aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_amazonmq/__init__.py

@@ -66,19 +66,25 @@ from .. import (
     TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
+from ..interfaces.aws_amazonmq import (
+    BrokerReference as _BrokerReference_1d1cbbf7,
+    ConfigurationAssociationReference as _ConfigurationAssociationReference_c6685840,
+    ConfigurationReference as _ConfigurationReference_19cddfe8,
+    IBrokerRef as _IBrokerRef_bd875819,
+    IConfigurationAssociationRef as _IConfigurationAssociationRef_98fafe4d,
+    IConfigurationRef as _IConfigurationRef_769e84b9,
+)
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IBrokerRef_bd875819, _ITaggable_36806126)
 class CfnBroker(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_amazonmq.CfnBroker",
 ):
-    '''A *broker* is a message broker environment running on Amazon MQ .
-
-    It is the basic building block of Amazon MQ .
+    '''Creates a broker. Note: This API is asynchronous.
 
-    The ``AWS::AmazonMQ::Broker`` resource lets you create Amazon MQ for ActiveMQ and Amazon MQ for RabbitMQ brokers, add configuration changes or modify users for a speified ActiveMQ broker, return information about the specified broker, and delete the broker. For more information, see `How Amazon MQ works <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/amazon-mq-how-it-works.html>`_ in the *Amazon MQ Developer Guide* .
+    To create a broker, you must either use the ``AmazonMQFullAccess`` IAM policy or include the following EC2 permissions in your IAM policy.
 
     - ``ec2:CreateNetworkInterface``
 
@@ -99,6 +105,8 @@ class CfnBroker(
     - ``ec2:DescribeSubnets``
     - ``ec2:DescribeVpcs``
 
+    For more information, see `Create an IAM User and Get Your AWS Credentials <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/amazon-mq-setting-up.html#create-iam-user>`_ and `Never Modify or Delete the Amazon MQ Elastic Network Interface <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/connecting-to-amazon-mq.html#never-modify-delete-elastic-network-interface>`_ in the *Amazon MQ Developer Guide* .
+
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html
     :cloudformationResource: AWS::AmazonMQ::Broker
     :exampleMetadata: fixture=_generated
@@ -115,16 +123,6 @@ class CfnBroker(
             engine_type="engineType",
             host_instance_type="hostInstanceType",
             publicly_accessible=False,
-            users=[amazonmq.CfnBroker.UserProperty(
-                password="password",
-                username="username",
-        
-                # the properties below are optional
-                console_access=False,
-                groups=["groups"],
-                jolokia_api_access="jolokiaApiAccess",
-                replication_user=False
-            )],
         
             # the properties below are optional
             authentication_strategy="authenticationStrategy",
@@ -146,7 +144,6 @@ class CfnBroker(
                 hosts=["hosts"],
                 role_base="roleBase",
                 role_search_matching="roleSearchMatching",
-                service_account_password="serviceAccountPassword",
                 service_account_username="serviceAccountUsername",
                 user_base="userBase",
                 user_search_matching="userSearchMatching",
@@ -154,6 +151,7 @@ class CfnBroker(
                 # the properties below are optional
                 role_name="roleName",
                 role_search_subtree=False,
+                service_account_password="serviceAccountPassword",
                 user_role_name="userRoleName",
                 user_search_subtree=False
             ),
@@ -172,6 +170,15 @@ class CfnBroker(
             tags=[amazonmq.CfnBroker.TagsEntryProperty(
                 key="key",
                 value="value"
+            )],
+            users=[amazonmq.CfnBroker.UserProperty(
+                password="password",
+                username="username",
+        
+                # the properties below are optional
+                console_access=False,
+                groups=["groups"],
+                replication_user=False
             )]
         )
     '''
@@ -186,7 +193,6 @@ class CfnBroker(
         engine_type: builtins.str,
         host_instance_type: builtins.str,
         publicly_accessible: typing.Union[builtins.bool, _IResolvable_da3f097b],
-        users: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnBroker.UserProperty", typing.Dict[builtins.str, typing.Any]]]]],
         authentication_strategy: typing.Optional[builtins.str] = None,
         auto_minor_version_upgrade: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnBroker.ConfigurationIdProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -201,30 +207,32 @@ class CfnBroker(
         storage_type: typing.Optional[builtins.str] = None,
         subnet_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union["CfnBroker.TagsEntryProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        users: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnBroker.UserProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AmazonMQ::Broker``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param broker_name: The name of the broker. This value must be unique in your AWS account , 1-50 characters long, must contain only letters, numbers, dashes, and underscores, and must not contain white spaces, brackets, wildcard characters, or special characters. .. epigraph:: Do not add personally identifiable information (PII) or other confidential or sensitive information in broker names. Broker names are accessible to other AWS services, including C CloudWatch Logs . Broker names are not intended to be used for private or sensitive data.
-        :param deployment_mode: The deployment mode of the broker. Available values:. - ``SINGLE_INSTANCE`` - ``ACTIVE_STANDBY_MULTI_AZ`` - ``CLUSTER_MULTI_AZ``
-        :param engine_type: The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
-        :param host_instance_type: The broker's instance type.
-        :param publicly_accessible: Enables connections from applications outside of the VPC that hosts the broker's subnets.
-        :param users: The list of broker users (persons or applications) who can access queues and topics. For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent RabbitMQ users are created by via the RabbitMQ web console or by using the RabbitMQ management API.
+        :param broker_name: Required. The broker's name. This value must be unique in your AWS account , 1-50 characters long, must contain only letters, numbers, dashes, and underscores, and must not contain white spaces, brackets, wildcard characters, or special characters. .. epigraph:: Do not add personally identifiable information (PII) or other confidential or sensitive information in broker names. Broker names are accessible to other AWS services, including CloudWatch Logs . Broker names are not intended to be used for private or sensitive data.
+        :param deployment_mode: Required. The broker's deployment mode.
+        :param engine_type: Required. The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
+        :param host_instance_type: Required. The broker's instance type.
+        :param publicly_accessible: Enables connections from applications outside of the VPC that hosts the broker's subnets. Set to ``false`` by default, if no value is provided.
         :param authentication_strategy: Optional. The authentication strategy used to secure the broker. The default is ``SIMPLE`` .
-        :param auto_minor_version_upgrade: Enables automatic upgrades to new minor versions for brokers, as new broker engine versions are released and supported by Amazon MQ. Automatic upgrades occur during the scheduled maintenance window of the broker or after a manual broker reboot.
-        :param configuration: A list of information about the configuration. Does not apply to RabbitMQ brokers.
+        :param auto_minor_version_upgrade: Enables automatic upgrades to new patch versions for brokers as new versions are released and supported by Amazon MQ. Automatic upgrades occur during the scheduled maintenance window or after a manual broker reboot. Set to ``true`` by default, if no value is specified. .. epigraph:: Must be set to ``true`` for ActiveMQ brokers version 5.18 and above and for RabbitMQ brokers version 3.13 and above.
+        :param configuration: A list of information about the configuration.
         :param data_replication_mode: Defines whether this broker is a part of a data replication pair.
         :param data_replication_primary_broker_arn: The Amazon Resource Name (ARN) of the primary broker that is used to replicate data from in a data replication pair, and is applied to the replica broker. Must be set when dataReplicationMode is set to CRDR.
-        :param encryption_options: Encryption options for the broker. Does not apply to RabbitMQ brokers.
-        :param engine_version: The version of the broker engine. For a list of supported engine versions, see `Engine <https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html>`_ in the *Amazon MQ Developer Guide* .
+        :param encryption_options: Encryption options for the broker.
+        :param engine_version: The broker engine version. Defaults to the latest available version for the specified broker engine type. For more information, see the `ActiveMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/activemq-version-management.html>`_ and the `RabbitMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/rabbitmq-version-management.html>`_ sections in the Amazon MQ Developer Guide.
         :param ldap_server_metadata: Optional. The metadata of the LDAP server used to authenticate and authorize connections to the broker. Does not apply to RabbitMQ brokers.
         :param logs: Enables Amazon CloudWatch logging for brokers.
-        :param maintenance_window_start_time: The scheduled time period relative to UTC during which Amazon MQ begins to apply pending updates or patches to the broker.
+        :param maintenance_window_start_time: The parameters that determine the WeeklyStartTime.
         :param security_groups: The list of rules (1 minimum, 125 maximum) that authorize connections to brokers.
         :param storage_type: The broker's storage type.
-        :param subnet_ids: The list of groups that define which subnets and IP ranges the broker can use from different Availability Zones. If you specify more than one subnet, the subnets must be in different Availability Zones. Amazon MQ will not be able to create VPC endpoints for your broker with multiple subnets in the same Availability Zone. A SINGLE_INSTANCE deployment requires one subnet (for example, the default subnet). An ACTIVE_STANDBY_MULTI_AZ deployment (ACTIVEMQ) requires two subnets. A CLUSTER_MULTI_AZ deployment (RABBITMQ) has no subnet requirements when deployed with public accessibility, deployment without public accessibility requires at least one subnet. .. epigraph:: If you specify subnets in a shared VPC for a RabbitMQ broker, the associated VPC to which the specified subnets belong must be owned by your AWS account . Amazon MQ will not be able to create VPC enpoints in VPCs that are not owned by your AWS account .
-        :param tags: An array of key-value pairs. For more information, see `Using Cost Allocation Tags <https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html>`_ in the *Billing and Cost Management User Guide* .
+        :param subnet_ids: The list of groups that define which subnets and IP ranges the broker can use from different Availability Zones. If you specify more than one subnet, the subnets must be in different Availability Zones. Amazon MQ will not be able to create VPC endpoints for your broker with multiple subnets in the same Availability Zone. A SINGLE_INSTANCE deployment requires one subnet (for example, the default subnet). An ACTIVE_STANDBY_MULTI_AZ Amazon MQ for ActiveMQ deployment requires two subnets. A CLUSTER_MULTI_AZ Amazon MQ for RabbitMQ deployment has no subnet requirements when deployed with public accessibility. Deployment without public accessibility requires at least one subnet. .. epigraph:: If you specify subnets in a `shared VPC <https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html>`_ for a RabbitMQ broker, the associated VPC to which the specified subnets belong must be owned by your AWS account . Amazon MQ will not be able to create VPC endpoints in VPCs that are not owned by your AWS account .
+        :param tags: Create tags when creating the broker.
+        :param users: The list of broker users (persons or applications) who can access queues and topics. For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent broker users are created by making RabbitMQ API calls directly to brokers or via the RabbitMQ web console. When OAuth 2.0 is enabled, the broker accepts one or no users.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__d16f84aeefdd69c636acf0c8b4d958b93ded39c1da5d5eecb39ce87535c69cb7)
@@ -236,7 +244,6 @@ class CfnBroker(
             engine_type=engine_type,
             host_instance_type=host_instance_type,
             publicly_accessible=publicly_accessible,
-            users=users,
             authentication_strategy=authentication_strategy,
             auto_minor_version_upgrade=auto_minor_version_upgrade,
             configuration=configuration,
@@ -251,6 +258,7 @@ class CfnBroker(
             storage_type=storage_type,
             subnet_ids=subnet_ids,
             tags=tags,
+            users=users,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
@@ -330,12 +338,28 @@ class CfnBroker(
         return typing.cast(jsii.Number, jsii.get(self, "attrConfigurationRevision"))
 
     @builtins.property
-    @jsii.member(jsii_name="attrId")
-    def attr_id(self) -> builtins.str:
-        '''Required.
+    @jsii.member(jsii_name="attrConsoleUrLs")
+    def attr_console_ur_ls(self) -> typing.List[builtins.str]:
+        '''
+        :cloudformationAttribute: ConsoleURLs
+        '''
+        return typing.cast(typing.List[builtins.str], jsii.get(self, "attrConsoleUrLs"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrEngineVersionCurrent")
+    def attr_engine_version_current(self) -> builtins.str:
+        '''The version in use.
 
-        The unique ID that Amazon MQ generates for the configuration.
+        This may have more precision than the specified EngineVersion.
 
+        :cloudformationAttribute: EngineVersionCurrent
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrEngineVersionCurrent"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrId")
+    def attr_id(self) -> builtins.str:
+        '''
         :cloudformationAttribute: Id
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrId"))
@@ -395,6 +419,12 @@ class CfnBroker(
         '''
         return typing.cast(typing.List[builtins.str], jsii.get(self, "attrWssEndpoints"))
 
+    @builtins.property
+    @jsii.member(jsii_name="brokerRef")
+    def broker_ref(self) -> _BrokerReference_1d1cbbf7:
+        '''A reference to a Broker resource.'''
+        return typing.cast(_BrokerReference_1d1cbbf7, jsii.get(self, "brokerRef"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -409,7 +439,7 @@ class CfnBroker(
     @builtins.property
     @jsii.member(jsii_name="brokerName")
     def broker_name(self) -> builtins.str:
-        '''The name of the broker.'''
+        '''Required.'''
         return typing.cast(builtins.str, jsii.get(self, "brokerName"))
 
     @broker_name.setter
@@ -422,10 +452,7 @@ class CfnBroker(
     @builtins.property
     @jsii.member(jsii_name="deploymentMode")
     def deployment_mode(self) -> builtins.str:
-        '''The deployment mode of the broker.
-
-        Available values:.
-        '''
+        '''Required.'''
         return typing.cast(builtins.str, jsii.get(self, "deploymentMode"))
 
     @deployment_mode.setter
@@ -438,7 +465,7 @@ class CfnBroker(
     @builtins.property
     @jsii.member(jsii_name="engineType")
     def engine_type(self) -> builtins.str:
-        '''The type of broker engine.'''
+        '''Required.'''
         return typing.cast(builtins.str, jsii.get(self, "engineType"))
 
     @engine_type.setter
@@ -451,7 +478,7 @@ class CfnBroker(
     @builtins.property
     @jsii.member(jsii_name="hostInstanceType")
     def host_instance_type(self) -> builtins.str:
-        '''The broker's instance type.'''
+        '''Required.'''
         return typing.cast(builtins.str, jsii.get(self, "hostInstanceType"))
 
     @host_instance_type.setter
@@ -477,24 +504,6 @@ class CfnBroker(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "publiclyAccessible", value) # pyright: ignore[reportArgumentType]
 
-    @builtins.property
-    @jsii.member(jsii_name="users")
-    def users(
-        self,
-    ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnBroker.UserProperty"]]]:
-        '''The list of broker users (persons or applications) who can access queues and topics.'''
-        return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnBroker.UserProperty"]]], jsii.get(self, "users"))
-
-    @users.setter
-    def users(
-        self,
-        value: typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnBroker.UserProperty"]]],
-    ) -> None:
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__85b9c0c3c3aa438279362aeaae2a3de844ec906edf5b12b7601c78bc63fbfd6b)
-            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "users", value) # pyright: ignore[reportArgumentType]
-
     @builtins.property
     @jsii.member(jsii_name="authenticationStrategy")
     def authentication_strategy(self) -> typing.Optional[builtins.str]:
@@ -513,7 +522,7 @@ class CfnBroker(
     def auto_minor_version_upgrade(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''Enables automatic upgrades to new minor versions for brokers, as new broker engine versions are released and supported by Amazon MQ.'''
+        '''Enables automatic upgrades to new patch versions for brokers as new versions are released and supported by Amazon MQ.'''
         return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "autoMinorVersionUpgrade"))
 
     @auto_minor_version_upgrade.setter
@@ -594,7 +603,7 @@ class CfnBroker(
     @builtins.property
     @jsii.member(jsii_name="engineVersion")
     def engine_version(self) -> typing.Optional[builtins.str]:
-        '''The version of the broker engine.'''
+        '''The broker engine version.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "engineVersion"))
 
     @engine_version.setter
@@ -645,7 +654,7 @@ class CfnBroker(
     def maintenance_window_start_time(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnBroker.MaintenanceWindowProperty"]]:
-        '''The scheduled time period relative to UTC during which Amazon MQ begins to apply pending updates or patches to the broker.'''
+        '''The parameters that determine the WeeklyStartTime.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnBroker.MaintenanceWindowProperty"]], jsii.get(self, "maintenanceWindowStartTime"))
 
     @maintenance_window_start_time.setter
@@ -703,7 +712,7 @@ class CfnBroker(
     @builtins.property
     @jsii.member(jsii_name="tagsRaw")
     def tags_raw(self) -> typing.Optional[typing.List["CfnBroker.TagsEntryProperty"]]:
-        '''An array of key-value pairs.'''
+        '''Create tags when creating the broker.'''
         return typing.cast(typing.Optional[typing.List["CfnBroker.TagsEntryProperty"]], jsii.get(self, "tagsRaw"))
 
     @tags_raw.setter
@@ -716,6 +725,24 @@ class CfnBroker(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "tagsRaw", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="users")
+    def users(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnBroker.UserProperty"]]]]:
+        '''The list of broker users (persons or applications) who can access queues and topics.'''
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnBroker.UserProperty"]]]], jsii.get(self, "users"))
+
+    @users.setter
+    def users(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnBroker.UserProperty"]]]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__85b9c0c3c3aa438279362aeaae2a3de844ec906edf5b12b7601c78bc63fbfd6b)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "users", value) # pyright: ignore[reportArgumentType]
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_amazonmq.CfnBroker.ConfigurationIdProperty",
         jsii_struct_bases=[],
@@ -725,11 +752,7 @@ class CfnBroker(
         def __init__(self, *, id: builtins.str, revision: jsii.Number) -> None:
             '''A list of information about the configuration.
 
-            .. epigraph::
-
-               Does not apply to RabbitMQ brokers.
-
-            :param id: The unique ID that Amazon MQ generates for the configuration.
+            :param id: Required. The unique ID that Amazon MQ generates for the configuration.
             :param revision: The revision number of the configuration.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-configurationid.html
@@ -757,7 +780,9 @@ class CfnBroker(
 
         @builtins.property
         def id(self) -> builtins.str:
-            '''The unique ID that Amazon MQ generates for the configuration.
+            '''Required.
+
+            The unique ID that Amazon MQ generates for the configuration.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-configurationid.html#cfn-amazonmq-broker-configurationid-id
             '''
@@ -800,10 +825,6 @@ class CfnBroker(
         ) -> None:
             '''Encryption options for the broker.
 
-            .. epigraph::
-
-               Does not apply to RabbitMQ brokers.
-
             :param use_aws_owned_key: Enables the use of an AWS owned CMK using AWS KMS (KMS). Set to ``true`` by default, if no value is provided, for example, for RabbitMQ brokers.
             :param kms_key_id: The customer master key (CMK) to use for the A AWS KMS (KMS). This key is used to encrypt your data at rest. If not provided, Amazon MQ will use a default CMK to encrypt your data.
 
@@ -876,12 +897,12 @@ class CfnBroker(
             "hosts": "hosts",
             "role_base": "roleBase",
             "role_search_matching": "roleSearchMatching",
-            "service_account_password": "serviceAccountPassword",
             "service_account_username": "serviceAccountUsername",
             "user_base": "userBase",
             "user_search_matching": "userSearchMatching",
             "role_name": "roleName",
             "role_search_subtree": "roleSearchSubtree",
+            "service_account_password": "serviceAccountPassword",
             "user_role_name": "userRoleName",
             "user_search_subtree": "userSearchSubtree",
         },
@@ -893,32 +914,30 @@ class CfnBroker(
             hosts: typing.Sequence[builtins.str],
             role_base: builtins.str,
             role_search_matching: builtins.str,
-            service_account_password: builtins.str,
             service_account_username: builtins.str,
             user_base: builtins.str,
             user_search_matching: builtins.str,
             role_name: typing.Optional[builtins.str] = None,
             role_search_subtree: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+            service_account_password: typing.Optional[builtins.str] = None,
             user_role_name: typing.Optional[builtins.str] = None,
             user_search_subtree: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         ) -> None:
-            '''Optional. The metadata of the LDAP server used to authenticate and authorize connections to the broker.
-
-            .. epigraph::
-
-               Does not apply to RabbitMQ brokers.
-
-            :param hosts: Specifies the location of the LDAP server such as AWS Directory Service for Microsoft Active Directory . Optional failover server.
-            :param role_base: The distinguished name of the node in the directory information tree (DIT) to search for roles or groups. For example, ``ou=group`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-            :param role_search_matching: The LDAP search filter used to find roles within the roleBase. The distinguished name of the user matched by userSearchMatching is substituted into the ``{0}`` placeholder in the search filter. The client's username is substituted into the ``{1}`` placeholder. For example, if you set this option to ``(member=uid={1})`` for the user janedoe, the search filter becomes ``(member=uid=janedoe)`` after string substitution. It matches all role entries that have a member attribute equal to ``uid=janedoe`` under the subtree selected by the ``RoleBases`` .
-            :param service_account_password: Service account password. A service account is an account in your LDAP server that has access to initiate a connection. For example, ``cn=admin`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-            :param service_account_username: Service account username. A service account is an account in your LDAP server that has access to initiate a connection. For example, ``cn=admin`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-            :param user_base: Select a particular subtree of the directory information tree (DIT) to search for user entries. The subtree is specified by a DN, which specifies the base node of the subtree. For example, by setting this option to ``ou=Users`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` , the search for user entries is restricted to the subtree beneath ``ou=Users`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-            :param user_search_matching: The LDAP search filter used to find users within the ``userBase`` . The client's username is substituted into the ``{0}`` placeholder in the search filter. For example, if this option is set to ``(uid={0})`` and the received username is ``janedoe`` , the search filter becomes ``(uid=janedoe)`` after string substitution. It will result in matching an entry like ``uid=janedoe`` , ``ou=Users`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-            :param role_name: The group name attribute in a role entry whose value is the name of that role. For example, you can specify ``cn`` for a group entry's common name. If authentication succeeds, then the user is assigned the the value of the ``cn`` attribute for each role entry that they are a member of.
-            :param role_search_subtree: The directory search scope for the role. If set to true, scope is to search the entire subtree.
-            :param user_role_name: The name of the LDAP attribute in the user's directory entry for the user's group membership. In some cases, user roles may be identified by the value of an attribute in the user's directory entry. The ``UserRoleName`` option allows you to provide the name of this attribute.
-            :param user_search_subtree: The directory search scope for the user. If set to true, scope is to search the entire subtree.
+            '''Optional.
+
+            The metadata of the LDAP server used to authenticate and authorize connections to the broker. Does not apply to RabbitMQ brokers.
+
+            :param hosts: 
+            :param role_base: 
+            :param role_search_matching: 
+            :param service_account_username: 
+            :param user_base: 
+            :param user_search_matching: 
+            :param role_name: 
+            :param role_search_subtree: 
+            :param service_account_password: 
+            :param user_role_name: 
+            :param user_search_subtree: 
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html
             :exampleMetadata: fixture=_generated
@@ -933,7 +952,6 @@ class CfnBroker(
                     hosts=["hosts"],
                     role_base="roleBase",
                     role_search_matching="roleSearchMatching",
-                    service_account_password="serviceAccountPassword",
                     service_account_username="serviceAccountUsername",
                     user_base="userBase",
                     user_search_matching="userSearchMatching",
@@ -941,6 +959,7 @@ class CfnBroker(
                     # the properties below are optional
                     role_name="roleName",
                     role_search_subtree=False,
+                    service_account_password="serviceAccountPassword",
                     user_role_name="userRoleName",
                     user_search_subtree=False
                 )
@@ -950,19 +969,18 @@ class CfnBroker(
                 check_type(argname="argument hosts", value=hosts, expected_type=type_hints["hosts"])
                 check_type(argname="argument role_base", value=role_base, expected_type=type_hints["role_base"])
                 check_type(argname="argument role_search_matching", value=role_search_matching, expected_type=type_hints["role_search_matching"])
-                check_type(argname="argument service_account_password", value=service_account_password, expected_type=type_hints["service_account_password"])
                 check_type(argname="argument service_account_username", value=service_account_username, expected_type=type_hints["service_account_username"])
                 check_type(argname="argument user_base", value=user_base, expected_type=type_hints["user_base"])
                 check_type(argname="argument user_search_matching", value=user_search_matching, expected_type=type_hints["user_search_matching"])
                 check_type(argname="argument role_name", value=role_name, expected_type=type_hints["role_name"])
                 check_type(argname="argument role_search_subtree", value=role_search_subtree, expected_type=type_hints["role_search_subtree"])
+                check_type(argname="argument service_account_password", value=service_account_password, expected_type=type_hints["service_account_password"])
                 check_type(argname="argument user_role_name", value=user_role_name, expected_type=type_hints["user_role_name"])
                 check_type(argname="argument user_search_subtree", value=user_search_subtree, expected_type=type_hints["user_search_subtree"])
             self._values: typing.Dict[builtins.str, typing.Any] = {
                 "hosts": hosts,
                 "role_base": role_base,
                 "role_search_matching": role_search_matching,
-                "service_account_password": service_account_password,
                 "service_account_username": service_account_username,
                 "user_base": user_base,
                 "user_search_matching": user_search_matching,
@@ -971,6 +989,8 @@ class CfnBroker(
                 self._values["role_name"] = role_name
             if role_search_subtree is not None:
                 self._values["role_search_subtree"] = role_search_subtree
+            if service_account_password is not None:
+                self._values["service_account_password"] = service_account_password
             if user_role_name is not None:
                 self._values["user_role_name"] = user_role_name
             if user_search_subtree is not None:
@@ -978,10 +998,7 @@ class CfnBroker(
 
         @builtins.property
         def hosts(self) -> typing.List[builtins.str]:
-            '''Specifies the location of the LDAP server such as AWS Directory Service for Microsoft Active Directory .
-
-            Optional failover server.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-hosts
             '''
             result = self._values.get("hosts")
@@ -990,10 +1007,7 @@ class CfnBroker(
 
         @builtins.property
         def role_base(self) -> builtins.str:
-            '''The distinguished name of the node in the directory information tree (DIT) to search for roles or groups.
-
-            For example, ``ou=group`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-rolebase
             '''
             result = self._values.get("role_base")
@@ -1002,34 +1016,16 @@ class CfnBroker(
 
         @builtins.property
         def role_search_matching(self) -> builtins.str:
-            '''The LDAP search filter used to find roles within the roleBase.
-
-            The distinguished name of the user matched by userSearchMatching is substituted into the ``{0}`` placeholder in the search filter. The client's username is substituted into the ``{1}`` placeholder. For example, if you set this option to ``(member=uid={1})`` for the user janedoe, the search filter becomes ``(member=uid=janedoe)`` after string substitution. It matches all role entries that have a member attribute equal to ``uid=janedoe`` under the subtree selected by the ``RoleBases`` .
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-rolesearchmatching
             '''
             result = self._values.get("role_search_matching")
             assert result is not None, "Required property 'role_search_matching' is missing"
             return typing.cast(builtins.str, result)
 
-        @builtins.property
-        def service_account_password(self) -> builtins.str:
-            '''Service account password.
-
-            A service account is an account in your LDAP server that has access to initiate a connection. For example, ``cn=admin`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-serviceaccountpassword
-            '''
-            result = self._values.get("service_account_password")
-            assert result is not None, "Required property 'service_account_password' is missing"
-            return typing.cast(builtins.str, result)
-
         @builtins.property
         def service_account_username(self) -> builtins.str:
-            '''Service account username.
-
-            A service account is an account in your LDAP server that has access to initiate a connection. For example, ``cn=admin`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-serviceaccountusername
             '''
             result = self._values.get("service_account_username")
@@ -1038,10 +1034,7 @@ class CfnBroker(
 
         @builtins.property
         def user_base(self) -> builtins.str:
-            '''Select a particular subtree of the directory information tree (DIT) to search for user entries.
-
-            The subtree is specified by a DN, which specifies the base node of the subtree. For example, by setting this option to ``ou=Users`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` , the search for user entries is restricted to the subtree beneath ``ou=Users`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-userbase
             '''
             result = self._values.get("user_base")
@@ -1050,10 +1043,7 @@ class CfnBroker(
 
         @builtins.property
         def user_search_matching(self) -> builtins.str:
-            '''The LDAP search filter used to find users within the ``userBase`` .
-
-            The client's username is substituted into the ``{0}`` placeholder in the search filter. For example, if this option is set to ``(uid={0})`` and the received username is ``janedoe`` , the search filter becomes ``(uid=janedoe)`` after string substitution. It will result in matching an entry like ``uid=janedoe`` , ``ou=Users`` , ``ou=corp`` , ``dc=corp`` , ``dc=example`` , ``dc=com`` .
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-usersearchmatching
             '''
             result = self._values.get("user_search_matching")
@@ -1062,10 +1052,7 @@ class CfnBroker(
 
         @builtins.property
         def role_name(self) -> typing.Optional[builtins.str]:
-            '''The group name attribute in a role entry whose value is the name of that role.
-
-            For example, you can specify ``cn`` for a group entry's common name. If authentication succeeds, then the user is assigned the the value of the ``cn`` attribute for each role entry that they are a member of.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-rolename
             '''
             result = self._values.get("role_name")
@@ -1075,21 +1062,23 @@ class CfnBroker(
         def role_search_subtree(
             self,
         ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-            '''The directory search scope for the role.
-
-            If set to true, scope is to search the entire subtree.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-rolesearchsubtree
             '''
             result = self._values.get("role_search_subtree")
             return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
 
         @builtins.property
-        def user_role_name(self) -> typing.Optional[builtins.str]:
-            '''The name of the LDAP attribute in the user's directory entry for the user's group membership.
-
-            In some cases, user roles may be identified by the value of an attribute in the user's directory entry. The ``UserRoleName`` option allows you to provide the name of this attribute.
+        def service_account_password(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-serviceaccountpassword
+            '''
+            result = self._values.get("service_account_password")
+            return typing.cast(typing.Optional[builtins.str], result)
 
+        @builtins.property
+        def user_role_name(self) -> typing.Optional[builtins.str]:
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-userrolename
             '''
             result = self._values.get("user_role_name")
@@ -1099,10 +1088,7 @@ class CfnBroker(
         def user_search_subtree(
             self,
         ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-            '''The directory search scope for the user.
-
-            If set to true, scope is to search the entire subtree.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-ldapservermetadata.html#cfn-amazonmq-broker-ldapservermetadata-usersearchsubtree
             '''
             result = self._values.get("user_search_subtree")
@@ -1212,10 +1198,10 @@ class CfnBroker(
             time_of_day: builtins.str,
             time_zone: builtins.str,
         ) -> None:
-            '''The parameters that determine the ``WeeklyStartTime`` to apply pending updates or patches to the broker.
+            '''The parameters that determine the WeeklyStartTime.
 
-            :param day_of_week: The day of the week.
-            :param time_of_day: The time, in 24-hour format.
+            :param day_of_week: Required. The day of the week.
+            :param time_of_day: Required. The time, in 24-hour format.
             :param time_zone: The time zone, UTC by default, in either the Country/City format, or the UTC offset format.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-maintenancewindow.html
@@ -1246,7 +1232,9 @@ class CfnBroker(
 
         @builtins.property
         def day_of_week(self) -> builtins.str:
-            '''The day of the week.
+            '''Required.
+
+            The day of the week.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-maintenancewindow.html#cfn-amazonmq-broker-maintenancewindow-dayofweek
             '''
@@ -1256,7 +1244,9 @@ class CfnBroker(
 
         @builtins.property
         def time_of_day(self) -> builtins.str:
-            '''The time, in 24-hour format.
+            '''Required.
+
+            The time, in 24-hour format.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-maintenancewindow.html#cfn-amazonmq-broker-maintenancewindow-timeofday
             '''
@@ -1292,10 +1282,10 @@ class CfnBroker(
     )
     class TagsEntryProperty:
         def __init__(self, *, key: builtins.str, value: builtins.str) -> None:
-            '''A key-value pair to associate with the broker.
+            '''Create tags when creating the broker.
 
-            :param key: The key in a key-value pair.
-            :param value: The value in a key-value pair.
+            :param key: 
+            :param value: 
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-tagsentry.html
             :exampleMetadata: fixture=_generated
@@ -1322,8 +1312,7 @@ class CfnBroker(
 
         @builtins.property
         def key(self) -> builtins.str:
-            '''The key in a key-value pair.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-tagsentry.html#cfn-amazonmq-broker-tagsentry-key
             '''
             result = self._values.get("key")
@@ -1332,8 +1321,7 @@ class CfnBroker(
 
         @builtins.property
         def value(self) -> builtins.str:
-            '''The value in a key-value pair.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-tagsentry.html#cfn-amazonmq-broker-tagsentry-value
             '''
             result = self._values.get("value")
@@ -1359,7 +1347,6 @@ class CfnBroker(
             "username": "username",
             "console_access": "consoleAccess",
             "groups": "groups",
-            "jolokia_api_access": "jolokiaApiAccess",
             "replication_user": "replicationUser",
         },
     )
@@ -1371,18 +1358,18 @@ class CfnBroker(
             username: builtins.str,
             console_access: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             groups: typing.Optional[typing.Sequence[builtins.str]] = None,
-            jolokia_api_access: typing.Optional[builtins.str] = None,
             replication_user: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         ) -> None:
             '''The list of broker users (persons or applications) who can access queues and topics.
 
-            For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent broker users are created via the RabbitMQ web console or by using the RabbitMQ management API.
+            For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent broker users are created by making RabbitMQ API calls directly to brokers or via the RabbitMQ web console.
 
-            :param password: The password of the user. This value must be at least 12 characters long, must contain at least 4 unique characters, and must not contain commas, colons, or equal signs (,:=).
-            :param username: The username of the broker user. For Amazon MQ for ActiveMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). For Amazon MQ for RabbitMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores (- . _). This value must not contain a tilde (~) character. Amazon MQ prohibts using guest as a valid usename. This value must be 2-100 characters long. .. epigraph:: Do not add personally identifiable information (PII) or other confidential or sensitive information in broker usernames. Broker usernames are accessible to other AWS services, including CloudWatch Logs . Broker usernames are not intended to be used for private or sensitive data.
-            :param console_access: Enables access to the ActiveMQ web console for the ActiveMQ user. Does not apply to RabbitMQ brokers.
+            When OAuth 2.0 is enabled, the broker accepts one or no users.
+
+            :param password: Required. The password of the user. This value must be at least 12 characters long, must contain at least 4 unique characters, and must not contain commas, colons, or equal signs (,:=).
+            :param username: The username of the broker user. The following restrictions apply to broker usernames:. - For Amazon MQ for ActiveMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 2-100 characters long. - For Amazon MQ for RabbitMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores (- . _). This value must not contain a tilde (~) character. Amazon MQ prohibts using ``guest`` as a valid usename. This value must be 2-100 characters long. .. epigraph:: Do not add personally identifiable information (PII) or other confidential or sensitive information in broker usernames. Broker usernames are accessible to other AWS services, including CloudWatch Logs . Broker usernames are not intended to be used for private or sensitive data.
+            :param console_access: Enables access to the ActiveMQ Web Console for the ActiveMQ user. Does not apply to RabbitMQ brokers.
             :param groups: The list of groups (20 maximum) to which the ActiveMQ user belongs. This value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 2-100 characters long. Does not apply to RabbitMQ brokers.
-            :param jolokia_api_access: Enables Jolokia access to the ActiveMQ broker for the ActiveMQ user (Does not apply to RabbitMQ brokers).
             :param replication_user: Defines if this user is intended for CRDR replication purposes.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-user.html
@@ -1401,7 +1388,6 @@ class CfnBroker(
                     # the properties below are optional
                     console_access=False,
                     groups=["groups"],
-                    jolokia_api_access="jolokiaApiAccess",
                     replication_user=False
                 )
             '''
@@ -1411,7 +1397,6 @@ class CfnBroker(
                 check_type(argname="argument username", value=username, expected_type=type_hints["username"])
                 check_type(argname="argument console_access", value=console_access, expected_type=type_hints["console_access"])
                 check_type(argname="argument groups", value=groups, expected_type=type_hints["groups"])
-                check_type(argname="argument jolokia_api_access", value=jolokia_api_access, expected_type=type_hints["jolokia_api_access"])
                 check_type(argname="argument replication_user", value=replication_user, expected_type=type_hints["replication_user"])
             self._values: typing.Dict[builtins.str, typing.Any] = {
                 "password": password,
@@ -1421,16 +1406,14 @@ class CfnBroker(
                 self._values["console_access"] = console_access
             if groups is not None:
                 self._values["groups"] = groups
-            if jolokia_api_access is not None:
-                self._values["jolokia_api_access"] = jolokia_api_access
             if replication_user is not None:
                 self._values["replication_user"] = replication_user
 
         @builtins.property
         def password(self) -> builtins.str:
-            '''The password of the user.
+            '''Required.
 
-            This value must be at least 12 characters long, must contain at least 4 unique characters, and must not contain commas, colons, or equal signs (,:=).
+            The password of the user. This value must be at least 12 characters long, must contain at least 4 unique characters, and must not contain commas, colons, or equal signs (,:=).
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-user.html#cfn-amazonmq-broker-user-password
             '''
@@ -1440,9 +1423,11 @@ class CfnBroker(
 
         @builtins.property
         def username(self) -> builtins.str:
-            '''The username of the broker user.
+            '''The username of the broker user. The following restrictions apply to broker usernames:.
+
+            - For Amazon MQ for ActiveMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 2-100 characters long.
+            - For Amazon MQ for RabbitMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores (- . _). This value must not contain a tilde (~) character. Amazon MQ prohibts using ``guest`` as a valid usename. This value must be 2-100 characters long.
 
-            For Amazon MQ for ActiveMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). For Amazon MQ for RabbitMQ brokers, this value can contain only alphanumeric characters, dashes, periods, underscores (- . _). This value must not contain a tilde (~) character. Amazon MQ prohibts using guest as a valid usename. This value must be 2-100 characters long.
             .. epigraph::
 
                Do not add personally identifiable information (PII) or other confidential or sensitive information in broker usernames. Broker usernames are accessible to other AWS services, including CloudWatch Logs . Broker usernames are not intended to be used for private or sensitive data.
@@ -1457,7 +1442,7 @@ class CfnBroker(
         def console_access(
             self,
         ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-            '''Enables access to the ActiveMQ web console for the ActiveMQ user.
+            '''Enables access to the ActiveMQ Web Console for the ActiveMQ user.
 
             Does not apply to RabbitMQ brokers.
 
@@ -1477,15 +1462,6 @@ class CfnBroker(
             result = self._values.get("groups")
             return typing.cast(typing.Optional[typing.List[builtins.str]], result)
 
-        @builtins.property
-        def jolokia_api_access(self) -> typing.Optional[builtins.str]:
-            '''Enables Jolokia access to the ActiveMQ broker for the ActiveMQ user (Does not apply to RabbitMQ brokers).
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-user.html#cfn-amazonmq-broker-user-jolokiaapiaccess
-            '''
-            result = self._values.get("jolokia_api_access")
-            return typing.cast(typing.Optional[builtins.str], result)
-
         @builtins.property
         def replication_user(
             self,
@@ -1518,7 +1494,6 @@ class CfnBroker(
         "engine_type": "engineType",
         "host_instance_type": "hostInstanceType",
         "publicly_accessible": "publiclyAccessible",
-        "users": "users",
         "authentication_strategy": "authenticationStrategy",
         "auto_minor_version_upgrade": "autoMinorVersionUpgrade",
         "configuration": "configuration",
@@ -1533,6 +1508,7 @@ class CfnBroker(
         "storage_type": "storageType",
         "subnet_ids": "subnetIds",
         "tags": "tags",
+        "users": "users",
     },
 )
 class CfnBrokerProps:
@@ -1544,7 +1520,6 @@ class CfnBrokerProps:
         engine_type: builtins.str,
         host_instance_type: builtins.str,
         publicly_accessible: typing.Union[builtins.bool, _IResolvable_da3f097b],
-        users: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.UserProperty, typing.Dict[builtins.str, typing.Any]]]]],
         authentication_strategy: typing.Optional[builtins.str] = None,
         auto_minor_version_upgrade: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.ConfigurationIdProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -1559,29 +1534,30 @@ class CfnBrokerProps:
         storage_type: typing.Optional[builtins.str] = None,
         subnet_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[CfnBroker.TagsEntryProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+        users: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.UserProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
         '''Properties for defining a ``CfnBroker``.
 
-        :param broker_name: The name of the broker. This value must be unique in your AWS account , 1-50 characters long, must contain only letters, numbers, dashes, and underscores, and must not contain white spaces, brackets, wildcard characters, or special characters. .. epigraph:: Do not add personally identifiable information (PII) or other confidential or sensitive information in broker names. Broker names are accessible to other AWS services, including C CloudWatch Logs . Broker names are not intended to be used for private or sensitive data.
-        :param deployment_mode: The deployment mode of the broker. Available values:. - ``SINGLE_INSTANCE`` - ``ACTIVE_STANDBY_MULTI_AZ`` - ``CLUSTER_MULTI_AZ``
-        :param engine_type: The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
-        :param host_instance_type: The broker's instance type.
-        :param publicly_accessible: Enables connections from applications outside of the VPC that hosts the broker's subnets.
-        :param users: The list of broker users (persons or applications) who can access queues and topics. For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent RabbitMQ users are created by via the RabbitMQ web console or by using the RabbitMQ management API.
+        :param broker_name: Required. The broker's name. This value must be unique in your AWS account , 1-50 characters long, must contain only letters, numbers, dashes, and underscores, and must not contain white spaces, brackets, wildcard characters, or special characters. .. epigraph:: Do not add personally identifiable information (PII) or other confidential or sensitive information in broker names. Broker names are accessible to other AWS services, including CloudWatch Logs . Broker names are not intended to be used for private or sensitive data.
+        :param deployment_mode: Required. The broker's deployment mode.
+        :param engine_type: Required. The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
+        :param host_instance_type: Required. The broker's instance type.
+        :param publicly_accessible: Enables connections from applications outside of the VPC that hosts the broker's subnets. Set to ``false`` by default, if no value is provided.
         :param authentication_strategy: Optional. The authentication strategy used to secure the broker. The default is ``SIMPLE`` .
-        :param auto_minor_version_upgrade: Enables automatic upgrades to new minor versions for brokers, as new broker engine versions are released and supported by Amazon MQ. Automatic upgrades occur during the scheduled maintenance window of the broker or after a manual broker reboot.
-        :param configuration: A list of information about the configuration. Does not apply to RabbitMQ brokers.
+        :param auto_minor_version_upgrade: Enables automatic upgrades to new patch versions for brokers as new versions are released and supported by Amazon MQ. Automatic upgrades occur during the scheduled maintenance window or after a manual broker reboot. Set to ``true`` by default, if no value is specified. .. epigraph:: Must be set to ``true`` for ActiveMQ brokers version 5.18 and above and for RabbitMQ brokers version 3.13 and above.
+        :param configuration: A list of information about the configuration.
         :param data_replication_mode: Defines whether this broker is a part of a data replication pair.
         :param data_replication_primary_broker_arn: The Amazon Resource Name (ARN) of the primary broker that is used to replicate data from in a data replication pair, and is applied to the replica broker. Must be set when dataReplicationMode is set to CRDR.
-        :param encryption_options: Encryption options for the broker. Does not apply to RabbitMQ brokers.
-        :param engine_version: The version of the broker engine. For a list of supported engine versions, see `Engine <https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html>`_ in the *Amazon MQ Developer Guide* .
+        :param encryption_options: Encryption options for the broker.
+        :param engine_version: The broker engine version. Defaults to the latest available version for the specified broker engine type. For more information, see the `ActiveMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/activemq-version-management.html>`_ and the `RabbitMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/rabbitmq-version-management.html>`_ sections in the Amazon MQ Developer Guide.
         :param ldap_server_metadata: Optional. The metadata of the LDAP server used to authenticate and authorize connections to the broker. Does not apply to RabbitMQ brokers.
         :param logs: Enables Amazon CloudWatch logging for brokers.
-        :param maintenance_window_start_time: The scheduled time period relative to UTC during which Amazon MQ begins to apply pending updates or patches to the broker.
+        :param maintenance_window_start_time: The parameters that determine the WeeklyStartTime.
         :param security_groups: The list of rules (1 minimum, 125 maximum) that authorize connections to brokers.
         :param storage_type: The broker's storage type.
-        :param subnet_ids: The list of groups that define which subnets and IP ranges the broker can use from different Availability Zones. If you specify more than one subnet, the subnets must be in different Availability Zones. Amazon MQ will not be able to create VPC endpoints for your broker with multiple subnets in the same Availability Zone. A SINGLE_INSTANCE deployment requires one subnet (for example, the default subnet). An ACTIVE_STANDBY_MULTI_AZ deployment (ACTIVEMQ) requires two subnets. A CLUSTER_MULTI_AZ deployment (RABBITMQ) has no subnet requirements when deployed with public accessibility, deployment without public accessibility requires at least one subnet. .. epigraph:: If you specify subnets in a shared VPC for a RabbitMQ broker, the associated VPC to which the specified subnets belong must be owned by your AWS account . Amazon MQ will not be able to create VPC enpoints in VPCs that are not owned by your AWS account .
-        :param tags: An array of key-value pairs. For more information, see `Using Cost Allocation Tags <https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html>`_ in the *Billing and Cost Management User Guide* .
+        :param subnet_ids: The list of groups that define which subnets and IP ranges the broker can use from different Availability Zones. If you specify more than one subnet, the subnets must be in different Availability Zones. Amazon MQ will not be able to create VPC endpoints for your broker with multiple subnets in the same Availability Zone. A SINGLE_INSTANCE deployment requires one subnet (for example, the default subnet). An ACTIVE_STANDBY_MULTI_AZ Amazon MQ for ActiveMQ deployment requires two subnets. A CLUSTER_MULTI_AZ Amazon MQ for RabbitMQ deployment has no subnet requirements when deployed with public accessibility. Deployment without public accessibility requires at least one subnet. .. epigraph:: If you specify subnets in a `shared VPC <https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html>`_ for a RabbitMQ broker, the associated VPC to which the specified subnets belong must be owned by your AWS account . Amazon MQ will not be able to create VPC endpoints in VPCs that are not owned by your AWS account .
+        :param tags: Create tags when creating the broker.
+        :param users: The list of broker users (persons or applications) who can access queues and topics. For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent broker users are created by making RabbitMQ API calls directly to brokers or via the RabbitMQ web console. When OAuth 2.0 is enabled, the broker accepts one or no users.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html
         :exampleMetadata: fixture=_generated
@@ -1598,16 +1574,6 @@ class CfnBrokerProps:
                 engine_type="engineType",
                 host_instance_type="hostInstanceType",
                 publicly_accessible=False,
-                users=[amazonmq.CfnBroker.UserProperty(
-                    password="password",
-                    username="username",
-            
-                    # the properties below are optional
-                    console_access=False,
-                    groups=["groups"],
-                    jolokia_api_access="jolokiaApiAccess",
-                    replication_user=False
-                )],
             
                 # the properties below are optional
                 authentication_strategy="authenticationStrategy",
@@ -1629,7 +1595,6 @@ class CfnBrokerProps:
                     hosts=["hosts"],
                     role_base="roleBase",
                     role_search_matching="roleSearchMatching",
-                    service_account_password="serviceAccountPassword",
                     service_account_username="serviceAccountUsername",
                     user_base="userBase",
                     user_search_matching="userSearchMatching",
@@ -1637,6 +1602,7 @@ class CfnBrokerProps:
                     # the properties below are optional
                     role_name="roleName",
                     role_search_subtree=False,
+                    service_account_password="serviceAccountPassword",
                     user_role_name="userRoleName",
                     user_search_subtree=False
                 ),
@@ -1655,6 +1621,15 @@ class CfnBrokerProps:
                 tags=[amazonmq.CfnBroker.TagsEntryProperty(
                     key="key",
                     value="value"
+                )],
+                users=[amazonmq.CfnBroker.UserProperty(
+                    password="password",
+                    username="username",
+            
+                    # the properties below are optional
+                    console_access=False,
+                    groups=["groups"],
+                    replication_user=False
                 )]
             )
         '''
@@ -1665,7 +1640,6 @@ class CfnBrokerProps:
             check_type(argname="argument engine_type", value=engine_type, expected_type=type_hints["engine_type"])
             check_type(argname="argument host_instance_type", value=host_instance_type, expected_type=type_hints["host_instance_type"])
             check_type(argname="argument publicly_accessible", value=publicly_accessible, expected_type=type_hints["publicly_accessible"])
-            check_type(argname="argument users", value=users, expected_type=type_hints["users"])
             check_type(argname="argument authentication_strategy", value=authentication_strategy, expected_type=type_hints["authentication_strategy"])
             check_type(argname="argument auto_minor_version_upgrade", value=auto_minor_version_upgrade, expected_type=type_hints["auto_minor_version_upgrade"])
             check_type(argname="argument configuration", value=configuration, expected_type=type_hints["configuration"])
@@ -1680,13 +1654,13 @@ class CfnBrokerProps:
             check_type(argname="argument storage_type", value=storage_type, expected_type=type_hints["storage_type"])
             check_type(argname="argument subnet_ids", value=subnet_ids, expected_type=type_hints["subnet_ids"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
+            check_type(argname="argument users", value=users, expected_type=type_hints["users"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "broker_name": broker_name,
             "deployment_mode": deployment_mode,
             "engine_type": engine_type,
             "host_instance_type": host_instance_type,
             "publicly_accessible": publicly_accessible,
-            "users": users,
         }
         if authentication_strategy is not None:
             self._values["authentication_strategy"] = authentication_strategy
@@ -1716,15 +1690,17 @@ class CfnBrokerProps:
             self._values["subnet_ids"] = subnet_ids
         if tags is not None:
             self._values["tags"] = tags
+        if users is not None:
+            self._values["users"] = users
 
     @builtins.property
     def broker_name(self) -> builtins.str:
-        '''The name of the broker.
+        '''Required.
 
-        This value must be unique in your AWS account , 1-50 characters long, must contain only letters, numbers, dashes, and underscores, and must not contain white spaces, brackets, wildcard characters, or special characters.
+        The broker's name. This value must be unique in your AWS account , 1-50 characters long, must contain only letters, numbers, dashes, and underscores, and must not contain white spaces, brackets, wildcard characters, or special characters.
         .. epigraph::
 
-           Do not add personally identifiable information (PII) or other confidential or sensitive information in broker names. Broker names are accessible to other AWS services, including C CloudWatch Logs . Broker names are not intended to be used for private or sensitive data.
+           Do not add personally identifiable information (PII) or other confidential or sensitive information in broker names. Broker names are accessible to other AWS services, including CloudWatch Logs . Broker names are not intended to be used for private or sensitive data.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-brokername
         '''
@@ -1734,11 +1710,9 @@ class CfnBrokerProps:
 
     @builtins.property
     def deployment_mode(self) -> builtins.str:
-        '''The deployment mode of the broker. Available values:.
+        '''Required.
 
-        - ``SINGLE_INSTANCE``
-        - ``ACTIVE_STANDBY_MULTI_AZ``
-        - ``CLUSTER_MULTI_AZ``
+        The broker's deployment mode.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-deploymentmode
         '''
@@ -1748,9 +1722,9 @@ class CfnBrokerProps:
 
     @builtins.property
     def engine_type(self) -> builtins.str:
-        '''The type of broker engine.
+        '''Required.
 
-        Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
+        The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-enginetype
         '''
@@ -1760,7 +1734,9 @@ class CfnBrokerProps:
 
     @builtins.property
     def host_instance_type(self) -> builtins.str:
-        '''The broker's instance type.
+        '''Required.
+
+        The broker's instance type.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-hostinstancetype
         '''
@@ -1772,26 +1748,14 @@ class CfnBrokerProps:
     def publicly_accessible(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
         '''Enables connections from applications outside of the VPC that hosts the broker's subnets.
 
+        Set to ``false`` by default, if no value is provided.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-publiclyaccessible
         '''
         result = self._values.get("publicly_accessible")
         assert result is not None, "Required property 'publicly_accessible' is missing"
         return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)
 
-    @builtins.property
-    def users(
-        self,
-    ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnBroker.UserProperty]]]:
-        '''The list of broker users (persons or applications) who can access queues and topics.
-
-        For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent RabbitMQ users are created by via the RabbitMQ web console or by using the RabbitMQ management API.
-
-        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-users
-        '''
-        result = self._values.get("users")
-        assert result is not None, "Required property 'users' is missing"
-        return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnBroker.UserProperty]]], result)
-
     @builtins.property
     def authentication_strategy(self) -> typing.Optional[builtins.str]:
         '''Optional.
@@ -1807,9 +1771,12 @@ class CfnBrokerProps:
     def auto_minor_version_upgrade(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''Enables automatic upgrades to new minor versions for brokers, as new broker engine versions are released and supported by Amazon MQ.
+        '''Enables automatic upgrades to new patch versions for brokers as new versions are released and supported by Amazon MQ.
+
+        Automatic upgrades occur during the scheduled maintenance window or after a manual broker reboot. Set to ``true`` by default, if no value is specified.
+        .. epigraph::
 
-        Automatic upgrades occur during the scheduled maintenance window of the broker or after a manual broker reboot.
+           Must be set to ``true`` for ActiveMQ brokers version 5.18 and above and for RabbitMQ brokers version 3.13 and above.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-autominorversionupgrade
         '''
@@ -1822,8 +1789,6 @@ class CfnBrokerProps:
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnBroker.ConfigurationIdProperty]]:
         '''A list of information about the configuration.
 
-        Does not apply to RabbitMQ brokers.
-
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-configuration
         '''
         result = self._values.get("configuration")
@@ -1855,8 +1820,6 @@ class CfnBrokerProps:
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnBroker.EncryptionOptionsProperty]]:
         '''Encryption options for the broker.
 
-        Does not apply to RabbitMQ brokers.
-
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-encryptionoptions
         '''
         result = self._values.get("encryption_options")
@@ -1864,9 +1827,9 @@ class CfnBrokerProps:
 
     @builtins.property
     def engine_version(self) -> typing.Optional[builtins.str]:
-        '''The version of the broker engine.
+        '''The broker engine version.
 
-        For a list of supported engine versions, see `Engine <https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html>`_ in the *Amazon MQ Developer Guide* .
+        Defaults to the latest available version for the specified broker engine type. For more information, see the `ActiveMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/activemq-version-management.html>`_ and the `RabbitMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/rabbitmq-version-management.html>`_ sections in the Amazon MQ Developer Guide.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-engineversion
         '''
@@ -1901,7 +1864,7 @@ class CfnBrokerProps:
     def maintenance_window_start_time(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnBroker.MaintenanceWindowProperty]]:
-        '''The scheduled time period relative to UTC during which Amazon MQ begins to apply pending updates or patches to the broker.
+        '''The parameters that determine the WeeklyStartTime.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-maintenancewindowstarttime
         '''
@@ -1930,10 +1893,10 @@ class CfnBrokerProps:
     def subnet_ids(self) -> typing.Optional[typing.List[builtins.str]]:
         '''The list of groups that define which subnets and IP ranges the broker can use from different Availability Zones.
 
-        If you specify more than one subnet, the subnets must be in different Availability Zones. Amazon MQ will not be able to create VPC endpoints for your broker with multiple subnets in the same Availability Zone. A SINGLE_INSTANCE deployment requires one subnet (for example, the default subnet). An ACTIVE_STANDBY_MULTI_AZ deployment (ACTIVEMQ) requires two subnets. A CLUSTER_MULTI_AZ deployment (RABBITMQ) has no subnet requirements when deployed with public accessibility, deployment without public accessibility requires at least one subnet.
+        If you specify more than one subnet, the subnets must be in different Availability Zones. Amazon MQ will not be able to create VPC endpoints for your broker with multiple subnets in the same Availability Zone. A SINGLE_INSTANCE deployment requires one subnet (for example, the default subnet). An ACTIVE_STANDBY_MULTI_AZ Amazon MQ for ActiveMQ deployment requires two subnets. A CLUSTER_MULTI_AZ Amazon MQ for RabbitMQ deployment has no subnet requirements when deployed with public accessibility. Deployment without public accessibility requires at least one subnet.
         .. epigraph::
 
-           If you specify subnets in a shared VPC for a RabbitMQ broker, the associated VPC to which the specified subnets belong must be owned by your AWS account . Amazon MQ will not be able to create VPC enpoints in VPCs that are not owned by your AWS account .
+           If you specify subnets in a `shared VPC <https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html>`_ for a RabbitMQ broker, the associated VPC to which the specified subnets belong must be owned by your AWS account . Amazon MQ will not be able to create VPC endpoints in VPCs that are not owned by your AWS account .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-subnetids
         '''
@@ -1942,15 +1905,28 @@ class CfnBrokerProps:
 
     @builtins.property
     def tags(self) -> typing.Optional[typing.List[CfnBroker.TagsEntryProperty]]:
-        '''An array of key-value pairs.
-
-        For more information, see `Using Cost Allocation Tags <https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html>`_ in the *Billing and Cost Management User Guide* .
+        '''Create tags when creating the broker.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-tags
         '''
         result = self._values.get("tags")
         return typing.cast(typing.Optional[typing.List[CfnBroker.TagsEntryProperty]], result)
 
+    @builtins.property
+    def users(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnBroker.UserProperty]]]]:
+        '''The list of broker users (persons or applications) who can access queues and topics.
+
+        For Amazon MQ for RabbitMQ brokers, one and only one administrative user is accepted and created when a broker is first provisioned. All subsequent broker users are created by making RabbitMQ API calls directly to brokers or via the RabbitMQ web console.
+
+        When OAuth 2.0 is enabled, the broker accepts one or no users.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html#cfn-amazonmq-broker-users
+        '''
+        result = self._values.get("users")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnBroker.UserProperty]]]], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -1963,7 +1939,7 @@ class CfnBrokerProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IConfigurationRef_769e84b9, _ITaggable_36806126)
 class CfnConfiguration(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1972,9 +1948,6 @@ class CfnConfiguration(
     '''Creates a new configuration for the specified configuration name.
 
     Amazon MQ uses the default configuration (the engine type and version).
-    .. epigraph::
-
-       Does not apply to RabbitMQ brokers.
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configuration.html
     :cloudformationResource: AWS::AmazonMQ::Configuration
@@ -2015,15 +1988,16 @@ class CfnConfiguration(
         engine_version: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union["CfnConfiguration.TagsEntryProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::AmazonMQ::Configuration``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param engine_type: The type of broker engine. Note: Currently, Amazon MQ only supports ACTIVEMQ for creating and editing broker configurations.
-        :param name: The name of the configuration. This value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 1-150 characters long.
+        :param engine_type: Required. The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
+        :param name: Required. The name of the configuration. This value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 1-150 characters long.
         :param authentication_strategy: Optional. The authentication strategy associated with the configuration. The default is ``SIMPLE`` .
-        :param data: The base64-encoded XML configuration.
+        :param data: Amazon MQ for Active MQ: The base64-encoded XML configuration. Amazon MQ for RabbitMQ: the base64-encoded Cuttlefish configuration.
         :param description: The description of the configuration.
-        :param engine_version: The version of the broker engine. For a list of supported engine versions, see ` <https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html>`_
+        :param engine_version: The broker engine version. Defaults to the latest available version for the specified broker engine type. For more information, see the `ActiveMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/activemq-version-management.html>`_ and the `RabbitMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/rabbitmq-version-management.html>`_ sections in the Amazon MQ Developer Guide.
         :param tags: Create tags when creating the configuration.
         '''
         if __debug__:
@@ -2042,6 +2016,48 @@ class CfnConfiguration(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromConfigurationArn")
+    @builtins.classmethod
+    def from_configuration_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IConfigurationRef_769e84b9:
+        '''Creates a new IConfigurationRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__952d6fa5f0120d9649475d290d7db9a47e3510ed333c700851b2aaa6a8ceeea1)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IConfigurationRef_769e84b9, jsii.sinvoke(cls, "fromConfigurationArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromConfigurationId")
+    @builtins.classmethod
+    def from_configuration_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        configuration_id: builtins.str,
+    ) -> _IConfigurationRef_769e84b9:
+        '''Creates a new IConfigurationRef from a configurationId.
+
+        :param scope: -
+        :param id: -
+        :param configuration_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__3a206d532f247ca241ebd211136e297c9461a4b800008d2c7db68e5a8ba25948)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument configuration_id", value=configuration_id, expected_type=type_hints["configuration_id"])
+        return typing.cast(_IConfigurationRef_769e84b9, jsii.sinvoke(cls, "fromConfigurationId", [scope, id, configuration_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -2110,6 +2126,12 @@ class CfnConfiguration(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="configurationRef")
+    def configuration_ref(self) -> _ConfigurationReference_19cddfe8:
+        '''A reference to a Configuration resource.'''
+        return typing.cast(_ConfigurationReference_19cddfe8, jsii.get(self, "configurationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -2119,7 +2141,7 @@ class CfnConfiguration(
     @builtins.property
     @jsii.member(jsii_name="engineType")
     def engine_type(self) -> builtins.str:
-        '''The type of broker engine.'''
+        '''Required.'''
         return typing.cast(builtins.str, jsii.get(self, "engineType"))
 
     @engine_type.setter
@@ -2132,7 +2154,7 @@ class CfnConfiguration(
     @builtins.property
     @jsii.member(jsii_name="name")
     def name(self) -> builtins.str:
-        '''The name of the configuration.'''
+        '''Required.'''
         return typing.cast(builtins.str, jsii.get(self, "name"))
 
     @name.setter
@@ -2158,7 +2180,7 @@ class CfnConfiguration(
     @builtins.property
     @jsii.member(jsii_name="data")
     def data(self) -> typing.Optional[builtins.str]:
-        '''The base64-encoded XML configuration.'''
+        '''Amazon MQ for Active MQ: The base64-encoded XML configuration.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "data"))
 
     @data.setter
@@ -2184,7 +2206,7 @@ class CfnConfiguration(
     @builtins.property
     @jsii.member(jsii_name="engineVersion")
     def engine_version(self) -> typing.Optional[builtins.str]:
-        '''The version of the broker engine.'''
+        '''The broker engine version.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "engineVersion"))
 
     @engine_version.setter
@@ -2219,10 +2241,10 @@ class CfnConfiguration(
     )
     class TagsEntryProperty:
         def __init__(self, *, key: builtins.str, value: builtins.str) -> None:
-            '''A key-value pair to associate with the configuration.
+            '''The list of all tags associated with this configuration.
 
-            :param key: The key in a key-value pair.
-            :param value: The value in a key-value pair.
+            :param key: 
+            :param value: 
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-configuration-tagsentry.html
             :exampleMetadata: fixture=_generated
@@ -2249,8 +2271,7 @@ class CfnConfiguration(
 
         @builtins.property
         def key(self) -> builtins.str:
-            '''The key in a key-value pair.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-configuration-tagsentry.html#cfn-amazonmq-configuration-tagsentry-key
             '''
             result = self._values.get("key")
@@ -2259,8 +2280,7 @@ class CfnConfiguration(
 
         @builtins.property
         def value(self) -> builtins.str:
-            '''The value in a key-value pair.
-
+            '''
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-configuration-tagsentry.html#cfn-amazonmq-configuration-tagsentry-value
             '''
             result = self._values.get("value")
@@ -2279,18 +2299,13 @@ class CfnConfiguration(
             )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IConfigurationAssociationRef_98fafe4d)
 class CfnConfigurationAssociation(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_amazonmq.CfnConfigurationAssociation",
 ):
-    '''Use the AWS CloudFormation ``AWS::AmazonMQ::ConfigurationAssociation`` resource to associate a configuration with a broker, or return information about the specified ConfigurationAssociation.
-
-    Only use one per broker, and don't use a configuration on the broker resource if you have associated a configuration with that broker.
-    .. epigraph::
-
-       Does not apply to RabbitMQ brokers.
+    '''http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configurationassociation.html.
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configurationassociation.html
     :cloudformationResource: AWS::AmazonMQ::ConfigurationAssociation
@@ -2319,11 +2334,12 @@ class CfnConfigurationAssociation(
         broker: builtins.str,
         configuration: typing.Union[_IResolvable_da3f097b, typing.Union["CfnConfigurationAssociation.ConfigurationIdProperty", typing.Dict[builtins.str, typing.Any]]],
     ) -> None:
-        '''
+        '''Create a new ``AWS::AmazonMQ::ConfigurationAssociation``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param broker: The broker to associate with a configuration.
-        :param configuration: The configuration to associate with a broker.
+        :param broker: ID of the Broker that the configuration should be applied to.
+        :param configuration: Returns information about all configurations.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7bc27c46ef5e7e06d6d69ca58cb1eeb529e57c3a1b1af3771750fe74a0e5a436)
@@ -2368,7 +2384,8 @@ class CfnConfigurationAssociation(
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''
+        '''The ID of the ConfigurationAssociation Resource.
+
         :cloudformationAttribute: Id
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrId"))
@@ -2378,10 +2395,18 @@ class CfnConfigurationAssociation(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="configurationAssociationRef")
+    def configuration_association_ref(
+        self,
+    ) -> _ConfigurationAssociationReference_c6685840:
+        '''A reference to a ConfigurationAssociation resource.'''
+        return typing.cast(_ConfigurationAssociationReference_c6685840, jsii.get(self, "configurationAssociationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="broker")
     def broker(self) -> builtins.str:
-        '''The broker to associate with a configuration.'''
+        '''ID of the Broker that the configuration should be applied to.'''
         return typing.cast(builtins.str, jsii.get(self, "broker"))
 
     @broker.setter
@@ -2396,7 +2421,7 @@ class CfnConfigurationAssociation(
     def configuration(
         self,
     ) -> typing.Union[_IResolvable_da3f097b, "CfnConfigurationAssociation.ConfigurationIdProperty"]:
-        '''The configuration to associate with a broker.'''
+        '''Returns information about all configurations.'''
         return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnConfigurationAssociation.ConfigurationIdProperty"], jsii.get(self, "configuration"))
 
     @configuration.setter
@@ -2416,9 +2441,9 @@ class CfnConfigurationAssociation(
     )
     class ConfigurationIdProperty:
         def __init__(self, *, id: builtins.str, revision: jsii.Number) -> None:
-            '''The ``ConfigurationId`` property type specifies a configuration Id and the revision of a configuration.
+            '''A list of information about the configuration.
 
-            :param id: The unique ID that Amazon MQ generates for the configuration.
+            :param id: Required. The unique ID that Amazon MQ generates for the configuration.
             :param revision: The revision number of the configuration.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-configurationassociation-configurationid.html
@@ -2446,7 +2471,9 @@ class CfnConfigurationAssociation(
 
         @builtins.property
         def id(self) -> builtins.str:
-            '''The unique ID that Amazon MQ generates for the configuration.
+            '''Required.
+
+            The unique ID that Amazon MQ generates for the configuration.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-configurationassociation-configurationid.html#cfn-amazonmq-configurationassociation-configurationid-id
             '''
@@ -2490,8 +2517,8 @@ class CfnConfigurationAssociationProps:
     ) -> None:
         '''Properties for defining a ``CfnConfigurationAssociation``.
 
-        :param broker: The broker to associate with a configuration.
-        :param configuration: The configuration to associate with a broker.
+        :param broker: ID of the Broker that the configuration should be applied to.
+        :param configuration: Returns information about all configurations.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configurationassociation.html
         :exampleMetadata: fixture=_generated
@@ -2521,7 +2548,7 @@ class CfnConfigurationAssociationProps:
 
     @builtins.property
     def broker(self) -> builtins.str:
-        '''The broker to associate with a configuration.
+        '''ID of the Broker that the configuration should be applied to.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configurationassociation.html#cfn-amazonmq-configurationassociation-broker
         '''
@@ -2533,7 +2560,7 @@ class CfnConfigurationAssociationProps:
     def configuration(
         self,
     ) -> typing.Union[_IResolvable_da3f097b, CfnConfigurationAssociation.ConfigurationIdProperty]:
-        '''The configuration to associate with a broker.
+        '''Returns information about all configurations.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configurationassociation.html#cfn-amazonmq-configurationassociation-configuration
         '''
@@ -2580,12 +2607,12 @@ class CfnConfigurationProps:
     ) -> None:
         '''Properties for defining a ``CfnConfiguration``.
 
-        :param engine_type: The type of broker engine. Note: Currently, Amazon MQ only supports ACTIVEMQ for creating and editing broker configurations.
-        :param name: The name of the configuration. This value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 1-150 characters long.
+        :param engine_type: Required. The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
+        :param name: Required. The name of the configuration. This value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 1-150 characters long.
         :param authentication_strategy: Optional. The authentication strategy associated with the configuration. The default is ``SIMPLE`` .
-        :param data: The base64-encoded XML configuration.
+        :param data: Amazon MQ for Active MQ: The base64-encoded XML configuration. Amazon MQ for RabbitMQ: the base64-encoded Cuttlefish configuration.
         :param description: The description of the configuration.
-        :param engine_version: The version of the broker engine. For a list of supported engine versions, see ` <https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html>`_
+        :param engine_version: The broker engine version. Defaults to the latest available version for the specified broker engine type. For more information, see the `ActiveMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/activemq-version-management.html>`_ and the `RabbitMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/rabbitmq-version-management.html>`_ sections in the Amazon MQ Developer Guide.
         :param tags: Create tags when creating the configuration.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configuration.html
@@ -2638,9 +2665,9 @@ class CfnConfigurationProps:
 
     @builtins.property
     def engine_type(self) -> builtins.str:
-        '''The type of broker engine.
+        '''Required.
 
-        Note: Currently, Amazon MQ only supports ACTIVEMQ for creating and editing broker configurations.
+        The type of broker engine. Currently, Amazon MQ supports ``ACTIVEMQ`` and ``RABBITMQ`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configuration.html#cfn-amazonmq-configuration-enginetype
         '''
@@ -2650,9 +2677,9 @@ class CfnConfigurationProps:
 
     @builtins.property
     def name(self) -> builtins.str:
-        '''The name of the configuration.
+        '''Required.
 
-        This value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 1-150 characters long.
+        The name of the configuration. This value can contain only alphanumeric characters, dashes, periods, underscores, and tildes (- . _ ~). This value must be 1-150 characters long.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configuration.html#cfn-amazonmq-configuration-name
         '''
@@ -2673,7 +2700,9 @@ class CfnConfigurationProps:
 
     @builtins.property
     def data(self) -> typing.Optional[builtins.str]:
-        '''The base64-encoded XML configuration.
+        '''Amazon MQ for Active MQ: The base64-encoded XML configuration.
+
+        Amazon MQ for RabbitMQ: the base64-encoded Cuttlefish configuration.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configuration.html#cfn-amazonmq-configuration-data
         '''
@@ -2691,9 +2720,9 @@ class CfnConfigurationProps:
 
     @builtins.property
     def engine_version(self) -> typing.Optional[builtins.str]:
-        '''The version of the broker engine.
+        '''The broker engine version.
 
-        For a list of supported engine versions, see ` <https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html>`_
+        Defaults to the latest available version for the specified broker engine type. For more information, see the `ActiveMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/activemq-version-management.html>`_ and the `RabbitMQ version management <https://docs.aws.amazon.com//amazon-mq/latest/developer-guide/rabbitmq-version-management.html>`_ sections in the Amazon MQ Developer Guide.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-configuration.html#cfn-amazonmq-configuration-engineversion
         '''
@@ -2741,7 +2770,6 @@ def _typecheckingstub__d16f84aeefdd69c636acf0c8b4d958b93ded39c1da5d5eecb39ce8753
     engine_type: builtins.str,
     host_instance_type: builtins.str,
     publicly_accessible: typing.Union[builtins.bool, _IResolvable_da3f097b],
-    users: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.UserProperty, typing.Dict[builtins.str, typing.Any]]]]],
     authentication_strategy: typing.Optional[builtins.str] = None,
     auto_minor_version_upgrade: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.ConfigurationIdProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -2756,6 +2784,7 @@ def _typecheckingstub__d16f84aeefdd69c636acf0c8b4d958b93ded39c1da5d5eecb39ce8753
     storage_type: typing.Optional[builtins.str] = None,
     subnet_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[CfnBroker.TagsEntryProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    users: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.UserProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -2802,12 +2831,6 @@ def _typecheckingstub__4a82a112ececec828f3c746f7c18e6b6ce32a5aa08550a05a69d7babd
     """Type checking stubs"""
     pass
 
-def _typecheckingstub__85b9c0c3c3aa438279362aeaae2a3de844ec906edf5b12b7601c78bc63fbfd6b(
-    value: typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnBroker.UserProperty]]],
-) -> None:
-    """Type checking stubs"""
-    pass
-
 def _typecheckingstub__3eab9258c47a74b1aabb4a39e66512dbb010a0f1c8838ec359338808e1f64681(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -2892,6 +2915,12 @@ def _typecheckingstub__739d50e75e2a93ab9671710563ad1ed5176802aef44a2986de718c86a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__85b9c0c3c3aa438279362aeaae2a3de844ec906edf5b12b7601c78bc63fbfd6b(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnBroker.UserProperty]]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__f9d5131bf29ed360bf06fb2fc10b8d6ac62da622a4f41bd0e435a4436ba5511c(
     *,
     id: builtins.str,
@@ -2913,12 +2942,12 @@ def _typecheckingstub__282093319da5ca5716ae9202b23fde6f2380a3a720f7bac369f166119
     hosts: typing.Sequence[builtins.str],
     role_base: builtins.str,
     role_search_matching: builtins.str,
-    service_account_password: builtins.str,
     service_account_username: builtins.str,
     user_base: builtins.str,
     user_search_matching: builtins.str,
     role_name: typing.Optional[builtins.str] = None,
     role_search_subtree: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    service_account_password: typing.Optional[builtins.str] = None,
     user_role_name: typing.Optional[builtins.str] = None,
     user_search_subtree: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
 ) -> None:
@@ -2956,7 +2985,6 @@ def _typecheckingstub__8a458786a0cd0d4269adef0bf3c85862386851ab69649004d5d3dcba4
     username: builtins.str,
     console_access: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     groups: typing.Optional[typing.Sequence[builtins.str]] = None,
-    jolokia_api_access: typing.Optional[builtins.str] = None,
     replication_user: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
 ) -> None:
     """Type checking stubs"""
@@ -2969,7 +2997,6 @@ def _typecheckingstub__d255f8718bac4d1453cb7e2ae3f8fb5a5ac0ed5b3551f73d52e4123fa
     engine_type: builtins.str,
     host_instance_type: builtins.str,
     publicly_accessible: typing.Union[builtins.bool, _IResolvable_da3f097b],
-    users: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.UserProperty, typing.Dict[builtins.str, typing.Any]]]]],
     authentication_strategy: typing.Optional[builtins.str] = None,
     auto_minor_version_upgrade: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.ConfigurationIdProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -2984,6 +3011,7 @@ def _typecheckingstub__d255f8718bac4d1453cb7e2ae3f8fb5a5ac0ed5b3551f73d52e4123fa
     storage_type: typing.Optional[builtins.str] = None,
     subnet_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[CfnBroker.TagsEntryProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    users: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnBroker.UserProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -3003,6 +3031,22 @@ def _typecheckingstub__e5d8c71c30a8f2bd8b3e455320ae87cc2204a9546d3ee226605a95753
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__952d6fa5f0120d9649475d290d7db9a47e3510ed333c700851b2aaa6a8ceeea1(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__3a206d532f247ca241ebd211136e297c9461a4b800008d2c7db68e5a8ba25948(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    configuration_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__df4e9311d1aa33bca48575d715d3a7e801184dc0b0d7ccbd91d39c5dd0ca05ce(
     inspector: _TreeInspector_488e0dd5,
 ) -> None: