aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_ecs_patterns/__init__.py

@@ -72,6 +72,8 @@ Fargate services will use the `LATEST` platform version by default, but you can
 
 Fargate services use the default VPC Security Group unless one or more are provided using the `securityGroups` property in the constructor.
 
+**Security Considerations**: When using custom security groups on your load balancer, the `openListener` property controls whether the load balancer listener allows traffic from anywhere on the internet (0.0.0.0/0). By default, `openListener` is `true`, but it will automatically default to `false` when custom security groups are detected, preventing unintended internet exposure. You can always explicitly set `openListener: true` to override this behavior if needed.
+
 By setting `redirectHTTP` to true, CDK will automatically create a listener on port 80 that redirects HTTP traffic to the HTTPS port.
 
 If you specify the option `recordType` you can decide if you want the construct to use CNAME or Route53-Aliases as record sets.

aws_cdk/aws_efs/__init__.py

@@ -358,6 +358,15 @@ from ..aws_iam import (
     PolicyStatement as _PolicyStatement_0fe33853,
 )
 from ..aws_kms import IKey as _IKey_5f11635f
+from ..interfaces.aws_efs import (
+    AccessPointReference as _AccessPointReference_4b264f5d,
+    FileSystemReference as _FileSystemReference_4a6f4058,
+    IAccessPointRef as _IAccessPointRef_437d4bf7,
+    IFileSystemRef as _IFileSystemRef_3dcf8b98,
+    IMountTargetRef as _IMountTargetRef_0955e348,
+    MountTargetReference as _MountTargetReference_498e181c,
+)
+from ..interfaces.aws_kms import IKeyRef as _IKeyRef_d4fc6ef3
 
 
 @jsii.data_type(
@@ -820,7 +829,7 @@ class Acl:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IAccessPointRef_437d4bf7, _ITaggable_36806126)
 class CfnAccessPoint(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -880,7 +889,8 @@ class CfnAccessPoint(
         posix_user: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnAccessPoint.PosixUserProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         root_directory: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnAccessPoint.RootDirectoryProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::EFS::AccessPoint``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param file_system_id: The ID of the EFS file system that the access point applies to. Accepts only the ID format for input when specifying a file system, for example ``fs-0123456789abcedf2`` .
@@ -903,6 +913,48 @@ class CfnAccessPoint(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromAccessPointArn")
+    @builtins.classmethod
+    def from_access_point_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IAccessPointRef_437d4bf7:
+        '''Creates a new IAccessPointRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__92ad86c592cb19a6abd73b1b479fad3b171522816029847cc3a4c5b73c6498de)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IAccessPointRef_437d4bf7, jsii.sinvoke(cls, "fromAccessPointArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromAccessPointId")
+    @builtins.classmethod
+    def from_access_point_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        access_point_id: builtins.str,
+    ) -> _IAccessPointRef_437d4bf7:
+        '''Creates a new IAccessPointRef from a accessPointId.
+
+        :param scope: -
+        :param id: -
+        :param access_point_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__8b64390d2c6b604063551974706c8adbb104ec23af46eef06f60815f3f011b40)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument access_point_id", value=access_point_id, expected_type=type_hints["access_point_id"])
+        return typing.cast(_IAccessPointRef_437d4bf7, jsii.sinvoke(cls, "fromAccessPointId", [scope, id, access_point_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -933,6 +985,12 @@ class CfnAccessPoint(
         '''The CloudFormation resource type name for this resource class.'''
         return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
+    @builtins.property
+    @jsii.member(jsii_name="accessPointRef")
+    def access_point_ref(self) -> _AccessPointReference_4b264f5d:
+        '''A reference to a AccessPoint resource.'''
+        return typing.cast(_AccessPointReference_4b264f5d, jsii.get(self, "accessPointRef"))
+
     @builtins.property
     @jsii.member(jsii_name="attrAccessPointId")
     def attr_access_point_id(self) -> builtins.str:
@@ -1542,7 +1600,7 @@ class CfnAccessPointProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IFileSystemRef_3dcf8b98, _ITaggable_36806126)
 class CfnFileSystem(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1621,7 +1679,8 @@ class CfnFileSystem(
         replication_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnFileSystem.ReplicationConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         throughput_mode: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::EFS::FileSystem``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param availability_zone_name: For One Zone file systems, specify the AWS Availability Zone in which to create the file system. Use the format ``us-east-1a`` to specify the Availability Zone. For more information about One Zone file systems, see `EFS file system types <https://docs.aws.amazon.com/efs/latest/ug/availability-durability.html#file-system-type>`_ in the *Amazon EFS User Guide* . .. epigraph:: One Zone file systems are not available in all Availability Zones in AWS Regions where Amazon EFS is available.
@@ -1660,6 +1719,48 @@ class CfnFileSystem(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromFileSystemArn")
+    @builtins.classmethod
+    def from_file_system_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IFileSystemRef_3dcf8b98:
+        '''Creates a new IFileSystemRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__3841b06a5a3cc43b9d7a952dde6883124724edd8a22c2c9508a0d5b531c04980)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IFileSystemRef_3dcf8b98, jsii.sinvoke(cls, "fromFileSystemArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromFileSystemId")
+    @builtins.classmethod
+    def from_file_system_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        file_system_id: builtins.str,
+    ) -> _IFileSystemRef_3dcf8b98:
+        '''Creates a new IFileSystemRef from a fileSystemId.
+
+        :param scope: -
+        :param id: -
+        :param file_system_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__62d193f49b214070795d7ac368f6d9118aaac887dc977af485a174b4b75fb67f)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument file_system_id", value=file_system_id, expected_type=type_hints["file_system_id"])
+        return typing.cast(_IFileSystemRef_3dcf8b98, jsii.sinvoke(cls, "fromFileSystemId", [scope, id, file_system_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1717,6 +1818,12 @@ class CfnFileSystem(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="fileSystemRef")
+    def file_system_ref(self) -> _FileSystemReference_4a6f4058:
+        '''A reference to a FileSystem resource.'''
+        return typing.cast(_FileSystemReference_4a6f4058, jsii.get(self, "fileSystemRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -2785,7 +2892,7 @@ class CfnFileSystemProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IMountTargetRef_0955e348)
 class CfnMountTarget(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2811,7 +2918,9 @@ class CfnMountTarget(
             subnet_id="subnetId",
         
             # the properties below are optional
-            ip_address="ipAddress"
+            ip_address="ipAddress",
+            ip_address_type="ipAddressType",
+            ipv6_address="ipv6Address"
         )
     '''
 
@@ -2824,14 +2933,19 @@ class CfnMountTarget(
         security_groups: typing.Sequence[builtins.str],
         subnet_id: builtins.str,
         ip_address: typing.Optional[builtins.str] = None,
+        ip_address_type: typing.Optional[builtins.str] = None,
+        ipv6_address: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::EFS::MountTarget``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param file_system_id: The ID of the file system for which to create the mount target.
-        :param security_groups: VPC security group IDs, of the form ``sg-xxxxxxxx`` . These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see `Amazon VPC Quotas <https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html>`_ in the *Amazon VPC User Guide* (see the *Security Groups* table).
-        :param subnet_id: The ID of the subnet to add the mount target in. For One Zone file systems, use the subnet that is associated with the file system's Availability Zone.
-        :param ip_address: Valid IPv4 address within the address range of the specified subnet.
+        :param security_groups: VPC security group IDs, of the form ``sg-xxxxxxxx`` . These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see `Amazon VPC Quotas <https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html>`_ in the *Amazon VPC User Guide* (see the *Security Groups* table). If you don't specify a security group, then Amazon EFS uses the default security group for the subnet's VPC.
+        :param subnet_id: The ID of the subnet to add the mount target in. For One Zone file systems, use the subnet that is associated with the file system's Availability Zone. The subnet type must be the same type as the ``IpAddressType`` .
+        :param ip_address: If the ``IpAddressType`` for the mount target is IPv4 ( ``IPV4_ONLY`` or ``DUAL_STACK`` ), then specify the IPv4 address to use. If you do not specify an ``IpAddress`` , then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId`` .
+        :param ip_address_type: The IP address type for the mount target. The possible values are ``IPV4_ONLY`` (only IPv4 addresses), ``IPV6_ONLY`` (only IPv6 addresses), and ``DUAL_STACK`` (dual-stack, both IPv4 and IPv6 addresses). If you don’t specify an ``IpAddressType`` , then ``IPV4_ONLY`` is used. .. epigraph:: The ``IPAddressType`` must match the IP type of the subnet. Additionally, the ``IPAddressType`` parameter overrides the value set as the default IP address for the subnet in the VPC. For example, if the ``IPAddressType`` is ``IPV4_ONLY`` and ``AssignIpv6AddressOnCreation`` is ``true`` , then IPv4 is used for the mount target. For more information, see `Modify the IP addressing attributes of your subnet <https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html>`_ .
+        :param ipv6_address: If the ``IPAddressType`` for the mount target is IPv6 ( ``IPV6_ONLY`` or ``DUAL_STACK`` ), then specify the IPv6 address to use. If you do not specify an ``Ipv6Address`` , then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId`` .
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__53e47daec02e70bf8a73cac8e0366ac0f8a6af5ccf7598cf37952afe954d30bd)
@@ -2842,6 +2956,8 @@ class CfnMountTarget(
             security_groups=security_groups,
             subnet_id=subnet_id,
             ip_address=ip_address,
+            ip_address_type=ip_address_type,
+            ipv6_address=ipv6_address,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
@@ -2903,6 +3019,12 @@ class CfnMountTarget(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="mountTargetRef")
+    def mount_target_ref(self) -> _MountTargetReference_498e181c:
+        '''A reference to a MountTarget resource.'''
+        return typing.cast(_MountTargetReference_498e181c, jsii.get(self, "mountTargetRef"))
+
     @builtins.property
     @jsii.member(jsii_name="fileSystemId")
     def file_system_id(self) -> builtins.str:
@@ -2945,7 +3067,7 @@ class CfnMountTarget(
     @builtins.property
     @jsii.member(jsii_name="ipAddress")
     def ip_address(self) -> typing.Optional[builtins.str]:
-        '''Valid IPv4 address within the address range of the specified subnet.'''
+        '''If the ``IpAddressType`` for the mount target is IPv4 ( ``IPV4_ONLY`` or ``DUAL_STACK`` ), then specify the IPv4 address to use.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "ipAddress"))
 
     @ip_address.setter
@@ -2955,6 +3077,32 @@ class CfnMountTarget(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "ipAddress", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="ipAddressType")
+    def ip_address_type(self) -> typing.Optional[builtins.str]:
+        '''The IP address type for the mount target.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "ipAddressType"))
+
+    @ip_address_type.setter
+    def ip_address_type(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__aa0cce2a23c783f1140d965a20db7db2255e72b575061672bff8884307e12048)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "ipAddressType", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="ipv6Address")
+    def ipv6_address(self) -> typing.Optional[builtins.str]:
+        '''If the ``IPAddressType`` for the mount target is IPv6 ( ``IPV6_ONLY`` or ``DUAL_STACK`` ), then specify the IPv6 address to use.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "ipv6Address"))
+
+    @ipv6_address.setter
+    def ipv6_address(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4d32de6237501dc91f3fc4a5121f4d28b9f910af301fcb6a625250a259cb215b)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "ipv6Address", value) # pyright: ignore[reportArgumentType]
+
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_efs.CfnMountTargetProps",
@@ -2964,6 +3112,8 @@ class CfnMountTarget(
         "security_groups": "securityGroups",
         "subnet_id": "subnetId",
         "ip_address": "ipAddress",
+        "ip_address_type": "ipAddressType",
+        "ipv6_address": "ipv6Address",
     },
 )
 class CfnMountTargetProps:
@@ -2974,13 +3124,17 @@ class CfnMountTargetProps:
         security_groups: typing.Sequence[builtins.str],
         subnet_id: builtins.str,
         ip_address: typing.Optional[builtins.str] = None,
+        ip_address_type: typing.Optional[builtins.str] = None,
+        ipv6_address: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Properties for defining a ``CfnMountTarget``.
 
         :param file_system_id: The ID of the file system for which to create the mount target.
-        :param security_groups: VPC security group IDs, of the form ``sg-xxxxxxxx`` . These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see `Amazon VPC Quotas <https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html>`_ in the *Amazon VPC User Guide* (see the *Security Groups* table).
-        :param subnet_id: The ID of the subnet to add the mount target in. For One Zone file systems, use the subnet that is associated with the file system's Availability Zone.
-        :param ip_address: Valid IPv4 address within the address range of the specified subnet.
+        :param security_groups: VPC security group IDs, of the form ``sg-xxxxxxxx`` . These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see `Amazon VPC Quotas <https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html>`_ in the *Amazon VPC User Guide* (see the *Security Groups* table). If you don't specify a security group, then Amazon EFS uses the default security group for the subnet's VPC.
+        :param subnet_id: The ID of the subnet to add the mount target in. For One Zone file systems, use the subnet that is associated with the file system's Availability Zone. The subnet type must be the same type as the ``IpAddressType`` .
+        :param ip_address: If the ``IpAddressType`` for the mount target is IPv4 ( ``IPV4_ONLY`` or ``DUAL_STACK`` ), then specify the IPv4 address to use. If you do not specify an ``IpAddress`` , then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId`` .
+        :param ip_address_type: The IP address type for the mount target. The possible values are ``IPV4_ONLY`` (only IPv4 addresses), ``IPV6_ONLY`` (only IPv6 addresses), and ``DUAL_STACK`` (dual-stack, both IPv4 and IPv6 addresses). If you don’t specify an ``IpAddressType`` , then ``IPV4_ONLY`` is used. .. epigraph:: The ``IPAddressType`` must match the IP type of the subnet. Additionally, the ``IPAddressType`` parameter overrides the value set as the default IP address for the subnet in the VPC. For example, if the ``IPAddressType`` is ``IPV4_ONLY`` and ``AssignIpv6AddressOnCreation`` is ``true`` , then IPv4 is used for the mount target. For more information, see `Modify the IP addressing attributes of your subnet <https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html>`_ .
+        :param ipv6_address: If the ``IPAddressType`` for the mount target is IPv6 ( ``IPV6_ONLY`` or ``DUAL_STACK`` ), then specify the IPv6 address to use. If you do not specify an ``Ipv6Address`` , then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html
         :exampleMetadata: fixture=_generated
@@ -2997,7 +3151,9 @@ class CfnMountTargetProps:
                 subnet_id="subnetId",
             
                 # the properties below are optional
-                ip_address="ipAddress"
+                ip_address="ipAddress",
+                ip_address_type="ipAddressType",
+                ipv6_address="ipv6Address"
             )
         '''
         if __debug__:
@@ -3006,6 +3162,8 @@ class CfnMountTargetProps:
             check_type(argname="argument security_groups", value=security_groups, expected_type=type_hints["security_groups"])
             check_type(argname="argument subnet_id", value=subnet_id, expected_type=type_hints["subnet_id"])
             check_type(argname="argument ip_address", value=ip_address, expected_type=type_hints["ip_address"])
+            check_type(argname="argument ip_address_type", value=ip_address_type, expected_type=type_hints["ip_address_type"])
+            check_type(argname="argument ipv6_address", value=ipv6_address, expected_type=type_hints["ipv6_address"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "file_system_id": file_system_id,
             "security_groups": security_groups,
@@ -3013,6 +3171,10 @@ class CfnMountTargetProps:
         }
         if ip_address is not None:
             self._values["ip_address"] = ip_address
+        if ip_address_type is not None:
+            self._values["ip_address_type"] = ip_address_type
+        if ipv6_address is not None:
+            self._values["ipv6_address"] = ipv6_address
 
     @builtins.property
     def file_system_id(self) -> builtins.str:
@@ -3028,7 +3190,7 @@ class CfnMountTargetProps:
     def security_groups(self) -> typing.List[builtins.str]:
         '''VPC security group IDs, of the form ``sg-xxxxxxxx`` .
 
-        These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see `Amazon VPC Quotas <https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html>`_ in the *Amazon VPC User Guide* (see the *Security Groups* table).
+        These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see `Amazon VPC Quotas <https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html>`_ in the *Amazon VPC User Guide* (see the *Security Groups* table). If you don't specify a security group, then Amazon EFS uses the default security group for the subnet's VPC.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html#cfn-efs-mounttarget-securitygroups
         '''
@@ -3040,7 +3202,7 @@ class CfnMountTargetProps:
     def subnet_id(self) -> builtins.str:
         '''The ID of the subnet to add the mount target in.
 
-        For One Zone file systems, use the subnet that is associated with the file system's Availability Zone.
+        For One Zone file systems, use the subnet that is associated with the file system's Availability Zone. The subnet type must be the same type as the ``IpAddressType`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html#cfn-efs-mounttarget-subnetid
         '''
@@ -3050,13 +3212,40 @@ class CfnMountTargetProps:
 
     @builtins.property
     def ip_address(self) -> typing.Optional[builtins.str]:
-        '''Valid IPv4 address within the address range of the specified subnet.
+        '''If the ``IpAddressType`` for the mount target is IPv4 ( ``IPV4_ONLY`` or ``DUAL_STACK`` ), then specify the IPv4 address to use.
+
+        If you do not specify an ``IpAddress`` , then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html#cfn-efs-mounttarget-ipaddress
         '''
         result = self._values.get("ip_address")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def ip_address_type(self) -> typing.Optional[builtins.str]:
+        '''The IP address type for the mount target.
+
+        The possible values are ``IPV4_ONLY`` (only IPv4 addresses), ``IPV6_ONLY`` (only IPv6 addresses), and ``DUAL_STACK`` (dual-stack, both IPv4 and IPv6 addresses). If you don’t specify an ``IpAddressType`` , then ``IPV4_ONLY`` is used.
+        .. epigraph::
+
+           The ``IPAddressType`` must match the IP type of the subnet. Additionally, the ``IPAddressType`` parameter overrides the value set as the default IP address for the subnet in the VPC. For example, if the ``IPAddressType`` is ``IPV4_ONLY`` and ``AssignIpv6AddressOnCreation`` is ``true`` , then IPv4 is used for the mount target. For more information, see `Modify the IP addressing attributes of your subnet <https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html>`_ .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html#cfn-efs-mounttarget-ipaddresstype
+        '''
+        result = self._values.get("ip_address_type")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def ipv6_address(self) -> typing.Optional[builtins.str]:
+        '''If the ``IPAddressType`` for the mount target is IPv6 ( ``IPV6_ONLY`` or ``DUAL_STACK`` ), then specify the IPv6 address to use.
+
+        If you do not specify an ``Ipv6Address`` , then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId`` .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html#cfn-efs-mounttarget-ipv6address
+        '''
+        result = self._values.get("ipv6_address")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -3242,7 +3431,7 @@ class FileSystemProps:
         encrypted: typing.Optional[builtins.bool] = None,
         file_system_name: typing.Optional[builtins.str] = None,
         file_system_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
-        kms_key: typing.Optional[_IKey_5f11635f] = None,
+        kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         lifecycle_policy: typing.Optional["LifecyclePolicy"] = None,
         one_zone: typing.Optional[builtins.bool] = None,
         out_of_infrequent_access_policy: typing.Optional["OutOfInfrequentAccessPolicy"] = None,
@@ -3416,7 +3605,7 @@ class FileSystemProps:
         return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
 
     @builtins.property
-    def kms_key(self) -> typing.Optional[_IKey_5f11635f]:
+    def kms_key(self) -> typing.Optional[_IKeyRef_d4fc6ef3]:
         '''The KMS key used for encryption.
 
         This is required to encrypt the data at rest if
@@ -3426,7 +3615,7 @@ class FileSystemProps:
         :encrypted: is set to true.
         '''
         result = self._values.get("kms_key")
-        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+        return typing.cast(typing.Optional[_IKeyRef_d4fc6ef3], result)
 
     @builtins.property
     def lifecycle_policy(self) -> typing.Optional["LifecyclePolicy"]:
@@ -4636,7 +4825,7 @@ class FileSystem(
         encrypted: typing.Optional[builtins.bool] = None,
         file_system_name: typing.Optional[builtins.str] = None,
         file_system_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
-        kms_key: typing.Optional[_IKey_5f11635f] = None,
+        kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         lifecycle_policy: typing.Optional[LifecyclePolicy] = None,
         one_zone: typing.Optional[builtins.bool] = None,
         out_of_infrequent_access_policy: typing.Optional[OutOfInfrequentAccessPolicy] = None,
@@ -4958,6 +5147,22 @@ def _typecheckingstub__ee6cf8e32e236f5b64c41d34d8956a146a19df0d9467273bec84f3053
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__92ad86c592cb19a6abd73b1b479fad3b171522816029847cc3a4c5b73c6498de(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__8b64390d2c6b604063551974706c8adbb104ec23af46eef06f60815f3f011b40(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    access_point_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__ca8bc4bd98606c2925e8e3beaf6899315a3a8aa05fe42a495c106412587debb7(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -5066,6 +5271,22 @@ def _typecheckingstub__cc457ee31ba660f40c549433977317b66ec9b461edc7a3afd3a157dcf
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__3841b06a5a3cc43b9d7a952dde6883124724edd8a22c2c9508a0d5b531c04980(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__62d193f49b214070795d7ac368f6d9118aaac887dc977af485a174b4b75fb67f(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    file_system_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__4de45f38231d265020ffa3517bb2f41c6c7f64bc0414e943cf094f6436b824df(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -5234,6 +5455,8 @@ def _typecheckingstub__53e47daec02e70bf8a73cac8e0366ac0f8a6af5ccf7598cf37952afe9
     security_groups: typing.Sequence[builtins.str],
     subnet_id: builtins.str,
     ip_address: typing.Optional[builtins.str] = None,
+    ip_address_type: typing.Optional[builtins.str] = None,
+    ipv6_address: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -5274,12 +5497,26 @@ def _typecheckingstub__804f6c8cadefc6e3bd989db6da64591d147d67de340d096244f68a218
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__aa0cce2a23c783f1140d965a20db7db2255e72b575061672bff8884307e12048(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__4d32de6237501dc91f3fc4a5121f4d28b9f910af301fcb6a625250a259cb215b(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__f2ad126af1a9797276c238562f8185eb06a56da00a9b12a35504f9d72fbdc711(
     *,
     file_system_id: builtins.str,
     security_groups: typing.Sequence[builtins.str],
     subnet_id: builtins.str,
     ip_address: typing.Optional[builtins.str] = None,
+    ip_address_type: typing.Optional[builtins.str] = None,
+    ipv6_address: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -5308,7 +5545,7 @@ def _typecheckingstub__a11d59607a7c01a190b2b0587733658cfcb8eddfb252f3c48abdc988b
     encrypted: typing.Optional[builtins.bool] = None,
     file_system_name: typing.Optional[builtins.str] = None,
     file_system_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
-    kms_key: typing.Optional[_IKey_5f11635f] = None,
+    kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     lifecycle_policy: typing.Optional[LifecyclePolicy] = None,
     one_zone: typing.Optional[builtins.bool] = None,
     out_of_infrequent_access_policy: typing.Optional[OutOfInfrequentAccessPolicy] = None,
@@ -5449,7 +5686,7 @@ def _typecheckingstub__fe7547e76a3f3502ef6c67d1cc851b25d13fe1b4b980d3bccee8eae2f
     encrypted: typing.Optional[builtins.bool] = None,
     file_system_name: typing.Optional[builtins.str] = None,
     file_system_policy: typing.Optional[_PolicyDocument_3ac34393] = None,
-    kms_key: typing.Optional[_IKey_5f11635f] = None,
+    kms_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     lifecycle_policy: typing.Optional[LifecyclePolicy] = None,
     one_zone: typing.Optional[builtins.bool] = None,
     out_of_infrequent_access_policy: typing.Optional[OutOfInfrequentAccessPolicy] = None,
@@ -5518,3 +5755,6 @@ def _typecheckingstub__020e1ad6a612ae3b94c3b53afd9ca3e8710c6a621174024a66a4889b0
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [IAccessPoint, IFileSystem]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])