aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_sdb/__init__.py

@@ -63,9 +63,12 @@ from .. import (
     IInspectable as _IInspectable_c2943556,
     TreeInspector as _TreeInspector_488e0dd5,
 )
+from ..interfaces.aws_sdb import (
+    DomainReference as _DomainReference_5952a7dd, IDomainRef as _IDomainRef_a4c85842
+)
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IDomainRef_a4c85842)
 class CfnDomain(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -100,7 +103,8 @@ class CfnDomain(
         *,
         description: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SDB::Domain``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param description: Information about the SimpleDB domain.
@@ -156,6 +160,12 @@ class CfnDomain(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="domainRef")
+    def domain_ref(self) -> _DomainReference_5952a7dd:
+        '''A reference to a Domain resource.'''
+        return typing.cast(_DomainReference_5952a7dd, jsii.get(self, "domainRef"))
+
     @builtins.property
     @jsii.member(jsii_name="description")
     def description(self) -> typing.Optional[builtins.str]:

aws_cdk/aws_secretsmanager/__init__.py

@@ -350,6 +350,7 @@ from .. import (
     RemovalPolicy as _RemovalPolicy_9f93c814,
     Resource as _Resource_45bc6135,
     SecretValue as _SecretValue_3dd0ddae,
+    SecretsManagerSecretOptions as _SecretsManagerSecretOptions_5c3ce656,
     TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
@@ -370,6 +371,17 @@ from ..aws_iam import (
 )
 from ..aws_kms import IKey as _IKey_5f11635f
 from ..aws_lambda import IFunction as _IFunction_6adb0ab8
+from ..interfaces.aws_kms import IKeyRef as _IKeyRef_d4fc6ef3
+from ..interfaces.aws_secretsmanager import (
+    IResourcePolicyRef as _IResourcePolicyRef_63a717f2,
+    IRotationScheduleRef as _IRotationScheduleRef_39ee30e9,
+    ISecretRef as _ISecretRef_3a7b28a3,
+    ISecretTargetAttachmentRef as _ISecretTargetAttachmentRef_0786fb30,
+    ResourcePolicyReference as _ResourcePolicyReference_55b14df8,
+    RotationScheduleReference as _RotationScheduleReference_430d14ec,
+    SecretReference as _SecretReference_6b31850e,
+    SecretTargetAttachmentReference as _SecretTargetAttachmentReference_5ec6f11b,
+)
 
 
 @jsii.data_type(
@@ -441,7 +453,7 @@ class AttachmentTargetType(enum.Enum):
     '''AWS::DocDB::DBCluster.'''
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResourcePolicyRef_63a717f2)
 class CfnResourcePolicy(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -483,7 +495,8 @@ class CfnResourcePolicy(
         secret_id: builtins.str,
         block_public_policy: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SecretsManager::ResourcePolicy``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param resource_policy: A JSON-formatted string for an AWS resource-based policy. For example policies, see `Permissions policy examples <https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples.html>`_ .
@@ -546,6 +559,12 @@ class CfnResourcePolicy(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicyRef")
+    def resource_policy_ref(self) -> _ResourcePolicyReference_55b14df8:
+        '''A reference to a ResourcePolicy resource.'''
+        return typing.cast(_ResourcePolicyReference_55b14df8, jsii.get(self, "resourcePolicyRef"))
+
     @builtins.property
     @jsii.member(jsii_name="resourcePolicy")
     def resource_policy(self) -> typing.Any:
@@ -694,7 +713,7 @@ class CfnResourcePolicyProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IRotationScheduleRef_39ee30e9)
 class CfnRotationSchedule(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -769,7 +788,8 @@ class CfnRotationSchedule(
         rotation_lambda_arn: typing.Optional[builtins.str] = None,
         rotation_rules: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRotationSchedule.RotationRulesProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SecretsManager::RotationSchedule``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param secret_id: The ARN or name of the secret to rotate. This is unique for each rotation schedule definition. To reference a secret also created in this template, use the `Ref <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html>`_ function with the secret's logical ID.
@@ -836,6 +856,12 @@ class CfnRotationSchedule(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="rotationScheduleRef")
+    def rotation_schedule_ref(self) -> _RotationScheduleReference_430d14ec:
+        '''A reference to a RotationSchedule resource.'''
+        return typing.cast(_RotationScheduleReference_430d14ec, jsii.get(self, "rotationScheduleRef"))
+
     @builtins.property
     @jsii.member(jsii_name="secretId")
     def secret_id(self) -> builtins.str:
@@ -966,7 +992,7 @@ class CfnRotationSchedule(
             :param master_secret_arn: The ARN of the secret that contains superuser credentials, if you use the `Alternating users rotation strategy <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users>`_ . CloudFormation grants the execution role for the Lambda rotation function ``GetSecretValue`` permission to the secret in this property. For more information, see `Lambda rotation function execution role permissions for Secrets Manager <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html>`_ . You must create the superuser secret before you can set this property. You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see `JSON structure of Secrets Manager secrets <https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html>`_ . You can specify ``MasterSecretArn`` or ``SuperuserSecretArn`` but not both. They represent the same superuser secret.
             :param master_secret_kms_key_arn: The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the `alternating users strategy <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users>`_ and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key ``aws/secretsmanager`` . CloudFormation grants the execution role for the Lambda rotation function ``Decrypt`` , ``DescribeKey`` , and ``GenerateDataKey`` permission to the key in this property. For more information, see `Lambda rotation function execution role permissions for Secrets Manager <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html>`_ . You can specify ``MasterSecretKmsKeyArn`` or ``SuperuserSecretKmsKeyArn`` but not both. They represent the same superuser secret KMS key .
             :param rotation_lambda_name: The name of the Lambda rotation function.
-            :param runtime: .. epigraph:: Do not set this value if you are using ``Transform: AWS::SecretsManager-2024-09-16`` . Over time, the updated rotation lambda artifacts vended by AWS may not be compatible with the code or shared object files defined in the rotation function deployment package. .. epigraph:: Only define the ``Runtime`` key if: - You are using ``Transform: AWS::SecretsManager-2020-07-23`` . - The code or shared object files defined in the rotation function deployment package are incompatible with Python 3.9. The Python Runtime version for with the rotation function. By default, CloudFormation deploys Python 3.9 binaries for the rotation function. To use a different version of Python, you must do the following two steps: - Deploy the matching version Python binaries with your rotation function. - Set the version number in this field. For example, for Python 3.7, enter *python3.7* . If you only do one of the steps, your rotation function will be incompatible with the binaries. For more information, see `Why did my Lambda rotation function fail with a "pg module not found" error <https://docs.aws.amazon.com/https://repost.aws/knowledge-center/secrets-manager-lambda-rotation>`_ .
+            :param runtime: .. epigraph:: Do not set this value if you are using ``Transform: AWS::SecretsManager-2024-09-16`` . Over time, the updated rotation lambda artifacts vended by AWS may not be compatible with the code or shared object files defined in the rotation function deployment package. .. epigraph:: Only define the ``Runtime`` key if: - You are using ``Transform: AWS::SecretsManager-2020-07-23`` . - The code or shared object files defined in the rotation function deployment package are incompatible with Python 3.10. The Python Runtime version for with the rotation function. By default, CloudFormation deploys Python 3.10 binaries for the rotation function. To use a different version of Python, you must do the following two steps: - Deploy the matching version Python binaries with your rotation function. - Set the version number in this field. For example, for Python 3.10, enter *python3.10* . If you only do one of the steps, your rotation function will be incompatible with the binaries. For more information, see `Why did my Lambda rotation function fail with a "pg module not found" error <https://docs.aws.amazon.com/https://repost.aws/knowledge-center/secrets-manager-lambda-rotation>`_ .
             :param superuser_secret_arn: The ARN of the secret that contains superuser credentials, if you use the `Alternating users rotation strategy <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users>`_ . CloudFormation grants the execution role for the Lambda rotation function ``GetSecretValue`` permission to the secret in this property. For more information, see `Lambda rotation function execution role permissions for Secrets Manager <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html>`_ . You must create the superuser secret before you can set this property. You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see `JSON structure of Secrets Manager secrets <https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html>`_ . You can specify ``MasterSecretArn`` or ``SuperuserSecretArn`` but not both. They represent the same superuser secret.
             :param superuser_secret_kms_key_arn: The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the `alternating users strategy <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users>`_ and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key ``aws/secretsmanager`` . CloudFormation grants the execution role for the Lambda rotation function ``Decrypt`` , ``DescribeKey`` , and ``GenerateDataKey`` permission to the key in this property. For more information, see `Lambda rotation function execution role permissions for Secrets Manager <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html>`_ . You can specify ``MasterSecretKmsKeyArn`` or ``SuperuserSecretKmsKeyArn`` but not both. They represent the same superuser secret KMS key .
             :param vpc_security_group_ids: A comma-separated list of security group IDs applied to the target database. The template applies the same security groups as on the Lambda rotation function that is created as part of this stack.
@@ -1128,12 +1154,12 @@ class CfnRotationSchedule(
                Only define the ``Runtime`` key if:
 
                - You are using ``Transform: AWS::SecretsManager-2020-07-23`` .
-               - The code or shared object files defined in the rotation function deployment package are incompatible with Python 3.9.
+               - The code or shared object files defined in the rotation function deployment package are incompatible with Python 3.10.
 
-            The Python Runtime version for with the rotation function. By default, CloudFormation deploys Python 3.9 binaries for the rotation function. To use a different version of Python, you must do the following two steps:
+            The Python Runtime version for with the rotation function. By default, CloudFormation deploys Python 3.10 binaries for the rotation function. To use a different version of Python, you must do the following two steps:
 
             - Deploy the matching version Python binaries with your rotation function.
-            - Set the version number in this field. For example, for Python 3.7, enter *python3.7* .
+            - Set the version number in this field. For example, for Python 3.10, enter *python3.10* .
 
             If you only do one of the steps, your rotation function will be incompatible with the binaries. For more information, see `Why did my Lambda rotation function fail with a "pg module not found" error <https://docs.aws.amazon.com/https://repost.aws/knowledge-center/secrets-manager-lambda-rotation>`_ .
 
@@ -1490,7 +1516,7 @@ class CfnRotationScheduleProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _ISecretRef_3a7b28a3, _ITaggable_36806126)
 class CfnSecret(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1563,7 +1589,8 @@ class CfnSecret(
         secret_string: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SecretsManager::Secret``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param description: The description of the secret.
@@ -1590,6 +1617,27 @@ class CfnSecret(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromSecretId")
+    @builtins.classmethod
+    def from_secret_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        secret_id: builtins.str,
+    ) -> _ISecretRef_3a7b28a3:
+        '''Creates a new ISecretRef from a secretId.
+
+        :param scope: -
+        :param id: -
+        :param secret_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__e3c3961c2a9f7641d6de2ed58080b5085d027497e32beb9b7b96c3365420ad89)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument secret_id", value=secret_id, expected_type=type_hints["secret_id"])
+        return typing.cast(_ISecretRef_3a7b28a3, jsii.sinvoke(cls, "fromSecretId", [scope, id, secret_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1634,6 +1682,12 @@ class CfnSecret(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="secretRef")
+    def secret_ref(self) -> _SecretReference_6b31850e:
+        '''A reference to a Secret resource.'''
+        return typing.cast(_SecretReference_6b31850e, jsii.get(self, "secretRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -2269,7 +2323,7 @@ class CfnSecretProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ISecretTargetAttachmentRef_0786fb30)
 class CfnSecretTargetAttachment(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2313,7 +2367,8 @@ class CfnSecretTargetAttachment(
         target_id: builtins.str,
         target_type: builtins.str,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SecretsManager::SecretTargetAttachment``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param secret_id: The ARN or name of the secret. To reference a secret also created in this template, use the see `Ref <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html>`_ function with the secret's logical ID. This field is unique for each target attachment definition.
@@ -2373,6 +2428,12 @@ class CfnSecretTargetAttachment(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="secretTargetAttachmentRef")
+    def secret_target_attachment_ref(self) -> _SecretTargetAttachmentReference_5ec6f11b:
+        '''A reference to a SecretTargetAttachment resource.'''
+        return typing.cast(_SecretTargetAttachmentReference_5ec6f11b, jsii.get(self, "secretTargetAttachmentRef"))
+
     @builtins.property
     @jsii.member(jsii_name="secretId")
     def secret_id(self) -> builtins.str:
@@ -3198,6 +3259,24 @@ class ISecret(_IResource_c80c4260, typing_extensions.Protocol):
         '''
         ...
 
+    @jsii.member(jsii_name="cfnDynamicReferenceKey")
+    def cfn_dynamic_reference_key(
+        self,
+        *,
+        json_field: typing.Optional[builtins.str] = None,
+        version_id: typing.Optional[builtins.str] = None,
+        version_stage: typing.Optional[builtins.str] = None,
+    ) -> builtins.str:
+        '''Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load this secret from AWS Secrets Manager.
+
+        :param json_field: The key of a JSON field to retrieve. This can only be used if the secret stores a JSON object. Default: - returns all the content stored in the Secrets Manager secret.
+        :param version_id: Specifies the unique identifier of the version of the secret you want to use. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+        :param version_stage: Specifies the secret version that you want to retrieve by the staging label attached to the version. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+
+        :see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html
+        '''
+        ...
+
     @jsii.member(jsii_name="denyAccountRootDelete")
     def deny_account_root_delete(self) -> None:
         '''Denies the ``DeleteSecret`` action to all principals within the current account.'''
@@ -3351,6 +3430,28 @@ class _ISecretProxy(
             check_type(argname="argument target", value=target, expected_type=type_hints["target"])
         return typing.cast(ISecret, jsii.invoke(self, "attach", [target]))
 
+    @jsii.member(jsii_name="cfnDynamicReferenceKey")
+    def cfn_dynamic_reference_key(
+        self,
+        *,
+        json_field: typing.Optional[builtins.str] = None,
+        version_id: typing.Optional[builtins.str] = None,
+        version_stage: typing.Optional[builtins.str] = None,
+    ) -> builtins.str:
+        '''Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load this secret from AWS Secrets Manager.
+
+        :param json_field: The key of a JSON field to retrieve. This can only be used if the secret stores a JSON object. Default: - returns all the content stored in the Secrets Manager secret.
+        :param version_id: Specifies the unique identifier of the version of the secret you want to use. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+        :param version_stage: Specifies the secret version that you want to retrieve by the staging label attached to the version. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+
+        :see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html
+        '''
+        options = _SecretsManagerSecretOptions_5c3ce656(
+            json_field=json_field, version_id=version_id, version_stage=version_stage
+        )
+
+        return typing.cast(builtins.str, jsii.invoke(self, "cfnDynamicReferenceKey", [options]))
+
     @jsii.member(jsii_name="denyAccountRootDelete")
     def deny_account_root_delete(self) -> None:
         '''Denies the ``DeleteSecret`` action to all principals within the current account.'''
@@ -4168,7 +4269,7 @@ class Secret(
     def add_replica_region(
         self,
         region: builtins.str,
-        encryption_key: typing.Optional[_IKey_5f11635f] = None,
+        encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     ) -> None:
         '''Adds a replica region for the secret.
 
@@ -4242,6 +4343,28 @@ class Secret(
             check_type(argname="argument target", value=target, expected_type=type_hints["target"])
         return typing.cast(ISecret, jsii.invoke(self, "attach", [target]))
 
+    @jsii.member(jsii_name="cfnDynamicReferenceKey")
+    def cfn_dynamic_reference_key(
+        self,
+        *,
+        json_field: typing.Optional[builtins.str] = None,
+        version_id: typing.Optional[builtins.str] = None,
+        version_stage: typing.Optional[builtins.str] = None,
+    ) -> builtins.str:
+        '''Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load this secret from AWS Secrets Manager.
+
+        :param json_field: The key of a JSON field to retrieve. This can only be used if the secret stores a JSON object. Default: - returns all the content stored in the Secrets Manager secret.
+        :param version_id: Specifies the unique identifier of the version of the secret you want to use. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+        :param version_stage: Specifies the secret version that you want to retrieve by the staging label attached to the version. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+
+        :see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html
+        '''
+        options = _SecretsManagerSecretOptions_5c3ce656(
+            json_field=json_field, version_id=version_id, version_stage=version_stage
+        )
+
+        return typing.cast(builtins.str, jsii.invoke(self, "cfnDynamicReferenceKey", [options]))
+
     @jsii.member(jsii_name="denyAccountRootDelete")
     def deny_account_root_delete(self) -> None:
         '''Denies the ``DeleteSecret`` action to all principals within the current account.'''
@@ -5724,6 +5847,28 @@ class SecretTargetAttachment(
             check_type(argname="argument target", value=target, expected_type=type_hints["target"])
         return typing.cast(ISecret, jsii.invoke(self, "attach", [target]))
 
+    @jsii.member(jsii_name="cfnDynamicReferenceKey")
+    def cfn_dynamic_reference_key(
+        self,
+        *,
+        json_field: typing.Optional[builtins.str] = None,
+        version_id: typing.Optional[builtins.str] = None,
+        version_stage: typing.Optional[builtins.str] = None,
+    ) -> builtins.str:
+        '''Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load this secret from AWS Secrets Manager.
+
+        :param json_field: The key of a JSON field to retrieve. This can only be used if the secret stores a JSON object. Default: - returns all the content stored in the Secrets Manager secret.
+        :param version_id: Specifies the unique identifier of the version of the secret you want to use. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+        :param version_stage: Specifies the secret version that you want to retrieve by the staging label attached to the version. Can specify at most one of ``versionId`` and ``versionStage``. Default: AWSCURRENT
+
+        :see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html
+        '''
+        options = _SecretsManagerSecretOptions_5c3ce656(
+            json_field=json_field, version_id=version_id, version_stage=version_stage
+        )
+
+        return typing.cast(builtins.str, jsii.invoke(self, "cfnDynamicReferenceKey", [options]))
+
     @jsii.member(jsii_name="denyAccountRootDelete")
     def deny_account_root_delete(self) -> None:
         '''Denies the ``DeleteSecret`` action to all principals within the current account.'''
@@ -6391,6 +6536,14 @@ def _typecheckingstub__85d618e732c6b1f020908289780221a8947553437136d3d13945c0f22
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__e3c3961c2a9f7641d6de2ed58080b5085d027497e32beb9b7b96c3365420ad89(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    secret_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__3e292aeb07dc3753c7a4e07c46e793e9a5c7266734d09d7d045223f304d4275f(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -6699,7 +6852,7 @@ def _typecheckingstub__37cd8e0754be5527a0ad4fee26cf19dad664499b08ffe7c9cc666fc3d
 
 def _typecheckingstub__fe1b065328cd9fa87e194c0b7fb09715a9775d0324ba830c43b9528fc26bbeed(
     region: builtins.str,
-    encryption_key: typing.Optional[_IKey_5f11635f] = None,
+    encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -6960,3 +7113,6 @@ def _typecheckingstub__eb32efb5952cc114eb89eeb6884dd52a8077263cbe3c8d6c019dee883
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [ISecret, ISecretAttachmentTarget, ISecretTargetAttachment]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])