aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_qbusiness/__init__.py

@@ -77,9 +77,27 @@ from .. import (
     TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
+from ..interfaces.aws_qbusiness import (
+    ApplicationReference as _ApplicationReference_a28950f9,
+    DataAccessorReference as _DataAccessorReference_bfa88236,
+    DataSourceReference as _DataSourceReference_1d701f00,
+    IApplicationRef as _IApplicationRef_3d9bfeca,
+    IDataAccessorRef as _IDataAccessorRef_78efaa5d,
+    IDataSourceRef as _IDataSourceRef_6971c570,
+    IIndexRef as _IIndexRef_f140f6cd,
+    IPermissionRef as _IPermissionRef_76f5df1e,
+    IPluginRef as _IPluginRef_68a8bf0a,
+    IRetrieverRef as _IRetrieverRef_e52248d3,
+    IWebExperienceRef as _IWebExperienceRef_8c51af85,
+    IndexReference as _IndexReference_3b8fe006,
+    PermissionReference as _PermissionReference_04c3d6e6,
+    PluginReference as _PluginReference_3fa6cf2e,
+    RetrieverReference as _RetrieverReference_5ca01e76,
+    WebExperienceReference as _WebExperienceReference_31dff9d1,
+)
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IApplicationRef_3d9bfeca, _ITaggableV2_4e6798f8)
 class CfnApplication(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -163,7 +181,8 @@ class CfnApplication(
         role_arn: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::Application``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param display_name: The name of the Amazon Q Business application.
@@ -177,7 +196,7 @@ class CfnApplication(
         :param identity_type: The authentication type being used by a Amazon Q Business application.
         :param personalization_configuration: Configuration information about chat response personalization. For more information, see `Personalizing chat responses <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/personalizing-chat-responses.html>`_ .
         :param q_apps_configuration: Configuration information about Amazon Q Apps.
-        :param quick_sight_configuration: The Amazon QuickSight configuration for an Amazon Q Business application that uses QuickSight as the identity provider.
+        :param quick_sight_configuration: The Amazon Quick Suite configuration for an Amazon Q Business application that uses Quick Suite as the identity provider.
         :param role_arn: The Amazon Resource Name (ARN) of an IAM role with permissions to access your Amazon CloudWatch logs and metrics. If this property is not specified, Amazon Q Business will create a `service linked role (SLR) <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/using-service-linked-roles.html#slr-permissions>`_ and use it as the application's role.
         :param tags: A list of key-value pairs that identify or categorize your Amazon Q Business application. You can also use tags to help control access to the application. Tag keys and values can consist of Unicode letters, digits, white space, and any of the following symbols: _ . : / = + -
         '''
@@ -204,6 +223,48 @@ class CfnApplication(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromApplicationArn")
+    @builtins.classmethod
+    def from_application_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IApplicationRef_3d9bfeca:
+        '''Creates a new IApplicationRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__7588037e663dbdf7e96cc384972e8ccf5a8f2b0ce464c77da36d747c5af4230b)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IApplicationRef_3d9bfeca, jsii.sinvoke(cls, "fromApplicationArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromApplicationId")
+    @builtins.classmethod
+    def from_application_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        application_id: builtins.str,
+    ) -> _IApplicationRef_3d9bfeca:
+        '''Creates a new IApplicationRef from a applicationId.
+
+        :param scope: -
+        :param id: -
+        :param application_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4437623b0c0426c55908d2b586e92137def40e9d7f5f7f4c722a1f1d09bf72f6)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
+        return typing.cast(_IApplicationRef_3d9bfeca, jsii.sinvoke(cls, "fromApplicationId", [scope, id, application_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -234,6 +295,12 @@ class CfnApplication(
         '''The CloudFormation resource type name for this resource class.'''
         return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
+    @builtins.property
+    @jsii.member(jsii_name="applicationRef")
+    def application_ref(self) -> _ApplicationReference_a28950f9:
+        '''A reference to a Application resource.'''
+        return typing.cast(_ApplicationReference_a28950f9, jsii.get(self, "applicationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="attrApplicationArn")
     def attr_application_arn(self) -> builtins.str:
@@ -480,7 +547,7 @@ class CfnApplication(
     def quick_sight_configuration(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnApplication.QuickSightConfigurationProperty"]]:
-        '''The Amazon QuickSight configuration for an Amazon Q Business application that uses QuickSight as the identity provider.'''
+        '''The Amazon Quick Suite configuration for an Amazon Q Business application that uses Quick Suite as the identity provider.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnApplication.QuickSightConfigurationProperty"]], jsii.get(self, "quickSightConfiguration"))
 
     @quick_sight_configuration.setter
@@ -817,11 +884,11 @@ class CfnApplication(
     )
     class QuickSightConfigurationProperty:
         def __init__(self, *, client_namespace: builtins.str) -> None:
-            '''The Amazon QuickSight configuration for an Amazon Q Business application that uses QuickSight as the identity provider.
+            '''The Amazon Quick Suite configuration for an Amazon Q Business application that uses Quick Suite as the identity provider.
 
-            For more information, see `Creating an Amazon QuickSight integrated application <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-quicksight-integrated-application.html>`_ .
+            For more information, see `Creating an Amazon Quick Suite integrated application <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-quicksight-integrated-application.html>`_ .
 
-            :param client_namespace: The Amazon QuickSight namespace that is used as the identity provider. For more information about QuickSight namespaces, see `Namespace operations <https://docs.aws.amazon.com/quicksight/latest/developerguide/namespace-operations.html>`_ .
+            :param client_namespace: The Amazon Quick Suite namespace that is used as the identity provider. For more information about Quick Suite namespaces, see `Namespace operations <https://docs.aws.amazon.com/quicksight/latest/developerguide/namespace-operations.html>`_ .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-application-quicksightconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -845,9 +912,9 @@ class CfnApplication(
 
         @builtins.property
         def client_namespace(self) -> builtins.str:
-            '''The Amazon QuickSight namespace that is used as the identity provider.
+            '''The Amazon Quick Suite namespace that is used as the identity provider.
 
-            For more information about QuickSight namespaces, see `Namespace operations <https://docs.aws.amazon.com/quicksight/latest/developerguide/namespace-operations.html>`_ .
+            For more information about Quick Suite namespaces, see `Namespace operations <https://docs.aws.amazon.com/quicksight/latest/developerguide/namespace-operations.html>`_ .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-application-quicksightconfiguration.html#cfn-qbusiness-application-quicksightconfiguration-clientnamespace
             '''
@@ -919,7 +986,7 @@ class CfnApplicationProps:
         :param identity_type: The authentication type being used by a Amazon Q Business application.
         :param personalization_configuration: Configuration information about chat response personalization. For more information, see `Personalizing chat responses <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/personalizing-chat-responses.html>`_ .
         :param q_apps_configuration: Configuration information about Amazon Q Apps.
-        :param quick_sight_configuration: The Amazon QuickSight configuration for an Amazon Q Business application that uses QuickSight as the identity provider.
+        :param quick_sight_configuration: The Amazon Quick Suite configuration for an Amazon Q Business application that uses Quick Suite as the identity provider.
         :param role_arn: The Amazon Resource Name (ARN) of an IAM role with permissions to access your Amazon CloudWatch logs and metrics. If this property is not specified, Amazon Q Business will create a `service linked role (SLR) <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/using-service-linked-roles.html#slr-permissions>`_ and use it as the application's role.
         :param tags: A list of key-value pairs that identify or categorize your Amazon Q Business application. You can also use tags to help control access to the application. Tag keys and values can consist of Unicode letters, digits, white space, and any of the following symbols: _ . : / = + -
 
@@ -1135,7 +1202,7 @@ class CfnApplicationProps:
     def quick_sight_configuration(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnApplication.QuickSightConfigurationProperty]]:
-        '''The Amazon QuickSight configuration for an Amazon Q Business application that uses QuickSight as the identity provider.
+        '''The Amazon Quick Suite configuration for an Amazon Q Business application that uses Quick Suite as the identity provider.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-application.html#cfn-qbusiness-application-quicksightconfiguration
         '''
@@ -1177,7 +1244,7 @@ class CfnApplicationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IDataAccessorRef_78efaa5d, _ITaggableV2_4e6798f8)
 class CfnDataAccessor(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1280,6 +1347,17 @@ class CfnDataAccessor(
             principal="principal",
         
             # the properties below are optional
+            authentication_detail=qbusiness.CfnDataAccessor.DataAccessorAuthenticationDetailProperty(
+                authentication_type="authenticationType",
+        
+                # the properties below are optional
+                authentication_configuration=qbusiness.CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty(
+                    idc_trusted_token_issuer_configuration=qbusiness.CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty(
+                        idc_trusted_token_issuer_arn="idcTrustedTokenIssuerArn"
+                    )
+                ),
+                external_ids=["externalIds"]
+            ),
             tags=[CfnTag(
                 key="key",
                 value="value"
@@ -1296,15 +1374,18 @@ class CfnDataAccessor(
         application_id: builtins.str,
         display_name: builtins.str,
         principal: builtins.str,
+        authentication_detail: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDataAccessor.DataAccessorAuthenticationDetailProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::DataAccessor``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param action_configurations: A list of action configurations specifying the allowed actions and any associated filters.
         :param application_id: The unique identifier of the Amazon Q Business application.
         :param display_name: The friendly name of the data accessor.
         :param principal: The Amazon Resource Name (ARN) of the IAM role for the ISV associated with this data accessor.
+        :param authentication_detail: The authentication configuration details for the data accessor. This specifies how the ISV authenticates when accessing data through this data accessor.
         :param tags: The tags to associate with the data accessor.
         '''
         if __debug__:
@@ -1316,6 +1397,7 @@ class CfnDataAccessor(
             application_id=application_id,
             display_name=display_name,
             principal=principal,
+            authentication_detail=authentication_detail,
             tags=tags,
         )
 
@@ -1407,6 +1489,12 @@ class CfnDataAccessor(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="dataAccessorRef")
+    def data_accessor_ref(self) -> _DataAccessorReference_bfa88236:
+        '''A reference to a DataAccessor resource.'''
+        return typing.cast(_DataAccessorReference_bfa88236, jsii.get(self, "dataAccessorRef"))
+
     @builtins.property
     @jsii.member(jsii_name="actionConfigurations")
     def action_configurations(
@@ -1464,6 +1552,24 @@ class CfnDataAccessor(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "principal", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="authenticationDetail")
+    def authentication_detail(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDataAccessor.DataAccessorAuthenticationDetailProperty"]]:
+        '''The authentication configuration details for the data accessor.'''
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDataAccessor.DataAccessorAuthenticationDetailProperty"]], jsii.get(self, "authenticationDetail"))
+
+    @authentication_detail.setter
+    def authentication_detail(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDataAccessor.DataAccessorAuthenticationDetailProperty"]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__8aa34af043257e0411af6e09ebeda77531edcaba51ad9fd392b4515b8c730792)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "authenticationDetail", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
@@ -2044,6 +2150,227 @@ class CfnDataAccessor(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_qbusiness.CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "idc_trusted_token_issuer_configuration": "idcTrustedTokenIssuerConfiguration",
+        },
+    )
+    class DataAccessorAuthenticationConfigurationProperty:
+        def __init__(
+            self,
+            *,
+            idc_trusted_token_issuer_configuration: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty", typing.Dict[builtins.str, typing.Any]]],
+        ) -> None:
+            '''A union type that contains the specific authentication configuration based on the authentication type selected.
+
+            :param idc_trusted_token_issuer_configuration: Configuration for IAM Identity Center Trusted Token Issuer (TTI) authentication used when the authentication type is ``AWS_IAM_IDC_TTI`` .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessorauthenticationconfiguration.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_qbusiness as qbusiness
+                
+                data_accessor_authentication_configuration_property = qbusiness.CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty(
+                    idc_trusted_token_issuer_configuration=qbusiness.CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty(
+                        idc_trusted_token_issuer_arn="idcTrustedTokenIssuerArn"
+                    )
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__5026e300a407a951a2bf85ba48cf1646fb1b1672f84f2ea26974311fd2b650de)
+                check_type(argname="argument idc_trusted_token_issuer_configuration", value=idc_trusted_token_issuer_configuration, expected_type=type_hints["idc_trusted_token_issuer_configuration"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "idc_trusted_token_issuer_configuration": idc_trusted_token_issuer_configuration,
+            }
+
+        @builtins.property
+        def idc_trusted_token_issuer_configuration(
+            self,
+        ) -> typing.Union[_IResolvable_da3f097b, "CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty"]:
+            '''Configuration for IAM Identity Center Trusted Token Issuer (TTI) authentication used when the authentication type is ``AWS_IAM_IDC_TTI`` .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessorauthenticationconfiguration.html#cfn-qbusiness-dataaccessor-dataaccessorauthenticationconfiguration-idctrustedtokenissuerconfiguration
+            '''
+            result = self._values.get("idc_trusted_token_issuer_configuration")
+            assert result is not None, "Required property 'idc_trusted_token_issuer_configuration' is missing"
+            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty"], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "DataAccessorAuthenticationConfigurationProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_qbusiness.CfnDataAccessor.DataAccessorAuthenticationDetailProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "authentication_type": "authenticationType",
+            "authentication_configuration": "authenticationConfiguration",
+            "external_ids": "externalIds",
+        },
+    )
+    class DataAccessorAuthenticationDetailProperty:
+        def __init__(
+            self,
+            *,
+            authentication_type: builtins.str,
+            authentication_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            external_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
+        ) -> None:
+            '''Contains the authentication configuration details for a data accessor.
+
+            This structure defines how the ISV authenticates when accessing data through the data accessor.
+
+            :param authentication_type: The type of authentication to use for the data accessor. This determines how the ISV authenticates when accessing data. You can use one of two authentication types: - ``AWS_IAM_IDC_TTI`` - Authentication using IAM Identity Center Trusted Token Issuer (TTI). This authentication type allows the ISV to use a trusted token issuer to generate tokens for accessing the data. - ``AWS_IAM_IDC_AUTH_CODE`` - Authentication using IAM Identity Center authorization code flow. This authentication type uses the standard OAuth 2.0 authorization code flow for authentication.
+            :param authentication_configuration: The specific authentication configuration based on the authentication type.
+            :param external_ids: A list of external identifiers associated with this authentication configuration. These are used to correlate the data accessor with external systems.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessorauthenticationdetail.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_qbusiness as qbusiness
+                
+                data_accessor_authentication_detail_property = qbusiness.CfnDataAccessor.DataAccessorAuthenticationDetailProperty(
+                    authentication_type="authenticationType",
+                
+                    # the properties below are optional
+                    authentication_configuration=qbusiness.CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty(
+                        idc_trusted_token_issuer_configuration=qbusiness.CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty(
+                            idc_trusted_token_issuer_arn="idcTrustedTokenIssuerArn"
+                        )
+                    ),
+                    external_ids=["externalIds"]
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__ce3d0eb33f705ecbcd9b23e1fae7014cc8010d410a8398ce3feea55694ebed37)
+                check_type(argname="argument authentication_type", value=authentication_type, expected_type=type_hints["authentication_type"])
+                check_type(argname="argument authentication_configuration", value=authentication_configuration, expected_type=type_hints["authentication_configuration"])
+                check_type(argname="argument external_ids", value=external_ids, expected_type=type_hints["external_ids"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "authentication_type": authentication_type,
+            }
+            if authentication_configuration is not None:
+                self._values["authentication_configuration"] = authentication_configuration
+            if external_ids is not None:
+                self._values["external_ids"] = external_ids
+
+        @builtins.property
+        def authentication_type(self) -> builtins.str:
+            '''The type of authentication to use for the data accessor.
+
+            This determines how the ISV authenticates when accessing data. You can use one of two authentication types:
+
+            - ``AWS_IAM_IDC_TTI`` - Authentication using IAM Identity Center Trusted Token Issuer (TTI). This authentication type allows the ISV to use a trusted token issuer to generate tokens for accessing the data.
+            - ``AWS_IAM_IDC_AUTH_CODE`` - Authentication using IAM Identity Center authorization code flow. This authentication type uses the standard OAuth 2.0 authorization code flow for authentication.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessorauthenticationdetail.html#cfn-qbusiness-dataaccessor-dataaccessorauthenticationdetail-authenticationtype
+            '''
+            result = self._values.get("authentication_type")
+            assert result is not None, "Required property 'authentication_type' is missing"
+            return typing.cast(builtins.str, result)
+
+        @builtins.property
+        def authentication_configuration(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty"]]:
+            '''The specific authentication configuration based on the authentication type.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessorauthenticationdetail.html#cfn-qbusiness-dataaccessor-dataaccessorauthenticationdetail-authenticationconfiguration
+            '''
+            result = self._values.get("authentication_configuration")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty"]], result)
+
+        @builtins.property
+        def external_ids(self) -> typing.Optional[typing.List[builtins.str]]:
+            '''A list of external identifiers associated with this authentication configuration.
+
+            These are used to correlate the data accessor with external systems.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessorauthenticationdetail.html#cfn-qbusiness-dataaccessor-dataaccessorauthenticationdetail-externalids
+            '''
+            result = self._values.get("external_ids")
+            return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "DataAccessorAuthenticationDetailProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_qbusiness.CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty",
+        jsii_struct_bases=[],
+        name_mapping={"idc_trusted_token_issuer_arn": "idcTrustedTokenIssuerArn"},
+    )
+    class DataAccessorIdcTrustedTokenIssuerConfigurationProperty:
+        def __init__(self, *, idc_trusted_token_issuer_arn: builtins.str) -> None:
+            '''Configuration details for IAM Identity Center Trusted Token Issuer (TTI) authentication.
+
+            :param idc_trusted_token_issuer_arn: The Amazon Resource Name (ARN) of the IAM Identity Center Trusted Token Issuer that will be used for authentication.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessoridctrustedtokenissuerconfiguration.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_qbusiness as qbusiness
+                
+                data_accessor_idc_trusted_token_issuer_configuration_property = qbusiness.CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty(
+                    idc_trusted_token_issuer_arn="idcTrustedTokenIssuerArn"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__aa8bef9d39508faf93f48a0365a4605be496aa8cf95d29ab54e4ceabbabaef4d)
+                check_type(argname="argument idc_trusted_token_issuer_arn", value=idc_trusted_token_issuer_arn, expected_type=type_hints["idc_trusted_token_issuer_arn"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "idc_trusted_token_issuer_arn": idc_trusted_token_issuer_arn,
+            }
+
+        @builtins.property
+        def idc_trusted_token_issuer_arn(self) -> builtins.str:
+            '''The Amazon Resource Name (ARN) of the IAM Identity Center Trusted Token Issuer that will be used for authentication.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-dataaccessor-dataaccessoridctrustedtokenissuerconfiguration.html#cfn-qbusiness-dataaccessor-dataaccessoridctrustedtokenissuerconfiguration-idctrustedtokenissuerarn
+            '''
+            result = self._values.get("idc_trusted_token_issuer_arn")
+            assert result is not None, "Required property 'idc_trusted_token_issuer_arn' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "DataAccessorIdcTrustedTokenIssuerConfigurationProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_qbusiness.CfnDataAccessor.DocumentAttributeProperty",
         jsii_struct_bases=[],
@@ -2240,6 +2567,7 @@ class CfnDataAccessor(
         "application_id": "applicationId",
         "display_name": "displayName",
         "principal": "principal",
+        "authentication_detail": "authenticationDetail",
         "tags": "tags",
     },
 )
@@ -2251,6 +2579,7 @@ class CfnDataAccessorProps:
         application_id: builtins.str,
         display_name: builtins.str,
         principal: builtins.str,
+        authentication_detail: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDataAccessor.DataAccessorAuthenticationDetailProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''Properties for defining a ``CfnDataAccessor``.
@@ -2259,6 +2588,7 @@ class CfnDataAccessorProps:
         :param application_id: The unique identifier of the Amazon Q Business application.
         :param display_name: The friendly name of the data accessor.
         :param principal: The Amazon Resource Name (ARN) of the IAM role for the ISV associated with this data accessor.
+        :param authentication_detail: The authentication configuration details for the data accessor. This specifies how the ISV authenticates when accessing data through this data accessor.
         :param tags: The tags to associate with the data accessor.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-dataaccessor.html
@@ -2353,6 +2683,17 @@ class CfnDataAccessorProps:
                 principal="principal",
             
                 # the properties below are optional
+                authentication_detail=qbusiness.CfnDataAccessor.DataAccessorAuthenticationDetailProperty(
+                    authentication_type="authenticationType",
+            
+                    # the properties below are optional
+                    authentication_configuration=qbusiness.CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty(
+                        idc_trusted_token_issuer_configuration=qbusiness.CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty(
+                            idc_trusted_token_issuer_arn="idcTrustedTokenIssuerArn"
+                        )
+                    ),
+                    external_ids=["externalIds"]
+                ),
                 tags=[CfnTag(
                     key="key",
                     value="value"
@@ -2365,6 +2706,7 @@ class CfnDataAccessorProps:
             check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
             check_type(argname="argument display_name", value=display_name, expected_type=type_hints["display_name"])
             check_type(argname="argument principal", value=principal, expected_type=type_hints["principal"])
+            check_type(argname="argument authentication_detail", value=authentication_detail, expected_type=type_hints["authentication_detail"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "action_configurations": action_configurations,
@@ -2372,6 +2714,8 @@ class CfnDataAccessorProps:
             "display_name": display_name,
             "principal": principal,
         }
+        if authentication_detail is not None:
+            self._values["authentication_detail"] = authentication_detail
         if tags is not None:
             self._values["tags"] = tags
 
@@ -2417,6 +2761,19 @@ class CfnDataAccessorProps:
         assert result is not None, "Required property 'principal' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def authentication_detail(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDataAccessor.DataAccessorAuthenticationDetailProperty]]:
+        '''The authentication configuration details for the data accessor.
+
+        This specifies how the ISV authenticates when accessing data through this data accessor.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-dataaccessor.html#cfn-qbusiness-dataaccessor-authenticationdetail
+        '''
+        result = self._values.get("authentication_detail")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDataAccessor.DataAccessorAuthenticationDetailProperty]], result)
+
     @builtins.property
     def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
         '''The tags to associate with the data accessor.
@@ -2438,7 +2795,7 @@ class CfnDataAccessorProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IDataSourceRef_6971c570, _ITaggableV2_4e6798f8)
 class CfnDataSource(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2572,7 +2929,8 @@ class CfnDataSource(
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         vpc_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDataSource.DataSourceVpcConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::DataSource``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The identifier of the Amazon Q Business application the data source will be attached to.
@@ -2582,7 +2940,7 @@ class CfnDataSource(
         :param description: A description for the data source connector.
         :param document_enrichment_configuration: Provides the configuration information for altering document metadata and content during the document ingestion process. For more information, see `Custom document enrichment <https://docs.aws.amazon.com/amazonq/latest/business-use-dg/custom-document-enrichment.html>`_ .
         :param media_extraction_configuration: The configuration for extracting information from media in documents.
-        :param role_arn: The Amazon Resource Name (ARN) of an IAM role with permission to access the data source and required resources.
+        :param role_arn: The Amazon Resource Name (ARN) of an IAM role with permission to access the data source and required resources. This field is required for all connector types except custom connectors, where it is optional.
         :param sync_schedule: Sets the frequency for Amazon Q Business to check the documents in your data source repository and update your index. If you don't set a schedule, Amazon Q Business won't periodically update the index. Specify a ``cron-`` format schedule string or an empty string to indicate that the index is updated on demand. You can't specify the ``Schedule`` parameter when the ``Type`` parameter is set to ``CUSTOM`` . If you do, you receive a ``ValidationException`` exception.
         :param tags: A list of key-value pairs that identify or categorize the data source connector. You can also use tags to help control access to the data source connector. Tag keys and values can consist of Unicode letters, digits, white space, and any of the following symbols: _ . : / = + -
         :param vpc_configuration: Configuration information for an Amazon VPC (Virtual Private Cloud) to connect to your data source. For more information, see `Using Amazon VPC with Amazon Q Business connectors <https://docs.aws.amazon.com/amazonq/latest/business-use-dg/connector-vpc.html>`_ .
@@ -2702,6 +3060,12 @@ class CfnDataSource(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="dataSourceRef")
+    def data_source_ref(self) -> _DataSourceReference_1d701f00:
+        '''A reference to a DataSource resource.'''
+        return typing.cast(_DataSourceReference_1d701f00, jsii.get(self, "dataSourceRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -3510,7 +3874,7 @@ class CfnDataSource(
             For more information, see `Custom document enrichment <https://docs.aws.amazon.com/amazonq/latest/business-use-dg/custom-document-enrichment.html>`_ .
 
             :param invocation_condition: The condition used for when a Lambda function should be invoked. For example, you can specify a condition that if there are empty date-time values, then Amazon Q Business should invoke a function that inserts the current date-time.
-            :param lambda_arn: The Amazon Resource Name (ARN) of the Lambda function sduring ingestion. For more information, see `Using Lambda functions for Amazon Q Business document enrichment <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/cde-lambda-operations.html>`_ .
+            :param lambda_arn: The Amazon Resource Name (ARN) of the Lambda function during ingestion. For more information, see `Using Lambda functions for Amazon Q Business document enrichment <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/cde-lambda-operations.html>`_ .
             :param role_arn: The Amazon Resource Name (ARN) of a role with permission to run ``PreExtractionHookConfiguration`` and ``PostExtractionHookConfiguration`` for altering document metadata and content during the document ingestion process.
             :param s3_bucket_name: Stores the original, raw documents or the structured, parsed documents before and after altering them. For more information, see `Data contracts for Lambda functions <https://docs.aws.amazon.com/amazonq/latest/business-use-dg/cde-lambda-operations.html#cde-lambda-operations-data-contracts>`_ .
 
@@ -3572,7 +3936,7 @@ class CfnDataSource(
 
         @builtins.property
         def lambda_arn(self) -> typing.Optional[builtins.str]:
-            '''The Amazon Resource Name (ARN) of the Lambda function sduring ingestion.
+            '''The Amazon Resource Name (ARN) of the Lambda function during ingestion.
 
             For more information, see `Using Lambda functions for Amazon Q Business document enrichment <https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/cde-lambda-operations.html>`_ .
 
@@ -3985,7 +4349,7 @@ class CfnDataSourceProps:
         :param description: A description for the data source connector.
         :param document_enrichment_configuration: Provides the configuration information for altering document metadata and content during the document ingestion process. For more information, see `Custom document enrichment <https://docs.aws.amazon.com/amazonq/latest/business-use-dg/custom-document-enrichment.html>`_ .
         :param media_extraction_configuration: The configuration for extracting information from media in documents.
-        :param role_arn: The Amazon Resource Name (ARN) of an IAM role with permission to access the data source and required resources.
+        :param role_arn: The Amazon Resource Name (ARN) of an IAM role with permission to access the data source and required resources. This field is required for all connector types except custom connectors, where it is optional.
         :param sync_schedule: Sets the frequency for Amazon Q Business to check the documents in your data source repository and update your index. If you don't set a schedule, Amazon Q Business won't periodically update the index. Specify a ``cron-`` format schedule string or an empty string to indicate that the index is updated on demand. You can't specify the ``Schedule`` parameter when the ``Type`` parameter is set to ``CUSTOM`` . If you do, you receive a ``ValidationException`` exception.
         :param tags: A list of key-value pairs that identify or categorize the data source connector. You can also use tags to help control access to the data source connector. Tag keys and values can consist of Unicode letters, digits, white space, and any of the following symbols: _ . : / = + -
         :param vpc_configuration: Configuration information for an Amazon VPC (Virtual Private Cloud) to connect to your data source. For more information, see `Using Amazon VPC with Amazon Q Business connectors <https://docs.aws.amazon.com/amazonq/latest/business-use-dg/connector-vpc.html>`_ .
@@ -4218,6 +4582,8 @@ class CfnDataSourceProps:
     def role_arn(self) -> typing.Optional[builtins.str]:
         '''The Amazon Resource Name (ARN) of an IAM role with permission to access the data source and required resources.
 
+        This field is required for all connector types except custom connectors, where it is optional.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-datasource.html#cfn-qbusiness-datasource-rolearn
         '''
         result = self._values.get("role_arn")
@@ -4273,7 +4639,7 @@ class CfnDataSourceProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IIndexRef_f140f6cd, _ITaggableV2_4e6798f8)
 class CfnIndex(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -4330,7 +4696,8 @@ class CfnIndex(
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         type: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::Index``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The identifier of the Amazon Q Business application using the index.
@@ -4453,6 +4820,12 @@ class CfnIndex(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="indexRef")
+    def index_ref(self) -> _IndexReference_3b8fe006:
+        '''A reference to a Index resource.'''
+        return typing.cast(_IndexReference_3b8fe006, jsii.get(self, "indexRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -5009,7 +5382,7 @@ class CfnIndexProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IPermissionRef_76f5df1e)
 class CfnPermission(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -5033,7 +5406,14 @@ class CfnPermission(
             actions=["actions"],
             application_id="applicationId",
             principal="principal",
-            statement_id="statementId"
+            statement_id="statementId",
+        
+            # the properties below are optional
+            conditions=[qbusiness.CfnPermission.ConditionProperty(
+                condition_key="conditionKey",
+                condition_operator="conditionOperator",
+                condition_values=["conditionValues"]
+            )]
         )
     '''
 
@@ -5046,14 +5426,17 @@ class CfnPermission(
         application_id: builtins.str,
         principal: builtins.str,
         statement_id: builtins.str,
+        conditions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPermission.ConditionProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::Permission``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param actions: The list of Amazon Q Business actions that the ISV is allowed to perform.
         :param application_id: The unique identifier of the Amazon Q Business application.
         :param principal: Provides user and group information used for filtering documents to use for generating Amazon Q Business conversation responses.
         :param statement_id: A unique identifier for the policy statement.
+        :param conditions: 
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__aa8b9992ffebedf4dda280be4bd0aa5dade8d62a6c092d850b1b1bb8df042ee8)
@@ -5064,6 +5447,7 @@ class CfnPermission(
             application_id=application_id,
             principal=principal,
             statement_id=statement_id,
+            conditions=conditions,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
@@ -5103,6 +5487,12 @@ class CfnPermission(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="permissionRef")
+    def permission_ref(self) -> _PermissionReference_04c3d6e6:
+        '''A reference to a Permission resource.'''
+        return typing.cast(_PermissionReference_04c3d6e6, jsii.get(self, "permissionRef"))
+
     @builtins.property
     @jsii.member(jsii_name="actions")
     def actions(self) -> typing.List[builtins.str]:
@@ -5155,6 +5545,109 @@ class CfnPermission(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "statementId", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="conditions")
+    def conditions(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnPermission.ConditionProperty"]]]]:
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnPermission.ConditionProperty"]]]], jsii.get(self, "conditions"))
+
+    @conditions.setter
+    def conditions(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnPermission.ConditionProperty"]]]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__df7eedd7834a134466643c8bd40b7906fe6b7fcc7f482e5265aec4bb05607f6a)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "conditions", value) # pyright: ignore[reportArgumentType]
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_qbusiness.CfnPermission.ConditionProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "condition_key": "conditionKey",
+            "condition_operator": "conditionOperator",
+            "condition_values": "conditionValues",
+        },
+    )
+    class ConditionProperty:
+        def __init__(
+            self,
+            *,
+            condition_key: builtins.str,
+            condition_operator: builtins.str,
+            condition_values: typing.Sequence[builtins.str],
+        ) -> None:
+            '''
+            :param condition_key: 
+            :param condition_operator: 
+            :param condition_values: 
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-permission-condition.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_qbusiness as qbusiness
+                
+                condition_property = qbusiness.CfnPermission.ConditionProperty(
+                    condition_key="conditionKey",
+                    condition_operator="conditionOperator",
+                    condition_values=["conditionValues"]
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__39a9bd842be75583d990f7774438e331f4161b57ee4d98a449b293c0e014f90d)
+                check_type(argname="argument condition_key", value=condition_key, expected_type=type_hints["condition_key"])
+                check_type(argname="argument condition_operator", value=condition_operator, expected_type=type_hints["condition_operator"])
+                check_type(argname="argument condition_values", value=condition_values, expected_type=type_hints["condition_values"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "condition_key": condition_key,
+                "condition_operator": condition_operator,
+                "condition_values": condition_values,
+            }
+
+        @builtins.property
+        def condition_key(self) -> builtins.str:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-permission-condition.html#cfn-qbusiness-permission-condition-conditionkey
+            '''
+            result = self._values.get("condition_key")
+            assert result is not None, "Required property 'condition_key' is missing"
+            return typing.cast(builtins.str, result)
+
+        @builtins.property
+        def condition_operator(self) -> builtins.str:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-permission-condition.html#cfn-qbusiness-permission-condition-conditionoperator
+            '''
+            result = self._values.get("condition_operator")
+            assert result is not None, "Required property 'condition_operator' is missing"
+            return typing.cast(builtins.str, result)
+
+        @builtins.property
+        def condition_values(self) -> typing.List[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qbusiness-permission-condition.html#cfn-qbusiness-permission-condition-conditionvalues
+            '''
+            result = self._values.get("condition_values")
+            assert result is not None, "Required property 'condition_values' is missing"
+            return typing.cast(typing.List[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ConditionProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_qbusiness.CfnPermissionProps",
@@ -5164,6 +5657,7 @@ class CfnPermission(
         "application_id": "applicationId",
         "principal": "principal",
         "statement_id": "statementId",
+        "conditions": "conditions",
     },
 )
 class CfnPermissionProps:
@@ -5174,6 +5668,7 @@ class CfnPermissionProps:
         application_id: builtins.str,
         principal: builtins.str,
         statement_id: builtins.str,
+        conditions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPermission.ConditionProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
         '''Properties for defining a ``CfnPermission``.
 
@@ -5181,6 +5676,7 @@ class CfnPermissionProps:
         :param application_id: The unique identifier of the Amazon Q Business application.
         :param principal: Provides user and group information used for filtering documents to use for generating Amazon Q Business conversation responses.
         :param statement_id: A unique identifier for the policy statement.
+        :param conditions: 
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-permission.html
         :exampleMetadata: fixture=_generated
@@ -5195,7 +5691,14 @@ class CfnPermissionProps:
                 actions=["actions"],
                 application_id="applicationId",
                 principal="principal",
-                statement_id="statementId"
+                statement_id="statementId",
+            
+                # the properties below are optional
+                conditions=[qbusiness.CfnPermission.ConditionProperty(
+                    condition_key="conditionKey",
+                    condition_operator="conditionOperator",
+                    condition_values=["conditionValues"]
+                )]
             )
         '''
         if __debug__:
@@ -5204,12 +5707,15 @@ class CfnPermissionProps:
             check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
             check_type(argname="argument principal", value=principal, expected_type=type_hints["principal"])
             check_type(argname="argument statement_id", value=statement_id, expected_type=type_hints["statement_id"])
+            check_type(argname="argument conditions", value=conditions, expected_type=type_hints["conditions"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "actions": actions,
             "application_id": application_id,
             "principal": principal,
             "statement_id": statement_id,
         }
+        if conditions is not None:
+            self._values["conditions"] = conditions
 
     @builtins.property
     def actions(self) -> typing.List[builtins.str]:
@@ -5251,6 +5757,16 @@ class CfnPermissionProps:
         assert result is not None, "Required property 'statement_id' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def conditions(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnPermission.ConditionProperty]]]]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-permission.html#cfn-qbusiness-permission-conditions
+        '''
+        result = self._values.get("conditions")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnPermission.ConditionProperty]]]], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -5263,7 +5779,7 @@ class CfnPermissionProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IPluginRef_68a8bf0a, _ITaggableV2_4e6798f8)
 class CfnPlugin(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -5338,7 +5854,8 @@ class CfnPlugin(
         state: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::Plugin``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param auth_configuration: Authentication configuration information for an Amazon Q Business plugin.
@@ -5455,6 +5972,12 @@ class CfnPlugin(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="pluginRef")
+    def plugin_ref(self) -> _PluginReference_3fa6cf2e:
+        '''A reference to a Plugin resource.'''
+        return typing.cast(_PluginReference_3fa6cf2e, jsii.get(self, "pluginRef"))
+
     @builtins.property
     @jsii.member(jsii_name="authConfiguration")
     def auth_configuration(
@@ -6301,7 +6824,7 @@ class CfnPluginProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IRetrieverRef_e52248d3, _ITaggableV2_4e6798f8)
 class CfnRetriever(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -6353,7 +6876,8 @@ class CfnRetriever(
         role_arn: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::Retriever``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The identifier of the Amazon Q Business application using the retriever.
@@ -6464,6 +6988,12 @@ class CfnRetriever(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="retrieverRef")
+    def retriever_ref(self) -> _RetrieverReference_5ca01e76:
+        '''A reference to a Retriever resource.'''
+        return typing.cast(_RetrieverReference_5ca01e76, jsii.get(self, "retrieverRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -6889,7 +7419,7 @@ class CfnRetrieverProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IWebExperienceRef_8c51af85, _ITaggableV2_4e6798f8)
 class CfnWebExperience(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -6959,7 +7489,8 @@ class CfnWebExperience(
         title: typing.Optional[builtins.str] = None,
         welcome_message: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::QBusiness::WebExperience``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param application_id: The identifier of the Amazon Q Business web experience.
@@ -6967,7 +7498,7 @@ class CfnWebExperience(
         :param customization_configuration: Contains the configuration information to customize the logo, font, and color of an Amazon Q Business web experience with individual files for each property or a CSS file for them all.
         :param identity_provider_configuration: Provides information about the identity provider (IdP) used to authenticate end users of an Amazon Q Business web experience.
         :param origins: Sets the website domain origins that are allowed to embed the Amazon Q Business web experience. The *domain origin* refers to the base URL for accessing a website including the protocol ( ``http/https`` ), the domain name, and the port number (if specified). .. epigraph:: You must only submit a *base URL* and not a full path. For example, ``https://docs.aws.amazon.com`` .
-        :param role_arn: The Amazon Resource Name (ARN) of the service role attached to your web experience. .. epigraph:: You must provide this value if you're using IAM Identity Center to manage end user access to your application. If you're using legacy identity management to manage user access, you don't need to provide this value.
+        :param role_arn: The Amazon Resource Name (ARN) of the service role attached to your web experience. .. epigraph:: The ``roleArn`` parameter is required when your Amazon Q Business application is created with IAM Identity Center. It is not required for SAML-based applications.
         :param sample_prompts_control_mode: Determines whether sample prompts are enabled in the web experience for an end user.
         :param subtitle: A subtitle to personalize your Amazon Q Business web experience.
         :param tags: A list of key-value pairs that identify or categorize your Amazon Q Business web experience. You can also use tags to help control access to the web experience. Tag keys and values can consist of Unicode letters, digits, white space, and any of the following symbols: _ . : / = + -
@@ -7091,6 +7622,12 @@ class CfnWebExperience(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="webExperienceRef")
+    def web_experience_ref(self) -> _WebExperienceReference_31dff9d1:
+        '''A reference to a WebExperience resource.'''
+        return typing.cast(_WebExperienceReference_31dff9d1, jsii.get(self, "webExperienceRef"))
+
     @builtins.property
     @jsii.member(jsii_name="applicationId")
     def application_id(self) -> builtins.str:
@@ -7660,7 +8197,7 @@ class CfnWebExperienceProps:
         :param customization_configuration: Contains the configuration information to customize the logo, font, and color of an Amazon Q Business web experience with individual files for each property or a CSS file for them all.
         :param identity_provider_configuration: Provides information about the identity provider (IdP) used to authenticate end users of an Amazon Q Business web experience.
         :param origins: Sets the website domain origins that are allowed to embed the Amazon Q Business web experience. The *domain origin* refers to the base URL for accessing a website including the protocol ( ``http/https`` ), the domain name, and the port number (if specified). .. epigraph:: You must only submit a *base URL* and not a full path. For example, ``https://docs.aws.amazon.com`` .
-        :param role_arn: The Amazon Resource Name (ARN) of the service role attached to your web experience. .. epigraph:: You must provide this value if you're using IAM Identity Center to manage end user access to your application. If you're using legacy identity management to manage user access, you don't need to provide this value.
+        :param role_arn: The Amazon Resource Name (ARN) of the service role attached to your web experience. .. epigraph:: The ``roleArn`` parameter is required when your Amazon Q Business application is created with IAM Identity Center. It is not required for SAML-based applications.
         :param sample_prompts_control_mode: Determines whether sample prompts are enabled in the web experience for an end user.
         :param subtitle: A subtitle to personalize your Amazon Q Business web experience.
         :param tags: A list of key-value pairs that identify or categorize your Amazon Q Business web experience. You can also use tags to help control access to the web experience. Tag keys and values can consist of Unicode letters, digits, white space, and any of the following symbols: _ . : / = + -
@@ -7810,7 +8347,7 @@ class CfnWebExperienceProps:
 
         .. epigraph::
 
-           You must provide this value if you're using IAM Identity Center to manage end user access to your application. If you're using legacy identity management to manage user access, you don't need to provide this value.
+           The ``roleArn`` parameter is required when your Amazon Q Business application is created with IAM Identity Center. It is not required for SAML-based applications.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-webexperience.html#cfn-qbusiness-webexperience-rolearn
         '''
@@ -7920,6 +8457,22 @@ def _typecheckingstub__e2c95edfee8896187b03149b15ce3604b3a59bfb3b08abd73c5672b7c
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__7588037e663dbdf7e96cc384972e8ccf5a8f2b0ce464c77da36d747c5af4230b(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__4437623b0c0426c55908d2b586e92137def40e9d7f5f7f4c722a1f1d09bf72f6(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    application_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__47a4b6795acfe5e89f676295cf4c40b3a8dced361f2d77a9b9d10c72aa48712c(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -8087,6 +8640,7 @@ def _typecheckingstub__32b7ecf69912e25edcd2354b3e0497931ea6bf042b1aabc881c8677d2
     application_id: builtins.str,
     display_name: builtins.str,
     principal: builtins.str,
+    authentication_detail: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDataAccessor.DataAccessorAuthenticationDetailProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
@@ -8128,6 +8682,12 @@ def _typecheckingstub__fd64ede16f385d2990fa12fa363564c55f359fed279a75365018e42cd
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__8aa34af043257e0411af6e09ebeda77531edcaba51ad9fd392b4515b8c730792(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDataAccessor.DataAccessorAuthenticationDetailProperty]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__17fcd903858daed5111fdf34ce66e12720cfa6fd9e1712eb5744a4b8c06fb1fe(
     value: typing.Optional[typing.List[_CfnTag_f6864754]],
 ) -> None:
@@ -8165,6 +8725,29 @@ def _typecheckingstub__e0944dd9fc73c38902199011a9a1b06a552398d255157793794e769d8
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__5026e300a407a951a2bf85ba48cf1646fb1b1672f84f2ea26974311fd2b650de(
+    *,
+    idc_trusted_token_issuer_configuration: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDataAccessor.DataAccessorIdcTrustedTokenIssuerConfigurationProperty, typing.Dict[builtins.str, typing.Any]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__ce3d0eb33f705ecbcd9b23e1fae7014cc8010d410a8398ce3feea55694ebed37(
+    *,
+    authentication_type: builtins.str,
+    authentication_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDataAccessor.DataAccessorAuthenticationConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    external_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__aa8bef9d39508faf93f48a0365a4605be496aa8cf95d29ab54e4ceabbabaef4d(
+    *,
+    idc_trusted_token_issuer_arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__fc877a8d06303e2294e4f8e5813534f57082fb9476b669bafe4451af29bb5979(
     *,
     name: builtins.str,
@@ -8189,6 +8772,7 @@ def _typecheckingstub__4dfde2d4c17793fa3cb9793a9171b9042ac55727b3f0c3a17f1606cab
     application_id: builtins.str,
     display_name: builtins.str,
     principal: builtins.str,
+    authentication_detail: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDataAccessor.DataAccessorAuthenticationDetailProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
@@ -8523,6 +9107,7 @@ def _typecheckingstub__aa8b9992ffebedf4dda280be4bd0aa5dade8d62a6c092d850b1b1bb8d
     application_id: builtins.str,
     principal: builtins.str,
     statement_id: builtins.str,
+    conditions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPermission.ConditionProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -8563,12 +9148,28 @@ def _typecheckingstub__5bf1e79f20a58bfbabb1ce356f12e0ce01131844f0c50f11db4e0f82f
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__df7eedd7834a134466643c8bd40b7906fe6b7fcc7f482e5265aec4bb05607f6a(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnPermission.ConditionProperty]]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__39a9bd842be75583d990f7774438e331f4161b57ee4d98a449b293c0e014f90d(
+    *,
+    condition_key: builtins.str,
+    condition_operator: builtins.str,
+    condition_values: typing.Sequence[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__7ea87fcda68d4a26468f5e5d1c394a46d117b80b00274f61bbd36b0329a0a8c4(
     *,
     actions: typing.Sequence[builtins.str],
     application_id: builtins.str,
     principal: builtins.str,
     statement_id: builtins.str,
+    conditions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPermission.ConditionProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass