aws-cdk-lib 2.201.0__py3-none-any.whl → 2.203.0__py3-none-any.whl

aws_cdk/aws_lambda/__init__.py

@@ -292,6 +292,23 @@ const fn = new lambda.Function(this, 'MyFunctionWithFFTrue', {
 cdk.Tags.of(fn).add('env', 'dev'); // the tag is also added to the log group
 ```
 
+### Log removal policy
+
+When using the deprecated `logRetention` property for creating a LogGroup, you can configure log removal policy:
+
+```python
+import aws_cdk.aws_logs as logs
+
+
+fn = lambda_.Function(self, "MyFunctionWithFFTrue",
+    runtime=lambda_.Runtime.NODEJS_LATEST,
+    handler="handler.main",
+    code=lambda_.Code.from_asset("lambda"),
+    log_retention=logs.RetentionDays.INFINITE,
+    log_removal_policy=RemovalPolicy.RETAIN
+)
+```
+
 ## Resource-based Policies
 
 AWS Lambda supports resource-based policies for controlling access to Lambda
@@ -4414,6 +4431,8 @@ class CfnEventInvokeConfig(
         ) -> None:
             '''A configuration object that specifies the destination of an event after Lambda processes it.
 
+            For more information, see `Adding a destination <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-async-destinations>`_ .
+
             :param on_failure: The destination configuration for failed invocations. .. epigraph:: When using an Amazon SQS queue as a destination, FIFO queues cannot be used.
             :param on_success: The destination configuration for successful invocations. .. epigraph:: When using an Amazon SQS queue as a destination, FIFO queues cannot be used.
 
@@ -4495,7 +4514,7 @@ class CfnEventInvokeConfig(
         def __init__(self, *, destination: builtins.str) -> None:
             '''A destination for events that failed processing.
 
-            See `Capturing records of Lambda asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html>`_ for more information.
+            For more information, see `Adding a destination <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-async-destinations>`_ .
 
             :param destination: The Amazon Resource Name (ARN) of the destination resource. To retain records of unsuccessful `asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, Amazon S3 bucket, Lambda function, or Amazon EventBridge event bus as the destination. To retain records of failed invocations from `Kinesis <https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html>`_ , `DynamoDB <https://docs.aws.amazon.com/lambda/latest/dg/with-ddb.html>`_ , `self-managed Kafka <https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination>`_ or `Amazon MSK <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.
 
@@ -4554,6 +4573,9 @@ class CfnEventInvokeConfig(
             '''A destination for events that were processed successfully.
 
             To retain records of successful `asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, Lambda function, or Amazon EventBridge event bus as the destination.
+            .. epigraph::
+
+               ``OnSuccess`` is not supported in ``CreateEventSourceMapping`` or ``UpdateEventSourceMapping`` requests.
 
             :param destination: The Amazon Resource Name (ARN) of the destination resource.
 
@@ -5475,7 +5497,7 @@ class CfnEventSourceMapping(
             '''Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
 
             :param consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
-            :param schema_registry_config: 
+            :param schema_registry_config: Specific configuration settings for a Kafka schema registry.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -5526,7 +5548,8 @@ class CfnEventSourceMapping(
         def schema_registry_config(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SchemaRegistryConfigProperty"]]:
-            '''
+            '''Specific configuration settings for a Kafka schema registry.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig.html#cfn-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig-schemaregistryconfig
             '''
             result = self._values.get("schema_registry_config")
@@ -5556,6 +5579,8 @@ class CfnEventSourceMapping(
         ) -> None:
             '''A configuration object that specifies the destination of an event after Lambda processes it.
 
+            For more information, see `Adding a destination <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-async-destinations>`_ .
+
             :param on_failure: The destination configuration for failed invocations.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-destinationconfig.html
@@ -5934,7 +5959,7 @@ class CfnEventSourceMapping(
         ) -> None:
             '''A destination for events that failed processing.
 
-            See `Capturing records of Lambda asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html>`_ for more information.
+            For more information, see `Adding a destination <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html#invocation-async-destinations>`_ .
 
             :param destination: The Amazon Resource Name (ARN) of the destination resource. To retain records of unsuccessful `asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, Amazon S3 bucket, Lambda function, or Amazon EventBridge event bus as the destination. To retain records of failed invocations from `Kinesis <https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html>`_ , `DynamoDB <https://docs.aws.amazon.com/lambda/latest/dg/with-ddb.html>`_ , `self-managed Kafka <https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination>`_ or `Amazon MSK <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.
 
@@ -6124,7 +6149,12 @@ class CfnEventSourceMapping(
             type: typing.Optional[builtins.str] = None,
             uri: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''
+            '''Specific access configuration settings that tell Lambda how to authenticate with your schema registry.
+
+            If you're working with an AWS Glue schema registry, don't provide authentication details in this object. Instead, ensure that your execution role has the required permissions for Lambda to access your cluster.
+
+            If you're working with a Confluent schema registry, choose the authentication method in the ``Type`` field, and provide the AWS Secrets Manager secret ARN in the ``URI`` field.
+
             :param type: The type of authentication Lambda uses to access your schema registry.
             :param uri: The URI of the secret (Secrets Manager secret ARN) to authenticate with your schema registry.
 
@@ -6200,10 +6230,11 @@ class CfnEventSourceMapping(
             schema_registry_uri: typing.Optional[builtins.str] = None,
             schema_validation_configs: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventSourceMapping.SchemaValidationConfigProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         ) -> None:
-            '''
+            '''Specific configuration settings for a Kafka schema registry.
+
             :param access_configs: An array of access configuration objects that tell Lambda how to authenticate with your schema registry.
-            :param event_record_format: The record format that Lambda delivers to your function after schema validation.
-            :param schema_registry_uri: The URI for your schema registry. The correct URI format depends on the type of schema registry you're using.
+            :param event_record_format: The record format that Lambda delivers to your function after schema validation. - Choose ``JSON`` to have Lambda deliver the record to your function as a standard JSON object. - Choose ``SOURCE`` to have Lambda deliver the record to your function in its original source format. Lambda removes all schema metadata, such as the schema ID, before sending the record to your function.
+            :param schema_registry_uri: The URI for your schema registry. The correct URI format depends on the type of schema registry you're using. - For AWS Glue schema registries, use the ARN of the registry. - For Confluent schema registries, use the URL of the registry.
             :param schema_validation_configs: An array of schema validation configuration objects, which tell Lambda the message attributes you want to validate and filter using your schema registry.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-schemaregistryconfig.html
@@ -6258,6 +6289,9 @@ class CfnEventSourceMapping(
         def event_record_format(self) -> typing.Optional[builtins.str]:
             '''The record format that Lambda delivers to your function after schema validation.
 
+            - Choose ``JSON`` to have Lambda deliver the record to your function as a standard JSON object.
+            - Choose ``SOURCE`` to have Lambda deliver the record to your function in its original source format. Lambda removes all schema metadata, such as the schema ID, before sending the record to your function.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-schemaregistryconfig.html#cfn-lambda-eventsourcemapping-schemaregistryconfig-eventrecordformat
             '''
             result = self._values.get("event_record_format")
@@ -6265,9 +6299,10 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def schema_registry_uri(self) -> typing.Optional[builtins.str]:
-            '''The URI for your schema registry.
+            '''The URI for your schema registry. The correct URI format depends on the type of schema registry you're using.
 
-            The correct URI format depends on the type of schema registry you're using.
+            - For AWS Glue schema registries, use the ARN of the registry.
+            - For Confluent schema registries, use the URL of the registry.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-schemaregistryconfig.html#cfn-lambda-eventsourcemapping-schemaregistryconfig-schemaregistryuri
             '''
@@ -6303,8 +6338,9 @@ class CfnEventSourceMapping(
     )
     class SchemaValidationConfigProperty:
         def __init__(self, *, attribute: typing.Optional[builtins.str] = None) -> None:
-            '''
-            :param attribute: The attribute you want your schema registry to validate and filter for.
+            '''Specific schema validation configuration settings that tell Lambda the message attributes you want to validate and filter using your schema registry.
+
+            :param attribute: The attributes you want your schema registry to validate and filter for. If you selected ``JSON`` as the ``EventRecordFormat`` , Lambda also deserializes the selected message attributes.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-schemavalidationconfig.html
             :exampleMetadata: fixture=_generated
@@ -6328,7 +6364,9 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def attribute(self) -> typing.Optional[builtins.str]:
-            '''The attribute you want your schema registry to validate and filter for.
+            '''The attributes you want your schema registry to validate and filter for.
+
+            If you selected ``JSON`` as the ``EventRecordFormat`` , Lambda also deserializes the selected message attributes.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-schemavalidationconfig.html#cfn-lambda-eventsourcemapping-schemavalidationconfig-attribute
             '''
@@ -6423,7 +6461,7 @@ class CfnEventSourceMapping(
             '''Specific configuration settings for a self-managed Apache Kafka event source.
 
             :param consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-kafka-process.html#services-smaa-topic-add>`_ .
-            :param schema_registry_config: 
+            :param schema_registry_config: Specific configuration settings for a Kafka schema registry.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -6474,7 +6512,8 @@ class CfnEventSourceMapping(
         def schema_registry_config(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SchemaRegistryConfigProperty"]]:
-            '''
+            '''Specific configuration settings for a Kafka schema registry.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig.html#cfn-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig-schemaregistryconfig
             '''
             result = self._values.get("schema_registry_config")
@@ -11831,6 +11870,9 @@ class Code(metaclass=jsii.JSIIAbstractClass, jsii_type="aws-cdk-lib.aws_lambda.C
     ) -> "S3Code":
         '''Lambda handler code as an S3 object.
 
+        Note: If ``objectVersion`` is not defined, the lambda will not be updated automatically if the code in the bucket is updated.
+        This is because CDK/Cloudformation does not track changes on the source S3 Bucket. It is recommended to either use S3Code.fromAsset() instead or set objectVersion.
+
         :param bucket: The S3 bucket.
         :param key: The object key.
         :param object_version: Optional S3 object version.
@@ -11854,6 +11896,9 @@ class Code(metaclass=jsii.JSIIAbstractClass, jsii_type="aws-cdk-lib.aws_lambda.C
     ) -> "S3CodeV2":
         '''Lambda handler code as an S3 object.
 
+        Note: If ``options.objectVersion`` is not defined, the lambda will not be updated automatically if the code in the bucket is updated.
+        This is because CDK/Cloudformation does not track changes on the source S3 Bucket. It is recommended to either use S3Code.fromAsset() instead or set objectVersion.
+
         :param bucket: The S3 bucket.
         :param key: The object key.
         :param object_version: Optional S3 object version.
@@ -13868,6 +13913,78 @@ class EventInvokeConfigProps(EventInvokeConfigOptions):
         )
 
 
+class EventRecordFormat(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_lambda.EventRecordFormat",
+):
+    '''The format target function should recieve record in.
+
+    :exampleMetadata: infused
+
+    Example::
+
+        from aws_cdk.aws_lambda_event_sources import ManagedKafkaEventSource, ConfluentSchemaRegistry
+        from aws_cdk.aws_secretsmanager import Secret
+        
+        # Your MSK cluster arn
+        # cluster_arn: str
+        
+        # my_function: lambda.Function
+        
+        
+        # The Kafka topic you want to subscribe to
+        topic = "some-cool-topic"
+        
+        secret = Secret(self, "Secret", secret_name="AmazonMSK_KafkaSecret")
+        my_function.add_event_source(ManagedKafkaEventSource(
+            cluster_arn=cluster_arn,
+            topic=topic,
+            starting_position=lambda_.StartingPosition.TRIM_HORIZON,
+            provisioned_poller_config=ProvisionedPollerConfig(
+                minimum_pollers=1,
+                maximum_pollers=3
+            ),
+            schema_registry_config=ConfluentSchemaRegistry(
+                schema_registry_uri="https://example.com",
+                event_record_format=lambda_.EventRecordFormat.JSON,
+                authentication_type=lambda_.KafkaSchemaRegistryAccessConfigType.BASIC_AUTH,
+                secret=secret,
+                schema_validation_configs=[lambda.KafkaSchemaValidationConfig(attribute=lambda_.KafkaSchemaValidationAttribute.KEY)]
+            )
+        ))
+    '''
+
+    @jsii.member(jsii_name="of")
+    @builtins.classmethod
+    def of(cls, name: builtins.str) -> "EventRecordFormat":
+        '''A custom event record format.
+
+        :param name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__913b83169547e1e27e0d17d4e5a189f10545dca54ca45db7a5dc40a7d5cc2999)
+            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+        return typing.cast("EventRecordFormat", jsii.sinvoke(cls, "of", [name]))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="JSON")
+    def JSON(cls) -> "EventRecordFormat":
+        '''The target function will recieve records as json objects.'''
+        return typing.cast("EventRecordFormat", jsii.sget(cls, "JSON"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="SOURCE")
+    def SOURCE(cls) -> "EventRecordFormat":
+        '''The target function will recieve records in same format as the schema source.'''
+        return typing.cast("EventRecordFormat", jsii.sget(cls, "SOURCE"))
+
+    @builtins.property
+    @jsii.member(jsii_name="value")
+    def value(self) -> builtins.str:
+        '''The enum to use in ``SchemaRegistryConfig.EventRecordFormat`` property in CloudFormation.'''
+        return typing.cast(builtins.str, jsii.get(self, "value"))
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_lambda.EventSourceMappingOptions",
     jsii_struct_bases=[],
@@ -13890,6 +14007,7 @@ class EventInvokeConfigProps(EventInvokeConfigOptions):
         "provisioned_poller_config": "provisionedPollerConfig",
         "report_batch_item_failures": "reportBatchItemFailures",
         "retry_attempts": "retryAttempts",
+        "schema_registry_config": "schemaRegistryConfig",
         "source_access_configurations": "sourceAccessConfigurations",
         "starting_position": "startingPosition",
         "starting_position_timestamp": "startingPositionTimestamp",
@@ -13919,6 +14037,7 @@ class EventSourceMappingOptions:
         provisioned_poller_config: typing.Optional[typing.Union["ProvisionedPollerConfig", typing.Dict[builtins.str, typing.Any]]] = None,
         report_batch_item_failures: typing.Optional[builtins.bool] = None,
         retry_attempts: typing.Optional[jsii.Number] = None,
+        schema_registry_config: typing.Optional["ISchemaRegistry"] = None,
         source_access_configurations: typing.Optional[typing.Sequence[typing.Union["SourceAccessConfiguration", typing.Dict[builtins.str, typing.Any]]]] = None,
         starting_position: typing.Optional["StartingPosition"] = None,
         starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -13944,6 +14063,7 @@ class EventSourceMappingOptions:
         :param provisioned_poller_config: Configuration for provisioned pollers that read from the event source. When specified, allows control over the minimum and maximum number of pollers that can be provisioned to process events from the source. Default: - no provisioned pollers
         :param report_batch_item_failures: Allow functions to return partially successful responses for a batch of records. Default: false
         :param retry_attempts: The maximum number of times to retry when the function returns an error. Set to ``undefined`` if you want lambda to keep retrying infinitely or until the record expires. Valid Range: - Minimum value of 0 - Maximum value of 10000 Default: - infinite or until the record expires.
+        :param schema_registry_config: Specific configuration settings for a Kafka schema registry. Default: - none
         :param source_access_configurations: Specific settings like the authentication protocol or the VPC components to secure access to your event source. Default: - none
         :param starting_position: The position in the DynamoDB, Kinesis or MSK stream where AWS Lambda should start reading. Default: - no starting position
         :param starting_position_timestamp: The time from which to start reading, in Unix time seconds. Default: - no timestamp
@@ -13963,6 +14083,7 @@ class EventSourceMappingOptions:
             # event_source_dlq: lambda.IEventSourceDlq
             # filters: Any
             # key: kms.Key
+            # schema_registry: lambda.ISchemaRegistry
             # source_access_configuration_type: lambda.SourceAccessConfigurationType
             
             event_source_mapping_options = lambda.EventSourceMappingOptions(
@@ -13991,6 +14112,7 @@ class EventSourceMappingOptions:
                 ),
                 report_batch_item_failures=False,
                 retry_attempts=123,
+                schema_registry_config=schema_registry,
                 source_access_configurations=[lambda.SourceAccessConfiguration(
                     type=source_access_configuration_type,
                     uri="uri"
@@ -14025,6 +14147,7 @@ class EventSourceMappingOptions:
             check_type(argname="argument provisioned_poller_config", value=provisioned_poller_config, expected_type=type_hints["provisioned_poller_config"])
             check_type(argname="argument report_batch_item_failures", value=report_batch_item_failures, expected_type=type_hints["report_batch_item_failures"])
             check_type(argname="argument retry_attempts", value=retry_attempts, expected_type=type_hints["retry_attempts"])
+            check_type(argname="argument schema_registry_config", value=schema_registry_config, expected_type=type_hints["schema_registry_config"])
             check_type(argname="argument source_access_configurations", value=source_access_configurations, expected_type=type_hints["source_access_configurations"])
             check_type(argname="argument starting_position", value=starting_position, expected_type=type_hints["starting_position"])
             check_type(argname="argument starting_position_timestamp", value=starting_position_timestamp, expected_type=type_hints["starting_position_timestamp"])
@@ -14067,6 +14190,8 @@ class EventSourceMappingOptions:
             self._values["report_batch_item_failures"] = report_batch_item_failures
         if retry_attempts is not None:
             self._values["retry_attempts"] = retry_attempts
+        if schema_registry_config is not None:
+            self._values["schema_registry_config"] = schema_registry_config
         if source_access_configurations is not None:
             self._values["source_access_configurations"] = source_access_configurations
         if starting_position is not None:
@@ -14294,6 +14419,15 @@ class EventSourceMappingOptions:
         result = self._values.get("retry_attempts")
         return typing.cast(typing.Optional[jsii.Number], result)
 
+    @builtins.property
+    def schema_registry_config(self) -> typing.Optional["ISchemaRegistry"]:
+        '''Specific configuration settings for a Kafka schema registry.
+
+        :default: - none
+        '''
+        result = self._values.get("schema_registry_config")
+        return typing.cast(typing.Optional["ISchemaRegistry"], result)
+
     @builtins.property
     def source_access_configurations(
         self,
@@ -14387,6 +14521,7 @@ class EventSourceMappingOptions:
         "provisioned_poller_config": "provisionedPollerConfig",
         "report_batch_item_failures": "reportBatchItemFailures",
         "retry_attempts": "retryAttempts",
+        "schema_registry_config": "schemaRegistryConfig",
         "source_access_configurations": "sourceAccessConfigurations",
         "starting_position": "startingPosition",
         "starting_position_timestamp": "startingPositionTimestamp",
@@ -14417,6 +14552,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         provisioned_poller_config: typing.Optional[typing.Union["ProvisionedPollerConfig", typing.Dict[builtins.str, typing.Any]]] = None,
         report_batch_item_failures: typing.Optional[builtins.bool] = None,
         retry_attempts: typing.Optional[jsii.Number] = None,
+        schema_registry_config: typing.Optional["ISchemaRegistry"] = None,
         source_access_configurations: typing.Optional[typing.Sequence[typing.Union["SourceAccessConfiguration", typing.Dict[builtins.str, typing.Any]]]] = None,
         starting_position: typing.Optional["StartingPosition"] = None,
         starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -14444,6 +14580,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         :param provisioned_poller_config: Configuration for provisioned pollers that read from the event source. When specified, allows control over the minimum and maximum number of pollers that can be provisioned to process events from the source. Default: - no provisioned pollers
         :param report_batch_item_failures: Allow functions to return partially successful responses for a batch of records. Default: false
         :param retry_attempts: The maximum number of times to retry when the function returns an error. Set to ``undefined`` if you want lambda to keep retrying infinitely or until the record expires. Valid Range: - Minimum value of 0 - Maximum value of 10000 Default: - infinite or until the record expires.
+        :param schema_registry_config: Specific configuration settings for a Kafka schema registry. Default: - none
         :param source_access_configurations: Specific settings like the authentication protocol or the VPC components to secure access to your event source. Default: - none
         :param starting_position: The position in the DynamoDB, Kinesis or MSK stream where AWS Lambda should start reading. Default: - no starting position
         :param starting_position_timestamp: The time from which to start reading, in Unix time seconds. Default: - no timestamp
@@ -14465,6 +14602,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             # filters: Any
             # function_: lambda.Function
             # key: kms.Key
+            # schema_registry: lambda.ISchemaRegistry
             # source_access_configuration_type: lambda.SourceAccessConfigurationType
             
             event_source_mapping_props = lambda.EventSourceMappingProps(
@@ -14496,6 +14634,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
                 ),
                 report_batch_item_failures=False,
                 retry_attempts=123,
+                schema_registry_config=schema_registry,
                 source_access_configurations=[lambda.SourceAccessConfiguration(
                     type=source_access_configuration_type,
                     uri="uri"
@@ -14530,6 +14669,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             check_type(argname="argument provisioned_poller_config", value=provisioned_poller_config, expected_type=type_hints["provisioned_poller_config"])
             check_type(argname="argument report_batch_item_failures", value=report_batch_item_failures, expected_type=type_hints["report_batch_item_failures"])
             check_type(argname="argument retry_attempts", value=retry_attempts, expected_type=type_hints["retry_attempts"])
+            check_type(argname="argument schema_registry_config", value=schema_registry_config, expected_type=type_hints["schema_registry_config"])
             check_type(argname="argument source_access_configurations", value=source_access_configurations, expected_type=type_hints["source_access_configurations"])
             check_type(argname="argument starting_position", value=starting_position, expected_type=type_hints["starting_position"])
             check_type(argname="argument starting_position_timestamp", value=starting_position_timestamp, expected_type=type_hints["starting_position_timestamp"])
@@ -14575,6 +14715,8 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             self._values["report_batch_item_failures"] = report_batch_item_failures
         if retry_attempts is not None:
             self._values["retry_attempts"] = retry_attempts
+        if schema_registry_config is not None:
+            self._values["schema_registry_config"] = schema_registry_config
         if source_access_configurations is not None:
             self._values["source_access_configurations"] = source_access_configurations
         if starting_position is not None:
@@ -14802,6 +14944,15 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         result = self._values.get("retry_attempts")
         return typing.cast(typing.Optional[jsii.Number], result)
 
+    @builtins.property
+    def schema_registry_config(self) -> typing.Optional["ISchemaRegistry"]:
+        '''Specific configuration settings for a Kafka schema registry.
+
+        :default: - none
+        '''
+        result = self._values.get("schema_registry_config")
+        return typing.cast(typing.Optional["ISchemaRegistry"], result)
+
     @builtins.property
     def source_access_configurations(
         self,
@@ -15482,6 +15633,7 @@ class FunctionAttributes:
         "log_format": "logFormat",
         "logging_format": "loggingFormat",
         "log_group": "logGroup",
+        "log_removal_policy": "logRemovalPolicy",
         "log_retention": "logRetention",
         "log_retention_retry_options": "logRetentionRetryOptions",
         "log_retention_role": "logRetentionRole",
@@ -15537,6 +15689,7 @@ class FunctionOptions(EventInvokeConfigOptions):
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional["LoggingFormat"] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union["LogRetentionRetryOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -15589,7 +15742,8 @@ class FunctionOptions(EventInvokeConfigOptions):
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -15690,6 +15844,7 @@ class FunctionOptions(EventInvokeConfigOptions):
                 log_format="logFormat",
                 logging_format=lambda_.LoggingFormat.TEXT,
                 log_group=log_group,
+                log_removal_policy=cdk.RemovalPolicy.DESTROY,
                 log_retention=logs.RetentionDays.ONE_DAY,
                 log_retention_retry_options=lambda.LogRetentionRetryOptions(
                     base=cdk.Duration.minutes(30),
@@ -15765,6 +15920,7 @@ class FunctionOptions(EventInvokeConfigOptions):
             check_type(argname="argument log_format", value=log_format, expected_type=type_hints["log_format"])
             check_type(argname="argument logging_format", value=logging_format, expected_type=type_hints["logging_format"])
             check_type(argname="argument log_group", value=log_group, expected_type=type_hints["log_group"])
+            check_type(argname="argument log_removal_policy", value=log_removal_policy, expected_type=type_hints["log_removal_policy"])
             check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
             check_type(argname="argument log_retention_retry_options", value=log_retention_retry_options, expected_type=type_hints["log_retention_retry_options"])
             check_type(argname="argument log_retention_role", value=log_retention_role, expected_type=type_hints["log_retention_role"])
@@ -15845,6 +16001,8 @@ class FunctionOptions(EventInvokeConfigOptions):
             self._values["logging_format"] = logging_format
         if log_group is not None:
             self._values["log_group"] = log_group
+        if log_removal_policy is not None:
+            self._values["log_removal_policy"] = log_removal_policy
         if log_retention is not None:
             self._values["log_retention"] = log_retention
         if log_retention_retry_options is not None:
@@ -16224,9 +16382,27 @@ class FunctionOptions(EventInvokeConfigOptions):
         result = self._values.get("log_group")
         return typing.cast(typing.Optional[_ILogGroup_3c4fa718], result)
 
+    @builtins.property
+    def log_removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
+        '''(deprecated) Determine the removal policy of the log group that is auto-created by this construct.
+
+        Normally you want to retain the log group so you can diagnose issues
+        from logs even after a deployment that no longer includes the log group.
+        In that case, use the normal date-based retention policy to age out your
+        logs.
+
+        :default: RemovalPolicy.Retain
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
+        '''
+        result = self._values.get("log_removal_policy")
+        return typing.cast(typing.Optional[_RemovalPolicy_9f93c814], result)
+
     @builtins.property
     def log_retention(self) -> typing.Optional[_RetentionDays_070f99f0]:
-        '''The number of days log events are kept in CloudWatch Logs.
+        '''(deprecated) The number of days log events are kept in CloudWatch Logs.
 
         When updating
         this property, unsetting it doesn't remove the log retention policy. To
@@ -16247,6 +16423,10 @@ class FunctionOptions(EventInvokeConfigOptions):
            my_log_group.log_group_name
 
         :default: logs.RetentionDays.INFINITE
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
         '''
         result = self._values.get("log_retention")
         return typing.cast(typing.Optional[_RetentionDays_070f99f0], result)
@@ -16520,6 +16700,7 @@ class FunctionOptions(EventInvokeConfigOptions):
         "log_format": "logFormat",
         "logging_format": "loggingFormat",
         "log_group": "logGroup",
+        "log_removal_policy": "logRemovalPolicy",
         "log_retention": "logRetention",
         "log_retention_retry_options": "logRetentionRetryOptions",
         "log_retention_role": "logRetentionRole",
@@ -16578,6 +16759,7 @@ class FunctionProps(FunctionOptions):
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional["LoggingFormat"] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union["LogRetentionRetryOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -16632,7 +16814,8 @@ class FunctionProps(FunctionOptions):
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -16722,6 +16905,7 @@ class FunctionProps(FunctionOptions):
             check_type(argname="argument log_format", value=log_format, expected_type=type_hints["log_format"])
             check_type(argname="argument logging_format", value=logging_format, expected_type=type_hints["logging_format"])
             check_type(argname="argument log_group", value=log_group, expected_type=type_hints["log_group"])
+            check_type(argname="argument log_removal_policy", value=log_removal_policy, expected_type=type_hints["log_removal_policy"])
             check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
             check_type(argname="argument log_retention_retry_options", value=log_retention_retry_options, expected_type=type_hints["log_retention_retry_options"])
             check_type(argname="argument log_retention_role", value=log_retention_role, expected_type=type_hints["log_retention_role"])
@@ -16809,6 +16993,8 @@ class FunctionProps(FunctionOptions):
             self._values["logging_format"] = logging_format
         if log_group is not None:
             self._values["log_group"] = log_group
+        if log_removal_policy is not None:
+            self._values["log_removal_policy"] = log_removal_policy
         if log_retention is not None:
             self._values["log_retention"] = log_retention
         if log_retention_retry_options is not None:
@@ -17188,9 +17374,27 @@ class FunctionProps(FunctionOptions):
         result = self._values.get("log_group")
         return typing.cast(typing.Optional[_ILogGroup_3c4fa718], result)
 
+    @builtins.property
+    def log_removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
+        '''(deprecated) Determine the removal policy of the log group that is auto-created by this construct.
+
+        Normally you want to retain the log group so you can diagnose issues
+        from logs even after a deployment that no longer includes the log group.
+        In that case, use the normal date-based retention policy to age out your
+        logs.
+
+        :default: RemovalPolicy.Retain
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
+        '''
+        result = self._values.get("log_removal_policy")
+        return typing.cast(typing.Optional[_RemovalPolicy_9f93c814], result)
+
     @builtins.property
     def log_retention(self) -> typing.Optional[_RetentionDays_070f99f0]:
-        '''The number of days log events are kept in CloudWatch Logs.
+        '''(deprecated) The number of days log events are kept in CloudWatch Logs.
 
         When updating
         this property, unsetting it doesn't remove the log retention policy. To
@@ -17211,6 +17415,10 @@ class FunctionProps(FunctionOptions):
            my_log_group.log_group_name
 
         :default: logs.RetentionDays.INFINITE
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
         '''
         result = self._values.get("log_retention")
         return typing.cast(typing.Optional[_RetentionDays_070f99f0], result)
@@ -18291,6 +18499,7 @@ class IFunction(
         provisioned_poller_config: typing.Optional[typing.Union["ProvisionedPollerConfig", typing.Dict[builtins.str, typing.Any]]] = None,
         report_batch_item_failures: typing.Optional[builtins.bool] = None,
         retry_attempts: typing.Optional[jsii.Number] = None,
+        schema_registry_config: typing.Optional["ISchemaRegistry"] = None,
         source_access_configurations: typing.Optional[typing.Sequence[typing.Union["SourceAccessConfiguration", typing.Dict[builtins.str, typing.Any]]]] = None,
         starting_position: typing.Optional["StartingPosition"] = None,
         starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -18318,6 +18527,7 @@ class IFunction(
         :param provisioned_poller_config: Configuration for provisioned pollers that read from the event source. When specified, allows control over the minimum and maximum number of pollers that can be provisioned to process events from the source. Default: - no provisioned pollers
         :param report_batch_item_failures: Allow functions to return partially successful responses for a batch of records. Default: false
         :param retry_attempts: The maximum number of times to retry when the function returns an error. Set to ``undefined`` if you want lambda to keep retrying infinitely or until the record expires. Valid Range: - Minimum value of 0 - Maximum value of 10000 Default: - infinite or until the record expires.
+        :param schema_registry_config: Specific configuration settings for a Kafka schema registry. Default: - none
         :param source_access_configurations: Specific settings like the authentication protocol or the VPC components to secure access to your event source. Default: - none
         :param starting_position: The position in the DynamoDB, Kinesis or MSK stream where AWS Lambda should start reading. Default: - no starting position
         :param starting_position_timestamp: The time from which to start reading, in Unix time seconds. Default: - no timestamp
@@ -18733,6 +18943,7 @@ class _IFunctionProxy(
         provisioned_poller_config: typing.Optional[typing.Union["ProvisionedPollerConfig", typing.Dict[builtins.str, typing.Any]]] = None,
         report_batch_item_failures: typing.Optional[builtins.bool] = None,
         retry_attempts: typing.Optional[jsii.Number] = None,
+        schema_registry_config: typing.Optional["ISchemaRegistry"] = None,
         source_access_configurations: typing.Optional[typing.Sequence[typing.Union["SourceAccessConfiguration", typing.Dict[builtins.str, typing.Any]]]] = None,
         starting_position: typing.Optional["StartingPosition"] = None,
         starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -18760,6 +18971,7 @@ class _IFunctionProxy(
         :param provisioned_poller_config: Configuration for provisioned pollers that read from the event source. When specified, allows control over the minimum and maximum number of pollers that can be provisioned to process events from the source. Default: - no provisioned pollers
         :param report_batch_item_failures: Allow functions to return partially successful responses for a batch of records. Default: false
         :param retry_attempts: The maximum number of times to retry when the function returns an error. Set to ``undefined`` if you want lambda to keep retrying infinitely or until the record expires. Valid Range: - Minimum value of 0 - Maximum value of 10000 Default: - infinite or until the record expires.
+        :param schema_registry_config: Specific configuration settings for a Kafka schema registry. Default: - none
         :param source_access_configurations: Specific settings like the authentication protocol or the VPC components to secure access to your event source. Default: - none
         :param starting_position: The position in the DynamoDB, Kinesis or MSK stream where AWS Lambda should start reading. Default: - no starting position
         :param starting_position_timestamp: The time from which to start reading, in Unix time seconds. Default: - no timestamp
@@ -18788,6 +19000,7 @@ class _IFunctionProxy(
             provisioned_poller_config=provisioned_poller_config,
             report_batch_item_failures=report_batch_item_failures,
             retry_attempts=retry_attempts,
+            schema_registry_config=schema_registry_config,
             source_access_configurations=source_access_configurations,
             starting_position=starting_position,
             starting_position_timestamp=starting_position_timestamp,
@@ -19527,6 +19740,50 @@ class _IScalableFunctionAttributeProxy(
 typing.cast(typing.Any, IScalableFunctionAttribute).__jsii_proxy_class__ = lambda : _IScalableFunctionAttributeProxy
 
 
+@jsii.interface(jsii_type="aws-cdk-lib.aws_lambda.ISchemaRegistry")
+class ISchemaRegistry(typing_extensions.Protocol):
+    '''A schema registry for an event source.'''
+
+    @jsii.member(jsii_name="bind")
+    def bind(
+        self,
+        target: IEventSourceMapping,
+        target_handler: IFunction,
+    ) -> "KafkaSchemaRegistryConfig":
+        '''Returns the schema registry config of the event source.
+
+        :param target: -
+        :param target_handler: -
+        '''
+        ...
+
+
+class _ISchemaRegistryProxy:
+    '''A schema registry for an event source.'''
+
+    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_lambda.ISchemaRegistry"
+
+    @jsii.member(jsii_name="bind")
+    def bind(
+        self,
+        target: IEventSourceMapping,
+        target_handler: IFunction,
+    ) -> "KafkaSchemaRegistryConfig":
+        '''Returns the schema registry config of the event source.
+
+        :param target: -
+        :param target_handler: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0c68a1588ffc2bca6786310b7681f323e4368d6bf66e13c5fbdc7ef0ad571a22)
+            check_type(argname="argument target", value=target, expected_type=type_hints["target"])
+            check_type(argname="argument target_handler", value=target_handler, expected_type=type_hints["target_handler"])
+        return typing.cast("KafkaSchemaRegistryConfig", jsii.invoke(self, "bind", [target, target_handler]))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, ISchemaRegistry).__jsii_proxy_class__ = lambda : _ISchemaRegistryProxy
+
+
 @jsii.interface(jsii_type="aws-cdk-lib.aws_lambda.IVersion")
 class IVersion(IFunction, typing_extensions.Protocol):
     @builtins.property
@@ -19745,6 +20002,408 @@ class InvokeMode(enum.Enum):
     '''
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfig",
+    jsii_struct_bases=[],
+    name_mapping={"type": "type", "uri": "uri"},
+)
+class KafkaSchemaRegistryAccessConfig:
+    def __init__(
+        self,
+        *,
+        type: "KafkaSchemaRegistryAccessConfigType",
+        uri: builtins.str,
+    ) -> None:
+        '''Specific access configuration settings that tell Lambda how to authenticate with your schema registry.
+
+        If you're working with an AWS Glue schema registry, don't provide authentication details in this object. Instead, ensure that your execution role has the required permissions for Lambda to access your cluster.
+
+        If you're working with a Confluent schema registry, choose the authentication method in the Type field, and provide the AWS Secrets Manager secret ARN in the URI field.
+
+        :param type: The type of authentication Lambda uses to access your schema registry.
+        :param uri: The URI of the secret (Secrets Manager secret ARN) to authenticate with your schema registry.
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_lambda as lambda_
+            
+            # kafka_schema_registry_access_config_type: lambda.KafkaSchemaRegistryAccessConfigType
+            
+            kafka_schema_registry_access_config = lambda.KafkaSchemaRegistryAccessConfig(
+                type=kafka_schema_registry_access_config_type,
+                uri="uri"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a9ed7f710fdd20a96eb8eeb709bbea9f1e52b3ca20bed4ca85cf8341031090d2)
+            check_type(argname="argument type", value=type, expected_type=type_hints["type"])
+            check_type(argname="argument uri", value=uri, expected_type=type_hints["uri"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "type": type,
+            "uri": uri,
+        }
+
+    @builtins.property
+    def type(self) -> "KafkaSchemaRegistryAccessConfigType":
+        '''The type of authentication Lambda uses to access your schema registry.'''
+        result = self._values.get("type")
+        assert result is not None, "Required property 'type' is missing"
+        return typing.cast("KafkaSchemaRegistryAccessConfigType", result)
+
+    @builtins.property
+    def uri(self) -> builtins.str:
+        '''The URI of the secret (Secrets Manager secret ARN) to authenticate with your schema registry.
+
+        :see: KafkaSchemaRegistryAccessConfigType
+        '''
+        result = self._values.get("uri")
+        assert result is not None, "Required property 'uri' is missing"
+        return typing.cast(builtins.str, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "KafkaSchemaRegistryAccessConfig(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class KafkaSchemaRegistryAccessConfigType(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType",
+):
+    '''The type of authentication protocol for your schema registry.
+
+    :exampleMetadata: infused
+
+    Example::
+
+        from aws_cdk.aws_lambda_event_sources import ManagedKafkaEventSource, ConfluentSchemaRegistry
+        from aws_cdk.aws_secretsmanager import Secret
+        
+        # Your MSK cluster arn
+        # cluster_arn: str
+        
+        # my_function: lambda.Function
+        
+        
+        # The Kafka topic you want to subscribe to
+        topic = "some-cool-topic"
+        
+        secret = Secret(self, "Secret", secret_name="AmazonMSK_KafkaSecret")
+        my_function.add_event_source(ManagedKafkaEventSource(
+            cluster_arn=cluster_arn,
+            topic=topic,
+            starting_position=lambda_.StartingPosition.TRIM_HORIZON,
+            provisioned_poller_config=ProvisionedPollerConfig(
+                minimum_pollers=1,
+                maximum_pollers=3
+            ),
+            schema_registry_config=ConfluentSchemaRegistry(
+                schema_registry_uri="https://example.com",
+                event_record_format=lambda_.EventRecordFormat.JSON,
+                authentication_type=lambda_.KafkaSchemaRegistryAccessConfigType.BASIC_AUTH,
+                secret=secret,
+                schema_validation_configs=[lambda.KafkaSchemaValidationConfig(attribute=lambda_.KafkaSchemaValidationAttribute.KEY)]
+            )
+        ))
+    '''
+
+    @jsii.member(jsii_name="of")
+    @builtins.classmethod
+    def of(cls, name: builtins.str) -> "KafkaSchemaRegistryAccessConfigType":
+        '''A custom source access configuration property for schema registry.
+
+        :param name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4bc6850ec99a0d35e26da78049f4174bb567964e6b20083c7a1e29e3f120f831)
+            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+        return typing.cast("KafkaSchemaRegistryAccessConfigType", jsii.sinvoke(cls, "of", [name]))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="BASIC_AUTH")
+    def BASIC_AUTH(cls) -> "KafkaSchemaRegistryAccessConfigType":
+        '''The Secrets Manager secret that stores your broker credentials.'''
+        return typing.cast("KafkaSchemaRegistryAccessConfigType", jsii.sget(cls, "BASIC_AUTH"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="CLIENT_CERTIFICATE_TLS_AUTH")
+    def CLIENT_CERTIFICATE_TLS_AUTH(cls) -> "KafkaSchemaRegistryAccessConfigType":
+        '''The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your schema registry.'''
+        return typing.cast("KafkaSchemaRegistryAccessConfigType", jsii.sget(cls, "CLIENT_CERTIFICATE_TLS_AUTH"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="SERVER_ROOT_CA_CERTIFICATE")
+    def SERVER_ROOT_CA_CERTIFICATE(cls) -> "KafkaSchemaRegistryAccessConfigType":
+        '''The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your schema registry.'''
+        return typing.cast("KafkaSchemaRegistryAccessConfigType", jsii.sget(cls, "SERVER_ROOT_CA_CERTIFICATE"))
+
+    @builtins.property
+    @jsii.member(jsii_name="type")
+    def type(self) -> builtins.str:
+        '''The key to use in ``SchemaRegistryConfig.AccessConfig.Type`` property in CloudFormation.'''
+        return typing.cast(builtins.str, jsii.get(self, "type"))
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_lambda.KafkaSchemaRegistryConfig",
+    jsii_struct_bases=[],
+    name_mapping={
+        "event_record_format": "eventRecordFormat",
+        "schema_registry_uri": "schemaRegistryUri",
+        "schema_validation_configs": "schemaValidationConfigs",
+        "access_configs": "accessConfigs",
+    },
+)
+class KafkaSchemaRegistryConfig:
+    def __init__(
+        self,
+        *,
+        event_record_format: EventRecordFormat,
+        schema_registry_uri: builtins.str,
+        schema_validation_configs: typing.Sequence[typing.Union["KafkaSchemaValidationConfig", typing.Dict[builtins.str, typing.Any]]],
+        access_configs: typing.Optional[typing.Sequence[typing.Union[KafkaSchemaRegistryAccessConfig, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ) -> None:
+        '''(Amazon MSK and self-managed Apache Kafka only) Specific configuration settings for a Kafka schema registry.
+
+        :param event_record_format: The record format that Lambda delivers to your function after schema validation. - Choose JSON to have Lambda deliver the record to your function as a standard JSON object. - Choose SOURCE to have Lambda deliver the record to your function in its original source format. Lambda removes all schema metadata, such as the schema ID, before sending the record to your function. Default: - none
+        :param schema_registry_uri: The URI for your schema registry. The correct URI format depends on the type of schema registry you're using. Default: - none
+        :param schema_validation_configs: An array of schema validation configuration objects, which tell Lambda the message attributes you want to validate and filter using your schema registry. Default: - none
+        :param access_configs: An array of access configuration objects that tell Lambda how to authenticate with your schema registry. Default: - none
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_lambda as lambda_
+            
+            # event_record_format: lambda.EventRecordFormat
+            # kafka_schema_registry_access_config_type: lambda.KafkaSchemaRegistryAccessConfigType
+            # kafka_schema_validation_attribute: lambda.KafkaSchemaValidationAttribute
+            
+            kafka_schema_registry_config = lambda.KafkaSchemaRegistryConfig(
+                event_record_format=event_record_format,
+                schema_registry_uri="schemaRegistryUri",
+                schema_validation_configs=[lambda.KafkaSchemaValidationConfig(
+                    attribute=kafka_schema_validation_attribute
+                )],
+            
+                # the properties below are optional
+                access_configs=[lambda.KafkaSchemaRegistryAccessConfig(
+                    type=kafka_schema_registry_access_config_type,
+                    uri="uri"
+                )]
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a3171876130664545cc7c6ac22856db59c006c52bb5f546cb11b18d515fef45e)
+            check_type(argname="argument event_record_format", value=event_record_format, expected_type=type_hints["event_record_format"])
+            check_type(argname="argument schema_registry_uri", value=schema_registry_uri, expected_type=type_hints["schema_registry_uri"])
+            check_type(argname="argument schema_validation_configs", value=schema_validation_configs, expected_type=type_hints["schema_validation_configs"])
+            check_type(argname="argument access_configs", value=access_configs, expected_type=type_hints["access_configs"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "event_record_format": event_record_format,
+            "schema_registry_uri": schema_registry_uri,
+            "schema_validation_configs": schema_validation_configs,
+        }
+        if access_configs is not None:
+            self._values["access_configs"] = access_configs
+
+    @builtins.property
+    def event_record_format(self) -> EventRecordFormat:
+        '''The record format that Lambda delivers to your function after schema validation.
+
+        - Choose JSON to have Lambda deliver the record to your function as a standard JSON object.
+        - Choose SOURCE to have Lambda deliver the record to your function in its original source format. Lambda removes all schema metadata, such as the schema ID, before sending the record to your function.
+
+        :default: - none
+        '''
+        result = self._values.get("event_record_format")
+        assert result is not None, "Required property 'event_record_format' is missing"
+        return typing.cast(EventRecordFormat, result)
+
+    @builtins.property
+    def schema_registry_uri(self) -> builtins.str:
+        '''The URI for your schema registry.
+
+        The correct URI format depends on the type of schema registry you're using.
+
+        :default: - none
+        '''
+        result = self._values.get("schema_registry_uri")
+        assert result is not None, "Required property 'schema_registry_uri' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def schema_validation_configs(self) -> typing.List["KafkaSchemaValidationConfig"]:
+        '''An array of schema validation configuration objects, which tell Lambda the message attributes you want to validate and filter using your schema registry.
+
+        :default: - none
+        '''
+        result = self._values.get("schema_validation_configs")
+        assert result is not None, "Required property 'schema_validation_configs' is missing"
+        return typing.cast(typing.List["KafkaSchemaValidationConfig"], result)
+
+    @builtins.property
+    def access_configs(
+        self,
+    ) -> typing.Optional[typing.List[KafkaSchemaRegistryAccessConfig]]:
+        '''An array of access configuration objects that tell Lambda how to authenticate with your schema registry.
+
+        :default: - none
+        '''
+        result = self._values.get("access_configs")
+        return typing.cast(typing.Optional[typing.List[KafkaSchemaRegistryAccessConfig]], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "KafkaSchemaRegistryConfig(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class KafkaSchemaValidationAttribute(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_lambda.KafkaSchemaValidationAttribute",
+):
+    '''Specific schema validation configuration settings that tell Lambda the message attributes you want to validate and filter using your schema registry.
+
+    :exampleMetadata: infused
+
+    Example::
+
+        from aws_cdk.aws_lambda_event_sources import ManagedKafkaEventSource, ConfluentSchemaRegistry
+        from aws_cdk.aws_secretsmanager import Secret
+        
+        # Your MSK cluster arn
+        # cluster_arn: str
+        
+        # my_function: lambda.Function
+        
+        
+        # The Kafka topic you want to subscribe to
+        topic = "some-cool-topic"
+        
+        secret = Secret(self, "Secret", secret_name="AmazonMSK_KafkaSecret")
+        my_function.add_event_source(ManagedKafkaEventSource(
+            cluster_arn=cluster_arn,
+            topic=topic,
+            starting_position=lambda_.StartingPosition.TRIM_HORIZON,
+            provisioned_poller_config=ProvisionedPollerConfig(
+                minimum_pollers=1,
+                maximum_pollers=3
+            ),
+            schema_registry_config=ConfluentSchemaRegistry(
+                schema_registry_uri="https://example.com",
+                event_record_format=lambda_.EventRecordFormat.JSON,
+                authentication_type=lambda_.KafkaSchemaRegistryAccessConfigType.BASIC_AUTH,
+                secret=secret,
+                schema_validation_configs=[lambda.KafkaSchemaValidationConfig(attribute=lambda_.KafkaSchemaValidationAttribute.KEY)]
+            )
+        ))
+    '''
+
+    @jsii.member(jsii_name="of")
+    @builtins.classmethod
+    def of(cls, name: builtins.str) -> "KafkaSchemaValidationAttribute":
+        '''A custom schema validation attribute property.
+
+        :param name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__90f583f1aa63ef4c8f67ca1d84697d67f4e81ae0ea5473533af46b85cc17e696)
+            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+        return typing.cast("KafkaSchemaValidationAttribute", jsii.sinvoke(cls, "of", [name]))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="KEY")
+    def KEY(cls) -> "KafkaSchemaValidationAttribute":
+        '''De-serialize the key field of the parload to target function.'''
+        return typing.cast("KafkaSchemaValidationAttribute", jsii.sget(cls, "KEY"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="VALUE")
+    def VALUE(cls) -> "KafkaSchemaValidationAttribute":
+        '''De-serialize the value field of the parload to target function.'''
+        return typing.cast("KafkaSchemaValidationAttribute", jsii.sget(cls, "VALUE"))
+
+    @builtins.property
+    @jsii.member(jsii_name="value")
+    def value(self) -> builtins.str:
+        '''The enum to use in ``SchemaRegistryConfig.SchemaValidationConfigs.Attribute`` property in CloudFormation.'''
+        return typing.cast(builtins.str, jsii.get(self, "value"))
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_lambda.KafkaSchemaValidationConfig",
+    jsii_struct_bases=[],
+    name_mapping={"attribute": "attribute"},
+)
+class KafkaSchemaValidationConfig:
+    def __init__(self, *, attribute: KafkaSchemaValidationAttribute) -> None:
+        '''Specific schema validation configuration settings that tell Lambda the message attributes you want to validate and filter using your schema registry.
+
+        :param attribute: The attributes you want your schema registry to validate and filter for. If you selected JSON as the EventRecordFormat, Lambda also deserializes the selected message attributes.
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_lambda as lambda_
+            
+            # kafka_schema_validation_attribute: lambda.KafkaSchemaValidationAttribute
+            
+            kafka_schema_validation_config = lambda.KafkaSchemaValidationConfig(
+                attribute=kafka_schema_validation_attribute
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__89fd450fee20fb5d81fd39157485acaae3ba70536153566208b1778d213a1ae8)
+            check_type(argname="argument attribute", value=attribute, expected_type=type_hints["attribute"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "attribute": attribute,
+        }
+
+    @builtins.property
+    def attribute(self) -> KafkaSchemaValidationAttribute:
+        '''The attributes you want your schema registry to validate and filter for.
+
+        If you selected JSON as the EventRecordFormat, Lambda also deserializes the selected message attributes.
+        '''
+        result = self._values.get("attribute")
+        assert result is not None, "Required property 'attribute' is missing"
+        return typing.cast(KafkaSchemaValidationAttribute, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "KafkaSchemaValidationConfig(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 class LambdaInsightsVersion(
     metaclass=jsii.JSIIAbstractClass,
     jsii_type="aws-cdk-lib.aws_lambda.LambdaInsightsVersion",
@@ -22314,6 +22973,88 @@ class S3CodeV2(
         return typing.cast(builtins.bool, jsii.get(self, "isInline"))
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_lambda.SchemaRegistryProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "event_record_format": "eventRecordFormat",
+        "schema_validation_configs": "schemaValidationConfigs",
+    },
+)
+class SchemaRegistryProps:
+    def __init__(
+        self,
+        *,
+        event_record_format: EventRecordFormat,
+        schema_validation_configs: typing.Sequence[typing.Union[KafkaSchemaValidationConfig, typing.Dict[builtins.str, typing.Any]]],
+    ) -> None:
+        '''Properties for schema registry configuration.
+
+        :param event_record_format: The record format that Lambda delivers to your function after schema validation. - Choose JSON to have Lambda deliver the record to your function as a standard JSON object. - Choose SOURCE to have Lambda deliver the record to your function in its original source format. Lambda removes all schema metadata, such as the schema ID, before sending the record to your function. Default: - none
+        :param schema_validation_configs: An array of schema validation configuration objects, which tell Lambda the message attributes you want to validate and filter using your schema registry. Default: - none
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_lambda as lambda_
+            
+            # event_record_format: lambda.EventRecordFormat
+            # kafka_schema_validation_attribute: lambda.KafkaSchemaValidationAttribute
+            
+            schema_registry_props = lambda.SchemaRegistryProps(
+                event_record_format=event_record_format,
+                schema_validation_configs=[lambda.KafkaSchemaValidationConfig(
+                    attribute=kafka_schema_validation_attribute
+                )]
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0915a5e0439a722acf480d4010d03236559e242684c698d0a460dffc5709933b)
+            check_type(argname="argument event_record_format", value=event_record_format, expected_type=type_hints["event_record_format"])
+            check_type(argname="argument schema_validation_configs", value=schema_validation_configs, expected_type=type_hints["schema_validation_configs"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "event_record_format": event_record_format,
+            "schema_validation_configs": schema_validation_configs,
+        }
+
+    @builtins.property
+    def event_record_format(self) -> EventRecordFormat:
+        '''The record format that Lambda delivers to your function after schema validation.
+
+        - Choose JSON to have Lambda deliver the record to your function as a standard JSON object.
+        - Choose SOURCE to have Lambda deliver the record to your function in its original source format. Lambda removes all schema metadata, such as the schema ID, before sending the record to your function.
+
+        :default: - none
+        '''
+        result = self._values.get("event_record_format")
+        assert result is not None, "Required property 'event_record_format' is missing"
+        return typing.cast(EventRecordFormat, result)
+
+    @builtins.property
+    def schema_validation_configs(self) -> typing.List[KafkaSchemaValidationConfig]:
+        '''An array of schema validation configuration objects, which tell Lambda the message attributes you want to validate and filter using your schema registry.
+
+        :default: - none
+        '''
+        result = self._values.get("schema_validation_configs")
+        assert result is not None, "Required property 'schema_validation_configs' is missing"
+        return typing.cast(typing.List[KafkaSchemaValidationConfig], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "SchemaRegistryProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_lambda.SingletonFunctionProps",
     jsii_struct_bases=[FunctionProps],
@@ -22348,6 +23089,7 @@ class S3CodeV2(
         "log_format": "logFormat",
         "logging_format": "loggingFormat",
         "log_group": "logGroup",
+        "log_removal_policy": "logRemovalPolicy",
         "log_retention": "logRetention",
         "log_retention_retry_options": "logRetentionRetryOptions",
         "log_retention_role": "logRetentionRole",
@@ -22408,6 +23150,7 @@ class SingletonFunctionProps(FunctionProps):
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional[LoggingFormat] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -22465,7 +23208,8 @@ class SingletonFunctionProps(FunctionProps):
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -22540,6 +23284,7 @@ class SingletonFunctionProps(FunctionProps):
             check_type(argname="argument log_format", value=log_format, expected_type=type_hints["log_format"])
             check_type(argname="argument logging_format", value=logging_format, expected_type=type_hints["logging_format"])
             check_type(argname="argument log_group", value=log_group, expected_type=type_hints["log_group"])
+            check_type(argname="argument log_removal_policy", value=log_removal_policy, expected_type=type_hints["log_removal_policy"])
             check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
             check_type(argname="argument log_retention_retry_options", value=log_retention_retry_options, expected_type=type_hints["log_retention_retry_options"])
             check_type(argname="argument log_retention_role", value=log_retention_role, expected_type=type_hints["log_retention_role"])
@@ -22630,6 +23375,8 @@ class SingletonFunctionProps(FunctionProps):
             self._values["logging_format"] = logging_format
         if log_group is not None:
             self._values["log_group"] = log_group
+        if log_removal_policy is not None:
+            self._values["log_removal_policy"] = log_removal_policy
         if log_retention is not None:
             self._values["log_retention"] = log_retention
         if log_retention_retry_options is not None:
@@ -23011,9 +23758,27 @@ class SingletonFunctionProps(FunctionProps):
         result = self._values.get("log_group")
         return typing.cast(typing.Optional[_ILogGroup_3c4fa718], result)
 
+    @builtins.property
+    def log_removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
+        '''(deprecated) Determine the removal policy of the log group that is auto-created by this construct.
+
+        Normally you want to retain the log group so you can diagnose issues
+        from logs even after a deployment that no longer includes the log group.
+        In that case, use the normal date-based retention policy to age out your
+        logs.
+
+        :default: RemovalPolicy.Retain
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
+        '''
+        result = self._values.get("log_removal_policy")
+        return typing.cast(typing.Optional[_RemovalPolicy_9f93c814], result)
+
     @builtins.property
     def log_retention(self) -> typing.Optional[_RetentionDays_070f99f0]:
-        '''The number of days log events are kept in CloudWatch Logs.
+        '''(deprecated) The number of days log events are kept in CloudWatch Logs.
 
         When updating
         this property, unsetting it doesn't remove the log retention policy. To
@@ -23034,6 +23799,10 @@ class SingletonFunctionProps(FunctionProps):
            my_log_group.log_group_name
 
         :default: logs.RetentionDays.INFINITE
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
         '''
         result = self._values.get("log_retention")
         return typing.cast(typing.Optional[_RetentionDays_070f99f0], result)
@@ -23551,20 +24320,30 @@ class StartingPosition(enum.Enum):
 
     Example::
 
-        import aws_cdk.aws_kinesis as kinesis
-        from aws_cdk.aws_lambda_event_sources import KinesisConsumerEventSource
+        from aws_cdk.aws_lambda_event_sources import ManagedKafkaEventSource
+        from aws_cdk.aws_kms import Key
         
         # my_function: lambda.Function
         
         
-        stream = kinesis.Stream(self, "MyStream")
-        stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
-            stream=stream,
-            stream_consumer_name="MyStreamConsumer"
-        )
-        my_function.add_event_source(KinesisConsumerEventSource(stream_consumer,
-            batch_size=100,  # default
-            starting_position=lambda_.StartingPosition.TRIM_HORIZON
+        # Your MSK cluster arn
+        cluster_arn = "arn:aws:kafka:us-east-1:0123456789019:cluster/SalesCluster/abcd1234-abcd-cafe-abab-9876543210ab-4"
+        
+        # The Kafka topic you want to subscribe to
+        topic = "some-cool-topic"
+        
+        # Your self managed KMS key
+        my_key = Key.from_key_arn(self, "SourceBucketEncryptionKey", "arn:aws:kms:us-east-1:123456789012:key/<key-id>")
+        my_function.add_event_source(ManagedKafkaEventSource(
+            cluster_arn=cluster_arn,
+            topic=topic,
+            starting_position=lambda_.StartingPosition.TRIM_HORIZON,
+            filters=[
+                lambda_.FilterCriteria.filter({
+                    "string_equals": lambda_.FilterRule.is_equal("test")
+                })
+            ],
+            filter_encryption=my_key
         ))
     '''
 
@@ -25329,6 +26108,7 @@ class CodeSigningConfig(
         "log_format": "logFormat",
         "logging_format": "loggingFormat",
         "log_group": "logGroup",
+        "log_removal_policy": "logRemovalPolicy",
         "log_retention": "logRetention",
         "log_retention_retry_options": "logRetentionRetryOptions",
         "log_retention_role": "logRetentionRole",
@@ -25385,6 +26165,7 @@ class DockerImageFunctionProps(FunctionOptions):
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional[LoggingFormat] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -25438,7 +26219,8 @@ class DockerImageFunctionProps(FunctionOptions):
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -25507,6 +26289,7 @@ class DockerImageFunctionProps(FunctionOptions):
             check_type(argname="argument log_format", value=log_format, expected_type=type_hints["log_format"])
             check_type(argname="argument logging_format", value=logging_format, expected_type=type_hints["logging_format"])
             check_type(argname="argument log_group", value=log_group, expected_type=type_hints["log_group"])
+            check_type(argname="argument log_removal_policy", value=log_removal_policy, expected_type=type_hints["log_removal_policy"])
             check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
             check_type(argname="argument log_retention_retry_options", value=log_retention_retry_options, expected_type=type_hints["log_retention_retry_options"])
             check_type(argname="argument log_retention_role", value=log_retention_role, expected_type=type_hints["log_retention_role"])
@@ -25590,6 +26373,8 @@ class DockerImageFunctionProps(FunctionOptions):
             self._values["logging_format"] = logging_format
         if log_group is not None:
             self._values["log_group"] = log_group
+        if log_removal_policy is not None:
+            self._values["log_removal_policy"] = log_removal_policy
         if log_retention is not None:
             self._values["log_retention"] = log_retention
         if log_retention_retry_options is not None:
@@ -25969,9 +26754,27 @@ class DockerImageFunctionProps(FunctionOptions):
         result = self._values.get("log_group")
         return typing.cast(typing.Optional[_ILogGroup_3c4fa718], result)
 
+    @builtins.property
+    def log_removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
+        '''(deprecated) Determine the removal policy of the log group that is auto-created by this construct.
+
+        Normally you want to retain the log group so you can diagnose issues
+        from logs even after a deployment that no longer includes the log group.
+        In that case, use the normal date-based retention policy to age out your
+        logs.
+
+        :default: RemovalPolicy.Retain
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
+        '''
+        result = self._values.get("log_removal_policy")
+        return typing.cast(typing.Optional[_RemovalPolicy_9f93c814], result)
+
     @builtins.property
     def log_retention(self) -> typing.Optional[_RetentionDays_070f99f0]:
-        '''The number of days log events are kept in CloudWatch Logs.
+        '''(deprecated) The number of days log events are kept in CloudWatch Logs.
 
         When updating
         this property, unsetting it doesn't remove the log retention policy. To
@@ -25992,6 +26795,10 @@ class DockerImageFunctionProps(FunctionOptions):
            my_log_group.log_group_name
 
         :default: logs.RetentionDays.INFINITE
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
         '''
         result = self._values.get("log_retention")
         return typing.cast(typing.Optional[_RetentionDays_070f99f0], result)
@@ -26278,6 +27085,7 @@ class EventSourceMapping(
         # filters: Any
         # function_: lambda.Function
         # key: kms.Key
+        # schema_registry: lambda.ISchemaRegistry
         # source_access_configuration_type: lambda.SourceAccessConfigurationType
         
         event_source_mapping = lambda_.EventSourceMapping(self, "MyEventSourceMapping",
@@ -26309,6 +27117,7 @@ class EventSourceMapping(
             ),
             report_batch_item_failures=False,
             retry_attempts=123,
+            schema_registry_config=schema_registry,
             source_access_configurations=[lambda.SourceAccessConfiguration(
                 type=source_access_configuration_type,
                 uri="uri"
@@ -26344,6 +27153,7 @@ class EventSourceMapping(
         provisioned_poller_config: typing.Optional[typing.Union[ProvisionedPollerConfig, typing.Dict[builtins.str, typing.Any]]] = None,
         report_batch_item_failures: typing.Optional[builtins.bool] = None,
         retry_attempts: typing.Optional[jsii.Number] = None,
+        schema_registry_config: typing.Optional[ISchemaRegistry] = None,
         source_access_configurations: typing.Optional[typing.Sequence[typing.Union[SourceAccessConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
         starting_position: typing.Optional[StartingPosition] = None,
         starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -26372,6 +27182,7 @@ class EventSourceMapping(
         :param provisioned_poller_config: Configuration for provisioned pollers that read from the event source. When specified, allows control over the minimum and maximum number of pollers that can be provisioned to process events from the source. Default: - no provisioned pollers
         :param report_batch_item_failures: Allow functions to return partially successful responses for a batch of records. Default: false
         :param retry_attempts: The maximum number of times to retry when the function returns an error. Set to ``undefined`` if you want lambda to keep retrying infinitely or until the record expires. Valid Range: - Minimum value of 0 - Maximum value of 10000 Default: - infinite or until the record expires.
+        :param schema_registry_config: Specific configuration settings for a Kafka schema registry. Default: - none
         :param source_access_configurations: Specific settings like the authentication protocol or the VPC components to secure access to your event source. Default: - none
         :param starting_position: The position in the DynamoDB, Kinesis or MSK stream where AWS Lambda should start reading. Default: - no starting position
         :param starting_position_timestamp: The time from which to start reading, in Unix time seconds. Default: - no timestamp
@@ -26402,6 +27213,7 @@ class EventSourceMapping(
             provisioned_poller_config=provisioned_poller_config,
             report_batch_item_failures=report_batch_item_failures,
             retry_attempts=retry_attempts,
+            schema_registry_config=schema_registry_config,
             source_access_configurations=source_access_configurations,
             starting_position=starting_position,
             starting_position_timestamp=starting_position_timestamp,
@@ -26529,6 +27341,7 @@ class FunctionBase(
         provisioned_poller_config: typing.Optional[typing.Union[ProvisionedPollerConfig, typing.Dict[builtins.str, typing.Any]]] = None,
         report_batch_item_failures: typing.Optional[builtins.bool] = None,
         retry_attempts: typing.Optional[jsii.Number] = None,
+        schema_registry_config: typing.Optional[ISchemaRegistry] = None,
         source_access_configurations: typing.Optional[typing.Sequence[typing.Union[SourceAccessConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
         starting_position: typing.Optional[StartingPosition] = None,
         starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -26556,6 +27369,7 @@ class FunctionBase(
         :param provisioned_poller_config: Configuration for provisioned pollers that read from the event source. When specified, allows control over the minimum and maximum number of pollers that can be provisioned to process events from the source. Default: - no provisioned pollers
         :param report_batch_item_failures: Allow functions to return partially successful responses for a batch of records. Default: false
         :param retry_attempts: The maximum number of times to retry when the function returns an error. Set to ``undefined`` if you want lambda to keep retrying infinitely or until the record expires. Valid Range: - Minimum value of 0 - Maximum value of 10000 Default: - infinite or until the record expires.
+        :param schema_registry_config: Specific configuration settings for a Kafka schema registry. Default: - none
         :param source_access_configurations: Specific settings like the authentication protocol or the VPC components to secure access to your event source. Default: - none
         :param starting_position: The position in the DynamoDB, Kinesis or MSK stream where AWS Lambda should start reading. Default: - no starting position
         :param starting_position_timestamp: The time from which to start reading, in Unix time seconds. Default: - no timestamp
@@ -26584,6 +27398,7 @@ class FunctionBase(
             provisioned_poller_config=provisioned_poller_config,
             report_batch_item_failures=report_batch_item_failures,
             retry_attempts=retry_attempts,
+            schema_registry_config=schema_registry_config,
             source_access_configurations=source_access_configurations,
             starting_position=starting_position,
             starting_position_timestamp=starting_position_timestamp,
@@ -27530,6 +28345,7 @@ class SingletonFunction(
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional[LoggingFormat] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -27588,7 +28404,8 @@ class SingletonFunction(
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -27648,6 +28465,7 @@ class SingletonFunction(
             log_format=log_format,
             logging_format=logging_format,
             log_group=log_group,
+            log_removal_policy=log_removal_policy,
             log_retention=log_retention,
             log_retention_retry_options=log_retention_retry_options,
             log_retention_role=log_retention_role,
@@ -28566,6 +29384,7 @@ class Function(
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional[LoggingFormat] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -28622,7 +29441,8 @@ class Function(
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -28680,6 +29500,7 @@ class Function(
             log_format=log_format,
             logging_format=logging_format,
             log_group=log_group,
+            log_removal_policy=log_removal_policy,
             log_retention=log_retention,
             log_retention_retry_options=log_retention_retry_options,
             log_retention_role=log_retention_role,
@@ -29412,6 +30233,7 @@ class DockerImageFunction(
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional[LoggingFormat] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -29466,7 +30288,8 @@ class DockerImageFunction(
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -29522,6 +30345,7 @@ class DockerImageFunction(
             log_format=log_format,
             logging_format=logging_format,
             log_group=log_group,
+            log_removal_policy=log_removal_policy,
             log_retention=log_retention,
             log_retention_retry_options=log_retention_retry_options,
             log_retention_role=log_retention_role,
@@ -29618,6 +30442,7 @@ __all__ = [
     "EventInvokeConfig",
     "EventInvokeConfigOptions",
     "EventInvokeConfigProps",
+    "EventRecordFormat",
     "EventSourceMapping",
     "EventSourceMappingOptions",
     "EventSourceMappingProps",
@@ -29648,9 +30473,15 @@ __all__ = [
     "IFunctionUrl",
     "ILayerVersion",
     "IScalableFunctionAttribute",
+    "ISchemaRegistry",
     "IVersion",
     "InlineCode",
     "InvokeMode",
+    "KafkaSchemaRegistryAccessConfig",
+    "KafkaSchemaRegistryAccessConfigType",
+    "KafkaSchemaRegistryConfig",
+    "KafkaSchemaValidationAttribute",
+    "KafkaSchemaValidationConfig",
     "LambdaInsightsVersion",
     "LambdaRuntimeProps",
     "LayerVersion",
@@ -29677,6 +30508,7 @@ __all__ = [
     "RuntimeManagementMode",
     "S3Code",
     "S3CodeV2",
+    "SchemaRegistryProps",
     "SingletonFunction",
     "SingletonFunctionProps",
     "SnapStartConf",
@@ -31503,6 +32335,12 @@ def _typecheckingstub__39c1b3a3185624e50b391ccba8992ee288e54789a9b063a9fbffc3207
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__913b83169547e1e27e0d17d4e5a189f10545dca54ca45db7a5dc40a7d5cc2999(
+    name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__7442d2bd60e56a826eab54e95fa6a6ebc8961285a26558c7189840a124a0a2e0(
     *,
     batch_size: typing.Optional[jsii.Number] = None,
@@ -31523,6 +32361,7 @@ def _typecheckingstub__7442d2bd60e56a826eab54e95fa6a6ebc8961285a26558c7189840a12
     provisioned_poller_config: typing.Optional[typing.Union[ProvisionedPollerConfig, typing.Dict[builtins.str, typing.Any]]] = None,
     report_batch_item_failures: typing.Optional[builtins.bool] = None,
     retry_attempts: typing.Optional[jsii.Number] = None,
+    schema_registry_config: typing.Optional[ISchemaRegistry] = None,
     source_access_configurations: typing.Optional[typing.Sequence[typing.Union[SourceAccessConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
     starting_position: typing.Optional[StartingPosition] = None,
     starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -31552,6 +32391,7 @@ def _typecheckingstub__e74d0bc5516fc715f7302bdf199df23dddf769e98771f0bac2ff026a4
     provisioned_poller_config: typing.Optional[typing.Union[ProvisionedPollerConfig, typing.Dict[builtins.str, typing.Any]]] = None,
     report_batch_item_failures: typing.Optional[builtins.bool] = None,
     retry_attempts: typing.Optional[jsii.Number] = None,
+    schema_registry_config: typing.Optional[ISchemaRegistry] = None,
     source_access_configurations: typing.Optional[typing.Sequence[typing.Union[SourceAccessConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
     starting_position: typing.Optional[StartingPosition] = None,
     starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -31661,6 +32501,7 @@ def _typecheckingstub__59918bb957d892739733c7a5849db990615fe5329709ad7ba703e0ee4
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[LoggingFormat] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -31716,6 +32557,7 @@ def _typecheckingstub__94e70d11aa3c53737d418dbb9983973dfc06dbdef5c8cc30613cc3c6d
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[LoggingFormat] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -31835,6 +32677,7 @@ def _typecheckingstub__726375d512fd3c0da30be8d20d1c4016974ba77359e6bac8eb3569126
     provisioned_poller_config: typing.Optional[typing.Union[ProvisionedPollerConfig, typing.Dict[builtins.str, typing.Any]]] = None,
     report_batch_item_failures: typing.Optional[builtins.bool] = None,
     retry_attempts: typing.Optional[jsii.Number] = None,
+    schema_registry_config: typing.Optional[ISchemaRegistry] = None,
     source_access_configurations: typing.Optional[typing.Sequence[typing.Union[SourceAccessConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
     starting_position: typing.Optional[StartingPosition] = None,
     starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -31941,6 +32784,13 @@ def _typecheckingstub__6400e52bafb7e00e3113dbb1e115c4dea946b786b17eee75a6aa6706a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__0c68a1588ffc2bca6786310b7681f323e4368d6bf66e13c5fbdc7ef0ad571a22(
+    target: IEventSourceMapping,
+    target_handler: IFunction,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__d163f09d3cc5fe40599d7400b73c5f0814fcf5b50dccd44d5740a368a0d84cf9(
     alias_name: builtins.str,
     *,
@@ -31967,6 +32817,43 @@ def _typecheckingstub__68701e0be659943818e792689f9c11f6ea386ae16b7e76ef2e090037d
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__a9ed7f710fdd20a96eb8eeb709bbea9f1e52b3ca20bed4ca85cf8341031090d2(
+    *,
+    type: KafkaSchemaRegistryAccessConfigType,
+    uri: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__4bc6850ec99a0d35e26da78049f4174bb567964e6b20083c7a1e29e3f120f831(
+    name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a3171876130664545cc7c6ac22856db59c006c52bb5f546cb11b18d515fef45e(
+    *,
+    event_record_format: EventRecordFormat,
+    schema_registry_uri: builtins.str,
+    schema_validation_configs: typing.Sequence[typing.Union[KafkaSchemaValidationConfig, typing.Dict[builtins.str, typing.Any]]],
+    access_configs: typing.Optional[typing.Sequence[typing.Union[KafkaSchemaRegistryAccessConfig, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__90f583f1aa63ef4c8f67ca1d84697d67f4e81ae0ea5473533af46b85cc17e696(
+    name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__89fd450fee20fb5d81fd39157485acaae3ba70536153566208b1778d213a1ae8(
+    *,
+    attribute: KafkaSchemaValidationAttribute,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__263309ccb98199a52576e8475ff6ab5f39d5cf43f49cd26a3d9a85ab711464ad(
     arn: builtins.str,
 ) -> None:
@@ -32218,6 +33105,14 @@ def _typecheckingstub__304505e97ff3b397f5306079c5410e06bb217281e1cc348ada6eef6ae
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__0915a5e0439a722acf480d4010d03236559e242684c698d0a460dffc5709933b(
+    *,
+    event_record_format: EventRecordFormat,
+    schema_validation_configs: typing.Sequence[typing.Union[KafkaSchemaValidationConfig, typing.Dict[builtins.str, typing.Any]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__68a03ec9f866a29c77aabcf8328c63a49511790fa9714874f255b3292623893c(
     *,
     max_event_age: typing.Optional[_Duration_4839e8c3] = None,
@@ -32250,6 +33145,7 @@ def _typecheckingstub__68a03ec9f866a29c77aabcf8328c63a49511790fa9714874f255b3292
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[LoggingFormat] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -32506,6 +33402,7 @@ def _typecheckingstub__04dd97f4b18c00e7ee0981f2428664401ae0b75dbda6102ea3ef53d08
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[LoggingFormat] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -32553,6 +33450,7 @@ def _typecheckingstub__b0460bc5250777612d2b42ec799737ce019fcdc03fe86c6540ab2ecec
     provisioned_poller_config: typing.Optional[typing.Union[ProvisionedPollerConfig, typing.Dict[builtins.str, typing.Any]]] = None,
     report_batch_item_failures: typing.Optional[builtins.bool] = None,
     retry_attempts: typing.Optional[jsii.Number] = None,
+    schema_registry_config: typing.Optional[ISchemaRegistry] = None,
     source_access_configurations: typing.Optional[typing.Sequence[typing.Union[SourceAccessConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
     starting_position: typing.Optional[StartingPosition] = None,
     starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -32609,6 +33507,7 @@ def _typecheckingstub__bfc312bd9bc4e64c5ae8419715155a56676bb9fe40870f57ffa4f3030
     provisioned_poller_config: typing.Optional[typing.Union[ProvisionedPollerConfig, typing.Dict[builtins.str, typing.Any]]] = None,
     report_batch_item_failures: typing.Optional[builtins.bool] = None,
     retry_attempts: typing.Optional[jsii.Number] = None,
+    schema_registry_config: typing.Optional[ISchemaRegistry] = None,
     source_access_configurations: typing.Optional[typing.Sequence[typing.Union[SourceAccessConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
     starting_position: typing.Optional[StartingPosition] = None,
     starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -32772,6 +33671,7 @@ def _typecheckingstub__e7b766bff13bb7266787cec9bebb600187e19c1672e530bb9cfa31649
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[LoggingFormat] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -32994,6 +33894,7 @@ def _typecheckingstub__724895b6b59aaf2b678ef25f2beca19fb114fc04ff6b37edef28e12b3
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[LoggingFormat] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -33141,6 +34042,7 @@ def _typecheckingstub__368a49fe1f866c7ea7986c57b6f8488d0fddea8f62bf05ec1ed7eb09b
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[LoggingFormat] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[LogRetentionRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,