
         :param access_policy: The backup vault access policy document in JSON format.
         :param backup_vault_tags: The tags to assign to the vault.
+        :param mpa_approval_team_arn: 
         :param notifications: Returns event notifications for the specified backup vault.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-backup-logicallyairgappedbackupvault.html
@@ -5085,6 +5312,7 @@ class CfnLogicallyAirGappedBackupVaultProps:
                 backup_vault_tags={
                     "backup_vault_tags_key": "backupVaultTags"
                 },
+                mpa_approval_team_arn="mpaApprovalTeamArn",
                 notifications=backup.CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty(
                     backup_vault_events=["backupVaultEvents"],
                     sns_topic_arn="snsTopicArn"
@@ -5098,6 +5326,7 @@ class CfnLogicallyAirGappedBackupVaultProps:
             check_type(argname="argument min_retention_days", value=min_retention_days, expected_type=type_hints["min_retention_days"])
             check_type(argname="argument access_policy", value=access_policy, expected_type=type_hints["access_policy"])
             check_type(argname="argument backup_vault_tags", value=backup_vault_tags, expected_type=type_hints["backup_vault_tags"])
+            check_type(argname="argument mpa_approval_team_arn", value=mpa_approval_team_arn, expected_type=type_hints["mpa_approval_team_arn"])
             check_type(argname="argument notifications", value=notifications, expected_type=type_hints["notifications"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "backup_vault_name": backup_vault_name,
@@ -5108,6 +5337,8 @@ class CfnLogicallyAirGappedBackupVaultProps:
             self._values["access_policy"] = access_policy
         if backup_vault_tags is not None:
             self._values["backup_vault_tags"] = backup_vault_tags
+        if mpa_approval_team_arn is not None:
+            self._values["mpa_approval_team_arn"] = mpa_approval_team_arn
         if notifications is not None:
             self._values["notifications"] = notifications
 
@@ -5165,6 +5396,14 @@ class CfnLogicallyAirGappedBackupVaultProps:
         result = self._values.get("backup_vault_tags")
         return typing.cast(typing.Optional[typing.Mapping[builtins.str, builtins.str]], result)
 
+    @builtins.property
+    def mpa_approval_team_arn(self) -> typing.Optional[builtins.str]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-backup-logicallyairgappedbackupvault.html#cfn-backup-logicallyairgappedbackupvault-mpaapprovalteamarn
+        '''
+        result = self._values.get("mpa_approval_team_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def notifications(
         self,
@@ -5188,7 +5427,7 @@ class CfnLogicallyAirGappedBackupVaultProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IReportPlanRef_2eb6ea89, _ITaggableV2_4e6798f8)
 class CfnReportPlan(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -5240,7 +5479,8 @@ class CfnReportPlan(
         report_plan_name: typing.Optional[builtins.str] = None,
         report_plan_tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::ReportPlan``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param report_delivery_channel: Contains information about where and how to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports.
@@ -5313,6 +5553,12 @@ class CfnReportPlan(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="reportPlanRef")
+    def report_plan_ref(self) -> _ReportPlanReference_0a875581:
+        '''A reference to a ReportPlan resource.'''
+        return typing.cast(_ReportPlanReference_0a875581, jsii.get(self, "reportPlanRef"))
+
     @builtins.property
     @jsii.member(jsii_name="reportDeliveryChannel")
     def report_delivery_channel(self) -> typing.Any:
@@ -5748,7 +5994,7 @@ class CfnReportPlanProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IRestoreTestingPlanRef_3850185f, _ITaggableV2_4e6798f8)
 class CfnRestoreTestingPlan(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -5803,7 +6049,8 @@ class CfnRestoreTestingPlan(
         start_window_hours: typing.Optional[jsii.Number] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::RestoreTestingPlan``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param recovery_point_selection: The specified criteria to assign a set of resources, such as recovery point types or backup vaults.
@@ -5878,6 +6125,12 @@ class CfnRestoreTestingPlan(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="restoreTestingPlanRef")
+    def restore_testing_plan_ref(self) -> _RestoreTestingPlanReference_99f8c406:
+        '''A reference to a RestoreTestingPlan resource.'''
+        return typing.cast(_RestoreTestingPlanReference_99f8c406, jsii.get(self, "restoreTestingPlanRef"))
+
     @builtins.property
     @jsii.member(jsii_name="recoveryPointSelection")
     def recovery_point_selection(
@@ -6269,7 +6522,7 @@ class CfnRestoreTestingPlanProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IRestoreTestingSelectionRef_f3800013)
 class CfnRestoreTestingSelection(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -6339,13 +6592,14 @@ class CfnRestoreTestingSelection(
         restore_metadata_overrides: typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]] = None,
         validation_window_hours: typing.Optional[jsii.Number] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Backup::RestoreTestingSelection``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param iam_role_arn: The Amazon Resource Name (ARN) of the IAM role that AWS Backup uses to create the target resource; for example: ``arn:aws:iam::123456789012:role/S3Access`` .
         :param protected_resource_type: The type of AWS resource included in a resource testing selection; for example, an Amazon EBS volume or an Amazon RDS database.
         :param restore_testing_plan_name: Unique string that is the name of the restore testing plan. The name cannot be changed after creation. The name must consist of only alphanumeric characters and underscores. Maximum length is 50.
-        :param restore_testing_selection_name: The unique name of the restore testing selection that belongs to the related restore testing plan.
+        :param restore_testing_selection_name: The unique name of the restore testing selection that belongs to the related restore testing plan. The name consists of only alphanumeric characters and underscores. Maximum length is 50.
         :param protected_resource_arns: You can include specific ARNs, such as ``ProtectedResourceArns: ["arn:aws:...", "arn:aws:..."]`` or you can include a wildcard: ``ProtectedResourceArns: ["*"]`` , but not both.
         :param protected_resource_conditions: In a resource testing selection, this parameter filters by specific conditions such as ``StringEquals`` or ``StringNotEquals`` .
         :param restore_metadata_overrides: You can override certain restore metadata keys by including the parameter ``RestoreMetadataOverrides`` in the body of ``RestoreTestingSelection`` . Key values are not case sensitive. See the complete list of `restore testing inferred metadata <https://docs.aws.amazon.com/aws-backup/latest/devguide/restore-testing-inferred-metadata.html>`_ .
@@ -6403,6 +6657,14 @@ class CfnRestoreTestingSelection(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="restoreTestingSelectionRef")
+    def restore_testing_selection_ref(
+        self,
+    ) -> _RestoreTestingSelectionReference_05d8055b:
+        '''A reference to a RestoreTestingSelection resource.'''
+        return typing.cast(_RestoreTestingSelectionReference_05d8055b, jsii.get(self, "restoreTestingSelectionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="iamRoleArn")
     def iam_role_arn(self) -> builtins.str:
@@ -6708,7 +6970,7 @@ class CfnRestoreTestingSelectionProps:
         :param iam_role_arn: The Amazon Resource Name (ARN) of the IAM role that AWS Backup uses to create the target resource; for example: ``arn:aws:iam::123456789012:role/S3Access`` .
         :param protected_resource_type: The type of AWS resource included in a resource testing selection; for example, an Amazon EBS volume or an Amazon RDS database.
         :param restore_testing_plan_name: Unique string that is the name of the restore testing plan. The name cannot be changed after creation. The name must consist of only alphanumeric characters and underscores. Maximum length is 50.
-        :param restore_testing_selection_name: The unique name of the restore testing selection that belongs to the related restore testing plan.
+        :param restore_testing_selection_name: The unique name of the restore testing selection that belongs to the related restore testing plan. The name consists of only alphanumeric characters and underscores. Maximum length is 50.
         :param protected_resource_arns: You can include specific ARNs, such as ``ProtectedResourceArns: ["arn:aws:...", "arn:aws:..."]`` or you can include a wildcard: ``ProtectedResourceArns: ["*"]`` , but not both.
         :param protected_resource_conditions: In a resource testing selection, this parameter filters by specific conditions such as ``StringEquals`` or ``StringNotEquals`` .
         :param restore_metadata_overrides: You can override certain restore metadata keys by including the parameter ``RestoreMetadataOverrides`` in the body of ``RestoreTestingSelection`` . Key values are not case sensitive. See the complete list of `restore testing inferred metadata <https://docs.aws.amazon.com/aws-backup/latest/devguide/restore-testing-inferred-metadata.html>`_ .
@@ -6812,6 +7074,8 @@ class CfnRestoreTestingSelectionProps:
     def restore_testing_selection_name(self) -> builtins.str:
         '''The unique name of the restore testing selection that belongs to the related restore testing plan.
 
+        The name consists of only alphanumeric characters and underscores. Maximum length is 50.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-backup-restoretestingselection.html#cfn-backup-restoretestingselection-restoretestingselectionname
         '''
         result = self._values.get("restore_testing_selection_name")
@@ -7396,6 +7660,12 @@ class BackupPlan(
 
         return typing.cast(BackupSelection, jsii.invoke(self, "addSelection", [id, options]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="backupPlanArn")
     def backup_plan_arn(self) -> builtins.str:
@@ -7454,7 +7724,7 @@ class BackupVault(
         access_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
         backup_vault_name: typing.Optional[builtins.str] = None,
         block_recovery_point_deletion: typing.Optional[builtins.bool] = None,
-        encryption_key: typing.Optional[_IKey_5f11635f] = None,
+        encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         lock_configuration: typing.Optional[typing.Union[LockConfiguration, typing.Dict[builtins.str, typing.Any]]] = None,
         notification_events: typing.Optional[typing.Sequence[BackupVaultEvents]] = None,
         notification_topic: typing.Optional[_ITopic_9eca4852] = None,
@@ -7564,6 +7834,12 @@ class BackupVault(
             check_type(argname="argument actions", value=actions, expected_type=typing.Tuple[type_hints["actions"], ...]) # pyright: ignore [reportGeneralTypeIssues]
         return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grant", [grantee, *actions]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="backupVaultArn")
     def backup_vault_arn(self) -> builtins.str:
@@ -7675,6 +7951,7 @@ def _typecheckingstub__521e43eca71db1c8347b5dbf1e88135cbc1fd43f07248784b33b55d83
     recovery_point_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     rule_name: typing.Optional[builtins.str] = None,
     schedule_expression: typing.Optional[_Schedule_c151d01f] = None,
+    schedule_expression_timezone: typing.Optional[_TimeZone_cdd72ac9] = None,
     start_window: typing.Optional[_Duration_4839e8c3] = None,
 ) -> None:
     """Type checking stubs"""
@@ -7707,7 +7984,7 @@ def _typecheckingstub__75ec54ba33468f397b4b954ffff5bb4a26a29e306b38c37a8a831233c
     pass
 
 def _typecheckingstub__bfac18ef33642ed976be7473c0fe4b5174e370a770ceabc690e397bcecfce6a3(
-    instance: _IInstance_ab239e7c,
+    instance: _IInstanceRef_b97803cb,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -7786,7 +8063,7 @@ def _typecheckingstub__6a7555f4b25ca4760e3a057b8e3a9b5e07feed1f99319d6e434cc8fed
     access_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     backup_vault_name: typing.Optional[builtins.str] = None,
     block_recovery_point_deletion: typing.Optional[builtins.bool] = None,
-    encryption_key: typing.Optional[_IKey_5f11635f] = None,
+    encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     lock_configuration: typing.Optional[typing.Union[LockConfiguration, typing.Dict[builtins.str, typing.Any]]] = None,
     notification_events: typing.Optional[typing.Sequence[BackupVaultEvents]] = None,
     notification_topic: typing.Optional[_ITopic_9eca4852] = None,
@@ -7805,6 +8082,22 @@ def _typecheckingstub__8250888ac08b345ef300cc4ce53cc267858e31401cdc7b6a427c98f5b
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__19a621581dc951af9f595672bab4c44806829db988a9a543e73c82aa211347cc(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__c10f5f2e9e380d8e917a10f74122d09d2b555c99380ffa6da4e01197e1e097dd(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    backup_plan_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__ff313ad9e84c3475e4286a17d3e066d3b8ff12dcdde29c7a2727bf7529fa7fbb(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -7990,6 +8283,22 @@ def _typecheckingstub__91f579bea882f82608d503a3e561568131d8e8e6d825c152c63d59622
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__2986d116c33dbb1dc995c507e7df9b0cf2f344f357d0a1404d0c2ece4c1fc5b2(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__cc137647a726cfa7058e572fdb03e73df8b9f52e786f61edcd64eb6c3fc59645(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    backup_vault_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__c5303f64257feccbaac430e6766ee8dd85d8293dcda5a0b514f9128fa193e156(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -8160,11 +8469,20 @@ def _typecheckingstub__f46c2d817c43abec9e204fc8a7211b43dd15b93e11a637e67a9711664
     min_retention_days: jsii.Number,
     access_policy: typing.Any = None,
     backup_vault_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+    mpa_approval_team_arn: typing.Optional[builtins.str] = None,
     notifications: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__e2d7a451581b8c789f1a800340871c2a6bccebe8622af1e2f5b447a3a98d1dbb(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    backup_vault_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__415ff13e64a57b94538bf66464736e9dc201021da09242c46763584700ef7f37(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -8207,6 +8525,12 @@ def _typecheckingstub__27388048f12fa4b0d6686a7b40795dea7b4219e2f388afdfc5733f704
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__d69a75a0b7ce93d33d99d99ea46c6bed385bc4618297cfeb5204520844045d0e(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__f1dc991e6a5cd9bb0776543a7419ba117220c8fec8f29ec2587f9a6747b5dcab(
     value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty]],
 ) -> None:
@@ -8228,6 +8552,7 @@ def _typecheckingstub__5a3b99abcf3e8ad32b3307410738488461421bb759c6f2f630a99abc5
     min_retention_days: jsii.Number,
     access_policy: typing.Any = None,
     backup_vault_tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+    mpa_approval_team_arn: typing.Optional[builtins.str] = None,
     notifications: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLogicallyAirGappedBackupVault.NotificationObjectTypeProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
@@ -8612,7 +8937,7 @@ def _typecheckingstub__5938cd051d17a4aa98a61f204449a9c4416544ba91e3c4e4821b784b4
     access_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
     backup_vault_name: typing.Optional[builtins.str] = None,
     block_recovery_point_deletion: typing.Optional[builtins.bool] = None,
-    encryption_key: typing.Optional[_IKey_5f11635f] = None,
+    encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     lock_configuration: typing.Optional[typing.Union[LockConfiguration, typing.Dict[builtins.str, typing.Any]]] = None,
     notification_events: typing.Optional[typing.Sequence[BackupVaultEvents]] = None,
     notification_topic: typing.Optional[_ITopic_9eca4852] = None,
@@ -8649,3 +8974,6 @@ def _typecheckingstub__d6f51b6b852524375032f5dd45b5c00d5d86423092d20d599599a38ce
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [IBackupPlan, IBackupVault]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])