aws-cdk-lib 2.206.0__py3-none-any.whl → 2.207.0__py3-none-any.whl

aws_cdk/aws_datasync/__init__.py

@@ -4643,7 +4643,7 @@ class CfnLocationNFS(
         :param id: Construct identifier for this resource (unique in its scope).
         :param on_prem_config: Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect to your NFS file server. You can specify more than one agent. For more information, see `Using multiple DataSync agents <https://docs.aws.amazon.com/datasync/latest/userguide/do-i-need-datasync-agent.html#multiple-agents>`_ .
         :param mount_options: Specifies the options that DataSync can use to mount your NFS file server.
-        :param server_hostname: Specifies the DNS name or IP version 4 address of the NFS file server that your DataSync agent connects to.
+        :param server_hostname: Specifies the DNS name or IP address (IPv4 or IPv6) of the NFS file server that your DataSync agent connects to.
         :param subdirectory: Specifies the export path in your NFS file server that you want DataSync to mount. This path (or a subdirectory of the path) is where DataSync transfers data to or from. For information on configuring an export for DataSync, see `Accessing NFS file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-nfs-location.html#accessing-nfs>`_ .
         :param tags: Specifies labels that help you categorize, filter, and search for your AWS resources. We recommend creating at least a name tag for your location.
         '''
@@ -4759,7 +4759,7 @@ class CfnLocationNFS(
     @builtins.property
     @jsii.member(jsii_name="serverHostname")
     def server_hostname(self) -> typing.Optional[builtins.str]:
-        '''Specifies the DNS name or IP version 4 address of the NFS file server that your DataSync agent connects to.'''
+        '''Specifies the DNS name or IP address (IPv4 or IPv6) of the NFS file server that your DataSync agent connects to.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "serverHostname"))
 
     @server_hostname.setter
@@ -4939,7 +4939,7 @@ class CfnLocationNFSProps:
 
         :param on_prem_config: Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect to your NFS file server. You can specify more than one agent. For more information, see `Using multiple DataSync agents <https://docs.aws.amazon.com/datasync/latest/userguide/do-i-need-datasync-agent.html#multiple-agents>`_ .
         :param mount_options: Specifies the options that DataSync can use to mount your NFS file server.
-        :param server_hostname: Specifies the DNS name or IP version 4 address of the NFS file server that your DataSync agent connects to.
+        :param server_hostname: Specifies the DNS name or IP address (IPv4 or IPv6) of the NFS file server that your DataSync agent connects to.
         :param subdirectory: Specifies the export path in your NFS file server that you want DataSync to mount. This path (or a subdirectory of the path) is where DataSync transfers data to or from. For information on configuring an export for DataSync, see `Accessing NFS file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-nfs-location.html#accessing-nfs>`_ .
         :param tags: Specifies labels that help you categorize, filter, and search for your AWS resources. We recommend creating at least a name tag for your location.
 
@@ -5015,7 +5015,7 @@ class CfnLocationNFSProps:
 
     @builtins.property
     def server_hostname(self) -> typing.Optional[builtins.str]:
-        '''Specifies the DNS name or IP version 4 address of the NFS file server that your DataSync agent connects to.
+        '''Specifies the DNS name or IP address (IPv4 or IPv6) of the NFS file server that your DataSync agent connects to.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationnfs.html#cfn-datasync-locationnfs-serverhostname
         '''
@@ -5129,7 +5129,7 @@ class CfnLocationObjectStorage(
         :param custom_secret_config: Specifies configuration information for a customer-managed Secrets Manager secret where the secret key for a specific object storage location is stored in plain text. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. .. epigraph:: You can use either ``CmkSecretConfig`` (with ``SecretKey`` ) or ``CustomSecretConfig`` (without ``SecretKey`` ) to provide credentials for a ``CreateLocationObjectStorage`` request. Do not provide both parameters for the same request.
         :param secret_key: Specifies the secret key (for example, a password) if credentials are required to authenticate with the object storage server. .. epigraph:: If you provide a secret using ``SecretKey`` , but do not provide secret configuration details using ``CmkSecretConfig`` or ``CustomSecretConfig`` , then DataSync stores the token using your AWS account's Secrets Manager secret.
         :param server_certificate: Specifies a certificate chain for DataSync to authenticate with your object storage system if the system uses a private or self-signed certificate authority (CA). You must specify a single ``.pem`` file with a full certificate chain (for example, ``file:///home/user/.ssh/object_storage_certificates.pem`` ). The certificate chain might include: - The object storage system's certificate - All intermediate certificates (if there are any) - The root certificate of the signing CA You can concatenate your certificates into a ``.pem`` file (which can be up to 32768 bytes before base64 encoding). The following example ``cat`` command creates an ``object_storage_certificates.pem`` file that includes three certificates: ``cat object_server_certificate.pem intermediate_certificate.pem ca_root_certificate.pem > object_storage_certificates.pem`` To use this parameter, configure ``ServerProtocol`` to ``HTTPS`` .
-        :param server_hostname: Specifies the domain name or IP version 4 (IPv4) address of the object storage server that your DataSync agent connects to.
+        :param server_hostname: Specifies the domain name or IP address (IPv4 or IPv6) of the object storage server that your DataSync agent connects to.
         :param server_port: Specifies the port that your object storage server accepts inbound network traffic on (for example, port 443).
         :param server_protocol: Specifies the protocol that your object storage server uses to communicate. If not specified, the default value is ``HTTPS`` .
         :param subdirectory: Specifies the object prefix for your object storage server. If this is a source location, DataSync only copies objects with this prefix. If this is a destination location, DataSync writes all objects with this prefix.
@@ -5341,7 +5341,7 @@ class CfnLocationObjectStorage(
     @builtins.property
     @jsii.member(jsii_name="serverHostname")
     def server_hostname(self) -> typing.Optional[builtins.str]:
-        '''Specifies the domain name or IP version 4 (IPv4) address of the object storage server that your DataSync agent connects to.'''
+        '''Specifies the domain name or IP address (IPv4 or IPv6) of the object storage server that your DataSync agent connects to.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "serverHostname"))
 
     @server_hostname.setter
@@ -5659,7 +5659,7 @@ class CfnLocationObjectStorageProps:
         :param custom_secret_config: Specifies configuration information for a customer-managed Secrets Manager secret where the secret key for a specific object storage location is stored in plain text. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. .. epigraph:: You can use either ``CmkSecretConfig`` (with ``SecretKey`` ) or ``CustomSecretConfig`` (without ``SecretKey`` ) to provide credentials for a ``CreateLocationObjectStorage`` request. Do not provide both parameters for the same request.
         :param secret_key: Specifies the secret key (for example, a password) if credentials are required to authenticate with the object storage server. .. epigraph:: If you provide a secret using ``SecretKey`` , but do not provide secret configuration details using ``CmkSecretConfig`` or ``CustomSecretConfig`` , then DataSync stores the token using your AWS account's Secrets Manager secret.
         :param server_certificate: Specifies a certificate chain for DataSync to authenticate with your object storage system if the system uses a private or self-signed certificate authority (CA). You must specify a single ``.pem`` file with a full certificate chain (for example, ``file:///home/user/.ssh/object_storage_certificates.pem`` ). The certificate chain might include: - The object storage system's certificate - All intermediate certificates (if there are any) - The root certificate of the signing CA You can concatenate your certificates into a ``.pem`` file (which can be up to 32768 bytes before base64 encoding). The following example ``cat`` command creates an ``object_storage_certificates.pem`` file that includes three certificates: ``cat object_server_certificate.pem intermediate_certificate.pem ca_root_certificate.pem > object_storage_certificates.pem`` To use this parameter, configure ``ServerProtocol`` to ``HTTPS`` .
-        :param server_hostname: Specifies the domain name or IP version 4 (IPv4) address of the object storage server that your DataSync agent connects to.
+        :param server_hostname: Specifies the domain name or IP address (IPv4 or IPv6) of the object storage server that your DataSync agent connects to.
         :param server_port: Specifies the port that your object storage server accepts inbound network traffic on (for example, port 443).
         :param server_protocol: Specifies the protocol that your object storage server uses to communicate. If not specified, the default value is ``HTTPS`` .
         :param subdirectory: Specifies the object prefix for your object storage server. If this is a source location, DataSync only copies objects with this prefix. If this is a destination location, DataSync writes all objects with this prefix.
@@ -5842,7 +5842,7 @@ class CfnLocationObjectStorageProps:
 
     @builtins.property
     def server_hostname(self) -> typing.Optional[builtins.str]:
-        '''Specifies the domain name or IP version 4 (IPv4) address of the object storage server that your DataSync agent connects to.
+        '''Specifies the domain name or IP address (IPv4 or IPv6) of the object storage server that your DataSync agent connects to.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationobjectstorage.html#cfn-datasync-locationobjectstorage-serverhostname
         '''
@@ -6381,7 +6381,7 @@ class CfnLocationSMB(
         :param kerberos_principal: Specifies a service principal name (SPN), which is an identity in your Kerberos realm that has permission to access the files, folders, and file metadata in your SMB file server. SPNs are case sensitive and must include a prepended cifs/. For example, an SPN might look like cifs/kerberosuser@EXAMPLE.COM. Your task execution will fail if the SPN that you provide for this parameter doesn't match exactly what's in your keytab or krb5.conf files.
         :param mount_options: Specifies the version of the SMB protocol that DataSync uses to access your SMB file server.
         :param password: Specifies the password of the user who can mount your SMB file server and has permission to access the files and folders involved in your transfer. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` .
-        :param server_hostname: Specifies the domain name or IP address of the SMB file server that your DataSync agent connects to. Remember the following when configuring this parameter: - You can't specify an IP version 6 (IPv6) address. - If you're using Kerberos authentication, you must specify a domain name.
+        :param server_hostname: Specifies the domain name or IP address (IPv4 or IPv6) of the SMB file server that your DataSync agent connects to. .. epigraph:: If you're using Kerberos authentication, you must specify a domain name.
         :param subdirectory: Specifies the name of the share exported by your SMB file server where DataSync will read or write data. You can include a subdirectory in the share path (for example, ``/path/to/subdirectory`` ). Make sure that other SMB clients in your network can also mount this path. To copy all data in the subdirectory, DataSync must be able to mount the SMB share and access all of its data. For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
         :param tags: Specifies labels that help you categorize, filter, and search for your AWS resources. We recommend creating at least a name tag for your location.
         :param user: Specifies the user that can mount and access the files, folders, and file metadata in your SMB file server. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` . For information about choosing a user with the right level of access for your transfer, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
@@ -6595,7 +6595,7 @@ class CfnLocationSMB(
     @builtins.property
     @jsii.member(jsii_name="serverHostname")
     def server_hostname(self) -> typing.Optional[builtins.str]:
-        '''Specifies the domain name or IP address of the SMB file server that your DataSync agent connects to.'''
+        '''Specifies the domain name or IP address (IPv4 or IPv6) of the SMB file server that your DataSync agent connects to.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "serverHostname"))
 
     @server_hostname.setter
@@ -6761,7 +6761,7 @@ class CfnLocationSMBProps:
         :param kerberos_principal: Specifies a service principal name (SPN), which is an identity in your Kerberos realm that has permission to access the files, folders, and file metadata in your SMB file server. SPNs are case sensitive and must include a prepended cifs/. For example, an SPN might look like cifs/kerberosuser@EXAMPLE.COM. Your task execution will fail if the SPN that you provide for this parameter doesn't match exactly what's in your keytab or krb5.conf files.
         :param mount_options: Specifies the version of the SMB protocol that DataSync uses to access your SMB file server.
         :param password: Specifies the password of the user who can mount your SMB file server and has permission to access the files and folders involved in your transfer. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` .
-        :param server_hostname: Specifies the domain name or IP address of the SMB file server that your DataSync agent connects to. Remember the following when configuring this parameter: - You can't specify an IP version 6 (IPv6) address. - If you're using Kerberos authentication, you must specify a domain name.
+        :param server_hostname: Specifies the domain name or IP address (IPv4 or IPv6) of the SMB file server that your DataSync agent connects to. .. epigraph:: If you're using Kerberos authentication, you must specify a domain name.
         :param subdirectory: Specifies the name of the share exported by your SMB file server where DataSync will read or write data. You can include a subdirectory in the share path (for example, ``/path/to/subdirectory`` ). Make sure that other SMB clients in your network can also mount this path. To copy all data in the subdirectory, DataSync must be able to mount the SMB share and access all of its data. For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
         :param tags: Specifies labels that help you categorize, filter, and search for your AWS resources. We recommend creating at least a name tag for your location.
         :param user: Specifies the user that can mount and access the files, folders, and file metadata in your SMB file server. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` . For information about choosing a user with the right level of access for your transfer, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
@@ -6941,12 +6941,11 @@ class CfnLocationSMBProps:
 
     @builtins.property
     def server_hostname(self) -> typing.Optional[builtins.str]:
-        '''Specifies the domain name or IP address of the SMB file server that your DataSync agent connects to.
+        '''Specifies the domain name or IP address (IPv4 or IPv6) of the SMB file server that your DataSync agent connects to.
 
-        Remember the following when configuring this parameter:
+        .. epigraph::
 
-        - You can't specify an IP version 6 (IPv6) address.
-        - If you're using Kerberos authentication, you must specify a domain name.
+           If you're using Kerberos authentication, you must specify a domain name.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-serverhostname
         '''

aws_cdk/aws_ec2/__init__.py

@@ -24427,7 +24427,7 @@ class CfnInstanceConnectEndpoint(
         :param id: Construct identifier for this resource (unique in its scope).
         :param subnet_id: The ID of the subnet in which to create the EC2 Instance Connect Endpoint.
         :param client_token: Unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
-        :param preserve_client_ip: Indicates whether the client IP address is preserved as the source. The following are the possible values. - ``true`` - Use the client IP address as the source. - ``false`` - Use the network interface IP address as the source. Default: ``false``
+        :param preserve_client_ip: Indicates whether the client IP address is preserved as the source. The following are the possible values. - ``true`` - Use the client IP address as the source. - ``false`` - Use the network interface IP address as the source. .. epigraph:: ``PreserveClientIp`` is only supported on IPv4 EC2 Instance Connect Endpoints. To use ``PreserveClientIp`` , the value for ``IpAddressType`` must be ``ipv4`` . Default: ``false``
         :param security_group_ids: One or more security groups to associate with the endpoint. If you don't specify a security group, the default security group for your VPC will be associated with the endpoint.
         :param tags: The tags to apply to the EC2 Instance Connect Endpoint during creation.
         '''
@@ -24597,7 +24597,7 @@ class CfnInstanceConnectEndpointProps:
 
         :param subnet_id: The ID of the subnet in which to create the EC2 Instance Connect Endpoint.
         :param client_token: Unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
-        :param preserve_client_ip: Indicates whether the client IP address is preserved as the source. The following are the possible values. - ``true`` - Use the client IP address as the source. - ``false`` - Use the network interface IP address as the source. Default: ``false``
+        :param preserve_client_ip: Indicates whether the client IP address is preserved as the source. The following are the possible values. - ``true`` - Use the client IP address as the source. - ``false`` - Use the network interface IP address as the source. .. epigraph:: ``PreserveClientIp`` is only supported on IPv4 EC2 Instance Connect Endpoints. To use ``PreserveClientIp`` , the value for ``IpAddressType`` must be ``ipv4`` . Default: ``false``
         :param security_group_ids: One or more security groups to associate with the endpoint. If you don't specify a security group, the default security group for your VPC will be associated with the endpoint.
         :param tags: The tags to apply to the EC2 Instance Connect Endpoint during creation.
 
@@ -24670,6 +24670,10 @@ class CfnInstanceConnectEndpointProps:
         - ``true`` - Use the client IP address as the source.
         - ``false`` - Use the network interface IP address as the source.
 
+        .. epigraph::
+
+           ``PreserveClientIp`` is only supported on IPv4 EC2 Instance Connect Endpoints. To use ``PreserveClientIp`` , the value for ``IpAddressType`` must be ``ipv4`` .
+
         Default: ``false``
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-instanceconnectendpoint.html#cfn-ec2-instanceconnectendpoint-preserveclientip

aws_cdk/aws_ecs/__init__.py

@@ -8701,9 +8701,9 @@ class CfnService(
         :param capacity_provider_strategy: The capacity provider strategy to use for the service. If a ``capacityProviderStrategy`` is specified, the ``launchType`` parameter must be omitted. If no ``capacityProviderStrategy`` or ``launchType`` is specified, the ``defaultCapacityProviderStrategy`` for the cluster is used. A capacity provider strategy can contain a maximum of 20 capacity providers. .. epigraph:: To remove this property from your service resource, specify an empty ``CapacityProviderStrategyItem`` array.
         :param cluster: The short name or full Amazon Resource Name (ARN) of the cluster that you run your service on. If you do not specify a cluster, the default cluster is assumed.
         :param deployment_configuration: Optional deployment parameters that control how many tasks run during the deployment and the ordering of stopping and starting tasks.
-        :param deployment_controller: The deployment controller to use for the service. If no deployment controller is specified, the default value of ``ECS`` is used.
+        :param deployment_controller: The deployment controller to use for the service.
         :param desired_count: The number of instantiations of the specified task definition to place and keep running in your service. For new services, if a desired count is not specified, a default value of ``1`` is used. When using the ``DAEMON`` scheduling strategy, the desired count is not required. For existing services, if a desired count is not specified, it is omitted from the operation.
-        :param enable_ecs_managed_tags: Specifies whether to turn on Amazon ECS managed tags for the tasks within the service. For more information, see `Tagging your Amazon ECS resources <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html>`_ in the *Amazon Elastic Container Service Developer Guide* . When you use Amazon ECS managed tags, you need to set the ``propagateTags`` request parameter.
+        :param enable_ecs_managed_tags: Specifies whether to turn on Amazon ECS managed tags for the tasks within the service. For more information, see `Tagging your Amazon ECS resources <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html>`_ in the *Amazon Elastic Container Service Developer Guide* . When you use Amazon ECS managed tags, you must set the ``propagateTags`` request parameter.
         :param enable_execute_command: Determines whether the execute command functionality is turned on for the service. If ``true`` , the execute command functionality is turned on for all containers in tasks as part of the service.
         :param health_check_grace_period_seconds: The period of time, in seconds, that the Amazon ECS service scheduler ignores unhealthy Elastic Load Balancing, VPC Lattice, and container health checks after a task has first started. If you don't specify a health check grace period value, the default value of ``0`` is used. If you don't use any of the health checks, then ``healthCheckGracePeriodSeconds`` is unused. If your service's tasks take a while to start and respond to health checks, you can specify a health check grace period of up to 2,147,483,647 seconds (about 69 years). During that time, the Amazon ECS service scheduler ignores health check status. This grace period can prevent the service scheduler from marking tasks as unhealthy and stopping them before they have time to come up.
         :param launch_type: The launch type on which to run your service. For more information, see `Amazon ECS Launch Types <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html>`_ in the *Amazon Elastic Container Service Developer Guide* .
@@ -9555,7 +9555,7 @@ class CfnService(
 
             When the alarms are generated, Amazon ECS sets the service deployment to failed. Set the rollback parameter to have Amazon ECS to roll back your service to the last completed deployment after a failure.
 
-            You can only use the ``DeploymentAlarms`` method to detect failures when the ``DeploymentController`` is set to ``ECS`` (rolling update).
+            You can only use the ``DeploymentAlarms`` method to detect failures when the ``DeploymentController`` is set to ``ECS`` .
 
             For more information, see `Rolling update <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-ecs.html>`_ in the **Amazon Elastic Container Service Developer Guide** .
 
@@ -9930,7 +9930,7 @@ class CfnService(
         def __init__(self, *, type: typing.Optional[builtins.str] = None) -> None:
             '''The deployment controller to use for the service.
 
-            :param type: The deployment controller type to use. There are three deployment controller types available:. - **ECS** - The rolling update ( ``ECS`` ) deployment type involves replacing the current running version of the container with the latest version. The number of containers Amazon ECS adds or removes from the service during a rolling update is controlled by adjusting the minimum and maximum number of healthy tasks allowed during a service deployment, as specified in the `DeploymentConfiguration <https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeploymentConfiguration.html>`_ . - **CODE_DEPLOY** - The blue/green ( ``CODE_DEPLOY`` ) deployment type uses the blue/green deployment model powered by AWS CodeDeploy , which allows you to verify a new deployment of a service before sending production traffic to it. - **EXTERNAL** - The external ( ``EXTERNAL`` ) deployment type enables you to use any third-party deployment controller for full control over the deployment process for an Amazon ECS service.
+            :param type: The deployment controller type to use. The deployment controller is the mechanism that determines how tasks are deployed for your service. The valid options are: - ECS When you create a service which uses the ``ECS`` deployment controller, you can choose between the following deployment strategies: - ``ROLLING`` : When you create a service which uses the *rolling update* ( ``ROLLING`` ) deployment strategy, the Amazon ECS service scheduler replaces the currently running tasks with new tasks. The number of tasks that Amazon ECS adds or removes from the service during a rolling update is controlled by the service deployment configuration. Rolling update deployments are best suited for the following scenarios: - Gradual service updates: You need to update your service incrementally without taking the entire service offline at once. - Limited resource requirements: You want to avoid the additional resource costs of running two complete environments simultaneously (as required by blue/green deployments). - Acceptable deployment time: Your application can tolerate a longer deployment process, as rolling updates replace tasks one by one. - No need for instant roll back: Your service can tolerate a rollback process that takes minutes rather than seconds. - Simple deployment process: You prefer a straightforward deployment approach without the complexity of managing multiple environments, target groups, and listeners. - No load balancer requirement: Your service doesn't use or require a load balancer, Application Load Balancer , Network Load Balancer , or Service Connect (which are required for blue/green deployments). - Stateful applications: Your application maintains state that makes it difficult to run two parallel environments. - Cost sensitivity: You want to minimize deployment costs by not running duplicate environments during deployment. Rolling updates are the default deployment strategy for services and provide a balance between deployment safety and resource efficiency for many common application scenarios. - ``BLUE_GREEN`` : A *blue/green* deployment strategy ( ``BLUE_GREEN`` ) is a release methodology that reduces downtime and risk by running two identical production environments called blue and green. With Amazon ECS blue/green deployments, you can validate new service revisions before directing production traffic to them. This approach provides a safer way to deploy changes with the ability to quickly roll back if needed. Amazon ECS blue/green deployments are best suited for the following scenarios: - Service validation: When you need to validate new service revisions before directing production traffic to them - Zero downtime: When your service requires zero-downtime deployments - Instant roll back: When you need the ability to quickly roll back if issues are detected - Load balancer requirement: When your service uses Application Load Balancer , Network Load Balancer , or Service Connect - External Use a third-party deployment controller. - Blue/green deployment (powered by CodeDeploy ) CodeDeploy installs an updated version of the application as a new replacement task set and reroutes production traffic from the original application task set to the replacement task set. The original task set is terminated after a successful deployment. Use this deployment controller to verify a new deployment of a service before sending production traffic to it. When updating the deployment controller for a service, consider the following depending on the type of migration you're performing. - If you have a template that contains the ``EXTERNAL`` deployment controller information as well as ``TaskSet`` and ``PrimaryTaskSet`` resources, and you remove the task set resources from the template when updating from ``EXTERNAL`` to ``ECS`` , the ``DescribeTaskSet`` and ``DeleteTaskSet`` API calls will return a 400 error after the deployment controller is updated to ``ECS`` . This results in a delete failure on the task set resources, even though the stack transitions to ``UPDATE_COMPLETE`` status. For more information, see `Resource removed from stack but not deleted <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-resource-removed-not-deleted>`_ in the AWS CloudFormation User Guide. To fix this issue, delete the task sets directly using the Amazon ECS ``DeleteTaskSet`` API. For more information about how to delete a task set, see `DeleteTaskSet <https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html>`_ in the Amazon Elastic Container Service API Reference. - If you're migrating from ``CODE_DEPLOY`` to ``ECS`` with a new task definition and AWS CloudFormation performs a rollback operation, the Amazon ECS ``UpdateService`` request fails with the following error: Resource handler returned message: "Invalid request provided: Unable to update task definition on services with a CODE_DEPLOY deployment controller. - After a successful migration from ``ECS`` to ``EXTERNAL`` deployment controller, you need to manually remove the ``ACTIVE`` task set, because Amazon ECS no longer manages the deployment. For information about how to delete a task set, see `DeleteTaskSet <https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html>`_ in the Amazon Elastic Container Service API Reference.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-service-deploymentcontroller.html
             :exampleMetadata: fixture=_generated
@@ -9954,11 +9954,53 @@ class CfnService(
 
         @builtins.property
         def type(self) -> typing.Optional[builtins.str]:
-            '''The deployment controller type to use. There are three deployment controller types available:.
+            '''The deployment controller type to use.
 
-            - **ECS** - The rolling update ( ``ECS`` ) deployment type involves replacing the current running version of the container with the latest version. The number of containers Amazon ECS adds or removes from the service during a rolling update is controlled by adjusting the minimum and maximum number of healthy tasks allowed during a service deployment, as specified in the `DeploymentConfiguration <https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeploymentConfiguration.html>`_ .
-            - **CODE_DEPLOY** - The blue/green ( ``CODE_DEPLOY`` ) deployment type uses the blue/green deployment model powered by AWS CodeDeploy , which allows you to verify a new deployment of a service before sending production traffic to it.
-            - **EXTERNAL** - The external ( ``EXTERNAL`` ) deployment type enables you to use any third-party deployment controller for full control over the deployment process for an Amazon ECS service.
+            The deployment controller is the mechanism that determines how tasks are deployed for your service. The valid options are:
+
+            - ECS
+
+            When you create a service which uses the ``ECS`` deployment controller, you can choose between the following deployment strategies:
+
+            - ``ROLLING`` : When you create a service which uses the *rolling update* ( ``ROLLING`` ) deployment strategy, the Amazon ECS service scheduler replaces the currently running tasks with new tasks. The number of tasks that Amazon ECS adds or removes from the service during a rolling update is controlled by the service deployment configuration.
+
+            Rolling update deployments are best suited for the following scenarios:
+
+            - Gradual service updates: You need to update your service incrementally without taking the entire service offline at once.
+            - Limited resource requirements: You want to avoid the additional resource costs of running two complete environments simultaneously (as required by blue/green deployments).
+            - Acceptable deployment time: Your application can tolerate a longer deployment process, as rolling updates replace tasks one by one.
+            - No need for instant roll back: Your service can tolerate a rollback process that takes minutes rather than seconds.
+            - Simple deployment process: You prefer a straightforward deployment approach without the complexity of managing multiple environments, target groups, and listeners.
+            - No load balancer requirement: Your service doesn't use or require a load balancer, Application Load Balancer , Network Load Balancer , or Service Connect (which are required for blue/green deployments).
+            - Stateful applications: Your application maintains state that makes it difficult to run two parallel environments.
+            - Cost sensitivity: You want to minimize deployment costs by not running duplicate environments during deployment.
+
+            Rolling updates are the default deployment strategy for services and provide a balance between deployment safety and resource efficiency for many common application scenarios.
+
+            - ``BLUE_GREEN`` : A *blue/green* deployment strategy ( ``BLUE_GREEN`` ) is a release methodology that reduces downtime and risk by running two identical production environments called blue and green. With Amazon ECS blue/green deployments, you can validate new service revisions before directing production traffic to them. This approach provides a safer way to deploy changes with the ability to quickly roll back if needed.
+
+            Amazon ECS blue/green deployments are best suited for the following scenarios:
+
+            - Service validation: When you need to validate new service revisions before directing production traffic to them
+            - Zero downtime: When your service requires zero-downtime deployments
+            - Instant roll back: When you need the ability to quickly roll back if issues are detected
+            - Load balancer requirement: When your service uses Application Load Balancer , Network Load Balancer , or Service Connect
+            - External
+
+            Use a third-party deployment controller.
+
+            - Blue/green deployment (powered by CodeDeploy )
+
+            CodeDeploy installs an updated version of the application as a new replacement task set and reroutes production traffic from the original application task set to the replacement task set. The original task set is terminated after a successful deployment. Use this deployment controller to verify a new deployment of a service before sending production traffic to it.
+
+            When updating the deployment controller for a service, consider the following depending on the type of migration you're performing.
+
+            - If you have a template that contains the ``EXTERNAL`` deployment controller information as well as ``TaskSet`` and ``PrimaryTaskSet`` resources, and you remove the task set resources from the template when updating from ``EXTERNAL`` to ``ECS`` , the ``DescribeTaskSet`` and ``DeleteTaskSet`` API calls will return a 400 error after the deployment controller is updated to ``ECS`` . This results in a delete failure on the task set resources, even though the stack transitions to ``UPDATE_COMPLETE`` status. For more information, see `Resource removed from stack but not deleted <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-resource-removed-not-deleted>`_ in the AWS CloudFormation User Guide. To fix this issue, delete the task sets directly using the Amazon ECS ``DeleteTaskSet`` API. For more information about how to delete a task set, see `DeleteTaskSet <https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html>`_ in the Amazon Elastic Container Service API Reference.
+            - If you're migrating from ``CODE_DEPLOY`` to ``ECS`` with a new task definition and AWS CloudFormation performs a rollback operation, the Amazon ECS ``UpdateService`` request fails with the following error:
+
+            Resource handler returned message: "Invalid request provided: Unable to update task definition on services with a CODE_DEPLOY deployment controller.
+
+            - After a successful migration from ``ECS`` to ``EXTERNAL`` deployment controller, you need to manually remove the ``ACTIVE`` task set, because Amazon ECS no longer manages the deployment. For information about how to delete a task set, see `DeleteTaskSet <https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html>`_ in the Amazon Elastic Container Service API Reference.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-service-deploymentcontroller.html#cfn-ecs-service-deploymentcontroller-type
             '''
@@ -12429,9 +12471,9 @@ class CfnServiceProps:
         :param capacity_provider_strategy: The capacity provider strategy to use for the service. If a ``capacityProviderStrategy`` is specified, the ``launchType`` parameter must be omitted. If no ``capacityProviderStrategy`` or ``launchType`` is specified, the ``defaultCapacityProviderStrategy`` for the cluster is used. A capacity provider strategy can contain a maximum of 20 capacity providers. .. epigraph:: To remove this property from your service resource, specify an empty ``CapacityProviderStrategyItem`` array.
         :param cluster: The short name or full Amazon Resource Name (ARN) of the cluster that you run your service on. If you do not specify a cluster, the default cluster is assumed.
         :param deployment_configuration: Optional deployment parameters that control how many tasks run during the deployment and the ordering of stopping and starting tasks.
-        :param deployment_controller: The deployment controller to use for the service. If no deployment controller is specified, the default value of ``ECS`` is used.
+        :param deployment_controller: The deployment controller to use for the service.
         :param desired_count: The number of instantiations of the specified task definition to place and keep running in your service. For new services, if a desired count is not specified, a default value of ``1`` is used. When using the ``DAEMON`` scheduling strategy, the desired count is not required. For existing services, if a desired count is not specified, it is omitted from the operation.
-        :param enable_ecs_managed_tags: Specifies whether to turn on Amazon ECS managed tags for the tasks within the service. For more information, see `Tagging your Amazon ECS resources <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html>`_ in the *Amazon Elastic Container Service Developer Guide* . When you use Amazon ECS managed tags, you need to set the ``propagateTags`` request parameter.
+        :param enable_ecs_managed_tags: Specifies whether to turn on Amazon ECS managed tags for the tasks within the service. For more information, see `Tagging your Amazon ECS resources <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html>`_ in the *Amazon Elastic Container Service Developer Guide* . When you use Amazon ECS managed tags, you must set the ``propagateTags`` request parameter.
         :param enable_execute_command: Determines whether the execute command functionality is turned on for the service. If ``true`` , the execute command functionality is turned on for all containers in tasks as part of the service.
         :param health_check_grace_period_seconds: The period of time, in seconds, that the Amazon ECS service scheduler ignores unhealthy Elastic Load Balancing, VPC Lattice, and container health checks after a task has first started. If you don't specify a health check grace period value, the default value of ``0`` is used. If you don't use any of the health checks, then ``healthCheckGracePeriodSeconds`` is unused. If your service's tasks take a while to start and respond to health checks, you can specify a health check grace period of up to 2,147,483,647 seconds (about 69 years). During that time, the Amazon ECS service scheduler ignores health check status. This grace period can prevent the service scheduler from marking tasks as unhealthy and stopping them before they have time to come up.
         :param launch_type: The launch type on which to run your service. For more information, see `Amazon ECS Launch Types <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html>`_ in the *Amazon Elastic Container Service Developer Guide* .
@@ -12771,8 +12813,6 @@ class CfnServiceProps:
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnService.DeploymentControllerProperty]]:
         '''The deployment controller to use for the service.
 
-        If no deployment controller is specified, the default value of ``ECS`` is used.
-
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html#cfn-ecs-service-deploymentcontroller
         '''
         result = self._values.get("deployment_controller")
@@ -12799,7 +12839,7 @@ class CfnServiceProps:
 
         For more information, see `Tagging your Amazon ECS resources <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html>`_ in the *Amazon Elastic Container Service Developer Guide* .
 
-        When you use Amazon ECS managed tags, you need to set the ``propagateTags`` request parameter.
+        When you use Amazon ECS managed tags, you must set the ``propagateTags`` request parameter.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html#cfn-ecs-service-enableecsmanagedtags
         '''
@@ -33949,11 +33989,7 @@ class NetworkMode(enum.Enum):
     single container instance when port mappings are used.
     '''
     NAT = "NAT"
-    '''The task utilizes NAT network mode required by Windows containers.
-
-    This is the only supported network mode for Windows containers. For more information, see
-    `Task Definition Parameters <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#network_mode>`_.
-    '''
+    '''The task utilizes Docker's built-in virtual network which runs inside each Windows container instance.'''
 
 
 class OperatingSystemFamily(
@@ -34049,6 +34085,18 @@ class OperatingSystemFamily(
         '''WINDOWS_SERVER_2022_FULL.'''
         return typing.cast("OperatingSystemFamily", jsii.sget(cls, "WINDOWS_SERVER_2022_FULL"))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="WINDOWS_SERVER_2025_CORE")
+    def WINDOWS_SERVER_2025_CORE(cls) -> "OperatingSystemFamily":
+        '''WINDOWS_SERVER_2025_CORE.'''
+        return typing.cast("OperatingSystemFamily", jsii.sget(cls, "WINDOWS_SERVER_2025_CORE"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="WINDOWS_SERVER_2025_FULL")
+    def WINDOWS_SERVER_2025_FULL(cls) -> "OperatingSystemFamily":
+        '''WINDOWS_SERVER_2025_FULL.'''
+        return typing.cast("OperatingSystemFamily", jsii.sget(cls, "WINDOWS_SERVER_2025_FULL"))
+
     @jsii.python.classproperty
     @jsii.member(jsii_name="WINDOWS_SERVER_20H2_CORE")
     def WINDOWS_SERVER_20_H2_CORE(cls) -> "OperatingSystemFamily":
@@ -39861,6 +39909,7 @@ class VolumeFrom:
 class WindowsOptimizedVersion(enum.Enum):
     '''ECS-optimized Windows version list.'''
 
+    SERVER_2025 = "SERVER_2025"
     SERVER_2022 = "SERVER_2022"
     SERVER_2019 = "SERVER_2019"
     SERVER_2016 = "SERVER_2016"

aws_cdk/aws_iotsitewise/__init__.py

@@ -4765,7 +4765,7 @@ class CfnGateway(
         :param gateway_name: A unique name for the gateway.
         :param gateway_platform: The gateway's platform. You can only specify one platform in a gateway.
         :param gateway_capability_summaries: A list of gateway capability summaries that each contain a namespace and status. Each gateway capability defines data sources for the gateway. To retrieve a capability configuration's definition, use `DescribeGatewayCapabilityConfiguration <https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeGatewayCapabilityConfiguration.html>`_ .
-        :param gateway_version: The version of the gateway. A value of ``3`` indicates an MQTT-enabled, V3 gateway, while ``2`` indicates a Classic streams, V2 gateway.
+        :param gateway_version: The version of the gateway you want to create.
         :param tags: A list of key-value pairs that contain metadata for the gateway. For more information, see `Tagging your AWS IoT SiteWise resources <https://docs.aws.amazon.com/iot-sitewise/latest/userguide/tag-resources.html>`_ in the *AWS IoT SiteWise User Guide* .
         '''
         if __debug__:
@@ -4884,7 +4884,7 @@ class CfnGateway(
     @builtins.property
     @jsii.member(jsii_name="gatewayVersion")
     def gateway_version(self) -> typing.Optional[builtins.str]:
-        '''The version of the gateway.'''
+        '''The version of the gateway you want to create.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "gatewayVersion"))
 
     @gateway_version.setter
@@ -4924,7 +4924,7 @@ class CfnGateway(
         ) -> None:
             '''Contains a summary of a gateway capability configuration.
 
-            :param capability_namespace: The namespace of the capability configuration. For example, if you configure OPC-UA sources from the AWS IoT SiteWise console, your OPC-UA capability configuration has the namespace ``iotsitewise:opcuacollector:version`` , where ``version`` is a number such as ``1`` .
+            :param capability_namespace: The namespace of the capability configuration. For example, if you configure OPC UA sources for an MQTT-enabled gateway, your OPC-UA capability configuration has the namespace ``iotsitewise:opcuacollector:3`` .
             :param capability_configuration: The JSON document that defines the configuration for the gateway capability. For more information, see `Configuring data sources (CLI) <https://docs.aws.amazon.com/iot-sitewise/latest/userguide/configure-sources.html#configure-source-cli>`_ in the *AWS IoT SiteWise User Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotsitewise-gateway-gatewaycapabilitysummary.html
@@ -4957,7 +4957,7 @@ class CfnGateway(
         def capability_namespace(self) -> builtins.str:
             '''The namespace of the capability configuration.
 
-            For example, if you configure OPC-UA sources from the AWS IoT SiteWise console, your OPC-UA capability configuration has the namespace ``iotsitewise:opcuacollector:version`` , where ``version`` is a number such as ``1`` .
+            For example, if you configure OPC UA sources for an MQTT-enabled gateway, your OPC-UA capability configuration has the namespace ``iotsitewise:opcuacollector:3`` .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotsitewise-gateway-gatewaycapabilitysummary.html#cfn-iotsitewise-gateway-gatewaycapabilitysummary-capabilitynamespace
             '''
@@ -5004,7 +5004,13 @@ class CfnGateway(
             greengrass_v2: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnGateway.GreengrassV2Property", typing.Dict[builtins.str, typing.Any]]]] = None,
             siemens_ie: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnGateway.SiemensIEProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
-            '''Contains a gateway's platform information.
+            '''The gateway's platform configuration. You can only specify one platform type in a gateway.
+
+            (Legacy only) For Greengrass V1 gateways, specify the ``greengrass`` parameter with a valid Greengrass group ARN.
+
+            For Greengrass V2 gateways, specify the ``greengrassV2`` parameter with a valid core device thing name. If creating a V3 gateway ( ``gatewayVersion=3`` ), you must also specify the ``coreDeviceOperatingSystem`` .
+
+            For Siemens Industrial Edge gateways, specify the ``siemensIE`` parameter with a valid IoT Core thing name.
 
             :param greengrass: 
             :param greengrass_v2: A gateway that runs on AWS IoT Greengrass V2 .
@@ -5297,7 +5303,7 @@ class CfnGatewayProps:
         :param gateway_name: A unique name for the gateway.
         :param gateway_platform: The gateway's platform. You can only specify one platform in a gateway.
         :param gateway_capability_summaries: A list of gateway capability summaries that each contain a namespace and status. Each gateway capability defines data sources for the gateway. To retrieve a capability configuration's definition, use `DescribeGatewayCapabilityConfiguration <https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeGatewayCapabilityConfiguration.html>`_ .
-        :param gateway_version: The version of the gateway. A value of ``3`` indicates an MQTT-enabled, V3 gateway, while ``2`` indicates a Classic streams, V2 gateway.
+        :param gateway_version: The version of the gateway you want to create.
         :param tags: A list of key-value pairs that contain metadata for the gateway. For more information, see `Tagging your AWS IoT SiteWise resources <https://docs.aws.amazon.com/iot-sitewise/latest/userguide/tag-resources.html>`_ in the *AWS IoT SiteWise User Guide* .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iotsitewise-gateway.html
@@ -5397,9 +5403,7 @@ class CfnGatewayProps:
 
     @builtins.property
     def gateway_version(self) -> typing.Optional[builtins.str]:
-        '''The version of the gateway.
-
-        A value of ``3`` indicates an MQTT-enabled, V3 gateway, while ``2`` indicates a Classic streams, V2 gateway.
+        '''The version of the gateway you want to create.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iotsitewise-gateway.html#cfn-iotsitewise-gateway-gatewayversion
         '''

aws_cdk/aws_kms/__init__.py

@@ -2751,29 +2751,31 @@ class KeyProps:
         :param removal_policy: Whether the encryption key should be retained when it is removed from the Stack. This is useful when one wants to retain access to data that was encrypted with a key that is being retired. Default: RemovalPolicy.Retain
         :param rotation_period: The period between each automatic rotation. Default: - set by CFN to 365 days.
 
-        :exampleMetadata: infused
+        :exampleMetadata: fixture=default infused
 
         Example::
 
-            import aws_cdk.aws_kms as kms
-            
+            cmk = kms.Key(self, "cmk")
+            claude_model = bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_SONNET_V1_0
             
-            source_output = codepipeline.Artifact()
-            target_bucket = s3.Bucket(self, "MyBucket")
-            key = kms.Key(self, "EnvVarEncryptKey",
-                description="sample key"
+            variant1 = bedrock.PromptVariant.text(
+                variant_name="variant1",
+                model=claude_model,
+                prompt_variables=["topic"],
+                prompt_text="This is my first text prompt. Please summarize our conversation on: {{topic}}.",
+                inference_configuration=bedrock.PromptInferenceConfiguration.text(
+                    temperature=1,
+                    top_p=0.999,
+                    max_tokens=2000
+                )
             )
             
-            pipeline = codepipeline.Pipeline(self, "MyPipeline")
-            deploy_action = codepipeline_actions.S3DeployAction(
-                action_name="S3Deploy",
-                bucket=target_bucket,
-                input=source_output,
-                encryption_key=key
-            )
-            deploy_stage = pipeline.add_stage(
-                stage_name="Deploy",
-                actions=[deploy_action]
+            prompt1 = bedrock.Prompt(self, "prompt1",
+                prompt_name="prompt1",
+                description="my first prompt",
+                default_variant=variant1,
+                variants=[variant1],
+                kms_key=cmk
             )
         '''
         if __debug__: