aws-cdk-lib 2.219.0__py3-none-any.whl → 2.220.0__py3-none-any.whl

aws_cdk/aws_cloudfront/experimental/__init__.py

@@ -499,6 +499,7 @@ class EdgeFunction(
         action: typing.Optional[builtins.str] = None,
         event_source_token: typing.Optional[builtins.str] = None,
         function_url_auth_type: typing.Optional[_FunctionUrlAuthType_9c7b2c86] = None,
+        invoked_via_function_url: typing.Optional[builtins.bool] = None,
         organization_id: typing.Optional[builtins.str] = None,
         scope: typing.Optional[_constructs_77d1e7e8.Construct] = None,
         source_account: typing.Optional[builtins.str] = None,
@@ -511,6 +512,7 @@ class EdgeFunction(
         :param action: The Lambda actions that you want to allow in this statement. For example, you can specify lambda:CreateFunction to specify a certain action, or use a wildcard (``lambda:*``) to grant permission to all Lambda actions. For a list of actions, see Actions and Condition Context Keys for AWS Lambda in the IAM User Guide. Default: 'lambda:InvokeFunction'
         :param event_source_token: A unique token that must be supplied by the principal invoking the function. Default: - The caller would not need to present a token.
         :param function_url_auth_type: The authType for the function URL that you are granting permissions for. Default: - No functionUrlAuthType
+        :param invoked_via_function_url: The condition key for limiting the scope of lambda:InvokeFunction action to Function URL only. When set to true, it restricts the principal in this policy to perform invokes for the resource only via Function URLs. Default: - false
         :param organization_id: The organization you want to grant permissions to. Use this ONLY if you need to grant permissions to a subset of the organization. If you want to grant permissions to the entire organization, sending the organization principal through the ``principal`` property will suffice. You can use this property to ensure that all source principals are owned by a specific organization. Default: - No organizationId
         :param scope: The scope to which the permission constructs be attached. The default is the Lambda function construct itself, but this would need to be different in cases such as cross-stack references where the Permissions would need to sit closer to the consumer of this permission (i.e., the caller). Default: - The instance of lambda.IFunction
         :param source_account: The AWS account ID (without hyphens) of the source owner. For example, if you specify an S3 bucket in the SourceArn property, this value is the bucket owner's account ID. You can use this property to ensure that all source principals are owned by a specific account.
@@ -524,6 +526,7 @@ class EdgeFunction(
             action=action,
             event_source_token=event_source_token,
             function_url_auth_type=function_url_auth_type,
+            invoked_via_function_url=invoked_via_function_url,
             organization_id=organization_id,
             scope=scope,
             source_account=source_account,
@@ -2196,6 +2199,7 @@ def _typecheckingstub__2eb22d84593be3f12d95da9b201a03a4c5bc3b744aa1e4ce7f555d5cd
     action: typing.Optional[builtins.str] = None,
     event_source_token: typing.Optional[builtins.str] = None,
     function_url_auth_type: typing.Optional[_FunctionUrlAuthType_9c7b2c86] = None,
+    invoked_via_function_url: typing.Optional[builtins.bool] = None,
     organization_id: typing.Optional[builtins.str] = None,
     scope: typing.Optional[_constructs_77d1e7e8.Construct] = None,
     source_account: typing.Optional[builtins.str] = None,

aws_cdk/aws_cloudfront_origins/__init__.py

@@ -851,6 +851,41 @@ cloudfront.Distribution(self, "Distribution",
 )
 ```
 
+### Configuring IP Address Type
+
+You can specify which IP protocol CloudFront uses when connecting to your Lambda Function URL origin. By default, CloudFront uses IPv4 only.
+
+```python
+import aws_cdk.aws_lambda as lambda_
+from aws_cdk.aws_cloudfront import OriginIpAddressType
+
+# fn: lambda.Function
+
+fn_url = fn.add_function_url(auth_type=lambda_.FunctionUrlAuthType.NONE)
+
+# Uses default IPv4 only
+cloudfront.Distribution(self, "Distribution",
+    default_behavior=cloudfront.BehaviorOptions(
+        origin=origins.FunctionUrlOrigin(fn_url)
+    )
+)
+
+# Explicitly specify IP address type
+cloudfront.Distribution(self, "Distribution",
+    default_behavior=cloudfront.BehaviorOptions(
+        origin=origins.FunctionUrlOrigin(fn_url,
+            ip_address_type=OriginIpAddressType.DUALSTACK
+        )
+    )
+)
+```
+
+Supported values for `ipAddressType`:
+
+* `OriginIpAddressType.IPV4` - CloudFront uses IPv4 only to connect to the origin (default)
+* `OriginIpAddressType.IPV6` - CloudFront uses IPv6 only to connect to the origin
+* `OriginIpAddressType.DUALSTACK` - CloudFront uses both IPv4 and IPv6 to connect to the origin
+
 ### Lambda Function URL with Origin Access Control (OAC)
 
 You can configure the Lambda Function URL with Origin Access Control (OAC) for enhanced security. When using OAC with Signing SIGV4_ALWAYS, it is recommended to set the Lambda Function URL authType to AWS_IAM to ensure proper authorization.
@@ -972,16 +1007,18 @@ class FunctionUrlOrigin(
     Example::
 
         import aws_cdk.aws_lambda as lambda_
+        
         # fn: lambda.Function
         
+        fn_url = fn.add_function_url(auth_type=lambda_.FunctionUrlAuthType.NONE)
         
-        fn_url = fn.add_function_url(
-            auth_type=lambda_.FunctionUrlAuthType.AWS_IAM
-        )
-        
-        cloudfront.Distribution(self, "MyDistribution",
+        cloudfront.Distribution(self, "Distribution",
             default_behavior=cloudfront.BehaviorOptions(
-                origin=origins.FunctionUrlOrigin.with_origin_access_control(fn_url)
+                origin=origins.FunctionUrlOrigin(fn_url,
+                    read_timeout=Duration.seconds(30),
+                    response_completion_timeout=Duration.seconds(90),
+                    keepalive_timeout=Duration.seconds(45)
+                )
             )
         )
     '''
@@ -990,6 +1027,7 @@ class FunctionUrlOrigin(
         self,
         lambda_function_url: _IFunctionUrl_1a74cd94,
         *,
+        ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
         keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
         read_timeout: typing.Optional[_Duration_4839e8c3] = None,
         origin_path: typing.Optional[builtins.str] = None,
@@ -1004,6 +1042,7 @@ class FunctionUrlOrigin(
     ) -> None:
         '''
         :param lambda_function_url: -
+        :param ip_address_type: Specifies which IP protocol CloudFront uses when connecting to your origin. If your origin uses both IPv4 and IPv6 protocols, you can choose dualstack to help optimize reliability. Default: OriginIpAddressType.IPV4
         :param keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(5)
         :param read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(30)
         :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. Must begin, but not end, with '/' (e.g., '/production/images'). Default: '/'
@@ -1020,6 +1059,7 @@ class FunctionUrlOrigin(
             type_hints = typing.get_type_hints(_typecheckingstub__fcda903697b26acfe2149a285d5a64619682b675affb52f4ae2d1aca46c8f1c3)
             check_type(argname="argument lambda_function_url", value=lambda_function_url, expected_type=type_hints["lambda_function_url"])
         props = FunctionUrlOriginProps(
+            ip_address_type=ip_address_type,
             keepalive_timeout=keepalive_timeout,
             read_timeout=read_timeout,
             origin_path=origin_path,
@@ -1042,6 +1082,7 @@ class FunctionUrlOrigin(
         lambda_function_url: _IFunctionUrl_1a74cd94,
         *,
         origin_access_control: typing.Optional[_IOriginAccessControl_82a6fe5a] = None,
+        ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
         keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
         read_timeout: typing.Optional[_Duration_4839e8c3] = None,
         origin_path: typing.Optional[builtins.str] = None,
@@ -1058,6 +1099,7 @@ class FunctionUrlOrigin(
 
         :param lambda_function_url: -
         :param origin_access_control: An optional Origin Access Control. Default: - an Origin Access Control will be created.
+        :param ip_address_type: Specifies which IP protocol CloudFront uses when connecting to your origin. If your origin uses both IPv4 and IPv6 protocols, you can choose dualstack to help optimize reliability. Default: OriginIpAddressType.IPV4
         :param keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(5)
         :param read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(30)
         :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. Must begin, but not end, with '/' (e.g., '/production/images'). Default: '/'
@@ -1075,6 +1117,7 @@ class FunctionUrlOrigin(
             check_type(argname="argument lambda_function_url", value=lambda_function_url, expected_type=type_hints["lambda_function_url"])
         props = FunctionUrlOriginWithOACProps(
             origin_access_control=origin_access_control,
+            ip_address_type=ip_address_type,
             keepalive_timeout=keepalive_timeout,
             read_timeout=read_timeout,
             origin_path=origin_path,
@@ -1316,6 +1359,7 @@ class FunctionUrlOriginBaseProps(_OriginProps_0675928d):
         "origin_shield_region": "originShieldRegion",
         "response_completion_timeout": "responseCompletionTimeout",
         "origin_path": "originPath",
+        "ip_address_type": "ipAddressType",
         "keepalive_timeout": "keepaliveTimeout",
         "read_timeout": "readTimeout",
     },
@@ -1333,6 +1377,7 @@ class FunctionUrlOriginProps(_OriginProps_0675928d):
         origin_shield_region: typing.Optional[builtins.str] = None,
         response_completion_timeout: typing.Optional[_Duration_4839e8c3] = None,
         origin_path: typing.Optional[builtins.str] = None,
+        ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
         keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
         read_timeout: typing.Optional[_Duration_4839e8c3] = None,
     ) -> None:
@@ -1347,6 +1392,7 @@ class FunctionUrlOriginProps(_OriginProps_0675928d):
         :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled
         :param response_completion_timeout: The time that a request from CloudFront to the origin can stay open and wait for a response. If the complete response isn't received from the origin by this time, CloudFront ends the connection. Valid values are 1-3600 seconds, inclusive. Default: undefined - AWS CloudFront default is not enforcing a maximum value
         :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. Must begin, but not end, with '/' (e.g., '/production/images'). Default: '/'
+        :param ip_address_type: Specifies which IP protocol CloudFront uses when connecting to your origin. If your origin uses both IPv4 and IPv6 protocols, you can choose dualstack to help optimize reliability. Default: OriginIpAddressType.IPV4
         :param keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(5)
         :param read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(30)
 
@@ -1381,6 +1427,7 @@ class FunctionUrlOriginProps(_OriginProps_0675928d):
             check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
             check_type(argname="argument response_completion_timeout", value=response_completion_timeout, expected_type=type_hints["response_completion_timeout"])
             check_type(argname="argument origin_path", value=origin_path, expected_type=type_hints["origin_path"])
+            check_type(argname="argument ip_address_type", value=ip_address_type, expected_type=type_hints["ip_address_type"])
             check_type(argname="argument keepalive_timeout", value=keepalive_timeout, expected_type=type_hints["keepalive_timeout"])
             check_type(argname="argument read_timeout", value=read_timeout, expected_type=type_hints["read_timeout"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
@@ -1402,6 +1449,8 @@ class FunctionUrlOriginProps(_OriginProps_0675928d):
             self._values["response_completion_timeout"] = response_completion_timeout
         if origin_path is not None:
             self._values["origin_path"] = origin_path
+        if ip_address_type is not None:
+            self._values["ip_address_type"] = ip_address_type
         if keepalive_timeout is not None:
             self._values["keepalive_timeout"] = keepalive_timeout
         if read_timeout is not None:
@@ -1506,6 +1555,17 @@ class FunctionUrlOriginProps(_OriginProps_0675928d):
         result = self._values.get("origin_path")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def ip_address_type(self) -> typing.Optional[_OriginIpAddressType_1c01e1a0]:
+        '''Specifies which IP protocol CloudFront uses when connecting to your origin.
+
+        If your origin uses both IPv4 and IPv6 protocols, you can choose dualstack to help optimize reliability.
+
+        :default: OriginIpAddressType.IPV4
+        '''
+        result = self._values.get("ip_address_type")
+        return typing.cast(typing.Optional[_OriginIpAddressType_1c01e1a0], result)
+
     @builtins.property
     def keepalive_timeout(self) -> typing.Optional[_Duration_4839e8c3]:
         '''Specifies how long, in seconds, CloudFront persists its connection to the origin.
@@ -1559,6 +1619,7 @@ class FunctionUrlOriginProps(_OriginProps_0675928d):
         "origin_shield_region": "originShieldRegion",
         "response_completion_timeout": "responseCompletionTimeout",
         "origin_path": "originPath",
+        "ip_address_type": "ipAddressType",
         "keepalive_timeout": "keepaliveTimeout",
         "read_timeout": "readTimeout",
         "origin_access_control": "originAccessControl",
@@ -1577,6 +1638,7 @@ class FunctionUrlOriginWithOACProps(FunctionUrlOriginProps):
         origin_shield_region: typing.Optional[builtins.str] = None,
         response_completion_timeout: typing.Optional[_Duration_4839e8c3] = None,
         origin_path: typing.Optional[builtins.str] = None,
+        ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
         keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
         read_timeout: typing.Optional[_Duration_4839e8c3] = None,
         origin_access_control: typing.Optional[_IOriginAccessControl_82a6fe5a] = None,
@@ -1592,6 +1654,7 @@ class FunctionUrlOriginWithOACProps(FunctionUrlOriginProps):
         :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled
         :param response_completion_timeout: The time that a request from CloudFront to the origin can stay open and wait for a response. If the complete response isn't received from the origin by this time, CloudFront ends the connection. Valid values are 1-3600 seconds, inclusive. Default: undefined - AWS CloudFront default is not enforcing a maximum value
         :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. Must begin, but not end, with '/' (e.g., '/production/images'). Default: '/'
+        :param ip_address_type: Specifies which IP protocol CloudFront uses when connecting to your origin. If your origin uses both IPv4 and IPv6 protocols, you can choose dualstack to help optimize reliability. Default: OriginIpAddressType.IPV4
         :param keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(5)
         :param read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. The valid range is from 1 to 180 seconds, inclusive. Note that values over 60 seconds are possible only after a limit increase request for the origin response timeout quota has been approved in the target account; otherwise, values over 60 seconds will produce an error at deploy time. Default: Duration.seconds(30)
         :param origin_access_control: An optional Origin Access Control. Default: - an Origin Access Control will be created.
@@ -1634,6 +1697,7 @@ class FunctionUrlOriginWithOACProps(FunctionUrlOriginProps):
             check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
             check_type(argname="argument response_completion_timeout", value=response_completion_timeout, expected_type=type_hints["response_completion_timeout"])
             check_type(argname="argument origin_path", value=origin_path, expected_type=type_hints["origin_path"])
+            check_type(argname="argument ip_address_type", value=ip_address_type, expected_type=type_hints["ip_address_type"])
             check_type(argname="argument keepalive_timeout", value=keepalive_timeout, expected_type=type_hints["keepalive_timeout"])
             check_type(argname="argument read_timeout", value=read_timeout, expected_type=type_hints["read_timeout"])
             check_type(argname="argument origin_access_control", value=origin_access_control, expected_type=type_hints["origin_access_control"])
@@ -1656,6 +1720,8 @@ class FunctionUrlOriginWithOACProps(FunctionUrlOriginProps):
             self._values["response_completion_timeout"] = response_completion_timeout
         if origin_path is not None:
             self._values["origin_path"] = origin_path
+        if ip_address_type is not None:
+            self._values["ip_address_type"] = ip_address_type
         if keepalive_timeout is not None:
             self._values["keepalive_timeout"] = keepalive_timeout
         if read_timeout is not None:
@@ -1762,6 +1828,17 @@ class FunctionUrlOriginWithOACProps(FunctionUrlOriginProps):
         result = self._values.get("origin_path")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def ip_address_type(self) -> typing.Optional[_OriginIpAddressType_1c01e1a0]:
+        '''Specifies which IP protocol CloudFront uses when connecting to your origin.
+
+        If your origin uses both IPv4 and IPv6 protocols, you can choose dualstack to help optimize reliability.
+
+        :default: OriginIpAddressType.IPV4
+        '''
+        result = self._values.get("ip_address_type")
+        return typing.cast(typing.Optional[_OriginIpAddressType_1c01e1a0], result)
+
     @builtins.property
     def keepalive_timeout(self) -> typing.Optional[_Duration_4839e8c3]:
         '''Specifies how long, in seconds, CloudFront persists its connection to the origin.
@@ -5770,6 +5847,7 @@ publication.publish()
 def _typecheckingstub__fcda903697b26acfe2149a285d5a64619682b675affb52f4ae2d1aca46c8f1c3(
     lambda_function_url: _IFunctionUrl_1a74cd94,
     *,
+    ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
     keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
     read_timeout: typing.Optional[_Duration_4839e8c3] = None,
     origin_path: typing.Optional[builtins.str] = None,
@@ -5789,6 +5867,7 @@ def _typecheckingstub__b4d59b7721f41be7903dbcffeddd34d596392d2c8d2a4110f31a4dacd
     lambda_function_url: _IFunctionUrl_1a74cd94,
     *,
     origin_access_control: typing.Optional[_IOriginAccessControl_82a6fe5a] = None,
+    ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
     keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
     read_timeout: typing.Optional[_Duration_4839e8c3] = None,
     origin_path: typing.Optional[builtins.str] = None,
@@ -5830,6 +5909,7 @@ def _typecheckingstub__56d340a9ac5dd93c6aa22cb98bcbc860fb23f8d247b53c2cd1a51ecd8
     origin_shield_region: typing.Optional[builtins.str] = None,
     response_completion_timeout: typing.Optional[_Duration_4839e8c3] = None,
     origin_path: typing.Optional[builtins.str] = None,
+    ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
     keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
     read_timeout: typing.Optional[_Duration_4839e8c3] = None,
 ) -> None:
@@ -5847,6 +5927,7 @@ def _typecheckingstub__56968af993436ccfcac0aa6a57169f1a033078c10740d435d086816ad
     origin_shield_region: typing.Optional[builtins.str] = None,
     response_completion_timeout: typing.Optional[_Duration_4839e8c3] = None,
     origin_path: typing.Optional[builtins.str] = None,
+    ip_address_type: typing.Optional[_OriginIpAddressType_1c01e1a0] = None,
     keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
     read_timeout: typing.Optional[_Duration_4839e8c3] = None,
     origin_access_control: typing.Optional[_IOriginAccessControl_82a6fe5a] = None,

aws_cdk/aws_cloudwatch/__init__.py

@@ -486,7 +486,7 @@ metric = cloudwatch.Metric(
     namespace="AWS/EC2",
     metric_name="CPUUtilization",
     statistic="Average",
-    period=Duration.minutes(5)
+    period=Duration.hours(1)
 )
 
 # Create an anomaly detection alarm
@@ -1635,7 +1635,7 @@ class AnomalyDetectionAlarmProps:
                 namespace="AWS/EC2",
                 metric_name="CPUUtilization",
                 statistic="Average",
-                period=Duration.minutes(5)
+                period=Duration.hours(1)
             )
             
             # Create an anomaly detection alarm
@@ -6616,7 +6616,7 @@ class Metric(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.aws_cloudwatch.Metr
             namespace="AWS/EC2",
             metric_name="CPUUtilization",
             statistic="Average",
-            period=Duration.minutes(5)
+            period=Duration.hours(1)
         )
         
         # Create an anomaly detection alarm
@@ -7578,7 +7578,7 @@ class MetricProps(CommonMetricOptions):
                 namespace="AWS/EC2",
                 metric_name="CPUUtilization",
                 statistic="Average",
-                period=Duration.minutes(5)
+                period=Duration.hours(1)
             )
             
             # Create an anomaly detection alarm
@@ -17444,7 +17444,7 @@ class AnomalyDetectionAlarm(
             namespace="AWS/EC2",
             metric_name="CPUUtilization",
             statistic="Average",
-            period=Duration.minutes(5)
+            period=Duration.hours(1)
         )
         
         # Create an anomaly detection alarm

aws_cdk/aws_cognito/__init__.py

@@ -5114,7 +5114,7 @@ class CfnUserPoolUserProps:
         '''Properties for defining a ``CfnUserPoolUser``.
 
         :param user_pool_id: The ID of the user pool where you want to create a user.
-        :param client_metadata: A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning AWS Lambda functions to user pool triggers. When you use the AdminCreateUser API action, Amazon Cognito invokes the function that is assigned to the *pre sign-up* trigger. When Amazon Cognito invokes this function, it passes a JSON payload, which the function receives as input. This payload contains a ``ClientMetadata`` attribute, which provides the data that you assigned to the ClientMetadata parameter in your AdminCreateUser request. In your function code in AWS Lambda , you can process the ``clientMetadata`` value to enhance your workflow for your specific needs. For more information, see `Using Lambda triggers <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html>`_ in the *Amazon Cognito Developer Guide* . .. epigraph:: When you use the ``ClientMetadata`` parameter, note that Amazon Cognito won't do the following: - Store the ``ClientMetadata`` value. This data is available only to AWS Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration doesn't include triggers, the ``ClientMetadata`` parameter serves no purpose. - Validate the ``ClientMetadata`` value. - Encrypt the ``ClientMetadata`` value. Don't send sensitive information in this parameter.
+        :param client_metadata: A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning AWS Lambda functions to user pool triggers. When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a ``clientMetadata`` attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the ``clientMetadata`` value to enhance your workflow for your specific needs. To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see `Connecting API actions to Lambda triggers <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event>`_ in the *Amazon Cognito Developer Guide* . .. epigraph:: When you use the ``ClientMetadata`` parameter, note that Amazon Cognito won't do the following: - Store the ``ClientMetadata`` value. This data is available only to AWS Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration doesn't include triggers, the ``ClientMetadata`` parameter serves no purpose. - Validate the ``ClientMetadata`` value. - Encrypt the ``ClientMetadata`` value. Don't send sensitive information in this parameter.
         :param desired_delivery_mediums: Specify ``EMAIL`` if email will be used to send the welcome message. Specify ``SMS`` if the phone number will be used. The default value is ``SMS`` . You can specify more than one value.
         :param force_alias_creation: This parameter is used only if the ``phone_number_verified`` or ``email_verified`` attribute is set to ``True`` . Otherwise, it is ignored. If this parameter is set to ``True`` and the phone number or email address specified in the ``UserAttributes`` parameter already exists as an alias with a different user, this request migrates the alias from the previous user to the newly-created user. The previous user will no longer be able to log in using that alias. If this parameter is set to ``False`` , the API throws an ``AliasExistsException`` error if the alias already exists. The default value is ``False`` .
         :param message_action: Set to ``RESEND`` to resend the invitation message to a user that already exists, and to reset the temporary-password duration with a new temporary password. Set to ``SUPPRESS`` to suppress sending the message. You can specify only one value.
@@ -5196,9 +5196,11 @@ class CfnUserPoolUserProps:
     ) -> typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]]:
         '''A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers.
 
-        You create custom workflows by assigning AWS Lambda functions to user pool triggers. When you use the AdminCreateUser API action, Amazon Cognito invokes the function that is assigned to the *pre sign-up* trigger. When Amazon Cognito invokes this function, it passes a JSON payload, which the function receives as input. This payload contains a ``ClientMetadata`` attribute, which provides the data that you assigned to the ClientMetadata parameter in your AdminCreateUser request. In your function code in AWS Lambda , you can process the ``clientMetadata`` value to enhance your workflow for your specific needs.
+        You create custom workflows by assigning AWS Lambda functions to user pool triggers.
 
-        For more information, see `Using Lambda triggers <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html>`_ in the *Amazon Cognito Developer Guide* .
+        When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a ``clientMetadata`` attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the ``clientMetadata`` value to enhance your workflow for your specific needs.
+
+        To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see `Connecting API actions to Lambda triggers <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event>`_ in the *Amazon Cognito Developer Guide* .
         .. epigraph::
 
            When you use the ``ClientMetadata`` parameter, note that Amazon Cognito won't do the following:
@@ -24285,7 +24287,7 @@ class CfnUserPoolUser(
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param user_pool_id: The ID of the user pool where you want to create a user.
-        :param client_metadata: A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning AWS Lambda functions to user pool triggers. When you use the AdminCreateUser API action, Amazon Cognito invokes the function that is assigned to the *pre sign-up* trigger. When Amazon Cognito invokes this function, it passes a JSON payload, which the function receives as input. This payload contains a ``ClientMetadata`` attribute, which provides the data that you assigned to the ClientMetadata parameter in your AdminCreateUser request. In your function code in AWS Lambda , you can process the ``clientMetadata`` value to enhance your workflow for your specific needs. For more information, see `Using Lambda triggers <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html>`_ in the *Amazon Cognito Developer Guide* . .. epigraph:: When you use the ``ClientMetadata`` parameter, note that Amazon Cognito won't do the following: - Store the ``ClientMetadata`` value. This data is available only to AWS Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration doesn't include triggers, the ``ClientMetadata`` parameter serves no purpose. - Validate the ``ClientMetadata`` value. - Encrypt the ``ClientMetadata`` value. Don't send sensitive information in this parameter.
+        :param client_metadata: A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning AWS Lambda functions to user pool triggers. When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a ``clientMetadata`` attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the ``clientMetadata`` value to enhance your workflow for your specific needs. To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see `Connecting API actions to Lambda triggers <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event>`_ in the *Amazon Cognito Developer Guide* . .. epigraph:: When you use the ``ClientMetadata`` parameter, note that Amazon Cognito won't do the following: - Store the ``ClientMetadata`` value. This data is available only to AWS Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration doesn't include triggers, the ``ClientMetadata`` parameter serves no purpose. - Validate the ``ClientMetadata`` value. - Encrypt the ``ClientMetadata`` value. Don't send sensitive information in this parameter.
         :param desired_delivery_mediums: Specify ``EMAIL`` if email will be used to send the welcome message. Specify ``SMS`` if the phone number will be used. The default value is ``SMS`` . You can specify more than one value.
         :param force_alias_creation: This parameter is used only if the ``phone_number_verified`` or ``email_verified`` attribute is set to ``True`` . Otherwise, it is ignored. If this parameter is set to ``True`` and the phone number or email address specified in the ``UserAttributes`` parameter already exists as an alias with a different user, this request migrates the alias from the previous user to the newly-created user. The previous user will no longer be able to log in using that alias. If this parameter is set to ``False`` , the API throws an ``AliasExistsException`` error if the alias already exists. The default value is ``False`` .
         :param message_action: Set to ``RESEND`` to resend the invitation message to a user that already exists, and to reset the temporary-password duration with a new temporary password. Set to ``SUPPRESS`` to suppress sending the message. You can specify only one value.

aws_cdk/aws_dax/__init__.py

@@ -118,7 +118,7 @@ class CfnClusterProps:
         :param cluster_endpoint_encryption_type: The encryption type of the cluster's endpoint. Available values are:. - ``NONE`` - The cluster's endpoint will be unencrypted. - ``TLS`` - The cluster's endpoint will be encrypted with Transport Layer Security, and will provide an x509 certificate for authentication. The default value is ``NONE`` .
         :param cluster_name: The name of the DAX cluster.
         :param description: The description of the cluster.
-        :param network_type: 
+        :param network_type: The IP address type of the cluster. Values are:. - ``ipv4`` - IPv4 addresses only - ``ipv6`` - IPv6 addresses only - ``dual_stack`` - Both IPv4 and IPv6 addresses
         :param notification_topic_arn: The Amazon Resource Name (ARN) of the Amazon SNS topic to which notifications will be sent. .. epigraph:: The Amazon SNS topic owner must be same as the DAX cluster owner.
         :param parameter_group_name: The parameter group to be associated with the DAX cluster.
         :param preferred_maintenance_window: A range of time when maintenance of DAX cluster software will be performed. For example: ``sun:01:00-sun:09:00`` . Cluster maintenance normally takes less than 30 minutes, and is performed automatically within the maintenance window.
@@ -291,7 +291,12 @@ class CfnClusterProps:
 
     @builtins.property
     def network_type(self) -> typing.Optional[builtins.str]:
-        '''
+        '''The IP address type of the cluster. Values are:.
+
+        - ``ipv4`` - IPv4 addresses only
+        - ``ipv6`` - IPv6 addresses only
+        - ``dual_stack`` - Both IPv4 and IPv6 addresses
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dax-cluster.html#cfn-dax-cluster-networktype
         '''
         result = self._values.get("network_type")
@@ -932,7 +937,7 @@ class CfnCluster(
         :param cluster_endpoint_encryption_type: The encryption type of the cluster's endpoint. Available values are:. - ``NONE`` - The cluster's endpoint will be unencrypted. - ``TLS`` - The cluster's endpoint will be encrypted with Transport Layer Security, and will provide an x509 certificate for authentication. The default value is ``NONE`` .
         :param cluster_name: The name of the DAX cluster.
         :param description: The description of the cluster.
-        :param network_type: 
+        :param network_type: The IP address type of the cluster. Values are:. - ``ipv4`` - IPv4 addresses only - ``ipv6`` - IPv6 addresses only - ``dual_stack`` - Both IPv4 and IPv6 addresses
         :param notification_topic_arn: The Amazon Resource Name (ARN) of the Amazon SNS topic to which notifications will be sent. .. epigraph:: The Amazon SNS topic owner must be same as the DAX cluster owner.
         :param parameter_group_name: The parameter group to be associated with the DAX cluster.
         :param preferred_maintenance_window: A range of time when maintenance of DAX cluster software will be performed. For example: ``sun:01:00-sun:09:00`` . Cluster maintenance normally takes less than 30 minutes, and is performed automatically within the maintenance window.
@@ -1162,6 +1167,10 @@ class CfnCluster(
     @builtins.property
     @jsii.member(jsii_name="networkType")
     def network_type(self) -> typing.Optional[builtins.str]:
+        '''The IP address type of the cluster.
+
+        Values are:.
+        '''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "networkType"))
 
     @network_type.setter

aws_cdk/aws_directoryservice/__init__.py

@@ -1026,6 +1026,27 @@ class CfnSimpleAD(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromDirectoryId")
+    @builtins.classmethod
+    def from_directory_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        directory_id: builtins.str,
+    ) -> ISimpleADRef:
+        '''Creates a new ISimpleADRef from a directoryId.
+
+        :param scope: -
+        :param id: -
+        :param directory_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4edb8188cf1a787819f9e08e002165b6e7e58550d088f80151ce91f3ee2ad4f0)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument directory_id", value=directory_id, expected_type=type_hints["directory_id"])
+        return typing.cast(ISimpleADRef, jsii.sinvoke(cls, "fromDirectoryId", [scope, id, directory_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1446,6 +1467,14 @@ def _typecheckingstub__40820ee1ed03f2cd4befa65e6404c1024999677e0624ca5450f4b1f92
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__4edb8188cf1a787819f9e08e002165b6e7e58550d088f80151ce91f3ee2ad4f0(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    directory_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__adbd82c9a36437463cde56b3a4ad4d5c5c16f2073416fd9e1873351e5eb928b2(
     inspector: _TreeInspector_488e0dd5,
 ) -> None: