aws-cdk-lib 2.218.0__py3-none-any.whl → 2.220.0__py3-none-any.whl

aws_cdk/aws_route53/__init__.py

@@ -572,6 +572,18 @@ zone_from_attributes = route53.PublicHostedZone.from_public_hosted_zone_attribut
 zone_from_id = route53.PublicHostedZone.from_public_hosted_zone_id(self, "MyZone", "ZOJJZC49E0EPZ")
 ```
 
+You can import a Private Hosted Zone with `PrivateHostedZone.fromPrivateHostedZoneId` and `PrivateHostedZone.fromPrivateHostedZoneAttributes` methods:
+
+```python
+private_zone_from_attributes = route53.PrivateHostedZone.from_private_hosted_zone_attributes(self, "MyPrivateZone",
+    zone_name="example.local",
+    hosted_zone_id="ZOJJZC49E0EPZ"
+)
+
+# Does not know zoneName
+private_zone_from_id = route53.PrivateHostedZone.from_private_hosted_zone_id(self, "MyPrivateZone", "ZOJJZC49E0EPZ")
+```
+
 You can use `CrossAccountZoneDelegationRecord` on imported Hosted Zones with the `grantDelegation` method:
 
 ```python
@@ -5069,6 +5081,70 @@ class MxRecordValue:
         )
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_route53.PrivateHostedZoneAttributes",
+    jsii_struct_bases=[HostedZoneAttributes],
+    name_mapping={"hosted_zone_id": "hostedZoneId", "zone_name": "zoneName"},
+)
+class PrivateHostedZoneAttributes(HostedZoneAttributes):
+    def __init__(
+        self,
+        *,
+        hosted_zone_id: builtins.str,
+        zone_name: builtins.str,
+    ) -> None:
+        '''Reference to a private hosted zone.
+
+        :param hosted_zone_id: Identifier of the hosted zone.
+        :param zone_name: Name of the hosted zone.
+
+        :exampleMetadata: infused
+
+        Example::
+
+            private_zone_from_attributes = route53.PrivateHostedZone.from_private_hosted_zone_attributes(self, "MyPrivateZone",
+                zone_name="example.local",
+                hosted_zone_id="ZOJJZC49E0EPZ"
+            )
+            
+            # Does not know zoneName
+            private_zone_from_id = route53.PrivateHostedZone.from_private_hosted_zone_id(self, "MyPrivateZone", "ZOJJZC49E0EPZ")
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__7d59e6606b03cf3d00569e659297984570c743e09eb89316ce4d0048cd192732)
+            check_type(argname="argument hosted_zone_id", value=hosted_zone_id, expected_type=type_hints["hosted_zone_id"])
+            check_type(argname="argument zone_name", value=zone_name, expected_type=type_hints["zone_name"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "hosted_zone_id": hosted_zone_id,
+            "zone_name": zone_name,
+        }
+
+    @builtins.property
+    def hosted_zone_id(self) -> builtins.str:
+        '''Identifier of the hosted zone.'''
+        result = self._values.get("hosted_zone_id")
+        assert result is not None, "Required property 'hosted_zone_id' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def zone_name(self) -> builtins.str:
+        '''Name of the hosted zone.'''
+        result = self._values.get("zone_name")
+        assert result is not None, "Required property 'zone_name' is missing"
+        return typing.cast(builtins.str, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "PrivateHostedZoneAttributes(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_route53.PrivateHostedZoneProps",
     jsii_struct_bases=[CommonHostedZoneProps],
@@ -12686,7 +12762,7 @@ class CfnRecordSet(
 
             :param dns_name: *Alias records only:* The value that you specify depends on where you want to route queries:. - **Amazon API Gateway custom regional APIs and edge-optimized APIs** - Specify the applicable domain name for your API. You can get the applicable value using the AWS CLI command `get-domain-names <https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-domain-names.html>`_ : - For regional APIs, specify the value of ``regionalDomainName`` . - For edge-optimized APIs, specify the value of ``distributionDomainName`` . This is the name of the associated CloudFront distribution, such as ``da1b2c3d4e5.cloudfront.net`` . .. epigraph:: The name of the record that you're creating must match a custom domain name for your API, such as ``api.example.com`` . - **Amazon Virtual Private Cloud interface VPC endpoint** - Enter the API endpoint for the interface endpoint, such as ``vpce-123456789abcdef01-example-us-east-1a.elasticloadbalancing.us-east-1.vpce.amazonaws.com`` . For edge-optimized APIs, this is the domain name for the corresponding CloudFront distribution. You can get the value of ``DnsName`` using the AWS CLI command `describe-vpc-endpoints <https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html>`_ . - **CloudFront distribution** - Specify the domain name that CloudFront assigned when you created your distribution. Your CloudFront distribution must include an alternate domain name that matches the name of the record. For example, if the name of the record is *acme.example.com* , your CloudFront distribution must include *acme.example.com* as one of the alternate domain names. For more information, see `Using Alternate Domain Names (CNAMEs) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html>`_ in the *Amazon CloudFront Developer Guide* . You can't create a record in a private hosted zone to route traffic to a CloudFront distribution. .. epigraph:: For failover alias records, you can't specify a CloudFront distribution for both the primary and secondary records. A distribution must include an alternate domain name that matches the name of the record. However, the primary and secondary records have the same name, and you can't include the same alternate domain name in more than one distribution. - **Elastic Beanstalk environment** - If the domain name for your Elastic Beanstalk environment includes the region that you deployed the environment in, you can create an alias record that routes traffic to the environment. For example, the domain name ``my-environment. *us-west-2* .elasticbeanstalk.com`` is a regionalized domain name. .. epigraph:: For environments that were created before early 2016, the domain name doesn't include the region. To route traffic to these environments, you must create a CNAME record instead of an alias record. Note that you can't create a CNAME record for the root domain name. For example, if your domain name is example.com, you can create a record that routes traffic for acme.example.com to your Elastic Beanstalk environment, but you can't create a record that routes traffic for example.com to your Elastic Beanstalk environment. For Elastic Beanstalk environments that have regionalized subdomains, specify the ``CNAME`` attribute for the environment. You can use the following methods to get the value of the CNAME attribute: - *AWS Management Console* : For information about how to get the value by using the console, see `Using Custom Domains with AWS Elastic Beanstalk <https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customdomains.html>`_ in the *AWS Elastic Beanstalk Developer Guide* . - *Elastic Beanstalk API* : Use the ``DescribeEnvironments`` action to get the value of the ``CNAME`` attribute. For more information, see `DescribeEnvironments <https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironments.html>`_ in the *AWS Elastic Beanstalk API Reference* . - *AWS CLI* : Use the ``describe-environments`` command to get the value of the ``CNAME`` attribute. For more information, see `describe-environments <https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/describe-environments.html>`_ in the *AWS CLI* . - **ELB load balancer** - Specify the DNS name that is associated with the load balancer. Get the DNS name by using the AWS Management Console , the ELB API, or the AWS CLI . - *AWS Management Console* : Go to the EC2 page, choose *Load Balancers* in the navigation pane, choose the load balancer, choose the *Description* tab, and get the value of the *DNS name* field. If you're routing traffic to a Classic Load Balancer, get the value that begins with *dualstack* . If you're routing traffic to another type of load balancer, get the value that applies to the record type, A or AAAA. - *Elastic Load Balancing API* : Use ``DescribeLoadBalancers`` to get the value of ``DNSName`` . For more information, see the applicable guide: - Classic Load Balancers: `DescribeLoadBalancers <https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancers.html>`_ - Application and Network Load Balancers: `DescribeLoadBalancers <https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancers.html>`_ - *CloudFormation Fn::GetAtt intrinsic function* : Use the `Fn::GetAtt <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html>`_ intrinsic function to get the value of ``DNSName`` : - `Classic Load Balancers <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-elb.html#aws-properties-ec2-elb-return-values>`_ . - `Application and Network Load Balancers <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html#aws-resource-elasticloadbalancingv2-loadbalancer-return-values>`_ . - *AWS CLI* : Use ``describe-load-balancers`` to get the value of ``DNSName`` . For more information, see the applicable guide: - Classic Load Balancers: `describe-load-balancers <https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html>`_ - Application and Network Load Balancers: `describe-load-balancers <https://docs.aws.amazon.com/cli/latest/reference/elbv2/describe-load-balancers.html>`_ - **Global Accelerator accelerator** - Specify the DNS name for your accelerator: - *Global Accelerator API* : To get the DNS name, use `DescribeAccelerator <https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeAccelerator.html>`_ . - *AWS CLI* : To get the DNS name, use `describe-accelerator <https://docs.aws.amazon.com/cli/latest/reference/globalaccelerator/describe-accelerator.html>`_ . - **Amazon S3 bucket that is configured as a static website** - Specify the domain name of the Amazon S3 website endpoint that you created the bucket in, for example, ``s3-website.us-east-2.amazonaws.com`` . For more information about valid values, see the table `Amazon S3 Website Endpoints <https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_website_region_endpoints>`_ in the *Amazon Web Services General Reference* . For more information about using S3 buckets for websites, see `Getting Started with Amazon Route 53 <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/getting-started.html>`_ in the *Amazon Route 53 Developer Guide.* - **Another Route 53 record** - Specify the value of the ``Name`` element for a record in the current hosted zone. .. epigraph:: If you're creating an alias record that has the same name as the hosted zone (known as the zone apex), you can't specify the domain name for a record for which the value of ``Type`` is ``CNAME`` . This is because the alias record must have the same type as the record that you're routing traffic to, and creating a CNAME record for the zone apex isn't supported even for an alias record.
             :param hosted_zone_id: *Alias resource records sets only* : The value used depends on where you want to route traffic:. - **Amazon API Gateway custom regional APIs and edge-optimized APIs** - Specify the hosted zone ID for your API. You can get the applicable value using the AWS CLI command `get-domain-names <https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-domain-names.html>`_ : - For regional APIs, specify the value of ``regionalHostedZoneId`` . - For edge-optimized APIs, specify the value of ``distributionHostedZoneId`` . - **Amazon Virtual Private Cloud interface VPC endpoint** - Specify the hosted zone ID for your interface endpoint. You can get the value of ``HostedZoneId`` using the AWS CLI command `describe-vpc-endpoints <https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html>`_ . - **CloudFront distribution** - Specify ``Z2FDTNDATAQYW2`` . This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution. .. epigraph:: Alias records for CloudFront can't be created in a private zone. - **Elastic Beanstalk environment** - Specify the hosted zone ID for the region that you created the environment in. The environment must have a regionalized subdomain. For a list of regions and the corresponding hosted zone IDs, see `AWS Elastic Beanstalk endpoints and quotas <https://docs.aws.amazon.com/general/latest/gr/elasticbeanstalk.html>`_ in the *Amazon Web Services General Reference* . - **ELB load balancer** - Specify the value of the hosted zone ID for the load balancer. Use the following methods to get the hosted zone ID: - `Service Endpoints <https://docs.aws.amazon.com/general/latest/gr/elb.html>`_ table in the "Elastic Load Balancing Endpoints and Quotas" topic in the *Amazon Web Services General Reference* : Use the value that corresponds with the region that you created your load balancer in. Note that there are separate columns for Application and Classic Load Balancers and for Network Load Balancers. - *AWS Management Console* : Go to the Amazon EC2 page, choose *Load Balancers* in the navigation pane, select the load balancer, and get the value of the *Hosted zone* field on the *Description* tab. - *Elastic Load Balancing API* : Use ``DescribeLoadBalancers`` to get the applicable value. For more information, see the applicable guide: - Classic Load Balancers: Use `DescribeLoadBalancers <https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancers.html>`_ to get the value of ``CanonicalHostedZoneNameID`` . - Application and Network Load Balancers: Use `DescribeLoadBalancers <https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancers.html>`_ to get the value of ``CanonicalHostedZoneID`` . - *CloudFormation Fn::GetAtt intrinsic function* : Use the `Fn::GetAtt <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html>`_ intrinsic function to get the applicable value: - Classic Load Balancers: Get `CanonicalHostedZoneNameID <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-elb.html#aws-properties-ec2-elb-return-values>`_ . - Application and Network Load Balancers: Get `CanonicalHostedZoneID <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html#aws-resource-elasticloadbalancingv2-loadbalancer-return-values>`_ . - *AWS CLI* : Use ``describe-load-balancers`` to get the applicable value. For more information, see the applicable guide: - Classic Load Balancers: Use `describe-load-balancers <https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html>`_ to get the value of ``CanonicalHostedZoneNameID`` . - Application and Network Load Balancers: Use `describe-load-balancers <https://docs.aws.amazon.com/cli/latest/reference/elbv2/describe-load-balancers.html>`_ to get the value of ``CanonicalHostedZoneID`` . - **Global Accelerator accelerator** - Specify ``Z2BJ6XQ5FK7U4H`` . - **An Amazon S3 bucket configured as a static website** - Specify the hosted zone ID for the region that you created the bucket in. For more information about valid values, see the table `Amazon S3 Website Endpoints <https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_website_region_endpoints>`_ in the *Amazon Web Services General Reference* . - **Another Route 53 record in your hosted zone** - Specify the hosted zone ID of your hosted zone. (An alias record can't reference a record in a different hosted zone.)
-            :param evaluate_target_health: *Applies only to alias, failover alias, geolocation alias, latency alias, and weighted alias resource record sets:* When ``EvaluateTargetHealth`` is ``true`` , an alias resource record set inherits the health of the referenced AWS resource, such as an ELB load balancer or another resource record set in the hosted zone. Note the following: - **CloudFront distributions** - You can't set ``EvaluateTargetHealth`` to ``true`` when the alias target is a CloudFront distribution. - **Elastic Beanstalk environments that have regionalized subdomains** - If you specify an Elastic Beanstalk environment in ``DNSName`` and the environment contains an ELB load balancer, Elastic Load Balancing routes queries only to the healthy Amazon EC2 instances that are registered with the load balancer. (An environment automatically contains an ELB load balancer if it includes more than one Amazon EC2 instance.) If you set ``EvaluateTargetHealth`` to ``true`` and either no Amazon EC2 instances are healthy or the load balancer itself is unhealthy, Route 53 routes queries to other available resources that are healthy, if any. If the environment contains a single Amazon EC2 instance, there are no special requirements. - **ELB load balancers** - Health checking behavior depends on the type of load balancer: - *Classic Load Balancers* : If you specify an ELB Classic Load Balancer in ``DNSName`` , Elastic Load Balancing routes queries only to the healthy Amazon EC2 instances that are registered with the load balancer. If you set ``EvaluateTargetHealth`` to ``true`` and either no EC2 instances are healthy or the load balancer itself is unhealthy, Route 53 routes queries to other resources. - *Application and Network Load Balancers* : If you specify an ELB Application or Network Load Balancer and you set ``EvaluateTargetHealth`` to ``true`` , Route 53 routes queries to the load balancer based on the health of the target groups that are associated with the load balancer: - For an Application or Network Load Balancer to be considered healthy, every target group that contains targets must contain at least one healthy target. If any target group contains only unhealthy targets, the load balancer is considered unhealthy, and Route 53 routes queries to other resources. - A target group that has no registered targets is considered unhealthy. .. epigraph:: When you create a load balancer, you configure settings for Elastic Load Balancing health checks; they're not Route 53 health checks, but they perform a similar function. Do not create Route 53 health checks for the EC2 instances that you register with an ELB load balancer. - **S3 buckets** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is an S3 bucket. - **Other records in the same hosted zone** - If the AWS resource that you specify in ``DNSName`` is a record or a group of records (for example, a group of weighted records) but is not another alias record, we recommend that you associate a health check with all of the records in the alias target. For more information, see `What Happens When You Omit Health Checks? <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-complex-configs.html#dns-failover-complex-configs-hc-omitting>`_ in the *Amazon Route 53 Developer Guide* . For more information and examples, see `Amazon Route 53 Health Checks and DNS Failover <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ in the *Amazon Route 53 Developer Guide* .
+            :param evaluate_target_health: *Applies only to alias, failover alias, geolocation alias, latency alias, and weighted alias resource record sets:* When ``EvaluateTargetHealth`` is ``true`` , an alias resource record set inherits the health of the referenced AWS resource, such as an ELB load balancer or another resource record set in the hosted zone. Note the following: - **CloudFront distributions** - You can't set ``EvaluateTargetHealth`` to ``true`` when the alias target is a CloudFront distribution. - **Elastic Beanstalk environments that have regionalized subdomains** - If you specify an Elastic Beanstalk environment in ``DNSName`` and the environment contains an ELB load balancer, Elastic Load Balancing routes queries only to the healthy Amazon EC2 instances that are registered with the load balancer. (An environment automatically contains an ELB load balancer if it includes more than one Amazon EC2 instance.) If you set ``EvaluateTargetHealth`` to ``true`` and either no Amazon EC2 instances are healthy or the load balancer itself is unhealthy, Route 53 routes queries to other available resources that are healthy, if any. If the environment contains a single Amazon EC2 instance, there are no special requirements. - **ELB load balancers** - Health checking behavior depends on the type of load balancer: - *Classic Load Balancers* : If you specify an ELB Classic Load Balancer in ``DNSName`` , Elastic Load Balancing routes queries only to the healthy Amazon EC2 instances that are registered with the load balancer. If you set ``EvaluateTargetHealth`` to ``true`` and either no EC2 instances are healthy or the load balancer itself is unhealthy, Route 53 routes queries to other resources. - *Application and Network Load Balancers* : If you specify an ELB Application or Network Load Balancer and you set ``EvaluateTargetHealth`` to ``true`` , Route 53 routes queries to the load balancer based on the health of the target groups that are associated with the load balancer: - For an Application or Network Load Balancer to be considered healthy, every target group that contains targets must contain at least one healthy target. If any target group contains only unhealthy targets, the load balancer is considered unhealthy, and Route 53 routes queries to other resources. - A target group that has no registered targets is considered unhealthy. .. epigraph:: When you create a load balancer, you configure settings for Elastic Load Balancing health checks; they're not Route 53 health checks, but they perform a similar function. Do not create Route 53 health checks for the EC2 instances that you register with an ELB load balancer. - **API Gateway APIs** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is an API Gateway API. However, because API Gateway is highly available by design, ``EvaluateTargetHealth`` provides no operational benefit and `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ are recommended instead for failover scenarios. - **S3 buckets** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is an S3 bucket. However, because S3 buckets are highly available by design, ``EvaluateTargetHealth`` provides no operational benefit and `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ are recommended instead for failover scenarios. - **VPC interface endpoints** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is a VPC interface endpoint. However, because VPC interface endpoints are highly available by design, ``EvaluateTargetHealth`` provides no operational benefit and `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ are recommended instead for failover scenarios. - **Other records in the same hosted zone** - If the AWS resource that you specify in ``DNSName`` is a record or a group of records (for example, a group of weighted records) but is not another alias record, we recommend that you associate a health check with all of the records in the alias target. For more information, see `What Happens When You Omit Health Checks? <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-complex-configs.html#dns-failover-complex-configs-hc-omitting>`_ in the *Amazon Route 53 Developer Guide* . .. epigraph:: While ``EvaluateTargetHealth`` can be set to ``true`` for highly available AWS services (such as S3 buckets, VPC interface endpoints, and API Gateway), these services are designed for high availability and rarely experience outages that would be detected by this feature. For failover scenarios with these services, consider using `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ that monitor your application's ability to access the service instead. For more information and examples, see `Amazon Route 53 Health Checks and DNS Failover <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ in the *Amazon Route 53 Developer Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset-aliastarget.html
             :exampleMetadata: fixture=_generated
@@ -12840,9 +12916,15 @@ class CfnRecordSet(
 
                When you create a load balancer, you configure settings for Elastic Load Balancing health checks; they're not Route 53 health checks, but they perform a similar function. Do not create Route 53 health checks for the EC2 instances that you register with an ELB load balancer.
 
-            - **S3 buckets** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is an S3 bucket.
+            - **API Gateway APIs** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is an API Gateway API. However, because API Gateway is highly available by design, ``EvaluateTargetHealth`` provides no operational benefit and `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ are recommended instead for failover scenarios.
+            - **S3 buckets** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is an S3 bucket. However, because S3 buckets are highly available by design, ``EvaluateTargetHealth`` provides no operational benefit and `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ are recommended instead for failover scenarios.
+            - **VPC interface endpoints** - There are no special requirements for setting ``EvaluateTargetHealth`` to ``true`` when the alias target is a VPC interface endpoint. However, because VPC interface endpoints are highly available by design, ``EvaluateTargetHealth`` provides no operational benefit and `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ are recommended instead for failover scenarios.
             - **Other records in the same hosted zone** - If the AWS resource that you specify in ``DNSName`` is a record or a group of records (for example, a group of weighted records) but is not another alias record, we recommend that you associate a health check with all of the records in the alias target. For more information, see `What Happens When You Omit Health Checks? <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-complex-configs.html#dns-failover-complex-configs-hc-omitting>`_ in the *Amazon Route 53 Developer Guide* .
 
+            .. epigraph::
+
+               While ``EvaluateTargetHealth`` can be set to ``true`` for highly available AWS services (such as S3 buckets, VPC interface endpoints, and API Gateway), these services are designed for high availability and rarely experience outages that would be detected by this feature. For failover scenarios with these services, consider using `Route 53 health checks <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ that monitor your application's ability to access the service instead.
+
             For more information and examples, see `Amazon Route 53 Health Checks and DNS Failover <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html>`_ in the *Amazon Route 53 Developer Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset-aliastarget.html#cfn-route53-recordset-aliastarget-evaluatetargethealth
@@ -17074,13 +17156,13 @@ class PrivateHostedZone(
 
     Example::
 
-        # vpc: ec2.Vpc
-        
-        
-        zone = route53.PrivateHostedZone(self, "HostedZone",
-            zone_name="fully.qualified.domain.com",
-            vpc=vpc
+        private_zone_from_attributes = route53.PrivateHostedZone.from_private_hosted_zone_attributes(self, "MyPrivateZone",
+            zone_name="example.local",
+            hosted_zone_id="ZOJJZC49E0EPZ"
         )
+        
+        # Does not know zoneName
+        private_zone_from_id = route53.PrivateHostedZone.from_private_hosted_zone_id(self, "MyPrivateZone", "ZOJJZC49E0EPZ")
     '''
 
     def __init__(
@@ -17117,6 +17199,35 @@ class PrivateHostedZone(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromPrivateHostedZoneAttributes")
+    @builtins.classmethod
+    def from_private_hosted_zone_attributes(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        hosted_zone_id: builtins.str,
+        zone_name: builtins.str,
+    ) -> IPrivateHostedZone:
+        '''Imports a private hosted zone from another stack.
+
+        Use when both hosted zone ID and hosted zone name are known.
+
+        :param scope: the parent Construct for this Construct.
+        :param id: the logical name of this Construct.
+        :param hosted_zone_id: Identifier of the hosted zone.
+        :param zone_name: Name of the hosted zone.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__2854fdc710e9385a23e0748e6a26b1a8050ddd16e7e432970959903de7650f09)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        attrs = PrivateHostedZoneAttributes(
+            hosted_zone_id=hosted_zone_id, zone_name=zone_name
+        )
+
+        return typing.cast(IPrivateHostedZone, jsii.sinvoke(cls, "fromPrivateHostedZoneAttributes", [scope, id, attrs]))
+
     @jsii.member(jsii_name="fromPrivateHostedZoneId")
     @builtins.classmethod
     def from_private_hosted_zone_id(
@@ -17511,6 +17622,7 @@ __all__ = [
     "NsRecord",
     "NsRecordProps",
     "PrivateHostedZone",
+    "PrivateHostedZoneAttributes",
     "PrivateHostedZoneProps",
     "PublicHostedZone",
     "PublicHostedZoneAttributes",
@@ -17876,6 +17988,14 @@ def _typecheckingstub__2600b3ca2027fe7d531738c20a112cef3282c7ef114758a51ee386360
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__7d59e6606b03cf3d00569e659297984570c743e09eb89316ce4d0048cd192732(
+    *,
+    hosted_zone_id: builtins.str,
+    zone_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__3dc8529d9382b27a0613e5ea30e125e3af07550dc23754412bd1f99368cfc62d(
     *,
     zone_name: builtins.str,
@@ -19305,6 +19425,16 @@ def _typecheckingstub__b5513b0f840f5eafaeee3e3a9c7776204d075ee417c3cce2c38a14213
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__2854fdc710e9385a23e0748e6a26b1a8050ddd16e7e432970959903de7650f09(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    hosted_zone_id: builtins.str,
+    zone_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__b376eac72cdb24a91e277cf6c9c277d3ed571280fb5b90bd23b7e1e1d5f88dac(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,

aws_cdk/aws_s3/__init__.py

@@ -2110,17 +2110,23 @@ class BucketNotificationDestinationType(enum.Enum):
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_s3.BucketPolicyProps",
     jsii_struct_bases=[],
-    name_mapping={"bucket": "bucket", "removal_policy": "removalPolicy"},
+    name_mapping={
+        "bucket": "bucket",
+        "document": "document",
+        "removal_policy": "removalPolicy",
+    },
 )
 class BucketPolicyProps:
     def __init__(
         self,
         *,
         bucket: "IBucket",
+        document: typing.Optional[_PolicyDocument_3ac34393] = None,
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     ) -> None:
         '''
         :param bucket: The Amazon S3 bucket that the policy applies to.
+        :param document: Policy document to apply to the bucket. Default: - A new empty PolicyDocument will be created.
         :param removal_policy: Policy to apply when the policy is removed from this stack. Default: - RemovalPolicy.DESTROY.
 
         :exampleMetadata: fixture=_generated
@@ -2130,24 +2136,30 @@ class BucketPolicyProps:
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             import aws_cdk as cdk
+            from aws_cdk import aws_iam as iam
             from aws_cdk import aws_s3 as s3
             
             # bucket: s3.Bucket
+            # policy_document: iam.PolicyDocument
             
             bucket_policy_props = s3.BucketPolicyProps(
                 bucket=bucket,
             
                 # the properties below are optional
+                document=policy_document,
                 removal_policy=cdk.RemovalPolicy.DESTROY
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__4d7b9233434273933326211f004f27c2982fedd89ad904dc86d84c54f0f50ac6)
             check_type(argname="argument bucket", value=bucket, expected_type=type_hints["bucket"])
+            check_type(argname="argument document", value=document, expected_type=type_hints["document"])
             check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "bucket": bucket,
         }
+        if document is not None:
+            self._values["document"] = document
         if removal_policy is not None:
             self._values["removal_policy"] = removal_policy
 
@@ -2158,6 +2170,15 @@ class BucketPolicyProps:
         assert result is not None, "Required property 'bucket' is missing"
         return typing.cast("IBucket", result)
 
+    @builtins.property
+    def document(self) -> typing.Optional[_PolicyDocument_3ac34393]:
+        '''Policy document to apply to the bucket.
+
+        :default: - A new empty PolicyDocument will be created.
+        '''
+        result = self._values.get("document")
+        return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
+
     @builtins.property
     def removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
         '''Policy to apply when the policy is removed from this stack.
@@ -8546,19 +8567,23 @@ class BucketPolicy(
         id: builtins.str,
         *,
         bucket: "IBucket",
+        document: typing.Optional[_PolicyDocument_3ac34393] = None,
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     ) -> None:
         '''
         :param scope: -
         :param id: -
         :param bucket: The Amazon S3 bucket that the policy applies to.
+        :param document: Policy document to apply to the bucket. Default: - A new empty PolicyDocument will be created.
         :param removal_policy: Policy to apply when the policy is removed from this stack. Default: - RemovalPolicy.DESTROY.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__910b3df1208e67cb52dad0b0b8c5feb43c7bddb0ced50eaf6c953477298a840e)
             check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
             check_type(argname="argument id", value=id, expected_type=type_hints["id"])
-        props = BucketPolicyProps(bucket=bucket, removal_policy=removal_policy)
+        props = BucketPolicyProps(
+            bucket=bucket, document=document, removal_policy=removal_policy
+        )
 
         jsii.create(self.__class__, self, [scope, id, props])
 
@@ -23634,6 +23659,7 @@ def _typecheckingstub__d6a435bc6f062bf994c2d09482e0e60e726c10272a9b728fd3ffc4281
 def _typecheckingstub__4d7b9233434273933326211f004f27c2982fedd89ad904dc86d84c54f0f50ac6(
     *,
     bucket: IBucket,
+    document: typing.Optional[_PolicyDocument_3ac34393] = None,
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
 ) -> None:
     """Type checking stubs"""
@@ -24088,6 +24114,7 @@ def _typecheckingstub__910b3df1208e67cb52dad0b0b8c5feb43c7bddb0ced50eaf6c9534772
     id: builtins.str,
     *,
     bucket: IBucket,
+    document: typing.Optional[_PolicyDocument_3ac34393] = None,
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
 ) -> None:
     """Type checking stubs"""

aws_cdk/aws_s3objectlambda/__init__.py

@@ -205,7 +205,7 @@ class CfnAccessPointPolicyProps:
     ) -> None:
         '''Properties for defining a ``CfnAccessPointPolicy``.
 
-        :param object_lambda_access_point: An access point with an attached AWS Lambda function used to access transformed data from an Amazon S3 bucket.
+        :param object_lambda_access_point: .. epigraph:: Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025. If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ . An access point with an attached AWS Lambda function used to access transformed data from an Amazon S3 bucket.
         :param policy_document: Object Lambda Access Point resource policy document.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-s3objectlambda-accesspointpolicy.html
@@ -235,7 +235,13 @@ class CfnAccessPointPolicyProps:
 
     @builtins.property
     def object_lambda_access_point(self) -> builtins.str:
-        '''An access point with an attached AWS Lambda function used to access transformed data from an Amazon S3 bucket.
+        '''.. epigraph::
+
+   Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025.
+
+        If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ .
+
+        An access point with an attached AWS Lambda function used to access transformed data from an Amazon S3 bucket.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-s3objectlambda-accesspointpolicy.html#cfn-s3objectlambda-accesspointpolicy-objectlambdaaccesspoint
         '''
@@ -282,7 +288,7 @@ class CfnAccessPointProps:
     ) -> None:
         '''Properties for defining a ``CfnAccessPoint``.
 
-        :param object_lambda_configuration: A configuration used when creating an Object Lambda Access Point.
+        :param object_lambda_configuration: .. epigraph:: Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025. If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ . A configuration used when creating an Object Lambda Access Point.
         :param name: The name of this access point.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-s3objectlambda-accesspoint.html
@@ -327,7 +333,13 @@ class CfnAccessPointProps:
     def object_lambda_configuration(
         self,
     ) -> typing.Union[_IResolvable_da3f097b, "CfnAccessPoint.ObjectLambdaConfigurationProperty"]:
-        '''A configuration used when creating an Object Lambda Access Point.
+        '''.. epigraph::
+
+   Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025.
+
+        If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ .
+
+        A configuration used when creating an Object Lambda Access Point.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-s3objectlambda-accesspoint.html#cfn-s3objectlambda-accesspoint-objectlambdaconfiguration
         '''
@@ -488,7 +500,7 @@ class CfnAccessPoint(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param object_lambda_configuration: A configuration used when creating an Object Lambda Access Point.
+        :param object_lambda_configuration: .. epigraph:: Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025. If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ . A configuration used when creating an Object Lambda Access Point.
         :param name: The name of this access point.
         '''
         if __debug__:
@@ -665,7 +677,9 @@ class CfnAccessPoint(
     def object_lambda_configuration(
         self,
     ) -> typing.Union[_IResolvable_da3f097b, "CfnAccessPoint.ObjectLambdaConfigurationProperty"]:
-        '''A configuration used when creating an Object Lambda Access Point.'''
+        '''.. epigraph::
+
+   Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025.'''
         return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnAccessPoint.ObjectLambdaConfigurationProperty"], jsii.get(self, "objectLambdaConfiguration"))
 
     @object_lambda_configuration.setter
@@ -703,9 +717,13 @@ class CfnAccessPoint(
             value: builtins.str,
             status: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''The alias of an Object Lambda Access Point.
+            '''.. epigraph::
+
+   Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025.
 
-            For more information, see `How to use a bucket-style alias for your S3 bucket Object Lambda Access Point <https://docs.aws.amazon.com/AmazonS3/latest/userguide/olap-use.html#ol-access-points-alias>`_ .
+            If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ .
+
+            The alias of an Object Lambda Access Point. For more information, see `How to use a bucket-style alias for your S3 bucket Object Lambda Access Point <https://docs.aws.amazon.com/AmazonS3/latest/userguide/olap-use.html#ol-access-points-alias>`_ .
 
             :param value: The alias value of the Object Lambda Access Point.
             :param status: The status of the Object Lambda Access Point alias. If the status is ``PROVISIONING`` , the Object Lambda Access Point is provisioning the alias and the alias is not ready for use yet. If the status is ``READY`` , the Object Lambda Access Point alias is successfully provisioned and ready for use.
@@ -921,7 +939,13 @@ class CfnAccessPoint(
             allowed_features: typing.Optional[typing.Sequence[builtins.str]] = None,
             cloud_watch_metrics_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         ) -> None:
-            '''A configuration used when creating an Object Lambda Access Point.
+            '''.. epigraph::
+
+   Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025.
+
+            If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ .
+
+            A configuration used when creating an Object Lambda Access Point.
 
             :param supporting_access_point: Standard access point associated with the Object Lambda Access Point.
             :param transformation_configurations: A container for transformation configurations for an Object Lambda Access Point.
@@ -1239,7 +1263,13 @@ class CfnAccessPoint(
             actions: typing.Sequence[builtins.str],
             content_transformation: typing.Any,
         ) -> None:
-            '''A configuration used when creating an Object Lambda Access Point transformation.
+            '''.. epigraph::
+
+   Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025.
+
+            If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ .
+
+            A configuration used when creating an Object Lambda Access Point transformation.
 
             :param actions: A container for the action of an Object Lambda Access Point configuration. Valid inputs are ``GetObject`` , ``HeadObject`` , ``ListObject`` , and ``ListObjectV2`` .
             :param content_transformation: A container for the content transformation of an Object Lambda Access Point configuration. Can include the FunctionArn and FunctionPayload. For more information, see `AwsLambdaTransformation <https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_AwsLambdaTransformation.html>`_ in the *Amazon S3 API Reference* .
@@ -1342,7 +1372,7 @@ class CfnAccessPointPolicy(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param object_lambda_access_point: An access point with an attached AWS Lambda function used to access transformed data from an Amazon S3 bucket.
+        :param object_lambda_access_point: .. epigraph:: Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025. If you would like to use the service, please sign up prior to 11/7/2025. For capabilities similar to S3 Object Lambda, learn more here - `Amazon S3 Object Lambda availability change <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>`_ . An access point with an attached AWS Lambda function used to access transformed data from an Amazon S3 bucket.
         :param policy_document: Object Lambda Access Point resource policy document.
         '''
         if __debug__:
@@ -1400,7 +1430,9 @@ class CfnAccessPointPolicy(
     @builtins.property
     @jsii.member(jsii_name="objectLambdaAccessPoint")
     def object_lambda_access_point(self) -> builtins.str:
-        '''An access point with an attached AWS Lambda function used to access transformed data from an Amazon S3 bucket.'''
+        '''.. epigraph::
+
+   Amazon S3 Object Lambda will no longer be open to new customers starting on 11/7/2025.'''
         return typing.cast(builtins.str, jsii.get(self, "objectLambdaAccessPoint"))
 
     @object_lambda_access_point.setter