aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_ssm/__init__.py

@@ -57,6 +57,22 @@ This method uses AWS API calls to lookup the value from SSM during synthesis.
 string_value = ssm.StringParameter.value_from_lookup(self, "/My/Public/Parameter")
 ```
 
+The result of the `StringParameter.valueFromLookup()` operation will be written to a file
+called `cdk.context.json`. You must commit this file to source control so
+that the lookup values are available in non-privileged environments such
+as CI build steps, and to ensure your template builds are repeatable.
+
+To customize the cache key, use the `additionalCacheKey` property of the `options` parameter.
+This allows you to have multiple lookups with the same parameters
+cache their values separately. This can be useful if you want to
+scope the context variable to a construct (ie, using `additionalCacheKey: this.node.path`),
+so that if the value in the cache needs to be updated, it does not need to be updated
+for all constructs at the same time.
+
+```python
+string_value = ssm.StringParameter.value_from_lookup(self, "/My/Public/Parameter", undefined, additional_cache_key=self.node.path)
+```
+
 When using `valueFromLookup` an initial value of 'dummy-value-for-${parameterName}'
 (`dummy-value-for-/My/Public/Parameter` in the above example)
 is returned prior to the lookup being performed. This can lead to errors if you are using this
@@ -247,9 +263,29 @@ from .. import (
 )
 from ..aws_iam import Grant as _Grant_a7ae64f8, IGrantable as _IGrantable_71c4f5de
 from ..aws_kms import IKey as _IKey_5f11635f
+from ..interfaces.aws_ssm import (
+    AssociationReference as _AssociationReference_4aae9ddd,
+    DocumentReference as _DocumentReference_5661bc29,
+    IAssociationRef as _IAssociationRef_a842a755,
+    IDocumentRef as _IDocumentRef_6c66ce42,
+    IMaintenanceWindowRef as _IMaintenanceWindowRef_1033e8f7,
+    IMaintenanceWindowTargetRef as _IMaintenanceWindowTargetRef_fe2384dd,
+    IMaintenanceWindowTaskRef as _IMaintenanceWindowTaskRef_72680416,
+    IParameterRef as _IParameterRef_b350095e,
+    IPatchBaselineRef as _IPatchBaselineRef_f929afe1,
+    IResourceDataSyncRef as _IResourceDataSyncRef_e153aa7a,
+    IResourcePolicyRef as _IResourcePolicyRef_8068eedb,
+    MaintenanceWindowReference as _MaintenanceWindowReference_601f32fe,
+    MaintenanceWindowTargetReference as _MaintenanceWindowTargetReference_ea6d19ad,
+    MaintenanceWindowTaskReference as _MaintenanceWindowTaskReference_0ac0909d,
+    ParameterReference as _ParameterReference_18138f09,
+    PatchBaselineReference as _PatchBaselineReference_b75c4dc5,
+    ResourceDataSyncReference as _ResourceDataSyncReference_a81c599c,
+    ResourcePolicyReference as _ResourcePolicyReference_937b9005,
+)
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IAssociationRef_a842a755)
 class CfnAssociation(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -326,7 +362,8 @@ class CfnAssociation(
         targets: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnAssociation.TargetProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         wait_for_success_timeout_seconds: typing.Optional[jsii.Number] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::Association``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: The name of the SSM document that contains the configuration information for the instance. You can specify ``Command`` or ``Automation`` documents. The documents can be AWS -predefined documents, documents you created, or a document that is shared with you from another account. For SSM documents that are shared with you from other AWS accounts , you must specify the complete SSM document ARN, in the following format: ``arn:partition:ssm:region:account-id:document/document-name`` For example: ``arn:aws:ssm:us-east-2:12345678912:document/My-Shared-Document`` For AWS -predefined documents and SSM documents you created in your account, you only need to specify the document name. For example, ``AWS -ApplyPatchBaseline`` or ``My-Document`` .
@@ -336,7 +373,7 @@ class CfnAssociation(
         :param calendar_names: The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see `AWS Systems Manager Change Calendar <https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-change-calendar>`_ in the *AWS Systems Manager User Guide* .
         :param compliance_severity: The severity level that is assigned to the association.
         :param document_version: The version of the SSM document to associate with the target. .. epigraph:: Note the following important information. - State Manager doesn't support running associations that use a new version of a document if that document is shared from another account. State Manager always runs the ``default`` version of a document if shared from another account, even though the Systems Manager console shows that a new version was processed. If you want to run an association using a new version of a document shared form another account, you must set the document version to ``default`` . - ``DocumentVersion`` is not valid for documents owned by AWS , such as ``AWS-RunPatchBaseline`` or ``AWS-UpdateSSMAgent`` . If you specify ``DocumentVersion`` for an AWS document, the system returns the following error: "Error occurred during operation 'CreateAssociation'." (RequestToken: , HandlerErrorCode: GeneralServiceException).
-        :param instance_id: The ID of the instance that the SSM document is associated with. You must specify the ``InstanceId`` or ``Targets`` property. .. epigraph:: ``InstanceId`` has been deprecated. To specify an instance ID for an association, use the ``Targets`` parameter. If you use the parameter ``InstanceId`` , you cannot use the parameters ``AssociationName`` , ``DocumentVersion`` , ``MaxErrors`` , ``MaxConcurrency`` , ``OutputLocation`` , or ``ScheduleExpression`` . To use these parameters, you must use the ``Targets`` parameter.
+        :param instance_id: .. epigraph:: ``InstanceId`` has been deprecated. To specify an instance ID for an association, use the ``Targets`` parameter. If you use the parameter ``InstanceId`` , you cannot use the parameters ``AssociationName`` , ``DocumentVersion`` , ``MaxErrors`` , ``MaxConcurrency`` , ``OutputLocation`` , or ``ScheduleExpression`` . To use these parameters, you must use the ``Targets`` parameter. .. epigraph:: Note that in some examples later in this page, ``InstanceIds`` is used as the tag-key name in a ``Targets`` filter. ``InstanceId`` is not used as a parameter. The ID of the instance that the SSM document is associated with. You must specify the ``InstanceId`` or ``Targets`` property.
         :param max_concurrency: The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time. If a new managed node starts and attempts to run an association while Systems Manager is running ``MaxConcurrency`` associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for ``MaxConcurrency`` .
         :param max_errors: The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set ``MaxError`` to 10%, then the system stops sending the request when the sixth error is received. Executions that are already running an association when ``MaxErrors`` is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set ``MaxConcurrency`` to 1 so that executions proceed one at a time.
         :param output_location: An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
@@ -373,6 +410,27 @@ class CfnAssociation(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromAssociationId")
+    @builtins.classmethod
+    def from_association_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        association_id: builtins.str,
+    ) -> _IAssociationRef_a842a755:
+        '''Creates a new IAssociationRef from a associationId.
+
+        :param scope: -
+        :param id: -
+        :param association_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b2a4e2f6f1ad5f1b777c7a5fcb533625aa60df723d920b56a3738329f8b631cb)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument association_id", value=association_id, expected_type=type_hints["association_id"])
+        return typing.cast(_IAssociationRef_a842a755, jsii.sinvoke(cls, "fromAssociationId", [scope, id, association_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -403,6 +461,12 @@ class CfnAssociation(
         '''The CloudFormation resource type name for this resource class.'''
         return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
+    @builtins.property
+    @jsii.member(jsii_name="associationRef")
+    def association_ref(self) -> _AssociationReference_4aae9ddd:
+        '''A reference to a Association resource.'''
+        return typing.cast(_AssociationReference_4aae9ddd, jsii.get(self, "associationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="attrAssociationId")
     def attr_association_id(self) -> builtins.str:
@@ -519,7 +583,9 @@ class CfnAssociation(
     @builtins.property
     @jsii.member(jsii_name="instanceId")
     def instance_id(self) -> typing.Optional[builtins.str]:
-        '''The ID of the instance that the SSM document is associated with.'''
+        '''.. epigraph::
+
+   ``InstanceId`` has been deprecated.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "instanceId"))
 
     @instance_id.setter
@@ -941,7 +1007,7 @@ class CfnAssociationProps:
         :param calendar_names: The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see `AWS Systems Manager Change Calendar <https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-change-calendar>`_ in the *AWS Systems Manager User Guide* .
         :param compliance_severity: The severity level that is assigned to the association.
         :param document_version: The version of the SSM document to associate with the target. .. epigraph:: Note the following important information. - State Manager doesn't support running associations that use a new version of a document if that document is shared from another account. State Manager always runs the ``default`` version of a document if shared from another account, even though the Systems Manager console shows that a new version was processed. If you want to run an association using a new version of a document shared form another account, you must set the document version to ``default`` . - ``DocumentVersion`` is not valid for documents owned by AWS , such as ``AWS-RunPatchBaseline`` or ``AWS-UpdateSSMAgent`` . If you specify ``DocumentVersion`` for an AWS document, the system returns the following error: "Error occurred during operation 'CreateAssociation'." (RequestToken: , HandlerErrorCode: GeneralServiceException).
-        :param instance_id: The ID of the instance that the SSM document is associated with. You must specify the ``InstanceId`` or ``Targets`` property. .. epigraph:: ``InstanceId`` has been deprecated. To specify an instance ID for an association, use the ``Targets`` parameter. If you use the parameter ``InstanceId`` , you cannot use the parameters ``AssociationName`` , ``DocumentVersion`` , ``MaxErrors`` , ``MaxConcurrency`` , ``OutputLocation`` , or ``ScheduleExpression`` . To use these parameters, you must use the ``Targets`` parameter.
+        :param instance_id: .. epigraph:: ``InstanceId`` has been deprecated. To specify an instance ID for an association, use the ``Targets`` parameter. If you use the parameter ``InstanceId`` , you cannot use the parameters ``AssociationName`` , ``DocumentVersion`` , ``MaxErrors`` , ``MaxConcurrency`` , ``OutputLocation`` , or ``ScheduleExpression`` . To use these parameters, you must use the ``Targets`` parameter. .. epigraph:: Note that in some examples later in this page, ``InstanceIds`` is used as the tag-key name in a ``Targets`` filter. ``InstanceId`` is not used as a parameter. The ID of the instance that the SSM document is associated with. You must specify the ``InstanceId`` or ``Targets`` property.
         :param max_concurrency: The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time. If a new managed node starts and attempts to run an association while Systems Manager is running ``MaxConcurrency`` associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for ``MaxConcurrency`` .
         :param max_errors: The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set ``MaxError`` to 10%, then the system stops sending the request when the sixth error is received. Executions that are already running an association when ``MaxErrors`` is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set ``MaxConcurrency`` to 1 so that executions proceed one at a time.
         :param output_location: An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
@@ -1138,12 +1204,16 @@ class CfnAssociationProps:
 
     @builtins.property
     def instance_id(self) -> typing.Optional[builtins.str]:
-        '''The ID of the instance that the SSM document is associated with.
+        '''.. epigraph::
 
-        You must specify the ``InstanceId`` or ``Targets`` property.
+   ``InstanceId`` has been deprecated.
+
+        To specify an instance ID for an association, use the ``Targets`` parameter. If you use the parameter ``InstanceId`` , you cannot use the parameters ``AssociationName`` , ``DocumentVersion`` , ``MaxErrors`` , ``MaxConcurrency`` , ``OutputLocation`` , or ``ScheduleExpression`` . To use these parameters, you must use the ``Targets`` parameter.
         .. epigraph::
 
-           ``InstanceId`` has been deprecated. To specify an instance ID for an association, use the ``Targets`` parameter. If you use the parameter ``InstanceId`` , you cannot use the parameters ``AssociationName`` , ``DocumentVersion`` , ``MaxErrors`` , ``MaxConcurrency`` , ``OutputLocation`` , or ``ScheduleExpression`` . To use these parameters, you must use the ``Targets`` parameter.
+           Note that in some examples later in this page, ``InstanceIds`` is used as the tag-key name in a ``Targets`` filter. ``InstanceId`` is not used as a parameter.
+
+        The ID of the instance that the SSM document is associated with. You must specify the ``InstanceId`` or ``Targets`` property.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-association.html#cfn-ssm-association-instanceid
         '''
@@ -1277,7 +1347,7 @@ class CfnAssociationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IDocumentRef_6c66ce42, _ITaggable_36806126)
 class CfnDocument(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1322,7 +1392,8 @@ class CfnDocument(
         update_method: typing.Optional[builtins.str] = None,
         version_name: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::Document``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param content: The content for the new SSM document in JSON or YAML. For more information about the schemas for SSM document content, see `SSM document schema features and examples <https://docs.aws.amazon.com/systems-manager/latest/userguide/document-schemas-features.html>`_ in the *AWS Systems Manager User Guide* . .. epigraph:: This parameter also supports ``String`` data types.
@@ -1355,6 +1426,27 @@ class CfnDocument(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromDocumentName")
+    @builtins.classmethod
+    def from_document_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        document_name: builtins.str,
+    ) -> _IDocumentRef_6c66ce42:
+        '''Creates a new IDocumentRef from a documentName.
+
+        :param scope: -
+        :param id: -
+        :param document_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0c67b192e3e153596beb12dc7520f7cbf677768f2e862aa4d968b306611aea53)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument document_name", value=document_name, expected_type=type_hints["document_name"])
+        return typing.cast(_IDocumentRef_6c66ce42, jsii.sinvoke(cls, "fromDocumentName", [scope, id, document_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1390,6 +1482,12 @@ class CfnDocument(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="documentRef")
+    def document_ref(self) -> _DocumentReference_5661bc29:
+        '''A reference to a Document resource.'''
+        return typing.cast(_DocumentReference_5661bc29, jsii.get(self, "documentRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -1965,7 +2063,7 @@ class CfnDocumentProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IMaintenanceWindowRef_1033e8f7, _ITaggable_36806126)
 class CfnMaintenanceWindow(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2024,7 +2122,8 @@ class CfnMaintenanceWindow(
         start_date: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::MaintenanceWindow``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param allow_unassociated_targets: Enables a maintenance window task to run on managed instances, even if you have not registered those instances as targets. If enabled, then you must specify the unregistered instances (by instance ID) when you register a task with the maintenance window.
@@ -2102,6 +2201,12 @@ class CfnMaintenanceWindow(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="maintenanceWindowRef")
+    def maintenance_window_ref(self) -> _MaintenanceWindowReference_601f32fe:
+        '''A reference to a MaintenanceWindow resource.'''
+        return typing.cast(_MaintenanceWindowReference_601f32fe, jsii.get(self, "maintenanceWindowRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -2489,7 +2594,7 @@ class CfnMaintenanceWindowProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IMaintenanceWindowTargetRef_fe2384dd)
 class CfnMaintenanceWindowTarget(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2536,7 +2641,8 @@ class CfnMaintenanceWindowTarget(
         name: typing.Optional[builtins.str] = None,
         owner_information: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::MaintenanceWindowTarget``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param resource_type: The type of target that is being registered with the maintenance window.
@@ -2604,6 +2710,14 @@ class CfnMaintenanceWindowTarget(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="maintenanceWindowTargetRef")
+    def maintenance_window_target_ref(
+        self,
+    ) -> _MaintenanceWindowTargetReference_ea6d19ad:
+        '''A reference to a MaintenanceWindowTarget resource.'''
+        return typing.cast(_MaintenanceWindowTargetReference_ea6d19ad, jsii.get(self, "maintenanceWindowTargetRef"))
+
     @builtins.property
     @jsii.member(jsii_name="resourceType")
     def resource_type(self) -> builtins.str:
@@ -2915,7 +3029,7 @@ class CfnMaintenanceWindowTargetProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IMaintenanceWindowTaskRef_72680416)
 class CfnMaintenanceWindowTask(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3023,7 +3137,8 @@ class CfnMaintenanceWindowTask(
         task_invocation_parameters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnMaintenanceWindowTask.TaskInvocationParametersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         task_parameters: typing.Any = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::MaintenanceWindowTask``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param priority: The priority of the task in the maintenance window. The lower the number, the higher the priority. Tasks that have the same priority are scheduled in parallel.
@@ -3032,14 +3147,14 @@ class CfnMaintenanceWindowTask(
         :param window_id: The ID of the maintenance window where the task is registered.
         :param cutoff_behavior: The specification for whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached.
         :param description: A description of the task.
-        :param logging_info: Information about an Amazon S3 bucket to write Run Command task-level logs to. .. epigraph:: ``LoggingInfo`` has been deprecated. To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ .
+        :param logging_info: .. epigraph:: ``LoggingInfo`` has been deprecated. To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ . Information about an Amazon S3 bucket to write Run Command task-level logs to.
         :param max_concurrency: The maximum number of targets this task can be run for, in parallel. .. epigraph:: Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a `targetless task <https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html>`_ You must provide a value in all other cases. For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of ``1`` . This value doesn't affect the running of your task.
         :param max_errors: The maximum number of errors allowed before this task stops being scheduled. .. epigraph:: Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a `targetless task <https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html>`_ You must provide a value in all other cases. For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of ``1`` . This value doesn't affect the running of your task.
         :param name: The task name.
         :param service_role_arn: The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task. If you do not specify a service role ARN, Systems Manager uses a service-linked role in your account. If no appropriate service-linked role for Systems Manager exists in your account, it is created when you run ``RegisterTaskWithMaintenanceWindow`` . However, for an improved security posture, we strongly recommend creating a custom policy and custom service role for running your maintenance window tasks. The policy can be crafted to provide only the permissions needed for your particular maintenance window tasks. For more information, see `Setting up Maintenance Windows <https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-permissions.html>`_ in the in the *AWS Systems Manager User Guide* .
         :param targets: The targets, either instances or window target IDs. - Specify instances using ``Key=InstanceIds,Values= *instanceid1* , *instanceid2*`` . - Specify window target IDs using ``Key=WindowTargetIds,Values= *window-target-id-1* , *window-target-id-2*`` .
         :param task_invocation_parameters: The parameters to pass to the task when it runs. Populate only the fields that match the task type. All other fields should be empty. .. epigraph:: When you update a maintenance window task that has options specified in ``TaskInvocationParameters`` , you must provide again all the ``TaskInvocationParameters`` values that you want to retain. The values you do not specify again are removed. For example, suppose that when you registered a Run Command task, you specified ``TaskInvocationParameters`` values for ``Comment`` , ``NotificationConfig`` , and ``OutputS3BucketName`` . If you update the maintenance window task and specify only a different ``OutputS3BucketName`` value, the values for ``Comment`` and ``NotificationConfig`` are removed.
-        :param task_parameters: The parameters to pass to the task when it runs. .. epigraph:: ``TaskParameters`` has been deprecated. To specify parameters to pass to a task when it runs, instead use the ``Parameters`` option in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `MaintenanceWindowTaskInvocationParameters <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html>`_ .
+        :param task_parameters: .. epigraph:: ``TaskParameters`` has been deprecated. To specify parameters to pass to a task when it runs, instead use the ``Parameters`` option in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `MaintenanceWindowTaskInvocationParameters <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html>`_ . The parameters to pass to the task when it runs.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__5ab957de8d8a36935188de8e7d81d523e1ab1253ec8aab9717d062cb647fc726)
@@ -3107,6 +3222,12 @@ class CfnMaintenanceWindowTask(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="maintenanceWindowTaskRef")
+    def maintenance_window_task_ref(self) -> _MaintenanceWindowTaskReference_0ac0909d:
+        '''A reference to a MaintenanceWindowTask resource.'''
+        return typing.cast(_MaintenanceWindowTaskReference_0ac0909d, jsii.get(self, "maintenanceWindowTaskRef"))
+
     @builtins.property
     @jsii.member(jsii_name="priority")
     def priority(self) -> jsii.Number:
@@ -3190,7 +3311,9 @@ class CfnMaintenanceWindowTask(
     def logging_info(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnMaintenanceWindowTask.LoggingInfoProperty"]]:
-        '''Information about an Amazon S3 bucket to write Run Command task-level logs to.'''
+        '''.. epigraph::
+
+   ``LoggingInfo`` has been deprecated.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnMaintenanceWindowTask.LoggingInfoProperty"]], jsii.get(self, "loggingInfo"))
 
     @logging_info.setter
@@ -3294,7 +3417,9 @@ class CfnMaintenanceWindowTask(
     @builtins.property
     @jsii.member(jsii_name="taskParameters")
     def task_parameters(self) -> typing.Any:
-        '''The parameters to pass to the task when it runs.'''
+        '''.. epigraph::
+
+   ``TaskParameters`` has been deprecated.'''
         return typing.cast(typing.Any, jsii.get(self, "taskParameters"))
 
     @task_parameters.setter
@@ -3400,12 +3525,15 @@ class CfnMaintenanceWindowTask(
             s3_bucket: builtins.str,
             s3_prefix: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''The ``LoggingInfo`` property type specifies information about the Amazon S3 bucket to write instance-level logs to.
+            '''.. epigraph::
 
-            ``LoggingInfo`` is a property of the `AWS::SSM::MaintenanceWindowTask <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html>`_ resource.
-            .. epigraph::
+   ``LoggingInfo`` has been deprecated.
 
-               ``LoggingInfo`` has been deprecated. To specify an Amazon S3 bucket to contain logs, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ .
+            To specify an Amazon S3 bucket to contain logs, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ .
+
+            The ``LoggingInfo`` property type specifies information about the Amazon S3 bucket to write instance-level logs to.
+
+            ``LoggingInfo`` is a property of the `AWS::SSM::MaintenanceWindowTask <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html>`_ resource.
 
             :param region: The AWS Region where the S3 bucket is located.
             :param s3_bucket: The name of an S3 bucket where execution logs are stored.
@@ -4367,14 +4495,14 @@ class CfnMaintenanceWindowTaskProps:
         :param window_id: The ID of the maintenance window where the task is registered.
         :param cutoff_behavior: The specification for whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached.
         :param description: A description of the task.
-        :param logging_info: Information about an Amazon S3 bucket to write Run Command task-level logs to. .. epigraph:: ``LoggingInfo`` has been deprecated. To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ .
+        :param logging_info: .. epigraph:: ``LoggingInfo`` has been deprecated. To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ . Information about an Amazon S3 bucket to write Run Command task-level logs to.
         :param max_concurrency: The maximum number of targets this task can be run for, in parallel. .. epigraph:: Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a `targetless task <https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html>`_ You must provide a value in all other cases. For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of ``1`` . This value doesn't affect the running of your task.
         :param max_errors: The maximum number of errors allowed before this task stops being scheduled. .. epigraph:: Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a `targetless task <https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html>`_ You must provide a value in all other cases. For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of ``1`` . This value doesn't affect the running of your task.
         :param name: The task name.
         :param service_role_arn: The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task. If you do not specify a service role ARN, Systems Manager uses a service-linked role in your account. If no appropriate service-linked role for Systems Manager exists in your account, it is created when you run ``RegisterTaskWithMaintenanceWindow`` . However, for an improved security posture, we strongly recommend creating a custom policy and custom service role for running your maintenance window tasks. The policy can be crafted to provide only the permissions needed for your particular maintenance window tasks. For more information, see `Setting up Maintenance Windows <https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-permissions.html>`_ in the in the *AWS Systems Manager User Guide* .
         :param targets: The targets, either instances or window target IDs. - Specify instances using ``Key=InstanceIds,Values= *instanceid1* , *instanceid2*`` . - Specify window target IDs using ``Key=WindowTargetIds,Values= *window-target-id-1* , *window-target-id-2*`` .
         :param task_invocation_parameters: The parameters to pass to the task when it runs. Populate only the fields that match the task type. All other fields should be empty. .. epigraph:: When you update a maintenance window task that has options specified in ``TaskInvocationParameters`` , you must provide again all the ``TaskInvocationParameters`` values that you want to retain. The values you do not specify again are removed. For example, suppose that when you registered a Run Command task, you specified ``TaskInvocationParameters`` values for ``Comment`` , ``NotificationConfig`` , and ``OutputS3BucketName`` . If you update the maintenance window task and specify only a different ``OutputS3BucketName`` value, the values for ``Comment`` and ``NotificationConfig`` are removed.
-        :param task_parameters: The parameters to pass to the task when it runs. .. epigraph:: ``TaskParameters`` has been deprecated. To specify parameters to pass to a task when it runs, instead use the ``Parameters`` option in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `MaintenanceWindowTaskInvocationParameters <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html>`_ .
+        :param task_parameters: .. epigraph:: ``TaskParameters`` has been deprecated. To specify parameters to pass to a task when it runs, instead use the ``Parameters`` option in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `MaintenanceWindowTaskInvocationParameters <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html>`_ . The parameters to pass to the task when it runs.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html
         :exampleMetadata: fixture=_generated
@@ -4567,11 +4695,13 @@ class CfnMaintenanceWindowTaskProps:
     def logging_info(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnMaintenanceWindowTask.LoggingInfoProperty]]:
-        '''Information about an Amazon S3 bucket to write Run Command task-level logs to.
+        '''.. epigraph::
 
-        .. epigraph::
+   ``LoggingInfo`` has been deprecated.
+
+        To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ .
 
-           ``LoggingInfo`` has been deprecated. To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the ``OutputS3BucketName`` and ``OutputS3KeyPrefix`` options in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html>`_ .
+        Information about an Amazon S3 bucket to write Run Command task-level logs to.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html#cfn-ssm-maintenancewindowtask-logginginfo
         '''
@@ -4662,11 +4792,13 @@ class CfnMaintenanceWindowTaskProps:
 
     @builtins.property
     def task_parameters(self) -> typing.Any:
-        '''The parameters to pass to the task when it runs.
+        '''.. epigraph::
 
-        .. epigraph::
+   ``TaskParameters`` has been deprecated.
+
+        To specify parameters to pass to a task when it runs, instead use the ``Parameters`` option in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `MaintenanceWindowTaskInvocationParameters <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html>`_ .
 
-           ``TaskParameters`` has been deprecated. To specify parameters to pass to a task when it runs, instead use the ``Parameters`` option in the ``TaskInvocationParameters`` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see `MaintenanceWindowTaskInvocationParameters <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html>`_ .
+        The parameters to pass to the task when it runs.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html#cfn-ssm-maintenancewindowtask-taskparameters
         '''
@@ -4685,7 +4817,7 @@ class CfnMaintenanceWindowTaskProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IParameterRef_b350095e, _ITaggable_36806126)
 class CfnParameter(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -4697,12 +4829,9 @@ class CfnParameter(
 
        To create an SSM parameter, you must have the AWS Identity and Access Management ( IAM ) permissions ``ssm:PutParameter`` and ``ssm:AddTagsToResource`` . On stack creation, AWS CloudFormation adds the following three tags to the parameter: ``aws:cloudformation:stack-name`` , ``aws:cloudformation:logical-id`` , and ``aws:cloudformation:stack-id`` , in addition to any custom tags you specify.
 
-       To add, update, or remove tags during stack update, you must have IAM permissions for both ``ssm:AddTagsToResource`` and ``ssm:RemoveTagsFromResource`` . For more information, see `Managing Access Using Policies <https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam.html#security_iam_access-manage>`_ in the *AWS Systems Manager User Guide* .
+       To add, update, or remove tags during stack update, you must have IAM permissions for both ``ssm:AddTagsToResource`` and ``ssm:RemoveTagsFromResource`` . For more information, see `Managing access using policies <https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam.html#security_iam_access-manage>`_ in the *AWS Systems Manager User Guide* .
 
     For information about valid values for parameters, see `About requirements and constraints for parameter names <https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-create.html#sysman-parameter-name-constraints>`_ in the *AWS Systems Manager User Guide* and `PutParameter <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutParameter.html>`_ in the *AWS Systems Manager API Reference* .
-    .. epigraph::
-
-       Parameters of type ``SecureString`` are not supported by AWS CloudFormation .
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.html
     :cloudformationResource: AWS::SSM::Parameter
@@ -4746,7 +4875,8 @@ class CfnParameter(
         tags: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         tier: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::Parameter``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param type: The type of parameter. .. epigraph:: Parameters of type ``SecureString`` are not supported by AWS CloudFormation .
@@ -4754,7 +4884,7 @@ class CfnParameter(
         :param allowed_pattern: A regular expression used to validate the parameter value. For example, for ``String`` types with values restricted to numbers, you can specify the following: ``AllowedPattern=^\\d+$``
         :param data_type: The data type of the parameter, such as ``text`` or ``aws:ec2:image`` . The default is ``text`` .
         :param description: Information about the parameter.
-        :param name: The name of the parameter. .. epigraph:: The maximum length constraint listed below includes capacity for additional system attributes that aren't part of the name. The maximum length for a parameter name, including the full length of the parameter Amazon Resource Name (ARN), is 1011 characters. For example, the length of the following parameter name is 65 characters, not 20 characters: ``arn:aws:ssm:us-east-2:111222333444:parameter/ExampleParameterName``
+        :param name: The name of the parameter. .. epigraph:: The reported maximum length of 2048 characters for a parameter name includes 1037 characters that are reserved for internal use by Systems Manager . The maximum length for a parameter name that you specify is 1011 characters. This count of 1011 characters includes the characters in the ARN that precede the name you specify. This ARN length will vary depending on your partition and Region. For example, the following 45 characters count toward the 1011 character maximum for a parameter created in the US East (Ohio) Region: ``arn:aws:ssm:us-east-2:111122223333:parameter/`` .
         :param policies: Information about the policies assigned to a parameter. `Assigning parameter policies <https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-policies.html>`_ in the *AWS Systems Manager User Guide* .
         :param tags: Optional metadata that you assign to a resource in the form of an arbitrary set of tags (key-value pairs). Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a Systems Manager parameter to identify the type of resource to which it applies, the environment, or the type of configuration data referenced by the parameter.
         :param tier: The parameter tier.
@@ -4832,6 +4962,12 @@ class CfnParameter(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="parameterRef")
+    def parameter_ref(self) -> _ParameterReference_18138f09:
+        '''A reference to a Parameter resource.'''
+        return typing.cast(_ParameterReference_18138f09, jsii.get(self, "parameterRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -4995,7 +5131,7 @@ class CfnParameterProps:
         :param allowed_pattern: A regular expression used to validate the parameter value. For example, for ``String`` types with values restricted to numbers, you can specify the following: ``AllowedPattern=^\\d+$``
         :param data_type: The data type of the parameter, such as ``text`` or ``aws:ec2:image`` . The default is ``text`` .
         :param description: Information about the parameter.
-        :param name: The name of the parameter. .. epigraph:: The maximum length constraint listed below includes capacity for additional system attributes that aren't part of the name. The maximum length for a parameter name, including the full length of the parameter Amazon Resource Name (ARN), is 1011 characters. For example, the length of the following parameter name is 65 characters, not 20 characters: ``arn:aws:ssm:us-east-2:111222333444:parameter/ExampleParameterName``
+        :param name: The name of the parameter. .. epigraph:: The reported maximum length of 2048 characters for a parameter name includes 1037 characters that are reserved for internal use by Systems Manager . The maximum length for a parameter name that you specify is 1011 characters. This count of 1011 characters includes the characters in the ARN that precede the name you specify. This ARN length will vary depending on your partition and Region. For example, the following 45 characters count toward the 1011 character maximum for a parameter created in the US East (Ohio) Region: ``arn:aws:ssm:us-east-2:111122223333:parameter/`` .
         :param policies: Information about the policies assigned to a parameter. `Assigning parameter policies <https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-policies.html>`_ in the *AWS Systems Manager User Guide* .
         :param tags: Optional metadata that you assign to a resource in the form of an arbitrary set of tags (key-value pairs). Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a Systems Manager parameter to identify the type of resource to which it applies, the environment, or the type of configuration data referenced by the parameter.
         :param tier: The parameter tier.
@@ -5120,7 +5256,9 @@ class CfnParameterProps:
 
         .. epigraph::
 
-           The maximum length constraint listed below includes capacity for additional system attributes that aren't part of the name. The maximum length for a parameter name, including the full length of the parameter Amazon Resource Name (ARN), is 1011 characters. For example, the length of the following parameter name is 65 characters, not 20 characters: ``arn:aws:ssm:us-east-2:111222333444:parameter/ExampleParameterName``
+           The reported maximum length of 2048 characters for a parameter name includes 1037 characters that are reserved for internal use by Systems Manager . The maximum length for a parameter name that you specify is 1011 characters.
+
+           This count of 1011 characters includes the characters in the ARN that precede the name you specify. This ARN length will vary depending on your partition and Region. For example, the following 45 characters count toward the 1011 character maximum for a parameter created in the US East (Ohio) Region: ``arn:aws:ssm:us-east-2:111122223333:parameter/`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.html#cfn-ssm-parameter-name
         '''
@@ -5170,7 +5308,7 @@ class CfnParameterProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IPatchBaselineRef_f929afe1, _ITaggable_36806126)
 class CfnPatchBaseline(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -5213,6 +5351,7 @@ class CfnPatchBaseline(
             approved_patches=["approvedPatches"],
             approved_patches_compliance_level="approvedPatchesComplianceLevel",
             approved_patches_enable_non_security=False,
+            available_security_updates_compliance_status="availableSecurityUpdatesComplianceStatus",
             default_baseline=False,
             description="description",
             global_filters=ssm.CfnPatchBaseline.PatchFilterGroupProperty(
@@ -5247,6 +5386,7 @@ class CfnPatchBaseline(
         approved_patches: typing.Optional[typing.Sequence[builtins.str]] = None,
         approved_patches_compliance_level: typing.Optional[builtins.str] = None,
         approved_patches_enable_non_security: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        available_security_updates_compliance_status: typing.Optional[builtins.str] = None,
         default_baseline: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         description: typing.Optional[builtins.str] = None,
         global_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPatchBaseline.PatchFilterGroupProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -5257,7 +5397,8 @@ class CfnPatchBaseline(
         sources: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPatchBaseline.PatchSourceProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::PatchBaseline``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: The name of the patch baseline.
@@ -5265,13 +5406,14 @@ class CfnPatchBaseline(
         :param approved_patches: A list of explicitly approved patches for the baseline. For information about accepted formats for lists of approved patches and rejected patches, see `Package name formats for approved and rejected patch lists <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html>`_ in the *AWS Systems Manager User Guide* .
         :param approved_patches_compliance_level: Defines the compliance level for approved patches. When an approved patch is reported as missing, this value describes the severity of the compliance violation. The default value is ``UNSPECIFIED`` . Default: - "UNSPECIFIED"
         :param approved_patches_enable_non_security: Indicates whether the list of approved patches includes non-security updates that should be applied to the managed nodes. The default value is ``false`` . Applies to Linux managed nodes only. Default: - false
+        :param available_security_updates_compliance_status: Indicates the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline. Example scenario: Security patches that you might want installed can be skipped if you have specified a long period to wait after a patch is released before installation. If an update to the patch is released during your specified waiting period, the waiting period for installing the patch starts over. If the waiting period is too long, multiple versions of the patch could be released but never installed. Supported for Windows Server managed nodes only.
         :param default_baseline: Indicates whether this is the default baseline. AWS Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system. Default: - false
         :param description: A description of the patch baseline.
         :param global_filters: A set of global filters used to include patches in the baseline. .. epigraph:: The ``GlobalFilters`` parameter can be configured only by using the AWS CLI or an AWS SDK. It can't be configured from the Patch Manager console, and its value isn't displayed in the console.
         :param operating_system: Defines the operating system the patch baseline applies to. The default value is ``WINDOWS`` . Default: - "WINDOWS"
         :param patch_groups: The name of the patch group to be registered with the patch baseline.
         :param rejected_patches: A list of explicitly rejected patches for the baseline. For information about accepted formats for lists of approved patches and rejected patches, see `Package name formats for approved and rejected patch lists <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html>`_ in the *AWS Systems Manager User Guide* .
-        :param rejected_patches_action: The action for Patch Manager to take on patches included in the ``RejectedPackages`` list. - **ALLOW_AS_DEPENDENCY** - *Linux and macOS* : A package in the rejected patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as ``INSTALLED_OTHER`` . This is the default action if no option is specified. *Windows Server* : Windows Server doesn't support the concept of package dependencies. If a package in the rejected patches list and already installed on the node, its status is reported as ``INSTALLED_OTHER`` . Any package not already installed on the node is skipped. This is the default action if no option is specified. - **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as ``INSTALLED_REJECTED`` . Default: - "ALLOW_AS_DEPENDENCY"
+        :param rejected_patches_action: The action for Patch Manager to take on patches included in the ``RejectedPackages`` list. - **ALLOW_AS_DEPENDENCY** - *Linux and macOS* : A package in the rejected patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as ``INSTALLED_OTHER`` . This is the default action if no option is specified. *Windows Server* : Windows Server doesn't support the concept of package dependencies. If a package in the rejected patches list and already installed on the node, its status is reported as ``INSTALLED_OTHER`` . Any package not already installed on the node is skipped. This is the default action if no option is specified. - **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. State value assignment for patch compliance: - If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as ``INSTALLED_REJECTED`` . - If an update attempts to install a dependency package that is now rejected by the baseline, when previous versions of the package were not rejected, the package being updated is reported as ``MISSING`` for ``SCAN`` operations and as ``FAILED`` for ``INSTALL`` operations. Default: - "ALLOW_AS_DEPENDENCY"
         :param sources: Information about the patches to use to update the managed nodes, including target operating systems and source repositories. Applies to Linux managed nodes only.
         :param tags: Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a patch baseline to identify the severity level of patches it specifies and the operating system family it applies to.
         '''
@@ -5285,6 +5427,7 @@ class CfnPatchBaseline(
             approved_patches=approved_patches,
             approved_patches_compliance_level=approved_patches_compliance_level,
             approved_patches_enable_non_security=approved_patches_enable_non_security,
+            available_security_updates_compliance_status=available_security_updates_compliance_status,
             default_baseline=default_baseline,
             description=description,
             global_filters=global_filters,
@@ -5342,6 +5485,12 @@ class CfnPatchBaseline(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="patchBaselineRef")
+    def patch_baseline_ref(self) -> _PatchBaselineReference_b75c4dc5:
+        '''A reference to a PatchBaseline resource.'''
+        return typing.cast(_PatchBaselineReference_b75c4dc5, jsii.get(self, "patchBaselineRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -5429,6 +5578,24 @@ class CfnPatchBaseline(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "approvedPatchesEnableNonSecurity", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="availableSecurityUpdatesComplianceStatus")
+    def available_security_updates_compliance_status(
+        self,
+    ) -> typing.Optional[builtins.str]:
+        '''Indicates the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "availableSecurityUpdatesComplianceStatus"))
+
+    @available_security_updates_compliance_status.setter
+    def available_security_updates_compliance_status(
+        self,
+        value: typing.Optional[builtins.str],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b3d22bb7723ec324262f77916922eeca45b414ed52032b18a9facc597e01c7c3)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "availableSecurityUpdatesComplianceStatus", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="defaultBaseline")
     def default_baseline(
@@ -5725,7 +5892,7 @@ class CfnPatchBaseline(
 
             The AWS CloudFormation ``AWS::SSM::PatchSource`` resource is used to provide information about the patches to use to update target instances, including target operating systems and source repository. Applies to Linux managed nodes only.
 
-            :param configuration: The value of the yum repo configuration. For example:. ``[main]`` ``name=MyCustomRepository`` ``baseurl=https://my-custom-repository`` ``enabled=1`` .. epigraph:: For information about other options available for your yum repository configuration, see `dnf.conf(5) <https://docs.aws.amazon.com/https://man7.org/linux/man-pages/man5/dnf.conf.5.html>`_ .
+            :param configuration: The value of the repo configuration. *Example for yum repositories* ``[main]`` ``name=MyCustomRepository`` ``baseurl=https://my-custom-repository`` ``enabled=1`` For information about other options available for your yum repository configuration, see `dnf.conf(5) <https://docs.aws.amazon.com/https://man7.org/linux/man-pages/man5/dnf.conf.5.html>`_ on the *man7.org* website. *Examples for Ubuntu Server and Debian Server* ``deb http://security.ubuntu.com/ubuntu jammy main`` ``deb https://site.example.com/debian distribution component1 component2 component3`` Repo information for Ubuntu Server repositories must be specifed in a single line. For more examples and information, see `jammy (5) sources.list.5.gz <https://docs.aws.amazon.com/https://manpages.ubuntu.com/manpages/jammy/man5/sources.list.5.html>`_ on the *Ubuntu Server Manuals* website and `sources.list format <https://docs.aws.amazon.com/https://wiki.debian.org/SourcesList#sources.list_format>`_ on the *Debian Wiki* .
             :param name: The name specified to identify the patch source.
             :param products: The specific operating system versions a patch repository applies to, such as "Ubuntu16.04", "RedhatEnterpriseLinux7.2" or "Suse12.7". For lists of supported product values, see `PatchFilter <https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html>`_ in the *AWS Systems Manager API Reference* .
 
@@ -5759,7 +5926,9 @@ class CfnPatchBaseline(
 
         @builtins.property
         def configuration(self) -> typing.Optional[builtins.str]:
-            '''The value of the yum repo configuration. For example:.
+            '''The value of the repo configuration.
+
+            *Example for yum repositories*
 
             ``[main]``
 
@@ -5768,9 +5937,16 @@ class CfnPatchBaseline(
             ``baseurl=https://my-custom-repository``
 
             ``enabled=1``
-            .. epigraph::
 
-               For information about other options available for your yum repository configuration, see `dnf.conf(5) <https://docs.aws.amazon.com/https://man7.org/linux/man-pages/man5/dnf.conf.5.html>`_ .
+            For information about other options available for your yum repository configuration, see `dnf.conf(5) <https://docs.aws.amazon.com/https://man7.org/linux/man-pages/man5/dnf.conf.5.html>`_ on the *man7.org* website.
+
+            *Examples for Ubuntu Server and Debian Server*
+
+            ``deb http://security.ubuntu.com/ubuntu jammy main``
+
+            ``deb https://site.example.com/debian distribution component1 component2 component3``
+
+            Repo information for Ubuntu Server repositories must be specifed in a single line. For more examples and information, see `jammy (5) sources.list.5.gz <https://docs.aws.amazon.com/https://manpages.ubuntu.com/manpages/jammy/man5/sources.list.5.html>`_ on the *Ubuntu Server Manuals* website and `sources.list format <https://docs.aws.amazon.com/https://wiki.debian.org/SourcesList#sources.list_format>`_ on the *Debian Wiki* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-patchbaseline-patchsource.html#cfn-ssm-patchbaseline-patchsource-configuration
             '''
@@ -5901,8 +6077,8 @@ class CfnPatchBaseline(
 
             The ``PatchRules`` property of the `RuleGroup <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-patchbaseline-rulegroup.html>`_ property type contains a list of ``Rule`` property types.
 
-            :param approve_after_days: The number of days after the release date of each patch matched by the rule that the patch is marked as approved in the patch baseline. For example, a value of ``7`` means that patches are approved seven days after they are released. This parameter is marked as ``Required: No`` , but your request must include a value for either ``ApproveAfterDays`` or ``ApproveUntilDate`` . Not supported for Debian Server or Ubuntu Server. .. epigraph:: Use caution when setting this value for Windows Server patch baselines. Because patch updates that are replaced by later updates are removed, setting too broad a value for this parameter can result in crucial patches not being installed. For more information, see the *Windows Server* tab in the topic `How security patches are selected <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-selecting-patches.html>`_ in the *AWS Systems Manager User Guide* .
-            :param approve_until_date: The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically. Enter dates in the format ``YYYY-MM-DD`` . For example, ``2024-12-31`` . This parameter is marked as ``Required: No`` , but your request must include a value for either ``ApproveUntilDate`` or ``ApproveAfterDays`` . Not supported for Debian Server or Ubuntu Server. .. epigraph:: Use caution when setting this value for Windows Server patch baselines. Because patch updates that are replaced by later updates are removed, setting too broad a value for this parameter can result in crucial patches not being installed. For more information, see the *Windows Server* tab in the topic `How security patches are selected <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-selecting-patches.html>`_ in the *AWS Systems Manager User Guide* .
+            :param approve_after_days: The number of days after the release date of each patch matched by the rule that the patch is marked as approved in the patch baseline. For example, a value of ``7`` means that patches are approved seven days after they are released. Patch Manager evaluates patch release dates using Coordinated Universal Time (UTC). If the day represented by ``7`` is ``2025-11-16`` , patches released between ``2025-11-16T00:00:00Z`` and ``2025-11-16T23:59:59Z`` will be included in the approval. This parameter is marked as ``Required: No`` , but your request must include a value for either ``ApproveAfterDays`` or ``ApproveUntilDate`` . Not supported for Debian Server or Ubuntu Server. .. epigraph:: Use caution when setting this value for Windows Server patch baselines. Because patch updates that are replaced by later updates are removed, setting too broad a value for this parameter can result in crucial patches not being installed. For more information, see the *Windows Server* tab in the topic `How security patches are selected <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-selecting-patches.html>`_ in the *AWS Systems Manager User Guide* .
+            :param approve_until_date: The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically. Enter dates in the format ``YYYY-MM-DD`` . For example, ``2025-11-16`` . Patch Manager evaluates patch release dates using Coordinated Universal Time (UTC). If you enter the date ``2025-11-16`` , patches released between ``2025-11-16T00:00:00Z`` and ``2025-11-16T23:59:59Z`` will be included in the approval. This parameter is marked as ``Required: No`` , but your request must include a value for either ``ApproveUntilDate`` or ``ApproveAfterDays`` . Not supported for Debian Server or Ubuntu Server. .. epigraph:: Use caution when setting this value for Windows Server patch baselines. Because patch updates that are replaced by later updates are removed, setting too broad a value for this parameter can result in crucial patches not being installed. For more information, see the *Windows Server* tab in the topic `How security patches are selected <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-selecting-patches.html>`_ in the *AWS Systems Manager User Guide* .
             :param compliance_level: A compliance severity level for all approved patches in a patch baseline. Valid compliance severity levels include the following: ``UNSPECIFIED`` , ``CRITICAL`` , ``HIGH`` , ``MEDIUM`` , ``LOW`` , and ``INFORMATIONAL`` .
             :param enable_non_security: For managed nodes identified by the approval rule filters, enables a patch baseline to apply non-security updates available in the specified repository. The default value is ``false`` . Applies to Linux managed nodes only. Default: - false
             :param patch_filter_group: The patch filter group that defines the criteria for the rule.
@@ -5954,6 +6130,8 @@ class CfnPatchBaseline(
 
             For example, a value of ``7`` means that patches are approved seven days after they are released.
 
+            Patch Manager evaluates patch release dates using Coordinated Universal Time (UTC). If the day represented by ``7`` is ``2025-11-16`` , patches released between ``2025-11-16T00:00:00Z`` and ``2025-11-16T23:59:59Z`` will be included in the approval.
+
             This parameter is marked as ``Required: No`` , but your request must include a value for either ``ApproveAfterDays`` or ``ApproveUntilDate`` .
 
             Not supported for Debian Server or Ubuntu Server.
@@ -5972,7 +6150,9 @@ class CfnPatchBaseline(
 
             Any patches released on or before this date are installed automatically.
 
-            Enter dates in the format ``YYYY-MM-DD`` . For example, ``2024-12-31`` .
+            Enter dates in the format ``YYYY-MM-DD`` . For example, ``2025-11-16`` .
+
+            Patch Manager evaluates patch release dates using Coordinated Universal Time (UTC). If you enter the date ``2025-11-16`` , patches released between ``2025-11-16T00:00:00Z`` and ``2025-11-16T23:59:59Z`` will be included in the approval.
 
             This parameter is marked as ``Required: No`` , but your request must include a value for either ``ApproveUntilDate`` or ``ApproveAfterDays`` .
 
@@ -6044,6 +6224,7 @@ class CfnPatchBaseline(
         "approved_patches": "approvedPatches",
         "approved_patches_compliance_level": "approvedPatchesComplianceLevel",
         "approved_patches_enable_non_security": "approvedPatchesEnableNonSecurity",
+        "available_security_updates_compliance_status": "availableSecurityUpdatesComplianceStatus",
         "default_baseline": "defaultBaseline",
         "description": "description",
         "global_filters": "globalFilters",
@@ -6064,6 +6245,7 @@ class CfnPatchBaselineProps:
         approved_patches: typing.Optional[typing.Sequence[builtins.str]] = None,
         approved_patches_compliance_level: typing.Optional[builtins.str] = None,
         approved_patches_enable_non_security: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        available_security_updates_compliance_status: typing.Optional[builtins.str] = None,
         default_baseline: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         description: typing.Optional[builtins.str] = None,
         global_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPatchBaseline.PatchFilterGroupProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -6081,13 +6263,14 @@ class CfnPatchBaselineProps:
         :param approved_patches: A list of explicitly approved patches for the baseline. For information about accepted formats for lists of approved patches and rejected patches, see `Package name formats for approved and rejected patch lists <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html>`_ in the *AWS Systems Manager User Guide* .
         :param approved_patches_compliance_level: Defines the compliance level for approved patches. When an approved patch is reported as missing, this value describes the severity of the compliance violation. The default value is ``UNSPECIFIED`` . Default: - "UNSPECIFIED"
         :param approved_patches_enable_non_security: Indicates whether the list of approved patches includes non-security updates that should be applied to the managed nodes. The default value is ``false`` . Applies to Linux managed nodes only. Default: - false
+        :param available_security_updates_compliance_status: Indicates the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline. Example scenario: Security patches that you might want installed can be skipped if you have specified a long period to wait after a patch is released before installation. If an update to the patch is released during your specified waiting period, the waiting period for installing the patch starts over. If the waiting period is too long, multiple versions of the patch could be released but never installed. Supported for Windows Server managed nodes only.
         :param default_baseline: Indicates whether this is the default baseline. AWS Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system. Default: - false
         :param description: A description of the patch baseline.
         :param global_filters: A set of global filters used to include patches in the baseline. .. epigraph:: The ``GlobalFilters`` parameter can be configured only by using the AWS CLI or an AWS SDK. It can't be configured from the Patch Manager console, and its value isn't displayed in the console.
         :param operating_system: Defines the operating system the patch baseline applies to. The default value is ``WINDOWS`` . Default: - "WINDOWS"
         :param patch_groups: The name of the patch group to be registered with the patch baseline.
         :param rejected_patches: A list of explicitly rejected patches for the baseline. For information about accepted formats for lists of approved patches and rejected patches, see `Package name formats for approved and rejected patch lists <https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html>`_ in the *AWS Systems Manager User Guide* .
-        :param rejected_patches_action: The action for Patch Manager to take on patches included in the ``RejectedPackages`` list. - **ALLOW_AS_DEPENDENCY** - *Linux and macOS* : A package in the rejected patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as ``INSTALLED_OTHER`` . This is the default action if no option is specified. *Windows Server* : Windows Server doesn't support the concept of package dependencies. If a package in the rejected patches list and already installed on the node, its status is reported as ``INSTALLED_OTHER`` . Any package not already installed on the node is skipped. This is the default action if no option is specified. - **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as ``INSTALLED_REJECTED`` . Default: - "ALLOW_AS_DEPENDENCY"
+        :param rejected_patches_action: The action for Patch Manager to take on patches included in the ``RejectedPackages`` list. - **ALLOW_AS_DEPENDENCY** - *Linux and macOS* : A package in the rejected patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as ``INSTALLED_OTHER`` . This is the default action if no option is specified. *Windows Server* : Windows Server doesn't support the concept of package dependencies. If a package in the rejected patches list and already installed on the node, its status is reported as ``INSTALLED_OTHER`` . Any package not already installed on the node is skipped. This is the default action if no option is specified. - **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. State value assignment for patch compliance: - If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as ``INSTALLED_REJECTED`` . - If an update attempts to install a dependency package that is now rejected by the baseline, when previous versions of the package were not rejected, the package being updated is reported as ``MISSING`` for ``SCAN`` operations and as ``FAILED`` for ``INSTALL`` operations. Default: - "ALLOW_AS_DEPENDENCY"
         :param sources: Information about the patches to use to update the managed nodes, including target operating systems and source repositories. Applies to Linux managed nodes only.
         :param tags: Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a patch baseline to identify the severity level of patches it specifies and the operating system family it applies to.
 
@@ -6121,6 +6304,7 @@ class CfnPatchBaselineProps:
                 approved_patches=["approvedPatches"],
                 approved_patches_compliance_level="approvedPatchesComplianceLevel",
                 approved_patches_enable_non_security=False,
+                available_security_updates_compliance_status="availableSecurityUpdatesComplianceStatus",
                 default_baseline=False,
                 description="description",
                 global_filters=ssm.CfnPatchBaseline.PatchFilterGroupProperty(
@@ -6151,6 +6335,7 @@ class CfnPatchBaselineProps:
             check_type(argname="argument approved_patches", value=approved_patches, expected_type=type_hints["approved_patches"])
             check_type(argname="argument approved_patches_compliance_level", value=approved_patches_compliance_level, expected_type=type_hints["approved_patches_compliance_level"])
             check_type(argname="argument approved_patches_enable_non_security", value=approved_patches_enable_non_security, expected_type=type_hints["approved_patches_enable_non_security"])
+            check_type(argname="argument available_security_updates_compliance_status", value=available_security_updates_compliance_status, expected_type=type_hints["available_security_updates_compliance_status"])
             check_type(argname="argument default_baseline", value=default_baseline, expected_type=type_hints["default_baseline"])
             check_type(argname="argument description", value=description, expected_type=type_hints["description"])
             check_type(argname="argument global_filters", value=global_filters, expected_type=type_hints["global_filters"])
@@ -6171,6 +6356,8 @@ class CfnPatchBaselineProps:
             self._values["approved_patches_compliance_level"] = approved_patches_compliance_level
         if approved_patches_enable_non_security is not None:
             self._values["approved_patches_enable_non_security"] = approved_patches_enable_non_security
+        if available_security_updates_compliance_status is not None:
+            self._values["available_security_updates_compliance_status"] = available_security_updates_compliance_status
         if default_baseline is not None:
             self._values["default_baseline"] = default_baseline
         if description is not None:
@@ -6250,6 +6437,21 @@ class CfnPatchBaselineProps:
         result = self._values.get("approved_patches_enable_non_security")
         return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
 
+    @builtins.property
+    def available_security_updates_compliance_status(
+        self,
+    ) -> typing.Optional[builtins.str]:
+        '''Indicates the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline.
+
+        Example scenario: Security patches that you might want installed can be skipped if you have specified a long period to wait after a patch is released before installation. If an update to the patch is released during your specified waiting period, the waiting period for installing the patch starts over. If the waiting period is too long, multiple versions of the patch could be released but never installed.
+
+        Supported for Windows Server managed nodes only.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-patchbaseline.html#cfn-ssm-patchbaseline-availablesecurityupdatescompliancestatus
+        '''
+        result = self._values.get("available_security_updates_compliance_status")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def default_baseline(
         self,
@@ -6330,7 +6532,12 @@ class CfnPatchBaselineProps:
 
         *Windows Server* : Windows Server doesn't support the concept of package dependencies. If a package in the rejected patches list and already installed on the node, its status is reported as ``INSTALLED_OTHER`` . Any package not already installed on the node is skipped. This is the default action if no option is specified.
 
-        - **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as ``INSTALLED_REJECTED`` .
+        - **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances.
+
+        State value assignment for patch compliance:
+
+        - If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as ``INSTALLED_REJECTED`` .
+        - If an update attempts to install a dependency package that is now rejected by the baseline, when previous versions of the package were not rejected, the package being updated is reported as ``MISSING`` for ``SCAN`` operations and as ``FAILED`` for ``INSTALL`` operations.
 
         :default: - "ALLOW_AS_DEPENDENCY"
 
@@ -6375,7 +6582,7 @@ class CfnPatchBaselineProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResourceDataSyncRef_e153aa7a)
 class CfnResourceDataSync(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -6458,7 +6665,8 @@ class CfnResourceDataSync(
         sync_source: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResourceDataSync.SyncSourceProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         sync_type: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::ResourceDataSync``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param sync_name: A name for the resource data sync.
@@ -6489,6 +6697,27 @@ class CfnResourceDataSync(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromSyncName")
+    @builtins.classmethod
+    def from_sync_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        sync_name: builtins.str,
+    ) -> _IResourceDataSyncRef_e153aa7a:
+        '''Creates a new IResourceDataSyncRef from a syncName.
+
+        :param scope: -
+        :param id: -
+        :param sync_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__8cedf0c69b18eabda62c763c9450657c3f2ff5e3fd11df7e4494672287104d75)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument sync_name", value=sync_name, expected_type=type_hints["sync_name"])
+        return typing.cast(_IResourceDataSyncRef_e153aa7a, jsii.sinvoke(cls, "fromSyncName", [scope, id, sync_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -6532,6 +6761,12 @@ class CfnResourceDataSync(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourceDataSyncRef")
+    def resource_data_sync_ref(self) -> _ResourceDataSyncReference_a81c599c:
+        '''A reference to a ResourceDataSync resource.'''
+        return typing.cast(_ResourceDataSyncReference_a81c599c, jsii.get(self, "resourceDataSyncRef"))
+
     @builtins.property
     @jsii.member(jsii_name="syncName")
     def sync_name(self) -> builtins.str:
@@ -7208,7 +7443,7 @@ class CfnResourceDataSyncProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResourcePolicyRef_8068eedb)
 class CfnResourcePolicy(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -7244,7 +7479,8 @@ class CfnResourcePolicy(
         policy: typing.Any,
         resource_arn: builtins.str,
     ) -> None:
-        '''
+        '''Create a new ``AWS::SSM::ResourcePolicy``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param policy: A policy you want to associate with a resource.
@@ -7313,6 +7549,12 @@ class CfnResourcePolicy(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicyRef")
+    def resource_policy_ref(self) -> _ResourcePolicyReference_937b9005:
+        '''A reference to a ResourcePolicy resource.'''
+        return typing.cast(_ResourcePolicyReference_937b9005, jsii.get(self, "resourcePolicyRef"))
+
     @builtins.property
     @jsii.member(jsii_name="policy")
     def policy(self) -> typing.Any:
@@ -8834,6 +9076,8 @@ class StringParameter(
         scope: _constructs_77d1e7e8.Construct,
         parameter_name: builtins.str,
         default_value: typing.Optional[builtins.str] = None,
+        *,
+        additional_cache_key: typing.Optional[builtins.str] = None,
     ) -> builtins.str:
         '''Reads the value of an SSM parameter during synthesis through an environmental context provider.
 
@@ -8847,13 +9091,18 @@ class StringParameter(
         :param scope: -
         :param parameter_name: -
         :param default_value: -
+        :param additional_cache_key: Adds an additional discriminator to the ``cdk.context.json`` cache key. Default: - no additional cache key
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__352ba5506c7762dcb469028a7b0515dc3daed2b43c5a8ff339ed16372f650250)
             check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
             check_type(argname="argument parameter_name", value=parameter_name, expected_type=type_hints["parameter_name"])
             check_type(argname="argument default_value", value=default_value, expected_type=type_hints["default_value"])
-        return typing.cast(builtins.str, jsii.sinvoke(cls, "valueFromLookup", [scope, parameter_name, default_value]))
+        options = StringParameterLookupOptions(
+            additional_cache_key=additional_cache_key
+        )
+
+        return typing.cast(builtins.str, jsii.sinvoke(cls, "valueFromLookup", [scope, parameter_name, default_value, options]))
 
     @jsii.member(jsii_name="grantRead")
     def grant_read(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
@@ -9100,6 +9349,55 @@ class StringParameterAttributes(CommonStringParameterAttributes):
         )
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_ssm.StringParameterLookupOptions",
+    jsii_struct_bases=[],
+    name_mapping={"additional_cache_key": "additionalCacheKey"},
+)
+class StringParameterLookupOptions:
+    def __init__(
+        self,
+        *,
+        additional_cache_key: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''Additional properties for looking up an existing StringParameter.
+
+        :param additional_cache_key: Adds an additional discriminator to the ``cdk.context.json`` cache key. Default: - no additional cache key
+
+        :exampleMetadata: infused
+
+        Example::
+
+            string_value = ssm.StringParameter.value_from_lookup(self, "/My/Public/Parameter", undefined, additional_cache_key=self.node.path)
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0b618e024c5c8f9f30e5674f96c195555764789c667bad41049a169d5d6af1d3)
+            check_type(argname="argument additional_cache_key", value=additional_cache_key, expected_type=type_hints["additional_cache_key"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if additional_cache_key is not None:
+            self._values["additional_cache_key"] = additional_cache_key
+
+    @builtins.property
+    def additional_cache_key(self) -> typing.Optional[builtins.str]:
+        '''Adds an additional discriminator to the ``cdk.context.json`` cache key.
+
+        :default: - no additional cache key
+        '''
+        result = self._values.get("additional_cache_key")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "StringParameterLookupOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_ssm.StringParameterProps",
     jsii_struct_bases=[ParameterOptions],
@@ -9327,6 +9625,7 @@ __all__ = [
     "StringListParameterProps",
     "StringParameter",
     "StringParameterAttributes",
+    "StringParameterLookupOptions",
     "StringParameterProps",
 ]
 
@@ -9357,6 +9656,14 @@ def _typecheckingstub__92579425f735301e17a993e7df464a283a7d42ba685c2d4205cf945db
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__b2a4e2f6f1ad5f1b777c7a5fcb533625aa60df723d920b56a3738329f8b631cb(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    association_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__04dced959ace7c06e46713696a2e0111696820a92076dddbfb0d4e73ef74ff78(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -9536,6 +9843,14 @@ def _typecheckingstub__4d0587e99b7ec516726ff27f1c34b1714d8645ad06944d59be27a6125
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__0c67b192e3e153596beb12dc7520f7cbf677768f2e862aa4d968b306611aea53(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    document_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e943c2273ff892e2fdd4d583a1890854bb12dbd590854b62347e2fa9562d5a14(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -10168,6 +10483,7 @@ def _typecheckingstub__5b87565e6649bbe5a503013adf6ae874b3dc918c05cd6b120b99a77e8
     approved_patches: typing.Optional[typing.Sequence[builtins.str]] = None,
     approved_patches_compliance_level: typing.Optional[builtins.str] = None,
     approved_patches_enable_non_security: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    available_security_updates_compliance_status: typing.Optional[builtins.str] = None,
     default_baseline: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     description: typing.Optional[builtins.str] = None,
     global_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPatchBaseline.PatchFilterGroupProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -10223,6 +10539,12 @@ def _typecheckingstub__596ca4adbe9b66ae96ac84884c609e25720aab40b7f9d665e6ea16808
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__b3d22bb7723ec324262f77916922eeca45b414ed52032b18a9facc597e01c7c3(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__a82f38addd776fccd7d2225bc356d9a6e4dc42b938cbf56c083c34cd4994c239(
     value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
 ) -> None:
@@ -10326,6 +10648,7 @@ def _typecheckingstub__ff6666a30d275f2a85d64de631c940fb83198b8b5a376b87a3a684f4a
     approved_patches: typing.Optional[typing.Sequence[builtins.str]] = None,
     approved_patches_compliance_level: typing.Optional[builtins.str] = None,
     approved_patches_enable_non_security: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    available_security_updates_compliance_status: typing.Optional[builtins.str] = None,
     default_baseline: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     description: typing.Optional[builtins.str] = None,
     global_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPatchBaseline.PatchFilterGroupProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -10356,6 +10679,14 @@ def _typecheckingstub__c8a24f4d86cad49691c9635278face17e76a24ad5a69daef9687e1e2d
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__8cedf0c69b18eabda62c763c9450657c3f2ff5e3fd11df7e4494672287104d75(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    sync_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__23f6022ac7efc29929aa079bf79384c8ac5f0ba1718316a5dd4e06c591b9203d(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -10722,6 +11053,8 @@ def _typecheckingstub__352ba5506c7762dcb469028a7b0515dc3daed2b43c5a8ff339ed16372
     scope: _constructs_77d1e7e8.Construct,
     parameter_name: builtins.str,
     default_value: typing.Optional[builtins.str] = None,
+    *,
+    additional_cache_key: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -10750,6 +11083,13 @@ def _typecheckingstub__045695ee32d353600237b891b14ad138098a0add8ba99199144ee57ef
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__0b618e024c5c8f9f30e5674f96c195555764789c667bad41049a169d5d6af1d3(
+    *,
+    additional_cache_key: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__a14e5cea1d211f374b7c289d526224c03be1f2e91a2a94cbcdf8f1d251335822(
     *,
     allowed_pattern: typing.Optional[builtins.str] = None,
@@ -10763,3 +11103,6 @@ def _typecheckingstub__a14e5cea1d211f374b7c289d526224c03be1f2e91a2a94cbcdf8f1d25
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [IParameter, IStringListParameter, IStringParameter]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])