aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_s3_assets/__init__.py

@@ -261,8 +261,8 @@ from .. import (
     SymlinkFollowMode as _SymlinkFollowMode_047ec1f6,
 )
 from ..aws_iam import IGrantable as _IGrantable_71c4f5de
-from ..aws_kms import IKey as _IKey_5f11635f
 from ..aws_s3 import IBucket as _IBucket_42e086fd
+from ..interfaces.aws_kms import IKeyRef as _IKeyRef_d4fc6ef3
 
 
 @jsii.implements(_IAsset_03c624d8)
@@ -299,7 +299,7 @@ class Asset(
         deploy_time: typing.Optional[builtins.bool] = None,
         display_name: typing.Optional[builtins.str] = None,
         readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-        source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+        source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         asset_hash: typing.Optional[builtins.str] = None,
         asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
         bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
@@ -486,7 +486,7 @@ class AssetOptions(_AssetOptions_9cd3031e, _FileCopyOptions_e03e2a30):
         deploy_time: typing.Optional[builtins.bool] = None,
         display_name: typing.Optional[builtins.str] = None,
         readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-        source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+        source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     ) -> None:
         '''
         :param asset_hash: Specify a custom hash for this asset. If ``assetHashType`` is set it must be set to ``AssetHashType.CUSTOM``. For consistency, this custom hash will be SHA256 hashed and encoded as hex. The resulting hash will be the asset hash. NOTE: the hash is used in order to identify a specific revision of the asset, and used for optimizing and caching deployment activities related to this asset such as packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will need to make sure it is updated every time the asset changes, or otherwise it is possible that some deployments will not be invalidated. Default: - based on ``assetHashType``
@@ -689,13 +689,13 @@ class AssetOptions(_AssetOptions_9cd3031e, _FileCopyOptions_e03e2a30):
         return typing.cast(typing.Optional[typing.List[_IGrantable_71c4f5de]], result)
 
     @builtins.property
-    def source_kms_key(self) -> typing.Optional[_IKey_5f11635f]:
+    def source_kms_key(self) -> typing.Optional[_IKeyRef_d4fc6ef3]:
         '''The ARN of the KMS key used to encrypt the handler code.
 
         :default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.
         '''
         result = self._values.get("source_kms_key")
-        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+        return typing.cast(typing.Optional[_IKeyRef_d4fc6ef3], result)
 
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -739,7 +739,7 @@ class AssetProps(AssetOptions):
         deploy_time: typing.Optional[builtins.bool] = None,
         display_name: typing.Optional[builtins.str] = None,
         readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-        source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+        source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         path: builtins.str,
     ) -> None:
         '''
@@ -947,13 +947,13 @@ class AssetProps(AssetOptions):
         return typing.cast(typing.Optional[typing.List[_IGrantable_71c4f5de]], result)
 
     @builtins.property
-    def source_kms_key(self) -> typing.Optional[_IKey_5f11635f]:
+    def source_kms_key(self) -> typing.Optional[_IKeyRef_d4fc6ef3]:
         '''The ARN of the KMS key used to encrypt the handler code.
 
         :default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.
         '''
         result = self._values.get("source_kms_key")
-        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+        return typing.cast(typing.Optional[_IKeyRef_d4fc6ef3], result)
 
     @builtins.property
     def path(self) -> builtins.str:
@@ -996,7 +996,7 @@ def _typecheckingstub__00df81fd3b746cf2ee52c0e7a23b6fdc1b45db97673ca7e25a9651e7e
     deploy_time: typing.Optional[builtins.bool] = None,
     display_name: typing.Optional[builtins.str] = None,
     readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-    source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+    source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     asset_hash: typing.Optional[builtins.str] = None,
     asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
     bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
@@ -1031,7 +1031,7 @@ def _typecheckingstub__11950fe0327642dd25ddfeb2c620bb33847718475fe489bf003d096a0
     deploy_time: typing.Optional[builtins.bool] = None,
     display_name: typing.Optional[builtins.str] = None,
     readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-    source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+    source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -1047,7 +1047,7 @@ def _typecheckingstub__f879318d3885bc2e9c71c124fac7ad5a955812e438be7c03244c3aad7
     deploy_time: typing.Optional[builtins.bool] = None,
     display_name: typing.Optional[builtins.str] = None,
     readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-    source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+    source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     path: builtins.str,
 ) -> None:
     """Type checking stubs"""

aws_cdk/aws_s3_deployment/__init__.py

@@ -329,6 +329,25 @@ s3deploy.BucketDeployment(self, "DeployWithInvalidation",
 )
 ```
 
+By default, the deployment will wait for invalidation to succeed to complete. This will poll Cloudfront for a maximum of 13 minutes to check for a successful invalidation. The drawback to this is that the deployment will fail if invalidation fails or if it takes longer than 13 minutes. As a workaround, there is the option `waitForDistributionInvalidation`, which can be set to false to skip waiting for the invalidation, but this can be risky as invalidation errors will not be reported.
+
+```python
+import aws_cdk.aws_cloudfront as cloudfront
+
+# bucket: s3.IBucket
+# distribution: cloudfront.IDistribution
+
+
+s3deploy.BucketDeployment(self, "DeployWithInvalidation",
+    sources=[s3deploy.Source.asset("./website-dist")],
+    destination_bucket=bucket,
+    distribution=distribution,
+    distribution_paths=["/images/*.png"],
+    # Invalidate cache but don't wait or verify that invalidation has completed successfully.
+    wait_for_distribution_invalidation=False
+)
+```
+
 ## Signed Content Payloads
 
 By default, deployment uses streaming uploads which set the `x-amz-content-sha256`
@@ -524,6 +543,67 @@ cdk.CfnOutput(self, "ObjectKey",
 )
 ```
 
+## Specifying a Custom VPC, Subnets, and Security Groups in BucketDeployment
+
+By default, the AWS CDK BucketDeployment construct runs in a publicly accessible environment. However, for enhanced security and compliance, you may need to deploy your assets from within a VPC while restricting network access through custom subnets and security groups.
+
+### Using a Custom VPC
+
+To deploy assets within a private network, specify the vpc property in BucketDeploymentProps. This ensures that the deployment Lambda function executes within your specified VPC.
+
+```python
+vpc = ec2.Vpc.from_lookup(self, "ExistingVPC", vpc_id="vpc-12345678")
+bucket = s3.Bucket(self, "MyBucket")
+
+s3deploy.BucketDeployment(self, "DeployToS3",
+    destination_bucket=bucket,
+    vpc=vpc,
+    sources=[s3deploy.Source.asset("./website")]
+)
+```
+
+### Specifying Subnets for Deployment
+
+By default, when you specify a VPC, the BucketDeployment function is deployed in the private subnets of that VPC.
+However, you can customize the subnet selection using the vpcSubnets property.
+
+```python
+vpc = ec2.Vpc.from_lookup(self, "ExistingVPC", vpc_id="vpc-12345678")
+bucket = s3.Bucket(self, "MyBucket")
+
+s3deploy.BucketDeployment(self, "DeployToS3",
+    destination_bucket=bucket,
+    vpc=vpc,
+    vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),
+    sources=[s3deploy.Source.asset("./website")]
+)
+```
+
+### Defining Custom Security Groups
+
+For enhanced network security, you can now specify custom security groups in BucketDeploymentProps.
+This allows fine-grained control over ingress and egress rules for the deployment Lambda function.
+
+```python
+vpc = ec2.Vpc.from_lookup(self, "ExistingVPC", vpc_id="vpc-12345678")
+bucket = s3.Bucket(self, "MyBucket")
+
+security_group = ec2.SecurityGroup(self, "CustomSG",
+    vpc=vpc,
+    description="Allow HTTPS outbound access",
+    allow_all_outbound=False
+)
+
+security_group.add_egress_rule(ec2.Peer.any_ipv4(), ec2.Port.tcp(443), "Allow HTTPS traffic")
+
+s3deploy.BucketDeployment(self, "DeployWithSecurityGroup",
+    destination_bucket=bucket,
+    vpc=vpc,
+    security_groups=[security_group],
+    sources=[s3deploy.Source.asset("./website")]
+)
+```
+
 ## Notes
 
 * This library uses an AWS CloudFormation custom resource which is about 10MiB in
@@ -599,12 +679,12 @@ from .. import (
     Size as _Size_7b441c34,
     SymlinkFollowMode as _SymlinkFollowMode_047ec1f6,
 )
-from ..aws_cloudfront import IDistribution as _IDistribution_7ac752a4
 from ..aws_ec2 import (
-    IVpc as _IVpc_f30d5663, SubnetSelection as _SubnetSelection_e57d76df
+    ISecurityGroup as _ISecurityGroup_acf8a799,
+    IVpc as _IVpc_f30d5663,
+    SubnetSelection as _SubnetSelection_e57d76df,
 )
 from ..aws_iam import IGrantable as _IGrantable_71c4f5de, IRole as _IRole_235f5d8e
-from ..aws_kms import IKey as _IKey_5f11635f
 from ..aws_logs import (
     ILogGroup as _ILogGroup_3c4fa718, RetentionDays as _RetentionDays_070f99f0
 )
@@ -612,6 +692,8 @@ from ..aws_s3 import (
     BucketAccessControl as _BucketAccessControl_466c7e1b, IBucket as _IBucket_42e086fd
 )
 from ..aws_s3_assets import AssetOptions as _AssetOptions_2aa69621
+from ..interfaces.aws_cloudfront import IDistributionRef as _IDistributionRef_36fd2094
+from ..interfaces.aws_kms import IKeyRef as _IKeyRef_d4fc6ef3
 
 
 class BucketDeployment(
@@ -655,7 +737,7 @@ class BucketDeployment(
         content_language: typing.Optional[builtins.str] = None,
         content_type: typing.Optional[builtins.str] = None,
         destination_key_prefix: typing.Optional[builtins.str] = None,
-        distribution: typing.Optional[_IDistribution_7ac752a4] = None,
+        distribution: typing.Optional[_IDistributionRef_36fd2094] = None,
         distribution_paths: typing.Optional[typing.Sequence[builtins.str]] = None,
         ephemeral_storage_size: typing.Optional[_Size_7b441c34] = None,
         exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -670,6 +752,7 @@ class BucketDeployment(
         prune: typing.Optional[builtins.bool] = None,
         retain_on_delete: typing.Optional[builtins.bool] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
+        security_groups: typing.Optional[typing.Sequence[_ISecurityGroup_acf8a799]] = None,
         server_side_encryption: typing.Optional["ServerSideEncryption"] = None,
         server_side_encryption_aws_kms_key_id: typing.Optional[builtins.str] = None,
         server_side_encryption_customer_algorithm: typing.Optional[builtins.str] = None,
@@ -678,6 +761,7 @@ class BucketDeployment(
         use_efs: typing.Optional[builtins.bool] = None,
         vpc: typing.Optional[_IVpc_f30d5663] = None,
         vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
+        wait_for_distribution_invalidation: typing.Optional[builtins.bool] = None,
         website_redirect_location: typing.Optional[builtins.str] = None,
     ) -> None:
         '''
@@ -707,6 +791,7 @@ class BucketDeployment(
         :param prune: By default, files in the destination bucket that don't exist in the source will be deleted when the BucketDeployment resource is created or updated. If this is set to false, files in the destination bucket that do not exist in the asset, will NOT be deleted during deployment (create/update). Default: true
         :param retain_on_delete: If this is set to "false", the destination files will be deleted when the resource is deleted or the destination is updated. NOTICE: Configuring this to "false" might have operational implications. Please visit to the package documentation referred below to make sure you fully understand those implications. Default: true - when resource is deleted/updated, files are retained
         :param role: Execution role associated with this function. Default: - A role is automatically created
+        :param security_groups: The list of security groups to associate with the lambda handlers network interfaces. Only used if 'vpc' is supplied. Default: undefined - If the function is placed within a VPC and a security group is not specified a dedicated security group will be created for this function.
         :param server_side_encryption: System-defined x-amz-server-side-encryption metadata to be set on all objects in the deployment. Default: - Server side encryption is not used.
         :param server_side_encryption_aws_kms_key_id: System-defined x-amz-server-side-encryption-aws-kms-key-id metadata to be set on all objects in the deployment. Default: - Not set.
         :param server_side_encryption_customer_algorithm: System-defined x-amz-server-side-encryption-customer-algorithm metadata to be set on all objects in the deployment. Warning: This is not a useful parameter until this bug is fixed: https://github.com/aws/aws-cdk/issues/6080 Default: - Not set.
@@ -715,6 +800,7 @@ class BucketDeployment(
         :param use_efs: Mount an EFS file system. Enable this if your assets are large and you encounter disk space errors. Enabling this option will require a VPC to be specified. Default: - No EFS. Lambda has access only to 512MB of disk space.
         :param vpc: The VPC network to place the deployment lambda handler in. This is required if ``useEfs`` is set. Default: None
         :param vpc_subnets: Where in the VPC to place the deployment lambda handler. Only used if 'vpc' is supplied. Default: - the Vpc default strategy if not specified
+        :param wait_for_distribution_invalidation: In case of using a cloudfront distribtuion, if this property is set to false then the custom resource will not wait and verify for Cloudfront invalidation to complete. This may speed up deployment and avoid intermittent Cloudfront issues. However, this is risky and not recommended as cache invalidation can silently fail. Default: true
         :param website_redirect_location: System-defined x-amz-website-redirect-location metadata to be set on all objects in the deployment. Default: - No website redirection.
         '''
         if __debug__:
@@ -746,6 +832,7 @@ class BucketDeployment(
             prune=prune,
             retain_on_delete=retain_on_delete,
             role=role,
+            security_groups=security_groups,
             server_side_encryption=server_side_encryption,
             server_side_encryption_aws_kms_key_id=server_side_encryption_aws_kms_key_id,
             server_side_encryption_customer_algorithm=server_side_encryption_customer_algorithm,
@@ -754,6 +841,7 @@ class BucketDeployment(
             use_efs=use_efs,
             vpc=vpc,
             vpc_subnets=vpc_subnets,
+            wait_for_distribution_invalidation=wait_for_distribution_invalidation,
             website_redirect_location=website_redirect_location,
         )
 
@@ -853,6 +941,7 @@ class BucketDeployment(
         "prune": "prune",
         "retain_on_delete": "retainOnDelete",
         "role": "role",
+        "security_groups": "securityGroups",
         "server_side_encryption": "serverSideEncryption",
         "server_side_encryption_aws_kms_key_id": "serverSideEncryptionAwsKmsKeyId",
         "server_side_encryption_customer_algorithm": "serverSideEncryptionCustomerAlgorithm",
@@ -861,6 +950,7 @@ class BucketDeployment(
         "use_efs": "useEfs",
         "vpc": "vpc",
         "vpc_subnets": "vpcSubnets",
+        "wait_for_distribution_invalidation": "waitForDistributionInvalidation",
         "website_redirect_location": "websiteRedirectLocation",
     },
 )
@@ -877,7 +967,7 @@ class BucketDeploymentProps:
         content_language: typing.Optional[builtins.str] = None,
         content_type: typing.Optional[builtins.str] = None,
         destination_key_prefix: typing.Optional[builtins.str] = None,
-        distribution: typing.Optional[_IDistribution_7ac752a4] = None,
+        distribution: typing.Optional[_IDistributionRef_36fd2094] = None,
         distribution_paths: typing.Optional[typing.Sequence[builtins.str]] = None,
         ephemeral_storage_size: typing.Optional[_Size_7b441c34] = None,
         exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -892,6 +982,7 @@ class BucketDeploymentProps:
         prune: typing.Optional[builtins.bool] = None,
         retain_on_delete: typing.Optional[builtins.bool] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
+        security_groups: typing.Optional[typing.Sequence[_ISecurityGroup_acf8a799]] = None,
         server_side_encryption: typing.Optional["ServerSideEncryption"] = None,
         server_side_encryption_aws_kms_key_id: typing.Optional[builtins.str] = None,
         server_side_encryption_customer_algorithm: typing.Optional[builtins.str] = None,
@@ -900,6 +991,7 @@ class BucketDeploymentProps:
         use_efs: typing.Optional[builtins.bool] = None,
         vpc: typing.Optional[_IVpc_f30d5663] = None,
         vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
+        wait_for_distribution_invalidation: typing.Optional[builtins.bool] = None,
         website_redirect_location: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Properties for ``BucketDeployment``.
@@ -928,6 +1020,7 @@ class BucketDeploymentProps:
         :param prune: By default, files in the destination bucket that don't exist in the source will be deleted when the BucketDeployment resource is created or updated. If this is set to false, files in the destination bucket that do not exist in the asset, will NOT be deleted during deployment (create/update). Default: true
         :param retain_on_delete: If this is set to "false", the destination files will be deleted when the resource is deleted or the destination is updated. NOTICE: Configuring this to "false" might have operational implications. Please visit to the package documentation referred below to make sure you fully understand those implications. Default: true - when resource is deleted/updated, files are retained
         :param role: Execution role associated with this function. Default: - A role is automatically created
+        :param security_groups: The list of security groups to associate with the lambda handlers network interfaces. Only used if 'vpc' is supplied. Default: undefined - If the function is placed within a VPC and a security group is not specified a dedicated security group will be created for this function.
         :param server_side_encryption: System-defined x-amz-server-side-encryption metadata to be set on all objects in the deployment. Default: - Server side encryption is not used.
         :param server_side_encryption_aws_kms_key_id: System-defined x-amz-server-side-encryption-aws-kms-key-id metadata to be set on all objects in the deployment. Default: - Not set.
         :param server_side_encryption_customer_algorithm: System-defined x-amz-server-side-encryption-customer-algorithm metadata to be set on all objects in the deployment. Warning: This is not a useful parameter until this bug is fixed: https://github.com/aws/aws-cdk/issues/6080 Default: - Not set.
@@ -936,6 +1029,7 @@ class BucketDeploymentProps:
         :param use_efs: Mount an EFS file system. Enable this if your assets are large and you encounter disk space errors. Enabling this option will require a VPC to be specified. Default: - No EFS. Lambda has access only to 512MB of disk space.
         :param vpc: The VPC network to place the deployment lambda handler in. This is required if ``useEfs`` is set. Default: None
         :param vpc_subnets: Where in the VPC to place the deployment lambda handler. Only used if 'vpc' is supplied. Default: - the Vpc default strategy if not specified
+        :param wait_for_distribution_invalidation: In case of using a cloudfront distribtuion, if this property is set to false then the custom resource will not wait and verify for Cloudfront invalidation to complete. This may speed up deployment and avoid intermittent Cloudfront issues. However, this is risky and not recommended as cache invalidation can silently fail. Default: true
         :param website_redirect_location: System-defined x-amz-website-redirect-location metadata to be set on all objects in the deployment. Default: - No website redirection.
 
         :exampleMetadata: infused
@@ -985,6 +1079,7 @@ class BucketDeploymentProps:
             check_type(argname="argument prune", value=prune, expected_type=type_hints["prune"])
             check_type(argname="argument retain_on_delete", value=retain_on_delete, expected_type=type_hints["retain_on_delete"])
             check_type(argname="argument role", value=role, expected_type=type_hints["role"])
+            check_type(argname="argument security_groups", value=security_groups, expected_type=type_hints["security_groups"])
             check_type(argname="argument server_side_encryption", value=server_side_encryption, expected_type=type_hints["server_side_encryption"])
             check_type(argname="argument server_side_encryption_aws_kms_key_id", value=server_side_encryption_aws_kms_key_id, expected_type=type_hints["server_side_encryption_aws_kms_key_id"])
             check_type(argname="argument server_side_encryption_customer_algorithm", value=server_side_encryption_customer_algorithm, expected_type=type_hints["server_side_encryption_customer_algorithm"])
@@ -993,6 +1088,7 @@ class BucketDeploymentProps:
             check_type(argname="argument use_efs", value=use_efs, expected_type=type_hints["use_efs"])
             check_type(argname="argument vpc", value=vpc, expected_type=type_hints["vpc"])
             check_type(argname="argument vpc_subnets", value=vpc_subnets, expected_type=type_hints["vpc_subnets"])
+            check_type(argname="argument wait_for_distribution_invalidation", value=wait_for_distribution_invalidation, expected_type=type_hints["wait_for_distribution_invalidation"])
             check_type(argname="argument website_redirect_location", value=website_redirect_location, expected_type=type_hints["website_redirect_location"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "destination_bucket": destination_bucket,
@@ -1042,6 +1138,8 @@ class BucketDeploymentProps:
             self._values["retain_on_delete"] = retain_on_delete
         if role is not None:
             self._values["role"] = role
+        if security_groups is not None:
+            self._values["security_groups"] = security_groups
         if server_side_encryption is not None:
             self._values["server_side_encryption"] = server_side_encryption
         if server_side_encryption_aws_kms_key_id is not None:
@@ -1058,6 +1156,8 @@ class BucketDeploymentProps:
             self._values["vpc"] = vpc
         if vpc_subnets is not None:
             self._values["vpc_subnets"] = vpc_subnets
+        if wait_for_distribution_invalidation is not None:
+            self._values["wait_for_distribution_invalidation"] = wait_for_distribution_invalidation
         if website_redirect_location is not None:
             self._values["website_redirect_location"] = website_redirect_location
 
@@ -1156,7 +1256,7 @@ class BucketDeploymentProps:
         return typing.cast(typing.Optional[builtins.str], result)
 
     @builtins.property
-    def distribution(self) -> typing.Optional[_IDistribution_7ac752a4]:
+    def distribution(self) -> typing.Optional[_IDistributionRef_36fd2094]:
         '''The CloudFront distribution using the destination bucket as an origin.
 
         Files in the distribution's edge caches will be invalidated after
@@ -1165,7 +1265,7 @@ class BucketDeploymentProps:
         :default: - No invalidation occurs
         '''
         result = self._values.get("distribution")
-        return typing.cast(typing.Optional[_IDistribution_7ac752a4], result)
+        return typing.cast(typing.Optional[_IDistributionRef_36fd2094], result)
 
     @builtins.property
     def distribution_paths(self) -> typing.Optional[typing.List[builtins.str]]:
@@ -1335,6 +1435,20 @@ class BucketDeploymentProps:
         result = self._values.get("role")
         return typing.cast(typing.Optional[_IRole_235f5d8e], result)
 
+    @builtins.property
+    def security_groups(self) -> typing.Optional[typing.List[_ISecurityGroup_acf8a799]]:
+        '''The list of security groups to associate with the lambda handlers network interfaces.
+
+        Only used if 'vpc' is supplied.
+
+        :default:
+
+        undefined - If the function is placed within a VPC and a security group is
+        not specified a dedicated security group will be created for this function.
+        '''
+        result = self._values.get("security_groups")
+        return typing.cast(typing.Optional[typing.List[_ISecurityGroup_acf8a799]], result)
+
     @builtins.property
     def server_side_encryption(self) -> typing.Optional["ServerSideEncryption"]:
         '''System-defined x-amz-server-side-encryption metadata to be set on all objects in the deployment.
@@ -1426,6 +1540,21 @@ class BucketDeploymentProps:
         result = self._values.get("vpc_subnets")
         return typing.cast(typing.Optional[_SubnetSelection_e57d76df], result)
 
+    @builtins.property
+    def wait_for_distribution_invalidation(self) -> typing.Optional[builtins.bool]:
+        '''In case of using a cloudfront distribtuion, if this property is set to false then the custom resource will not wait and verify for Cloudfront invalidation to complete.
+
+        This may speed up deployment and avoid
+        intermittent Cloudfront issues. However, this is risky and not recommended as cache invalidation
+        can silently fail.
+
+        :default: true
+
+        :see: https://github.com/aws/aws-cdk/issues/15891
+        '''
+        result = self._values.get("wait_for_distribution_invalidation")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
     @builtins.property
     def website_redirect_location(self) -> typing.Optional[builtins.str]:
         '''System-defined x-amz-website-redirect-location metadata to be set on all objects in the deployment.
@@ -2098,7 +2227,7 @@ class Source(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.aws_s3_deployment.S
         deploy_time: typing.Optional[builtins.bool] = None,
         display_name: typing.Optional[builtins.str] = None,
         readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-        source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+        source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         asset_hash: typing.Optional[builtins.str] = None,
         asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
         bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
@@ -2484,7 +2613,7 @@ def _typecheckingstub__2544491e92aa50a255b927ef16b9cde2961eae48803afca3b5d1105bf
     content_language: typing.Optional[builtins.str] = None,
     content_type: typing.Optional[builtins.str] = None,
     destination_key_prefix: typing.Optional[builtins.str] = None,
-    distribution: typing.Optional[_IDistribution_7ac752a4] = None,
+    distribution: typing.Optional[_IDistributionRef_36fd2094] = None,
     distribution_paths: typing.Optional[typing.Sequence[builtins.str]] = None,
     ephemeral_storage_size: typing.Optional[_Size_7b441c34] = None,
     exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -2499,6 +2628,7 @@ def _typecheckingstub__2544491e92aa50a255b927ef16b9cde2961eae48803afca3b5d1105bf
     prune: typing.Optional[builtins.bool] = None,
     retain_on_delete: typing.Optional[builtins.bool] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
+    security_groups: typing.Optional[typing.Sequence[_ISecurityGroup_acf8a799]] = None,
     server_side_encryption: typing.Optional[ServerSideEncryption] = None,
     server_side_encryption_aws_kms_key_id: typing.Optional[builtins.str] = None,
     server_side_encryption_customer_algorithm: typing.Optional[builtins.str] = None,
@@ -2507,6 +2637,7 @@ def _typecheckingstub__2544491e92aa50a255b927ef16b9cde2961eae48803afca3b5d1105bf
     use_efs: typing.Optional[builtins.bool] = None,
     vpc: typing.Optional[_IVpc_f30d5663] = None,
     vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
+    wait_for_distribution_invalidation: typing.Optional[builtins.bool] = None,
     website_redirect_location: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -2529,7 +2660,7 @@ def _typecheckingstub__cbabf07e8b4adfb2b2058c075c4f35512ebc580f80a6db9bf13e90589
     content_language: typing.Optional[builtins.str] = None,
     content_type: typing.Optional[builtins.str] = None,
     destination_key_prefix: typing.Optional[builtins.str] = None,
-    distribution: typing.Optional[_IDistribution_7ac752a4] = None,
+    distribution: typing.Optional[_IDistributionRef_36fd2094] = None,
     distribution_paths: typing.Optional[typing.Sequence[builtins.str]] = None,
     ephemeral_storage_size: typing.Optional[_Size_7b441c34] = None,
     exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -2544,6 +2675,7 @@ def _typecheckingstub__cbabf07e8b4adfb2b2058c075c4f35512ebc580f80a6db9bf13e90589
     prune: typing.Optional[builtins.bool] = None,
     retain_on_delete: typing.Optional[builtins.bool] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
+    security_groups: typing.Optional[typing.Sequence[_ISecurityGroup_acf8a799]] = None,
     server_side_encryption: typing.Optional[ServerSideEncryption] = None,
     server_side_encryption_aws_kms_key_id: typing.Optional[builtins.str] = None,
     server_side_encryption_customer_algorithm: typing.Optional[builtins.str] = None,
@@ -2552,6 +2684,7 @@ def _typecheckingstub__cbabf07e8b4adfb2b2058c075c4f35512ebc580f80a6db9bf13e90589
     use_efs: typing.Optional[builtins.bool] = None,
     vpc: typing.Optional[_IVpc_f30d5663] = None,
     vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
+    wait_for_distribution_invalidation: typing.Optional[builtins.bool] = None,
     website_redirect_location: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -2646,7 +2779,7 @@ def _typecheckingstub__fc877c69568cee7364ec77003356fc6818118602dda64adf3dbf38ff7
     deploy_time: typing.Optional[builtins.bool] = None,
     display_name: typing.Optional[builtins.str] = None,
     readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-    source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+    source_kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     asset_hash: typing.Optional[builtins.str] = None,
     asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
     bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
@@ -2698,3 +2831,6 @@ def _typecheckingstub__dafa1619bb92595ec0ff7aa95e55221719ed81eb6d2f7d44a84193d81
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [ISource]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])

aws_cdk/aws_s3_notifications/__init__.py

@@ -84,11 +84,11 @@ import constructs as _constructs_77d1e7e8
 from ..aws_lambda import IFunction as _IFunction_6adb0ab8
 from ..aws_s3 import (
     BucketNotificationDestinationConfig as _BucketNotificationDestinationConfig_a4c4f83d,
-    IBucket as _IBucket_42e086fd,
     IBucketNotificationDestination as _IBucketNotificationDestination_ae5ca51a,
 )
 from ..aws_sns import ITopic as _ITopic_9eca4852
 from ..aws_sqs import IQueue as _IQueue_7ed6f679
+from ..interfaces.aws_s3 import IBucketRef as _IBucketRef_3debe44e
 
 
 @jsii.implements(_IBucketNotificationDestination_ae5ca51a)
@@ -127,7 +127,7 @@ class LambdaDestination(
     def bind(
         self,
         scope: _constructs_77d1e7e8.Construct,
-        bucket: _IBucket_42e086fd,
+        bucket: _IBucketRef_3debe44e,
     ) -> _BucketNotificationDestinationConfig_a4c4f83d:
         '''Registers this resource to receive notifications for the specified bucket.
 
@@ -174,7 +174,7 @@ class SnsDestination(
     def bind(
         self,
         scope: _constructs_77d1e7e8.Construct,
-        bucket: _IBucket_42e086fd,
+        bucket: _IBucketRef_3debe44e,
     ) -> _BucketNotificationDestinationConfig_a4c4f83d:
         '''Registers this resource to receive notifications for the specified bucket.
 
@@ -224,7 +224,7 @@ class SqsDestination(
     def bind(
         self,
         _scope: _constructs_77d1e7e8.Construct,
-        bucket: _IBucket_42e086fd,
+        bucket: _IBucketRef_3debe44e,
     ) -> _BucketNotificationDestinationConfig_a4c4f83d:
         '''Allows using SQS queues as destinations for bucket notifications.
 
@@ -256,7 +256,7 @@ def _typecheckingstub__aa31f009d508c5e9716ef8081ccf63abb6866ffbf349417ea81abf6f6
 
 def _typecheckingstub__72fb0e43c5d0bdebbc9b643b327c5cd42f851dbe4c4a6ac53bb2849787b3adec(
     scope: _constructs_77d1e7e8.Construct,
-    bucket: _IBucket_42e086fd,
+    bucket: _IBucketRef_3debe44e,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -269,7 +269,7 @@ def _typecheckingstub__88bc302a2eb7b4d1c7dc00b1564ab4c536d2626942f2cec60d543582b
 
 def _typecheckingstub__3553ece4b599ce7e526b55722477cb04771e1907840471521f08a9dbdea726a1(
     scope: _constructs_77d1e7e8.Construct,
-    bucket: _IBucket_42e086fd,
+    bucket: _IBucketRef_3debe44e,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -282,7 +282,7 @@ def _typecheckingstub__b615fa89f2fab6db113bd6376cf27eba6eb754a702e60b29024bc94c8
 
 def _typecheckingstub__e60900d91c64bba2d0ee8f8b0ace07ff0ee2d07e518d7b03941ed5bb85044f8b(
     _scope: _constructs_77d1e7e8.Construct,
-    bucket: _IBucket_42e086fd,
+    bucket: _IBucketRef_3debe44e,
 ) -> None:
     """Type checking stubs"""
     pass