aws-cdk-lib 2.195.0__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_appconfig/__init__.py

@@ -98,26 +98,6 @@ user = iam.User(self, "MyUser")
 env.grant_read_config(user)
 ```
 
-### Deletion Protection Check
-
-You can enable [deletion protection](https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html) on the environment by setting the `deletionProtectionCheck` property.
-
-* ACCOUNT_DEFAULT: The default setting, which uses account-level deletion protection. To configure account-level deletion protection, use the UpdateAccountSettings API.
-* APPLY: Instructs the deletion protection check to run, even if deletion protection is disabled at the account level. APPLY also forces the deletion protection check to run against resources created in the past hour, which are normally excluded from deletion protection checks.
-* BYPASS: Instructs AWS AppConfig to bypass the deletion protection check and delete an environment even if deletion protection would have otherwise prevented it.
-
-```python
-# application: appconfig.Application
-# alarm: cloudwatch.Alarm
-# composite_alarm: cloudwatch.CompositeAlarm
-
-
-appconfig.Environment(self, "MyEnvironment",
-    application=application,
-    deletion_protection_check=appconfig.DeletionProtectionCheck.APPLY
-)
-```
-
 ## Deployment Strategy
 
 [AWS AppConfig Deployment Strategy Documentation](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-deployment-strategy.html)
@@ -402,6 +382,21 @@ The declaration order will be respected regardless of the approach used.
 > [!IMPORTANT]
 > If none of these options are utilized, there will not be any deployments.
 
+You can use customer managed key to encrypt a hosted configuration. For mora information, see [Data encryption at rest for AWS AppConfig](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-security.html#appconfig-security-data-encryption).
+
+```python
+# application: appconfig.Application
+# kms_key: kms.Key
+
+
+appconfig.HostedConfiguration(self, "MyHostedConfiguration",
+    application=application,
+    content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content."),
+    type=appconfig.ConfigurationType.FEATURE_FLAGS,
+    kms_key=kms_key
+)
+```
+
 ### SourcedConfiguration
 
 A sourced configuration represents configuration stored in any of the following:
@@ -569,6 +564,41 @@ appconfig.SourcedConfiguration(self, "MySourcedConfiguration",
 )
 ```
 
+## Deletion Protection Check
+
+You can enable [deletion protection](https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html) on the environment and configuration profile by setting the `deletionProtectionCheck` property.
+
+* ACCOUNT_DEFAULT: The default setting, which uses account-level deletion protection. To configure account-level deletion protection, use the UpdateAccountSettings API.
+* APPLY: Instructs the deletion protection check to run, even if deletion protection is disabled at the account level. APPLY also forces the deletion protection check to run against resources created in the past hour, which are normally excluded from deletion protection checks.
+* BYPASS: Instructs AWS AppConfig to bypass the deletion protection check and delete an environment even if deletion protection would have otherwise prevented it.
+
+```python
+# application: appconfig.Application
+# alarm: cloudwatch.Alarm
+# composite_alarm: cloudwatch.CompositeAlarm
+# bucket: s3.Bucket
+
+
+# Environment deletion protection check
+appconfig.Environment(self, "MyEnvironment",
+    application=application,
+    deletion_protection_check=appconfig.DeletionProtectionCheck.APPLY
+)
+
+# configuration profile with deletion protection check
+appconfig.HostedConfiguration(self, "MyHostedConfigFromFile",
+    application=application,
+    content=appconfig.ConfigurationContent.from_file("config.json"),
+    deletion_protection_check=appconfig.DeletionProtectionCheck.BYPASS
+)
+
+appconfig.SourcedConfiguration(self, "MySourcedConfiguration",
+    application=application,
+    location=appconfig.ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
+    deletion_protection_check=appconfig.DeletionProtectionCheck.ACCOUNT_DEFAULT
+)
+```
+
 ## Extension
 
 An extension augments your ability to inject logic or behavior at different points during the AWS AppConfig workflow of
@@ -762,6 +792,26 @@ from ..aws_sqs import IQueue as _IQueue_7ed6f679
 from ..aws_ssm import (
     CfnDocument as _CfnDocument_8b177f00, IParameter as _IParameter_509a0f80
 )
+from ..interfaces.aws_appconfig import (
+    ApplicationReference as _ApplicationReference_2b7c5bb6,
+    ConfigurationProfileReference as _ConfigurationProfileReference_c0821f22,
+    DeploymentReference as _DeploymentReference_5ef418d1,
+    DeploymentStrategyReference as _DeploymentStrategyReference_e1908020,
+    EnvironmentReference as _EnvironmentReference_610ea6de,
+    ExtensionAssociationReference as _ExtensionAssociationReference_35a869f1,
+    ExtensionReference as _ExtensionReference_a0aef309,
+    HostedConfigurationVersionReference as _HostedConfigurationVersionReference_6f730fe8,
+    IApplicationRef as _IApplicationRef_768db227,
+    IConfigurationProfileRef as _IConfigurationProfileRef_3e332cf9,
+    IDeploymentRef as _IDeploymentRef_c08544bf,
+    IDeploymentStrategyRef as _IDeploymentStrategyRef_2cd4ca44,
+    IEnvironmentRef as _IEnvironmentRef_5f5c3f67,
+    IExtensionAssociationRef as _IExtensionAssociationRef_1b672c9b,
+    IExtensionRef as _IExtensionRef_abba29c3,
+    IHostedConfigurationVersionRef as _IHostedConfigurationVersionRef_eb4b6788,
+)
+from ..interfaces.aws_iam import IRoleRef as _IRoleRef_8400221f
+from ..interfaces.aws_kms import IKeyRef as _IKeyRef_d4fc6ef3
 
 
 class Action(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.aws_appconfig.Action"):
@@ -1087,7 +1137,7 @@ class ApplicationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IApplicationRef_768db227, _ITaggableV2_4e6798f8)
 class CfnApplication(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1138,7 +1188,8 @@ class CfnApplication(
         description: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::Application``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: A name for the application.
@@ -1153,6 +1204,27 @@ class CfnApplication(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromApplicationId")
+    @builtins.classmethod
+    def from_application_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        application_id: builtins.str,
+    ) -> _IApplicationRef_768db227:
+        '''Creates a new IApplicationRef from a applicationId.
+
+        :param scope: -
+        :param id: -
+        :param application_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__afd571466571231348a78cb931c25e5d1b3c70347a376b9d64e551c1d6126654)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
+        return typing.cast(_IApplicationRef_768db227, jsii.sinvoke(cls, "fromApplicationId", [scope, id, application_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1183,6 +1255,12 @@ class CfnApplication(
         '''The CloudFormation resource type name for this resource class.'''
         return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
+    @builtins.property
+    @jsii.member(jsii_name="applicationRef")
+    def application_ref(self) -> _ApplicationReference_2b7c5bb6:
+        '''A reference to a Application resource.'''
+        return typing.cast(_ApplicationReference_2b7c5bb6, jsii.get(self, "applicationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="attrApplicationId")
     def attr_application_id(self) -> builtins.str:
@@ -1337,7 +1415,7 @@ class CfnApplicationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IConfigurationProfileRef_3e332cf9, _ITaggableV2_4e6798f8)
 class CfnConfigurationProfile(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1409,7 +1487,8 @@ class CfnConfigurationProfile(
         type: typing.Optional[builtins.str] = None,
         validators: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnConfigurationProfile.ValidatorsProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::ConfigurationProfile``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The application ID.
@@ -1503,6 +1582,12 @@ class CfnConfigurationProfile(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="configurationProfileRef")
+    def configuration_profile_ref(self) -> _ConfigurationProfileReference_c0821f22:
+        '''A reference to a ConfigurationProfile resource.'''
+        return typing.cast(_ConfigurationProfileReference_c0821f22, jsii.get(self, "configurationProfileRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -1954,7 +2039,7 @@ class CfnConfigurationProfileProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IDeploymentRef_c08544bf, _ITaggableV2_4e6798f8)
 class CfnDeployment(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2023,7 +2108,8 @@ class CfnDeployment(
         kms_key_identifier: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::Deployment``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The application ID.
@@ -2093,6 +2179,15 @@ class CfnDeployment(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrDeploymentNumber"))
 
+    @builtins.property
+    @jsii.member(jsii_name="attrState")
+    def attr_state(self) -> builtins.str:
+        '''The state of the deployment.
+
+        :cloudformationAttribute: State
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrState"))
+
     @builtins.property
     @jsii.member(jsii_name="cdkTagManager")
     def cdk_tag_manager(self) -> _TagManager_0a598cb3:
@@ -2104,6 +2199,12 @@ class CfnDeployment(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="deploymentRef")
+    def deployment_ref(self) -> _DeploymentReference_5ef418d1:
+        '''A reference to a Deployment resource.'''
+        return typing.cast(_DeploymentReference_5ef418d1, jsii.get(self, "deploymentRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -2518,7 +2619,7 @@ class CfnDeploymentProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IDeploymentStrategyRef_2cd4ca44, _ITaggableV2_4e6798f8)
 class CfnDeploymentStrategy(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2579,7 +2680,8 @@ class CfnDeploymentStrategy(
         growth_type: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::DeploymentStrategy``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param deployment_duration_in_minutes: Total amount of time for a deployment to last.
@@ -2608,6 +2710,27 @@ class CfnDeploymentStrategy(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromDeploymentStrategyId")
+    @builtins.classmethod
+    def from_deployment_strategy_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        deployment_strategy_id: builtins.str,
+    ) -> _IDeploymentStrategyRef_2cd4ca44:
+        '''Creates a new IDeploymentStrategyRef from a deploymentStrategyId.
+
+        :param scope: -
+        :param id: -
+        :param deployment_strategy_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a211633629f45a21de52e2d3b8c73b520eee7fc38d9ec5fafe4d90b277a310a5)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument deployment_strategy_id", value=deployment_strategy_id, expected_type=type_hints["deployment_strategy_id"])
+        return typing.cast(_IDeploymentStrategyRef_2cd4ca44, jsii.sinvoke(cls, "fromDeploymentStrategyId", [scope, id, deployment_strategy_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -2658,6 +2781,12 @@ class CfnDeploymentStrategy(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="deploymentStrategyRef")
+    def deployment_strategy_ref(self) -> _DeploymentStrategyReference_e1908020:
+        '''A reference to a DeploymentStrategy resource.'''
+        return typing.cast(_DeploymentStrategyReference_e1908020, jsii.get(self, "deploymentStrategyRef"))
+
     @builtins.property
     @jsii.member(jsii_name="deploymentDurationInMinutes")
     def deployment_duration_in_minutes(self) -> jsii.Number:
@@ -2958,7 +3087,7 @@ class CfnDeploymentStrategyProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IEnvironmentRef_5f5c3f67, _ITaggableV2_4e6798f8)
 class CfnEnvironment(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3018,7 +3147,8 @@ class CfnEnvironment(
         monitors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEnvironment.MonitorsProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::Environment``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The application ID.
@@ -3093,6 +3223,12 @@ class CfnEnvironment(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="environmentRef")
+    def environment_ref(self) -> _EnvironmentReference_610ea6de:
+        '''A reference to a Environment resource.'''
+        return typing.cast(_EnvironmentReference_610ea6de, jsii.get(self, "environmentRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -3476,7 +3612,7 @@ class CfnEnvironmentProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IExtensionRef_abba29c3, _ITaggable_36806126)
 class CfnExtension(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3541,7 +3677,8 @@ class CfnExtension(
         parameters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, typing.Union[_IResolvable_da3f097b, typing.Union["CfnExtension.ParameterProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::Extension``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param actions: The actions defined in the extension.
@@ -3628,6 +3765,12 @@ class CfnExtension(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="extensionRef")
+    def extension_ref(self) -> _ExtensionReference_a0aef309:
+        '''A reference to a Extension resource.'''
+        return typing.cast(_ExtensionReference_a0aef309, jsii.get(self, "extensionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -3926,7 +4069,7 @@ class CfnExtension(
             )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IExtensionAssociationRef_1b672c9b, _ITaggable_36806126)
 class CfnExtensionAssociation(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3971,7 +4114,8 @@ class CfnExtensionAssociation(
         resource_identifier: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::ExtensionAssociation``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param extension_identifier: The name, the ID, or the Amazon Resource Name (ARN) of the extension.
@@ -3994,6 +4138,48 @@ class CfnExtensionAssociation(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromExtensionAssociationArn")
+    @builtins.classmethod
+    def from_extension_association_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IExtensionAssociationRef_1b672c9b:
+        '''Creates a new IExtensionAssociationRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0f2ddb8bad12cb1e96088c9c43262a44a268a1f9f59e087e06c9e1981203af04)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IExtensionAssociationRef_1b672c9b, jsii.sinvoke(cls, "fromExtensionAssociationArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromExtensionAssociationId")
+    @builtins.classmethod
+    def from_extension_association_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        extension_association_id: builtins.str,
+    ) -> _IExtensionAssociationRef_1b672c9b:
+        '''Creates a new IExtensionAssociationRef from a extensionAssociationId.
+
+        :param scope: -
+        :param id: -
+        :param extension_association_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__40444fb29d9428650401cd4b9cf7689bd4735cae65b5137a1802e1a8a7fd4825)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument extension_association_id", value=extension_association_id, expected_type=type_hints["extension_association_id"])
+        return typing.cast(_IExtensionAssociationRef_1b672c9b, jsii.sinvoke(cls, "fromExtensionAssociationId", [scope, id, extension_association_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -4065,6 +4251,12 @@ class CfnExtensionAssociation(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="extensionAssociationRef")
+    def extension_association_ref(self) -> _ExtensionAssociationReference_35a869f1:
+        '''A reference to a ExtensionAssociation resource.'''
+        return typing.cast(_ExtensionAssociationReference_35a869f1, jsii.get(self, "extensionAssociationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -4441,7 +4633,7 @@ class CfnExtensionProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IHostedConfigurationVersionRef_eb4b6788)
 class CfnHostedConfigurationVersion(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -4493,7 +4685,8 @@ class CfnHostedConfigurationVersion(
         latest_version_number: typing.Optional[jsii.Number] = None,
         version_label: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AppConfig::HostedConfigurationVersion``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The application ID.
@@ -4564,6 +4757,14 @@ class CfnHostedConfigurationVersion(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="hostedConfigurationVersionRef")
+    def hosted_configuration_version_ref(
+        self,
+    ) -> _HostedConfigurationVersionReference_6f730fe8:
+        '''A reference to a HostedConfigurationVersion resource.'''
+        return typing.cast(_HostedConfigurationVersionReference_6f730fe8, jsii.get(self, "hostedConfigurationVersionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -4835,15 +5036,17 @@ class ConfigurationContent(
 
     Example::
 
-        app = appconfig.Application(self, "MyApp")
-        env = appconfig.Environment(self, "MyEnv",
-            application=app
-        )
+        # application: appconfig.Application
+        # fn: lambda.Function
         
-        appconfig.HostedConfiguration(self, "MyHostedConfig",
-            application=app,
-            deploy_to=[env],
-            content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content.")
+        
+        appconfig.HostedConfiguration(self, "MyHostedConfiguration",
+            application=application,
+            content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content."),
+            validators=[
+                appconfig.JsonSchemaValidator.from_file("schema.json"),
+                appconfig.LambdaValidator.from_function(fn)
+            ]
         )
     '''
 
@@ -4860,7 +5063,7 @@ class ConfigurationContent(
         '''Defines the hosted configuration content from a file.
 
         :param input_path: The path to the file that defines configuration content.
-        :param content_type: The content type of the configuration.
+        :param content_type: The configuration content type, specified as a standard MIME type. Supported examples include: - ``text/plain`` - ``application/json`` - ``application/octet-stream`` - ``application/x-yaml``. For an up-to-date list of valid MIME types, see: https://www.iana.org/assignments/media-types/media-types.xhtml
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__90a444a396ae95bf4dbe20a3cba4428b472f8dc18cddec786f4ed521d3ef8224)
@@ -4878,7 +5081,7 @@ class ConfigurationContent(
         '''Defines the hosted configuration content from inline code.
 
         :param content: The inline code that defines the configuration content.
-        :param content_type: The content type of the configuration.
+        :param content_type: The configuration content type, specified as a standard MIME type. Supported examples include: - ``text/plain`` - ``application/json`` - ``application/octet-stream`` - ``application/x-yaml``. For an up-to-date list of valid MIME types, see: https://www.iana.org/assignments/media-types/media-types.xhtml
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__3dc78a8c320c476850c109277461b0640bc3492938af15c32744671285117e99)
@@ -4896,7 +5099,7 @@ class ConfigurationContent(
         '''Defines the hosted configuration content as JSON from inline code.
 
         :param content: The inline code that defines the configuration content.
-        :param content_type: The content type of the configuration.
+        :param content_type: The configuration content type, specified as a standard MIME type. Supported examples include: - ``text/plain`` - ``application/json`` - ``application/octet-stream`` - ``application/x-yaml``. For an up-to-date list of valid MIME types, see: https://www.iana.org/assignments/media-types/media-types.xhtml
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__0be240b695740e98f6925d6eb7c6948c1cdff98558955885c2275a539fa4e5f0)
@@ -4939,7 +5142,11 @@ class ConfigurationContent(
     @jsii.member(jsii_name="contentType")
     @abc.abstractmethod
     def content_type(self) -> builtins.str:
-        '''The configuration content type.'''
+        '''The configuration content type, specified as a standard MIME type. Supported examples include: - ``text/plain`` - ``application/json`` - ``application/octet-stream`` - ``application/x-yaml``.
+
+        For an up-to-date list of valid MIME types, see:
+        https://www.iana.org/assignments/media-types/media-types.xhtml
+        '''
         ...
 
 
@@ -4953,7 +5160,11 @@ class _ConfigurationContentProxy(ConfigurationContent):
     @builtins.property
     @jsii.member(jsii_name="contentType")
     def content_type(self) -> builtins.str:
-        '''The configuration content type.'''
+        '''The configuration content type, specified as a standard MIME type. Supported examples include: - ``text/plain`` - ``application/json`` - ``application/octet-stream`` - ``application/x-yaml``.
+
+        For an up-to-date list of valid MIME types, see:
+        https://www.iana.org/assignments/media-types/media-types.xhtml
+        '''
         return typing.cast(builtins.str, jsii.get(self, "contentType"))
 
 # Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
@@ -4964,6 +5175,7 @@ typing.cast(typing.Any, ConfigurationContent).__jsii_proxy_class__ = lambda : _C
     jsii_type="aws-cdk-lib.aws_appconfig.ConfigurationOptions",
     jsii_struct_bases=[],
     name_mapping={
+        "deletion_protection_check": "deletionProtectionCheck",
         "deployment_key": "deploymentKey",
         "deployment_strategy": "deploymentStrategy",
         "deploy_to": "deployTo",
@@ -4977,6 +5189,7 @@ class ConfigurationOptions:
     def __init__(
         self,
         *,
+        deletion_protection_check: typing.Optional["DeletionProtectionCheck"] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -4987,6 +5200,7 @@ class ConfigurationOptions:
     ) -> None:
         '''Options for the Configuration construct.
 
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -5010,6 +5224,7 @@ class ConfigurationOptions:
             # validator: appconfig.IValidator
             
             configuration_options = appconfig.ConfigurationOptions(
+                deletion_protection_check=appconfig.DeletionProtectionCheck.ACCOUNT_DEFAULT,
                 deployment_key=key,
                 deployment_strategy=deployment_strategy,
                 deploy_to=[environment],
@@ -5021,6 +5236,7 @@ class ConfigurationOptions:
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7d8aafff2e2f314c1c4bef6e213f0aaef56ff294051b33fee835ad5716a7e093)
+            check_type(argname="argument deletion_protection_check", value=deletion_protection_check, expected_type=type_hints["deletion_protection_check"])
             check_type(argname="argument deployment_key", value=deployment_key, expected_type=type_hints["deployment_key"])
             check_type(argname="argument deployment_strategy", value=deployment_strategy, expected_type=type_hints["deployment_strategy"])
             check_type(argname="argument deploy_to", value=deploy_to, expected_type=type_hints["deploy_to"])
@@ -5029,6 +5245,8 @@ class ConfigurationOptions:
             check_type(argname="argument type", value=type, expected_type=type_hints["type"])
             check_type(argname="argument validators", value=validators, expected_type=type_hints["validators"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if deletion_protection_check is not None:
+            self._values["deletion_protection_check"] = deletion_protection_check
         if deployment_key is not None:
             self._values["deployment_key"] = deployment_key
         if deployment_strategy is not None:
@@ -5044,6 +5262,20 @@ class ConfigurationOptions:
         if validators is not None:
             self._values["validators"] = validators
 
+    @builtins.property
+    def deletion_protection_check(self) -> typing.Optional["DeletionProtectionCheck"]:
+        '''A parameter to configure deletion protection.
+
+        Deletion protection prevents a user from deleting a configuration profile if your application has called
+        either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval.
+
+        :default: DeletionProtectionCheck.ACCOUNT_DEFAULT
+
+        :see: https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html
+        '''
+        result = self._values.get("deletion_protection_check")
+        return typing.cast(typing.Optional["DeletionProtectionCheck"], result)
+
     @builtins.property
     def deployment_key(self) -> typing.Optional[_IKey_5f11635f]:
         '''The deployment key of the configuration.
@@ -5132,6 +5364,7 @@ class ConfigurationOptions:
     jsii_type="aws-cdk-lib.aws_appconfig.ConfigurationProps",
     jsii_struct_bases=[ConfigurationOptions],
     name_mapping={
+        "deletion_protection_check": "deletionProtectionCheck",
         "deployment_key": "deploymentKey",
         "deployment_strategy": "deploymentStrategy",
         "deploy_to": "deployTo",
@@ -5146,6 +5379,7 @@ class ConfigurationProps(ConfigurationOptions):
     def __init__(
         self,
         *,
+        deletion_protection_check: typing.Optional["DeletionProtectionCheck"] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -5157,6 +5391,7 @@ class ConfigurationProps(ConfigurationOptions):
     ) -> None:
         '''Properties for the Configuration construct.
 
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -5185,6 +5420,7 @@ class ConfigurationProps(ConfigurationOptions):
                 application=application,
             
                 # the properties below are optional
+                deletion_protection_check=appconfig.DeletionProtectionCheck.ACCOUNT_DEFAULT,
                 deployment_key=key,
                 deployment_strategy=deployment_strategy,
                 deploy_to=[environment],
@@ -5196,6 +5432,7 @@ class ConfigurationProps(ConfigurationOptions):
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__fde28a86ff967e860849eabd5d00b00f1f841ba2ded09e00655f2b7d433ef121)
+            check_type(argname="argument deletion_protection_check", value=deletion_protection_check, expected_type=type_hints["deletion_protection_check"])
             check_type(argname="argument deployment_key", value=deployment_key, expected_type=type_hints["deployment_key"])
             check_type(argname="argument deployment_strategy", value=deployment_strategy, expected_type=type_hints["deployment_strategy"])
             check_type(argname="argument deploy_to", value=deploy_to, expected_type=type_hints["deploy_to"])
@@ -5207,6 +5444,8 @@ class ConfigurationProps(ConfigurationOptions):
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "application": application,
         }
+        if deletion_protection_check is not None:
+            self._values["deletion_protection_check"] = deletion_protection_check
         if deployment_key is not None:
             self._values["deployment_key"] = deployment_key
         if deployment_strategy is not None:
@@ -5222,6 +5461,20 @@ class ConfigurationProps(ConfigurationOptions):
         if validators is not None:
             self._values["validators"] = validators
 
+    @builtins.property
+    def deletion_protection_check(self) -> typing.Optional["DeletionProtectionCheck"]:
+        '''A parameter to configure deletion protection.
+
+        Deletion protection prevents a user from deleting a configuration profile if your application has called
+        either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval.
+
+        :default: DeletionProtectionCheck.ACCOUNT_DEFAULT
+
+        :see: https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html
+        '''
+        result = self._values.get("deletion_protection_check")
+        return typing.cast(typing.Optional["DeletionProtectionCheck"], result)
+
     @builtins.property
     def deployment_key(self) -> typing.Optional[_IKey_5f11635f]:
         '''The deployment key of the configuration.
@@ -5482,12 +5735,14 @@ class ConfigurationType(enum.Enum):
     Example::
 
         # application: appconfig.Application
+        # kms_key: kms.Key
         
         
         appconfig.HostedConfiguration(self, "MyHostedConfiguration",
             application=application,
             content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content."),
-            type=appconfig.ConfigurationType.FEATURE_FLAGS
+            type=appconfig.ConfigurationType.FEATURE_FLAGS,
+            kms_key=kms_key
         )
     '''
 
@@ -5519,12 +5774,27 @@ class DeletionProtectionCheck(enum.Enum):
         # application: appconfig.Application
         # alarm: cloudwatch.Alarm
         # composite_alarm: cloudwatch.CompositeAlarm
+        # bucket: s3.Bucket
         
         
+        # Environment deletion protection check
         appconfig.Environment(self, "MyEnvironment",
             application=application,
             deletion_protection_check=appconfig.DeletionProtectionCheck.APPLY
         )
+        
+        # configuration profile with deletion protection check
+        appconfig.HostedConfiguration(self, "MyHostedConfigFromFile",
+            application=application,
+            content=appconfig.ConfigurationContent.from_file("config.json"),
+            deletion_protection_check=appconfig.DeletionProtectionCheck.BYPASS
+        )
+        
+        appconfig.SourcedConfiguration(self, "MySourcedConfiguration",
+            application=application,
+            location=appconfig.ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
+            deletion_protection_check=appconfig.DeletionProtectionCheck.ACCOUNT_DEFAULT
+        )
     '''
 
     ACCOUNT_DEFAULT = "ACCOUNT_DEFAULT"
@@ -5991,10 +6261,16 @@ class EnvironmentProps(EnvironmentOptions):
                 application=app
             )
             
-            appconfig.HostedConfiguration(self, "MyHostedConfig",
+            appconfig.HostedConfiguration(self, "MyFirstHostedConfig",
                 application=app,
                 deploy_to=[env],
-                content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content.")
+                content=appconfig.ConfigurationContent.from_inline_text("This is my first configuration content.")
+            )
+            
+            appconfig.HostedConfiguration(self, "MySecondHostedConfig",
+                application=app,
+                deploy_to=[env],
+                content=appconfig.ConfigurationContent.from_inline_text("This is my second configuration content.")
             )
         '''
         if __debug__:
@@ -6459,6 +6735,7 @@ class GrowthType(enum.Enum):
     jsii_type="aws-cdk-lib.aws_appconfig.HostedConfigurationOptions",
     jsii_struct_bases=[ConfigurationOptions],
     name_mapping={
+        "deletion_protection_check": "deletionProtectionCheck",
         "deployment_key": "deploymentKey",
         "deployment_strategy": "deploymentStrategy",
         "deploy_to": "deployTo",
@@ -6475,6 +6752,7 @@ class HostedConfigurationOptions(ConfigurationOptions):
     def __init__(
         self,
         *,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -6488,6 +6766,7 @@ class HostedConfigurationOptions(ConfigurationOptions):
     ) -> None:
         '''Options for HostedConfiguration.
 
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -6518,6 +6797,7 @@ class HostedConfigurationOptions(ConfigurationOptions):
                 content=configuration_content,
             
                 # the properties below are optional
+                deletion_protection_check=appconfig.DeletionProtectionCheck.ACCOUNT_DEFAULT,
                 deployment_key=key,
                 deployment_strategy=deployment_strategy,
                 deploy_to=[environment],
@@ -6531,6 +6811,7 @@ class HostedConfigurationOptions(ConfigurationOptions):
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__4c4d8fda2e4860630073eda40d5a32347248e82c24127624ef93e735b071da8f)
+            check_type(argname="argument deletion_protection_check", value=deletion_protection_check, expected_type=type_hints["deletion_protection_check"])
             check_type(argname="argument deployment_key", value=deployment_key, expected_type=type_hints["deployment_key"])
             check_type(argname="argument deployment_strategy", value=deployment_strategy, expected_type=type_hints["deployment_strategy"])
             check_type(argname="argument deploy_to", value=deploy_to, expected_type=type_hints["deploy_to"])
@@ -6544,6 +6825,8 @@ class HostedConfigurationOptions(ConfigurationOptions):
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "content": content,
         }
+        if deletion_protection_check is not None:
+            self._values["deletion_protection_check"] = deletion_protection_check
         if deployment_key is not None:
             self._values["deployment_key"] = deployment_key
         if deployment_strategy is not None:
@@ -6563,6 +6846,20 @@ class HostedConfigurationOptions(ConfigurationOptions):
         if version_label is not None:
             self._values["version_label"] = version_label
 
+    @builtins.property
+    def deletion_protection_check(self) -> typing.Optional[DeletionProtectionCheck]:
+        '''A parameter to configure deletion protection.
+
+        Deletion protection prevents a user from deleting a configuration profile if your application has called
+        either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval.
+
+        :default: DeletionProtectionCheck.ACCOUNT_DEFAULT
+
+        :see: https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html
+        '''
+        result = self._values.get("deletion_protection_check")
+        return typing.cast(typing.Optional[DeletionProtectionCheck], result)
+
     @builtins.property
     def deployment_key(self) -> typing.Optional[_IKey_5f11635f]:
         '''The deployment key of the configuration.
@@ -6676,6 +6973,7 @@ class HostedConfigurationOptions(ConfigurationOptions):
     jsii_type="aws-cdk-lib.aws_appconfig.HostedConfigurationProps",
     jsii_struct_bases=[ConfigurationProps],
     name_mapping={
+        "deletion_protection_check": "deletionProtectionCheck",
         "deployment_key": "deploymentKey",
         "deployment_strategy": "deploymentStrategy",
         "deploy_to": "deployTo",
@@ -6685,6 +6983,7 @@ class HostedConfigurationOptions(ConfigurationOptions):
         "validators": "validators",
         "application": "application",
         "content": "content",
+        "kms_key": "kmsKey",
         "latest_version_number": "latestVersionNumber",
         "version_label": "versionLabel",
     },
@@ -6693,6 +6992,7 @@ class HostedConfigurationProps(ConfigurationProps):
     def __init__(
         self,
         *,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -6702,11 +7002,13 @@ class HostedConfigurationProps(ConfigurationProps):
         validators: typing.Optional[typing.Sequence["IValidator"]] = None,
         application: "IApplication",
         content: ConfigurationContent,
+        kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         latest_version_number: typing.Optional[jsii.Number] = None,
         version_label: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Properties for HostedConfiguration.
 
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -6716,6 +7018,7 @@ class HostedConfigurationProps(ConfigurationProps):
         :param validators: The validators for the configuration. Default: - No validators.
         :param application: The application associated with the configuration.
         :param content: The content of the hosted configuration.
+        :param kms_key: The customer managed key to encrypt hosted configuration. Default: None
         :param latest_version_number: The latest version number of the hosted configuration. Default: - None.
         :param version_label: The version label of the hosted configuration. Default: - None.
 
@@ -6723,19 +7026,22 @@ class HostedConfigurationProps(ConfigurationProps):
 
         Example::
 
-            app = appconfig.Application(self, "MyApp")
-            env = appconfig.Environment(self, "MyEnv",
-                application=app
-            )
+            # application: appconfig.Application
+            # fn: lambda.Function
             
-            appconfig.HostedConfiguration(self, "MyHostedConfig",
-                application=app,
-                deploy_to=[env],
-                content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content.")
+            
+            appconfig.HostedConfiguration(self, "MyHostedConfiguration",
+                application=application,
+                content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content."),
+                validators=[
+                    appconfig.JsonSchemaValidator.from_file("schema.json"),
+                    appconfig.LambdaValidator.from_function(fn)
+                ]
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7cba9d5464f3f4cbc208d892995245e5078fc2cc794651c71942035a9b151b2e)
+            check_type(argname="argument deletion_protection_check", value=deletion_protection_check, expected_type=type_hints["deletion_protection_check"])
             check_type(argname="argument deployment_key", value=deployment_key, expected_type=type_hints["deployment_key"])
             check_type(argname="argument deployment_strategy", value=deployment_strategy, expected_type=type_hints["deployment_strategy"])
             check_type(argname="argument deploy_to", value=deploy_to, expected_type=type_hints["deploy_to"])
@@ -6745,12 +7051,15 @@ class HostedConfigurationProps(ConfigurationProps):
             check_type(argname="argument validators", value=validators, expected_type=type_hints["validators"])
             check_type(argname="argument application", value=application, expected_type=type_hints["application"])
             check_type(argname="argument content", value=content, expected_type=type_hints["content"])
+            check_type(argname="argument kms_key", value=kms_key, expected_type=type_hints["kms_key"])
             check_type(argname="argument latest_version_number", value=latest_version_number, expected_type=type_hints["latest_version_number"])
             check_type(argname="argument version_label", value=version_label, expected_type=type_hints["version_label"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "application": application,
             "content": content,
         }
+        if deletion_protection_check is not None:
+            self._values["deletion_protection_check"] = deletion_protection_check
         if deployment_key is not None:
             self._values["deployment_key"] = deployment_key
         if deployment_strategy is not None:
@@ -6765,11 +7074,27 @@ class HostedConfigurationProps(ConfigurationProps):
             self._values["type"] = type
         if validators is not None:
             self._values["validators"] = validators
+        if kms_key is not None:
+            self._values["kms_key"] = kms_key
         if latest_version_number is not None:
             self._values["latest_version_number"] = latest_version_number
         if version_label is not None:
             self._values["version_label"] = version_label
 
+    @builtins.property
+    def deletion_protection_check(self) -> typing.Optional[DeletionProtectionCheck]:
+        '''A parameter to configure deletion protection.
+
+        Deletion protection prevents a user from deleting a configuration profile if your application has called
+        either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval.
+
+        :default: DeletionProtectionCheck.ACCOUNT_DEFAULT
+
+        :see: https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html
+        '''
+        result = self._values.get("deletion_protection_check")
+        return typing.cast(typing.Optional[DeletionProtectionCheck], result)
+
     @builtins.property
     def deployment_key(self) -> typing.Optional[_IKey_5f11635f]:
         '''The deployment key of the configuration.
@@ -6856,6 +7181,15 @@ class HostedConfigurationProps(ConfigurationProps):
         assert result is not None, "Required property 'content' is missing"
         return typing.cast(ConfigurationContent, result)
 
+    @builtins.property
+    def kms_key(self) -> typing.Optional[_IKeyRef_d4fc6ef3]:
+        '''The customer managed key to encrypt hosted configuration.
+
+        :default: None
+        '''
+        result = self._values.get("kms_key")
+        return typing.cast(typing.Optional[_IKeyRef_d4fc6ef3], result)
+
     @builtins.property
     def latest_version_number(self) -> typing.Optional[jsii.Number]:
         '''The latest version number of the hosted configuration.
@@ -6962,6 +7296,7 @@ class IApplication(_IResource_c80c4260, typing_extensions.Protocol):
         content: ConfigurationContent,
         latest_version_number: typing.Optional[jsii.Number] = None,
         version_label: typing.Optional[builtins.str] = None,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -6976,6 +7311,7 @@ class IApplication(_IResource_c80c4260, typing_extensions.Protocol):
         :param content: The content of the hosted configuration.
         :param latest_version_number: The latest version number of the hosted configuration. Default: - None.
         :param version_label: The version label of the hosted configuration. Default: - None.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -6992,8 +7328,9 @@ class IApplication(_IResource_c80c4260, typing_extensions.Protocol):
         id: builtins.str,
         *,
         location: ConfigurationSource,
-        retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+        retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
         version_number: typing.Optional[builtins.str] = None,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -7008,6 +7345,7 @@ class IApplication(_IResource_c80c4260, typing_extensions.Protocol):
         :param location: The location where the configuration is stored.
         :param retrieval_role: The IAM role to retrieve the configuration. Default: - A role is generated.
         :param version_number: The version number of the sourced configuration to deploy. If this is not specified, then there will be no deployment. Default: - None.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -7301,6 +7639,7 @@ class _IApplicationProxy(
         content: ConfigurationContent,
         latest_version_number: typing.Optional[jsii.Number] = None,
         version_label: typing.Optional[builtins.str] = None,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -7315,6 +7654,7 @@ class _IApplicationProxy(
         :param content: The content of the hosted configuration.
         :param latest_version_number: The latest version number of the hosted configuration. Default: - None.
         :param version_label: The version label of the hosted configuration. Default: - None.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -7330,6 +7670,7 @@ class _IApplicationProxy(
             content=content,
             latest_version_number=latest_version_number,
             version_label=version_label,
+            deletion_protection_check=deletion_protection_check,
             deployment_key=deployment_key,
             deployment_strategy=deployment_strategy,
             deploy_to=deploy_to,
@@ -7347,8 +7688,9 @@ class _IApplicationProxy(
         id: builtins.str,
         *,
         location: ConfigurationSource,
-        retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+        retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
         version_number: typing.Optional[builtins.str] = None,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional["IDeploymentStrategy"] = None,
         deploy_to: typing.Optional[typing.Sequence["IEnvironment"]] = None,
@@ -7363,6 +7705,7 @@ class _IApplicationProxy(
         :param location: The location where the configuration is stored.
         :param retrieval_role: The IAM role to retrieve the configuration. Default: - A role is generated.
         :param version_number: The version number of the sourced configuration to deploy. If this is not specified, then there will be no deployment. Default: - None.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -7378,6 +7721,7 @@ class _IApplicationProxy(
             location=location,
             retrieval_role=retrieval_role,
             version_number=version_number,
+            deletion_protection_check=deletion_protection_check,
             deployment_key=deployment_key,
             deployment_strategy=deployment_strategy,
             deploy_to=deploy_to,
@@ -9568,7 +9912,7 @@ class Monitor(
     def from_cloud_watch_alarm(
         cls,
         alarm: _IAlarm_ff3eabc0,
-        alarm_role: typing.Optional[_IRole_235f5d8e] = None,
+        alarm_role: typing.Optional[_IRoleRef_8400221f] = None,
     ) -> "Monitor":
         '''Creates a Monitor from a CloudWatch alarm.
 
@@ -10120,9 +10464,10 @@ class SourcedConfiguration(
         id: builtins.str,
         *,
         location: ConfigurationSource,
-        retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+        retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
         version_number: typing.Optional[builtins.str] = None,
         application: IApplication,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
         deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -10138,6 +10483,7 @@ class SourcedConfiguration(
         :param retrieval_role: The IAM role to retrieve the configuration. Default: - Auto generated if location type is not ConfigurationSourceType.CODE_PIPELINE otherwise no role specified.
         :param version_number: The version number of the sourced configuration to deploy. If this is not specified, then there will be no deployment. Default: - None.
         :param application: The application associated with the configuration.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -10155,6 +10501,7 @@ class SourcedConfiguration(
             retrieval_role=retrieval_role,
             version_number=version_number,
             application=application,
+            deletion_protection_check=deletion_protection_check,
             deployment_key=deployment_key,
             deployment_strategy=deployment_strategy,
             deploy_to=deploy_to,
@@ -10571,11 +10918,27 @@ class SourcedConfiguration(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "extensible", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="deletionProtectionCheck")
+    def _deletion_protection_check(self) -> typing.Optional[DeletionProtectionCheck]:
+        return typing.cast(typing.Optional[DeletionProtectionCheck], jsii.get(self, "deletionProtectionCheck"))
+
+    @_deletion_protection_check.setter
+    def _deletion_protection_check(
+        self,
+        value: typing.Optional[DeletionProtectionCheck],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__ff7730984215a53f88ccb3e1915941985bedc75f6b24a06eae12d583d8f4bca9)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "deletionProtectionCheck", value) # pyright: ignore[reportArgumentType]
+
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_appconfig.SourcedConfigurationOptions",
     jsii_struct_bases=[ConfigurationOptions],
     name_mapping={
+        "deletion_protection_check": "deletionProtectionCheck",
         "deployment_key": "deploymentKey",
         "deployment_strategy": "deploymentStrategy",
         "deploy_to": "deployTo",
@@ -10592,6 +10955,7 @@ class SourcedConfigurationOptions(ConfigurationOptions):
     def __init__(
         self,
         *,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
         deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -10600,11 +10964,12 @@ class SourcedConfigurationOptions(ConfigurationOptions):
         type: typing.Optional[ConfigurationType] = None,
         validators: typing.Optional[typing.Sequence[IValidator]] = None,
         location: ConfigurationSource,
-        retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+        retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
         version_number: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Options for SourcedConfiguration.
 
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -10623,26 +10988,27 @@ class SourcedConfigurationOptions(ConfigurationOptions):
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             from aws_cdk import aws_appconfig as appconfig
-            from aws_cdk import aws_iam as iam
             from aws_cdk import aws_kms as kms
+            from aws_cdk.interfaces import aws_iam as interfaces_aws_iam
             
             # configuration_source: appconfig.ConfigurationSource
             # deployment_strategy: appconfig.DeploymentStrategy
             # environment: appconfig.Environment
             # key: kms.Key
-            # role: iam.Role
+            # role_ref: interfaces_aws_iam.IRoleRef
             # validator: appconfig.IValidator
             
             sourced_configuration_options = appconfig.SourcedConfigurationOptions(
                 location=configuration_source,
             
                 # the properties below are optional
+                deletion_protection_check=appconfig.DeletionProtectionCheck.ACCOUNT_DEFAULT,
                 deployment_key=key,
                 deployment_strategy=deployment_strategy,
                 deploy_to=[environment],
                 description="description",
                 name="name",
-                retrieval_role=role,
+                retrieval_role=role_ref,
                 type=appconfig.ConfigurationType.FREEFORM,
                 validators=[validator],
                 version_number="versionNumber"
@@ -10650,6 +11016,7 @@ class SourcedConfigurationOptions(ConfigurationOptions):
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__115deabe7a02ce295c431e7d9a99bcbe112bc017436380d80181c5db491187a1)
+            check_type(argname="argument deletion_protection_check", value=deletion_protection_check, expected_type=type_hints["deletion_protection_check"])
             check_type(argname="argument deployment_key", value=deployment_key, expected_type=type_hints["deployment_key"])
             check_type(argname="argument deployment_strategy", value=deployment_strategy, expected_type=type_hints["deployment_strategy"])
             check_type(argname="argument deploy_to", value=deploy_to, expected_type=type_hints["deploy_to"])
@@ -10663,6 +11030,8 @@ class SourcedConfigurationOptions(ConfigurationOptions):
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "location": location,
         }
+        if deletion_protection_check is not None:
+            self._values["deletion_protection_check"] = deletion_protection_check
         if deployment_key is not None:
             self._values["deployment_key"] = deployment_key
         if deployment_strategy is not None:
@@ -10682,6 +11051,20 @@ class SourcedConfigurationOptions(ConfigurationOptions):
         if version_number is not None:
             self._values["version_number"] = version_number
 
+    @builtins.property
+    def deletion_protection_check(self) -> typing.Optional[DeletionProtectionCheck]:
+        '''A parameter to configure deletion protection.
+
+        Deletion protection prevents a user from deleting a configuration profile if your application has called
+        either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval.
+
+        :default: DeletionProtectionCheck.ACCOUNT_DEFAULT
+
+        :see: https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html
+        '''
+        result = self._values.get("deletion_protection_check")
+        return typing.cast(typing.Optional[DeletionProtectionCheck], result)
+
     @builtins.property
     def deployment_key(self) -> typing.Optional[_IKey_5f11635f]:
         '''The deployment key of the configuration.
@@ -10762,13 +11145,13 @@ class SourcedConfigurationOptions(ConfigurationOptions):
         return typing.cast(ConfigurationSource, result)
 
     @builtins.property
-    def retrieval_role(self) -> typing.Optional[_IRole_235f5d8e]:
+    def retrieval_role(self) -> typing.Optional[_IRoleRef_8400221f]:
         '''The IAM role to retrieve the configuration.
 
         :default: - A role is generated.
         '''
         result = self._values.get("retrieval_role")
-        return typing.cast(typing.Optional[_IRole_235f5d8e], result)
+        return typing.cast(typing.Optional[_IRoleRef_8400221f], result)
 
     @builtins.property
     def version_number(self) -> typing.Optional[builtins.str]:
@@ -10798,6 +11181,7 @@ class SourcedConfigurationOptions(ConfigurationOptions):
     jsii_type="aws-cdk-lib.aws_appconfig.SourcedConfigurationProps",
     jsii_struct_bases=[ConfigurationProps],
     name_mapping={
+        "deletion_protection_check": "deletionProtectionCheck",
         "deployment_key": "deploymentKey",
         "deployment_strategy": "deploymentStrategy",
         "deploy_to": "deployTo",
@@ -10815,6 +11199,7 @@ class SourcedConfigurationProps(ConfigurationProps):
     def __init__(
         self,
         *,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
         deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -10824,11 +11209,12 @@ class SourcedConfigurationProps(ConfigurationProps):
         validators: typing.Optional[typing.Sequence[IValidator]] = None,
         application: IApplication,
         location: ConfigurationSource,
-        retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+        retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
         version_number: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Properties for SourcedConfiguration.
 
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -10859,6 +11245,7 @@ class SourcedConfigurationProps(ConfigurationProps):
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__d41101d1b0f699a52d44a2b86fe3e9dcd0e6f1487f088908464eb49cb3e5e12c)
+            check_type(argname="argument deletion_protection_check", value=deletion_protection_check, expected_type=type_hints["deletion_protection_check"])
             check_type(argname="argument deployment_key", value=deployment_key, expected_type=type_hints["deployment_key"])
             check_type(argname="argument deployment_strategy", value=deployment_strategy, expected_type=type_hints["deployment_strategy"])
             check_type(argname="argument deploy_to", value=deploy_to, expected_type=type_hints["deploy_to"])
@@ -10874,6 +11261,8 @@ class SourcedConfigurationProps(ConfigurationProps):
             "application": application,
             "location": location,
         }
+        if deletion_protection_check is not None:
+            self._values["deletion_protection_check"] = deletion_protection_check
         if deployment_key is not None:
             self._values["deployment_key"] = deployment_key
         if deployment_strategy is not None:
@@ -10893,6 +11282,20 @@ class SourcedConfigurationProps(ConfigurationProps):
         if version_number is not None:
             self._values["version_number"] = version_number
 
+    @builtins.property
+    def deletion_protection_check(self) -> typing.Optional[DeletionProtectionCheck]:
+        '''A parameter to configure deletion protection.
+
+        Deletion protection prevents a user from deleting a configuration profile if your application has called
+        either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval.
+
+        :default: DeletionProtectionCheck.ACCOUNT_DEFAULT
+
+        :see: https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html
+        '''
+        result = self._values.get("deletion_protection_check")
+        return typing.cast(typing.Optional[DeletionProtectionCheck], result)
+
     @builtins.property
     def deployment_key(self) -> typing.Optional[_IKey_5f11635f]:
         '''The deployment key of the configuration.
@@ -10980,13 +11383,13 @@ class SourcedConfigurationProps(ConfigurationProps):
         return typing.cast(ConfigurationSource, result)
 
     @builtins.property
-    def retrieval_role(self) -> typing.Optional[_IRole_235f5d8e]:
+    def retrieval_role(self) -> typing.Optional[_IRoleRef_8400221f]:
         '''The IAM role to retrieve the configuration.
 
         :default: - Auto generated if location type is not ConfigurationSourceType.CODE_PIPELINE otherwise no role specified.
         '''
         result = self._values.get("retrieval_role")
-        return typing.cast(typing.Optional[_IRole_235f5d8e], result)
+        return typing.cast(typing.Optional[_IRoleRef_8400221f], result)
 
     @builtins.property
     def version_number(self) -> typing.Optional[builtins.str]:
@@ -11258,6 +11661,7 @@ class Application(
         content: ConfigurationContent,
         latest_version_number: typing.Optional[jsii.Number] = None,
         version_label: typing.Optional[builtins.str] = None,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
         deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -11272,6 +11676,7 @@ class Application(
         :param content: The content of the hosted configuration.
         :param latest_version_number: The latest version number of the hosted configuration. Default: - None.
         :param version_label: The version label of the hosted configuration. Default: - None.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -11287,6 +11692,7 @@ class Application(
             content=content,
             latest_version_number=latest_version_number,
             version_label=version_label,
+            deletion_protection_check=deletion_protection_check,
             deployment_key=deployment_key,
             deployment_strategy=deployment_strategy,
             deploy_to=deploy_to,
@@ -11304,8 +11710,9 @@ class Application(
         id: builtins.str,
         *,
         location: ConfigurationSource,
-        retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+        retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
         version_number: typing.Optional[builtins.str] = None,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
         deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -11320,6 +11727,7 @@ class Application(
         :param location: The location where the configuration is stored.
         :param retrieval_role: The IAM role to retrieve the configuration. Default: - A role is generated.
         :param version_number: The version number of the sourced configuration to deploy. If this is not specified, then there will be no deployment. Default: - None.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -11335,6 +11743,7 @@ class Application(
             location=location,
             retrieval_role=retrieval_role,
             version_number=version_number,
+            deletion_protection_check=deletion_protection_check,
             deployment_key=deployment_key,
             deployment_strategy=deployment_strategy,
             deploy_to=deploy_to,
@@ -11624,6 +12033,12 @@ class Application(
 
         return typing.cast(None, jsii.invoke(self, "preStartDeployment", [event_destination, options]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationArn")
     def application_arn(self) -> builtins.str:
@@ -11760,6 +12175,12 @@ class DeploymentStrategy(
             check_type(argname="argument deployment_strategy_id", value=deployment_strategy_id, expected_type=type_hints["deployment_strategy_id"])
         return typing.cast(IDeploymentStrategy, jsii.sinvoke(cls, "fromDeploymentStrategyId", [scope, id, deployment_strategy_id]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="deploymentStrategyArn")
     def deployment_strategy_arn(self) -> builtins.str:
@@ -11831,10 +12252,16 @@ class Environment(
             application=app
         )
         
-        appconfig.HostedConfiguration(self, "MyHostedConfig",
+        appconfig.HostedConfiguration(self, "MyFirstHostedConfig",
             application=app,
             deploy_to=[env],
-            content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content.")
+            content=appconfig.ConfigurationContent.from_inline_text("This is my first configuration content.")
+        )
+        
+        appconfig.HostedConfiguration(self, "MySecondHostedConfig",
+            application=app,
+            deploy_to=[env],
+            content=appconfig.ConfigurationContent.from_inline_text("This is my second configuration content.")
         )
     '''
 
@@ -12272,6 +12699,12 @@ class Environment(
 
         return typing.cast(None, jsii.invoke(self, "preStartDeployment", [event_destination, options]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -12838,6 +13271,12 @@ class Extension(
 
         return typing.cast(IExtension, jsii.sinvoke(cls, "fromExtensionAttributes", [scope, id, attrs]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="extensionArn")
     def extension_arn(self) -> builtins.str:
@@ -12908,15 +13347,17 @@ class HostedConfiguration(
 
     Example::
 
-        app = appconfig.Application(self, "MyApp")
-        env = appconfig.Environment(self, "MyEnv",
-            application=app
-        )
+        # application: appconfig.Application
+        # fn: lambda.Function
         
-        appconfig.HostedConfiguration(self, "MyHostedConfig",
-            application=app,
-            deploy_to=[env],
-            content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content.")
+        
+        appconfig.HostedConfiguration(self, "MyHostedConfiguration",
+            application=application,
+            content=appconfig.ConfigurationContent.from_inline_text("This is my configuration content."),
+            validators=[
+                appconfig.JsonSchemaValidator.from_file("schema.json"),
+                appconfig.LambdaValidator.from_function(fn)
+            ]
         )
     '''
 
@@ -12926,9 +13367,11 @@ class HostedConfiguration(
         id: builtins.str,
         *,
         content: ConfigurationContent,
+        kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         latest_version_number: typing.Optional[jsii.Number] = None,
         version_label: typing.Optional[builtins.str] = None,
         application: IApplication,
+        deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
         deployment_key: typing.Optional[_IKey_5f11635f] = None,
         deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
         deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -12941,9 +13384,11 @@ class HostedConfiguration(
         :param scope: -
         :param id: -
         :param content: The content of the hosted configuration.
+        :param kms_key: The customer managed key to encrypt hosted configuration. Default: None
         :param latest_version_number: The latest version number of the hosted configuration. Default: - None.
         :param version_label: The version label of the hosted configuration. Default: - None.
         :param application: The application associated with the configuration.
+        :param deletion_protection_check: A parameter to configure deletion protection. Deletion protection prevents a user from deleting a configuration profile if your application has called either ``GetLatestConfiguration`` or ``GetConfiguration`` for the configuration profile during the specified interval. Default: DeletionProtectionCheck.ACCOUNT_DEFAULT
         :param deployment_key: The deployment key of the configuration. Default: - None.
         :param deployment_strategy: The deployment strategy for the configuration. Default: - A deployment strategy with the rollout strategy set to RolloutStrategy.CANARY_10_PERCENT_20_MINUTES
         :param deploy_to: The list of environments to deploy the configuration to. If this parameter is not specified, then there will be no deployment created alongside this configuration. Deployments can be added later using the ``IEnvironment.addDeployment`` or ``IEnvironment.addDeployments`` methods. Default: - None.
@@ -12958,9 +13403,11 @@ class HostedConfiguration(
             check_type(argname="argument id", value=id, expected_type=type_hints["id"])
         props = HostedConfigurationProps(
             content=content,
+            kms_key=kms_key,
             latest_version_number=latest_version_number,
             version_label=version_label,
             application=application,
+            deletion_protection_check=deletion_protection_check,
             deployment_key=deployment_key,
             deployment_strategy=deployment_strategy,
             deploy_to=deploy_to,
@@ -13297,7 +13744,11 @@ class HostedConfiguration(
     @builtins.property
     @jsii.member(jsii_name="contentType")
     def content_type(self) -> typing.Optional[builtins.str]:
-        '''The content type of the hosted configuration.'''
+        '''The configuration content type, specified as a standard MIME type. Supported examples include: - ``text/plain`` - ``application/json`` - ``application/octet-stream`` - ``application/x-yaml``.
+
+        For an up-to-date list of valid MIME types, see:
+        https://www.iana.org/assignments/media-types/media-types.xhtml
+        '''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "contentType"))
 
     @builtins.property
@@ -13384,6 +13835,21 @@ class HostedConfiguration(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "extensible", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="deletionProtectionCheck")
+    def _deletion_protection_check(self) -> typing.Optional[DeletionProtectionCheck]:
+        return typing.cast(typing.Optional[DeletionProtectionCheck], jsii.get(self, "deletionProtectionCheck"))
+
+    @_deletion_protection_check.setter
+    def _deletion_protection_check(
+        self,
+        value: typing.Optional[DeletionProtectionCheck],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0a1e6913f9293558fa6d2222b6d11c3af6b25866b966dd6319551117306cf272)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "deletionProtectionCheck", value) # pyright: ignore[reportArgumentType]
+
 
 __all__ = [
     "Action",
@@ -13490,6 +13956,14 @@ def _typecheckingstub__c5cb8c402a0d1a836162f596142de6ed2a1f2a0635a355ae334b92eb1
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__afd571466571231348a78cb931c25e5d1b3c70347a376b9d64e551c1d6126654(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    application_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__0ea7b1a84049868bc175511a7cff8896cbe830377b519f6e81ca6912165c12a6(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -13766,6 +14240,14 @@ def _typecheckingstub__bb88c221f102c1b57ba4f19db7656eb36ff011a70e3643e39d048c313
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__a211633629f45a21de52e2d3b8c73b520eee7fc38d9ec5fafe4d90b277a310a5(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    deployment_strategy_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__6c07282bd387e2aab09e9241f96ded37ff336d3f231f996e048ef207d3a38bc3(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -14024,6 +14506,22 @@ def _typecheckingstub__b2e5a069dff64a93330fdfc39cee819956ed46cafa89dc1aee558b0c2
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__0f2ddb8bad12cb1e96088c9c43262a44a268a1f9f59e087e06c9e1981203af04(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__40444fb29d9428650401cd4b9cf7689bd4735cae65b5137a1802e1a8a7fd4825(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    extension_association_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__209622600665bfa16663cc19d0b91c8caf5c5d29f4cc7cb09fd6fba67bcb1739(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -14206,6 +14704,7 @@ def _typecheckingstub__af127c28dd1d72bacc88a31e7606c4f0729ead8629d2aa39eca948c88
 
 def _typecheckingstub__7d8aafff2e2f314c1c4bef6e213f0aaef56ff294051b33fee835ad5716a7e093(
     *,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14219,6 +14718,7 @@ def _typecheckingstub__7d8aafff2e2f314c1c4bef6e213f0aaef56ff294051b33fee835ad571
 
 def _typecheckingstub__fde28a86ff967e860849eabd5d00b00f1f841ba2ded09e00655f2b7d433ef121(
     *,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14346,6 +14846,7 @@ def _typecheckingstub__003bfe5f4d042a69eceddde85ccfcfdb2e64aaea78e28426808804379
 
 def _typecheckingstub__4c4d8fda2e4860630073eda40d5a32347248e82c24127624ef93e735b071da8f(
     *,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14362,6 +14863,7 @@ def _typecheckingstub__4c4d8fda2e4860630073eda40d5a32347248e82c24127624ef93e735b
 
 def _typecheckingstub__7cba9d5464f3f4cbc208d892995245e5078fc2cc794651c71942035a9b151b2e(
     *,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14371,6 +14873,7 @@ def _typecheckingstub__7cba9d5464f3f4cbc208d892995245e5078fc2cc794651c71942035a9
     validators: typing.Optional[typing.Sequence[IValidator]] = None,
     application: IApplication,
     content: ConfigurationContent,
+    kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     latest_version_number: typing.Optional[jsii.Number] = None,
     version_label: typing.Optional[builtins.str] = None,
 ) -> None:
@@ -14406,6 +14909,7 @@ def _typecheckingstub__3bd9df804b6975de3426c197a45965f129649a986f5cd9a03f0a4ee6f
     content: ConfigurationContent,
     latest_version_number: typing.Optional[jsii.Number] = None,
     version_label: typing.Optional[builtins.str] = None,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14421,8 +14925,9 @@ def _typecheckingstub__652068ebd01467de1bc3159a4c8fef165c1053fe6662fcbb6e0b8cb9f
     id: builtins.str,
     *,
     location: ConfigurationSource,
-    retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+    retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
     version_number: typing.Optional[builtins.str] = None,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14797,7 +15302,7 @@ def _typecheckingstub__a245d9ad2d5a72963867d7f392bf31c9977c87f33b0ba8389f1024ee4
 
 def _typecheckingstub__ccc59f1c5523364b8528526a5b6087774df2b905407caca37b7c685a5bfb76cb(
     alarm: _IAlarm_ff3eabc0,
-    alarm_role: typing.Optional[_IRole_235f5d8e] = None,
+    alarm_role: typing.Optional[_IRoleRef_8400221f] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -14838,9 +15343,10 @@ def _typecheckingstub__61200a738f2584e5d86190492c99ded9cebb5cc41d230eec1c74f7130
     id: builtins.str,
     *,
     location: ConfigurationSource,
-    retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+    retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
     version_number: typing.Optional[builtins.str] = None,
     application: IApplication,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14970,8 +15476,15 @@ def _typecheckingstub__af782e66a589643c3273915140536d8c7931cca7f2adf6a0fc45e67b9
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__ff7730984215a53f88ccb3e1915941985bedc75f6b24a06eae12d583d8f4bca9(
+    value: typing.Optional[DeletionProtectionCheck],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__115deabe7a02ce295c431e7d9a99bcbe112bc017436380d80181c5db491187a1(
     *,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14980,7 +15493,7 @@ def _typecheckingstub__115deabe7a02ce295c431e7d9a99bcbe112bc017436380d80181c5db4
     type: typing.Optional[ConfigurationType] = None,
     validators: typing.Optional[typing.Sequence[IValidator]] = None,
     location: ConfigurationSource,
-    retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+    retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
     version_number: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -14988,6 +15501,7 @@ def _typecheckingstub__115deabe7a02ce295c431e7d9a99bcbe112bc017436380d80181c5db4
 
 def _typecheckingstub__d41101d1b0f699a52d44a2b86fe3e9dcd0e6f1487f088908464eb49cb3e5e12c(
     *,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -14997,7 +15511,7 @@ def _typecheckingstub__d41101d1b0f699a52d44a2b86fe3e9dcd0e6f1487f088908464eb49cb
     validators: typing.Optional[typing.Sequence[IValidator]] = None,
     application: IApplication,
     location: ConfigurationSource,
-    retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+    retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
     version_number: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -15077,6 +15591,7 @@ def _typecheckingstub__7b18310538532e3e3e53af99bb5da0c248186673a38a5175633a0149c
     content: ConfigurationContent,
     latest_version_number: typing.Optional[jsii.Number] = None,
     version_label: typing.Optional[builtins.str] = None,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -15092,8 +15607,9 @@ def _typecheckingstub__8c0399b30aac3a09a4a5e9f3f33f358c90afa60099a7dd6cfc1f1b40f
     id: builtins.str,
     *,
     location: ConfigurationSource,
-    retrieval_role: typing.Optional[_IRole_235f5d8e] = None,
+    retrieval_role: typing.Optional[_IRoleRef_8400221f] = None,
     version_number: typing.Optional[builtins.str] = None,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -15575,9 +16091,11 @@ def _typecheckingstub__8e7eecc550d3d689f07534db869c7be67f00e08dcbf880bbb2656d019
     id: builtins.str,
     *,
     content: ConfigurationContent,
+    kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     latest_version_number: typing.Optional[jsii.Number] = None,
     version_label: typing.Optional[builtins.str] = None,
     application: IApplication,
+    deletion_protection_check: typing.Optional[DeletionProtectionCheck] = None,
     deployment_key: typing.Optional[_IKey_5f11635f] = None,
     deployment_strategy: typing.Optional[IDeploymentStrategy] = None,
     deploy_to: typing.Optional[typing.Sequence[IEnvironment]] = None,
@@ -15706,3 +16224,12 @@ def _typecheckingstub__27c25acd80a9bdc9870365bad92556272569854dc957ad7cdf2b6e5a2
 ) -> None:
     """Type checking stubs"""
     pass
+
+def _typecheckingstub__0a1e6913f9293558fa6d2222b6d11c3af6b25866b966dd6319551117306cf272(
+    value: typing.Optional[DeletionProtectionCheck],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+for cls in [IApplication, IConfiguration, IDeploymentStrategy, IEnvironment, IEventDestination, IExtensible, IExtension, IValidator]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])