konokenj.cdk-api-mcp-server 0.2.0__py3-none-any.whl → 0.2.2__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling/integ.custom-scaling.ts

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as cdk from 'aws-cdk-lib';
+import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-cdk-autoscaling-integ');
+
+const vpc = new ec2.Vpc(stack, 'VPC', {
+  maxAzs: 2,
+  restrictDefaultSecurityGroup: false,
+});
+
+const asg = new autoscaling.AutoScalingGroup(stack, 'Fleet', {
+  vpc,
+  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+  machineImage: new ec2.AmazonLinuxImage({ generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2 }),
+});
+
+asg.scaleOnSchedule('ScaleUpInTheMorning', {
+  schedule: autoscaling.Schedule.cron({ hour: '8', minute: '0' }),
+  minCapacity: 5,
+});
+
+asg.scaleOnSchedule('ScaleDownAtNight', {
+  schedule: autoscaling.Schedule.cron({ hour: '20', minute: '0' }),
+  maxCapacity: 2,
+});
+
+asg.scaleOnSchedule('ScaleUpInTheDay', {
+  schedule: autoscaling.Schedule.cron({ minute: '0/10', day: '1' }),
+  minCapacity: 5,
+});
+
+asg.scaleOnSchedule('ScaleUpInTheWeekDay', {
+  schedule: autoscaling.Schedule.cron({ minute: '0/10', weekDay: 'MON-SUN' }),
+  minCapacity: 5,
+});
+
+asg.scaleOnCpuUtilization('KeepCPUReasonable', {
+  targetUtilizationPercent: 50,
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling/integ.external-role.ts

@@ -0,0 +1,28 @@
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as cdk from 'aws-cdk-lib';
+import * as asg from 'aws-cdk-lib/aws-autoscaling';
+
+class TestStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string) {
+    super(scope, id);
+
+    const vpc = new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false });
+    const role = new iam.Role(this, 'Role', {
+      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
+    });
+
+    new asg.AutoScalingGroup(this, 'ASG', {
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO),
+      vpc,
+      machineImage: new ec2.AmazonLinuxImage(),
+      role,
+    });
+  }
+}
+
+const app = new cdk.App();
+
+new TestStack(app, 'integ-iam-external-role');
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling/integ.health-checks.ts

@@ -0,0 +1,56 @@
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as cdk from 'aws-cdk-lib';
+import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+
+export class TestStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+
+    const vpc = new ec2.Vpc(this, 'myVpcAuto', { restrictDefaultSecurityGroup: false });
+
+    new autoscaling.AutoScalingGroup(this, 'EC2HealthChecks', {
+      vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+      machineImage: new ec2.AmazonLinuxImage(), // get the latest Amazon Linux image
+      healthChecks: autoscaling.HealthChecks.ec2(
+        {
+          gracePeriod: cdk.Duration.seconds(100),
+        },
+      ),
+    });
+
+    new autoscaling.AutoScalingGroup(this, 'AdditionalHealthChecks', {
+      vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+      machineImage: new ec2.AmazonLinuxImage(), // get the latest Amazon Linux image
+      healthChecks: autoscaling.HealthChecks.withAdditionalChecks({
+        gracePeriod: cdk.Duration.seconds(100),
+        additionalTypes: [
+          autoscaling.AdditionalHealthCheckType.EBS,
+          autoscaling.AdditionalHealthCheckType.ELB,
+          autoscaling.AdditionalHealthCheckType.VPC_LATTICE,
+        ],
+      }),
+    });
+
+    new autoscaling.AutoScalingGroup(this, 'HealthChecksWithoutGrace', {
+      vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+      machineImage: new ec2.AmazonLinuxImage(), // get the latest Amazon Linux image
+      healthChecks: autoscaling.HealthChecks.withAdditionalChecks({
+        additionalTypes: [
+          autoscaling.AdditionalHealthCheckType.ELB,
+        ],
+      }),
+    });
+  }
+}
+
+const app = new cdk.App();
+
+const stack = new TestStack(app, 'integ-health-checks');
+
+new IntegTest(app, 'AutoScalingGroupHealthChecks', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling/integ.role-target-hook.ts

@@ -0,0 +1,79 @@
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as cdk from 'aws-cdk-lib';
+import * as constructs from 'constructs';
+import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
+
+export class FakeNotificationTarget implements autoscaling.ILifecycleHookTarget {
+  constructor(private readonly topic: sns.ITopic) {
+  }
+
+  private createRole(scope: constructs.Construct, _role?: iam.IRole) {
+    let role = _role;
+    if (!role) {
+      role = new iam.Role(scope, 'Role', {
+        assumedBy: new iam.ServicePrincipal('autoscaling.amazonaws.com'),
+      });
+    }
+
+    return role;
+  }
+
+  public bind(_scope: constructs.Construct, options: autoscaling.BindHookTargetOptions): autoscaling.LifecycleHookTargetConfig {
+    const role = this.createRole(options.lifecycleHook, options.role);
+    this.topic.grantPublish(role);
+
+    return {
+      notificationTargetArn: this.topic.topicArn,
+      createdRole: role,
+    };
+  }
+}
+
+export class TestStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+
+    let vpc = new ec2.Vpc(this, 'myVpcAuto', { restrictDefaultSecurityGroup: false });
+    const myrole = new iam.Role(this, 'MyRole', {
+      assumedBy: new iam.ServicePrincipal('autoscaling.amazonaws.com'),
+    });
+    const topic = new sns.Topic(this, 'topic', {});
+    const topic2 = new sns.Topic(this, 'topic2', {});
+
+    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
+      vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+      machineImage: new ec2.AmazonLinuxImage(), // get the latest Amazon Linux image
+      healthCheck: autoscaling.HealthCheck.ec2(),
+    });
+
+    // no role or notificationTarget
+    new autoscaling.LifecycleHook(this, 'LCHookNoRoleNoTarget', {
+      autoScalingGroup: asg,
+      lifecycleTransition: autoscaling.LifecycleTransition.INSTANCE_TERMINATING,
+    });
+
+    // no role with notificationTarget
+    new autoscaling.LifecycleHook(this, 'LCHookNoRoleTarget', {
+      notificationTarget: new FakeNotificationTarget(topic),
+      autoScalingGroup: asg,
+      lifecycleTransition: autoscaling.LifecycleTransition.INSTANCE_TERMINATING,
+    });
+
+    // role with target
+    new autoscaling.LifecycleHook(this, 'LCHookRoleTarget', {
+      notificationTarget: new FakeNotificationTarget(topic2),
+      role: myrole,
+      autoScalingGroup: asg,
+      lifecycleTransition: autoscaling.LifecycleTransition.INSTANCE_TERMINATING,
+    });
+  }
+}
+
+const app = new cdk.App();
+
+new TestStack(app, 'integ-role-target-hook');
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling/integ.spot-instances.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as cdk from 'aws-cdk-lib';
+import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-cdk-autoscaling-integ');
+
+const vpc = new ec2.Vpc(stack, 'VPC', {
+  maxAzs: 2,
+  restrictDefaultSecurityGroup: false,
+});
+
+new autoscaling.AutoScalingGroup(stack, 'Fleet', {
+  vpc,
+  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+  machineImage: new ec2.AmazonLinuxImage({ generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2 }),
+  spotPrice: '0.20',
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling/integ.step-scaling-with-cooldown.ts

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as cdk from 'aws-cdk-lib';
+import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import { Metric } from 'aws-cdk-lib/aws-cloudwatch';
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-cdk-autoscaling-integ');
+
+const vpc = new ec2.Vpc(stack, 'VPC', {
+  maxAzs: 2,
+  restrictDefaultSecurityGroup: false,
+});
+
+const autoScalingGroup = new autoscaling.AutoScalingGroup(stack, 'Fleet', {
+  vpc,
+  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+  machineImage: new ec2.AmazonLinuxImage({ generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2 }),
+  spotPrice: '0.20',
+});
+
+const metric = new Metric({
+  namespace: 'Repro',
+  metricName: 'Metric',
+});
+
+autoScalingGroup.scaleOnMetric('MetricScale', {
+  metric,
+  scalingSteps: [
+    { upper: 10, change: -5 },
+    { lower: 50, change: 5 },
+  ],
+  cooldown: cdk.Duration.minutes(5), // should ignore this property and deploy successfully
+});
+
+new IntegTest(app, 'step-scaling-with-cooldown', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling/integ.warm-pool.ts

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as cdk from 'aws-cdk-lib';
+import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
+
+/**
+ * Stack verification steps:
+ *
+ * -- aws autoscaling describe-warm-pool --auto-scaling-group-name ASG has 0 and 'Stopped' as MinSize and PoolState, respectively.
+ */
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-cdk-autoscaling-integ');
+
+const vpc = new ec2.Vpc(stack, 'VPC', {
+  maxAzs: 2,
+  restrictDefaultSecurityGroup: false,
+});
+
+const asg = new autoscaling.AutoScalingGroup(stack, 'Fleet', {
+  vpc,
+  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+  machineImage: new ec2.AmazonLinuxImage({ generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2 }),
+  autoScalingGroupName: 'ASG',
+});
+
+asg.addWarmPool();
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling-common/README.md

@@ -0,0 +1,8 @@
+# AWS AutoScaling Common Library
+
+
+This is a sister package to `aws-cdk-lib/aws-autoscaling` and
+`aws-cdk-lib/aws-applicationautoscaling`. It contains shared implementation
+details between them.
+
+It does not need to be used directly.

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling-hooktargets/README.md

@@ -0,0 +1,18 @@
+# Lifecycle Hook for the CDK AWS AutoScaling Library
+
+
+This library contains integration classes for AutoScaling lifecycle hooks.
+Instances of these classes should be passed to the
+`autoScalingGroup.addLifecycleHook()` method.
+
+Lifecycle hooks can be activated in one of the following ways:
+
+* Invoke a Lambda function
+* Publish to an SNS topic
+* Send to an SQS queue
+
+For more information on using this library, see the README of the
+`aws-cdk-lib/aws-autoscaling` library.
+
+For more information about lifecycle hooks, see
+[Amazon EC2 AutoScaling Lifecycle hooks](https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html) in the Amazon EC2 User Guide.

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-autoscaling-hooktargets/integ.queue-hook.ts

@@ -0,0 +1,80 @@
+import * as scaling from 'aws-cdk-lib/aws-autoscaling';
+import { Vpc, InstanceType, InstanceClass, InstanceSize, OperatingSystemType, UserData } from 'aws-cdk-lib/aws-ec2';
+import { Queue } from 'aws-cdk-lib/aws-sqs';
+import { StringParameter } from 'aws-cdk-lib/aws-ssm';
+import * as cdk from 'aws-cdk-lib';
+import { IntegTest, ExpectedResult } from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
+import { QueueHook } from 'aws-cdk-lib/aws-autoscaling-hooktargets';
+
+const app = new cdk.App();
+
+class TestStack extends cdk.Stack {
+  public readonly queueUrl: string;
+  public readonly groupName: string;
+  public readonly hookName: string;
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const queue = new Queue(this, 'HookQueue');
+    this.queueUrl = queue.queueUrl;
+    const group = new scaling.AutoScalingGroup(this, 'Group', {
+      vpc: new Vpc(this, 'Vpc', { restrictDefaultSecurityGroup: false }),
+      maxCapacity: 1,
+      minCapacity: 0,
+      instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.SMALL),
+      machineImage: {
+        getImage: () => {
+          return {
+            osType: OperatingSystemType.LINUX,
+            userData: UserData.forLinux(),
+            imageId: StringParameter.fromStringParameterName(
+              this,
+              'al2023AMI',
+              '/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64',
+            ).stringValue,
+          };
+        },
+      },
+    });
+    this.groupName = group.autoScalingGroupName;
+    const hook = group.addLifecycleHook('scaleout', {
+      lifecycleTransition: scaling.LifecycleTransition.INSTANCE_LAUNCHING,
+      notificationTarget: new QueueHook(queue),
+    });
+    this.hookName = hook.lifecycleHookName;
+  }
+}
+
+const testCase = new TestStack(app, 'integ-autoscalinghook-queue');
+const integ = new IntegTest(app, 'queue-hook-test', {
+  testCases: [testCase],
+});
+
+const setDesired = integ.assertions.awsApiCall('AutoScaling', 'setDesiredCapacity', {
+  AutoScalingGroupName: testCase.groupName,
+  DesiredCapacity: 1,
+});
+
+const message = integ.assertions.awsApiCall('SQS', 'receiveMessage', {
+  QueueUrl: testCase.queueUrl,
+});
+message.assertAtPath(
+  'Messages.0.Body.LifecycleTransition',
+  ExpectedResult.stringLikeRegexp('autoscaling:EC2_INSTANCE_LAUNCHING'),
+).waitForAssertions();
+
+const token = message.getAttString('Messages.0.Body.LifecycleActionToken');
+
+const completeAction = integ.assertions.awsApiCall('AutoScaling', 'completeLifecycleAction', {
+  AutoScalingGroupName: testCase.groupName,
+  LifecycleActionResult: 'CONTINUE',
+  LifecycleActionToken: token,
+  LifecycleHookName: testCase.hookName,
+});
+
+setDesired.next(
+  message.next(
+    completeAction,
+  ),
+);

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-backup/README.md

@@ -0,0 +1,258 @@
+# AWS Backup Construct Library
+
+
+AWS Backup is a fully managed backup service that makes it easy to centralize and automate the
+backup of data across AWS services in the cloud and on premises. Using AWS Backup, you can
+configure backup policies and monitor backup activity for your AWS resources in one place.
+
+## Backup plan and selection
+
+In AWS Backup, a *backup plan* is a policy expression that defines when and how you want to back up
+ your AWS resources, such as Amazon DynamoDB tables or Amazon Elastic File System (Amazon EFS) file
+ systems. You can assign resources to backup plans, and AWS Backup automatically backs up and retains
+ backups for those resources according to the backup plan. You can create multiple backup plans if you
+ have workloads with different backup requirements.
+
+This module provides ready-made backup plans (similar to the console experience):
+
+```ts
+// Daily, weekly and monthly with 5 year retention
+const plan = backup.BackupPlan.dailyWeeklyMonthly5YearRetention(this, 'Plan');
+```
+
+Assigning resources to a plan can be done with `addSelection()`:
+
+```ts
+declare const plan: backup.BackupPlan;
+declare const vpc: ec2.Vpc;
+const myTable = dynamodb.Table.fromTableName(this, 'Table', 'myTableName');
+const myDatabaseInstance = new rds.DatabaseInstance(this, 'DatabaseInstance', {
+  engine: rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0_26 }),
+  vpc,
+});
+const myDatabaseCluster = new rds.DatabaseCluster(this, 'DatabaseCluster', {
+  engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_2_08_1 }),
+  credentials: rds.Credentials.fromGeneratedSecret('clusteradmin'),
+  instanceProps: {
+    vpc,
+  },
+});
+const myServerlessCluster = new rds.ServerlessCluster(this, 'ServerlessCluster', {
+  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,
+  parameterGroup: rds.ParameterGroup.fromParameterGroupName(this, 'ParameterGroup', 'default.aurora-postgresql11'),
+  vpc,
+});
+const myCoolConstruct = new Construct(this, 'MyCoolConstruct');
+
+plan.addSelection('Selection', {
+  resources: [
+    backup.BackupResource.fromDynamoDbTable(myTable), // A DynamoDB table
+    backup.BackupResource.fromRdsDatabaseInstance(myDatabaseInstance), // A RDS instance
+    backup.BackupResource.fromRdsDatabaseCluster(myDatabaseCluster), // A RDS database cluster
+    backup.BackupResource.fromRdsServerlessCluster(myServerlessCluster), // An Aurora Serverless cluster
+    backup.BackupResource.fromTag('stage', 'prod'), // All resources that are tagged stage=prod in the region/account
+    backup.BackupResource.fromConstruct(myCoolConstruct), // All backupable resources in `myCoolConstruct`
+  ]
+})
+```
+
+If not specified, a new IAM role with a managed policy for backup will be
+created for the selection. The `BackupSelection` implements `IGrantable`.
+
+To disable the plan from assigning the default `AWSBackupServiceRolePolicyForBackup` backup policy use the `disableDefaultBackupPolicy` property.
+
+This is useful if you want to avoid granting unnecessary permissions to the role.
+
+```ts
+declare const plan: backup.BackupPlan;
+
+const role = new iam.Role(this, 'BackupRole', {
+  assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
+});
+// Assign S3-specific backup policy
+role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AWSBackupServiceRolePolicyForS3Backup'));
+
+plan.addSelection('Selection', {
+  resources: [
+    backup.BackupResource.fromTag('stage', 'prod'),
+  ],
+  role,
+  disableDefaultBackupPolicy: true,
+});
+```
+
+To add rules to a plan, use `addRule()`:
+
+```ts
+declare const plan: backup.BackupPlan;
+plan.addRule(new backup.BackupPlanRule({
+  completionWindow: Duration.hours(2),
+  startWindow: Duration.hours(1),
+  scheduleExpression: events.Schedule.cron({ // Only cron expressions are supported
+    day: '15',
+    hour: '3',
+    minute: '30',
+  }),
+  moveToColdStorageAfter: Duration.days(30),
+}));
+```
+
+Continuous backup and point-in-time restores (PITR) can be configured.
+Property `deleteAfter` defines the retention period for the backup. It is mandatory if PITR is enabled.
+If no value is specified, the retention period is set to 35 days which is the maximum retention period supported by PITR.
+Property `moveToColdStorageAfter` must not be specified because PITR does not support this option.
+This example defines an AWS Backup rule with PITR and a retention period set to 14 days:
+
+```ts
+declare const plan: backup.BackupPlan;
+plan.addRule(new backup.BackupPlanRule({
+  enableContinuousBackup: true,
+  deleteAfter: Duration.days(14),
+}));
+```
+
+Rules can also specify to copy recovery points to another Backup Vault using `copyActions`. Copied recovery points can
+optionally have `moveToColdStorageAfter` and `deleteAfter` configured.
+
+```ts
+declare const plan: backup.BackupPlan;
+declare const secondaryVault: backup.BackupVault;
+plan.addRule(new backup.BackupPlanRule({
+  copyActions: [{
+    destinationBackupVault: secondaryVault,
+    moveToColdStorageAfter: Duration.days(30),
+    deleteAfter: Duration.days(120),
+  }]
+}));
+```
+
+You can assign your own metadata to the resources that are associated with the rule when restored from backup using `recoveryPointTags`. Each tag is a key-value pair.
+
+```ts
+declare const plan: backup.BackupPlan;
+plan.addRule(new backup.BackupPlanRule({
+  recoveryPointTags: {
+    key: 'value',
+  },
+}));
+```
+
+Ready-made rules are also available:
+
+```ts
+declare const plan: backup.BackupPlan;
+plan.addRule(backup.BackupPlanRule.daily());
+plan.addRule(backup.BackupPlanRule.weekly());
+```
+
+By default a new [vault](#Backup-vault) is created when creating a plan.
+It is also possible to specify a vault either at the plan level or at the
+rule level.
+
+```ts
+const myVault = backup.BackupVault.fromBackupVaultName(this, 'Vault1', 'myVault');
+const otherVault = backup.BackupVault.fromBackupVaultName(this, 'Vault2', 'otherVault');
+
+const plan = backup.BackupPlan.daily35DayRetention(this, 'Plan', myVault); // Use `myVault` for all plan rules
+plan.addRule(backup.BackupPlanRule.monthly1Year(otherVault)); // Use `otherVault` for this specific rule
+```
+
+You can [backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/windows-backups.html)
+VSS-enabled Windows applications running on Amazon EC2 instances by setting the `windowsVss`
+parameter to `true`. If the application has VSS writer registered with Windows VSS,
+then AWS Backup creates a snapshot that will be consistent for that application.
+
+```ts
+const plan = new backup.BackupPlan(this, 'Plan', {
+  windowsVss: true,
+});
+```
+
+## Backup vault
+
+In AWS Backup, a *backup vault* is a container that you organize your backups in. You can use backup
+vaults to set the AWS Key Management Service (AWS KMS) encryption key that is used to encrypt backups
+in the backup vault and to control access to the backups in the backup vault. If you require different
+encryption keys or access policies for different groups of backups, you can optionally create multiple
+backup vaults.
+
+```ts
+const myKey = kms.Key.fromKeyArn(this, 'MyKey', 'aaa');
+const myTopic = sns.Topic.fromTopicArn(this, 'MyTopic', 'bbb');
+
+const vault = new backup.BackupVault(this, 'Vault', {
+  encryptionKey: myKey, // Custom encryption key
+  notificationTopic: myTopic, // Send all vault events to this SNS topic
+});
+```
+
+A vault has a default `RemovalPolicy` set to `RETAIN`. Note that removing a vault
+that contains recovery points will fail.
+
+You can assign policies to backup vaults and the resources they contain. Assigning policies allows
+you to do things like grant access to users to create backup plans and on-demand backups, but limit
+their ability to delete recovery points after they're created.
+
+Use the `accessPolicy` property to create a backup vault policy:
+
+```ts
+const vault = new backup.BackupVault(this, 'Vault', {
+  accessPolicy: new iam.PolicyDocument({
+    statements: [
+      new iam.PolicyStatement({
+        effect: iam.Effect.DENY,
+        principals: [new iam.AnyPrincipal()],
+        actions: ['backup:DeleteRecoveryPoint'],
+        resources: ['*'],
+        conditions: {
+          StringNotLike: {
+            'aws:userId': [
+              'user1',
+              'user2',
+            ],
+          },
+        },
+      }),
+    ],
+  }),
+})
+```
+
+Alternativately statements can be added to the vault policy using `addToAccessPolicy()`.
+
+Use the `blockRecoveryPointDeletion` property or the `blockRecoveryPointDeletion()` method to add
+a statement to the vault access policy that prevents recovery point deletions in your vault:
+
+```ts
+new backup.BackupVault(this, 'Vault', {
+  blockRecoveryPointDeletion: true,
+});
+
+declare const backupVault: backup.BackupVault;
+backupVault.blockRecoveryPointDeletion();
+```
+
+By default access is not restricted.
+
+Use the `lockConfiguration` property to enable [AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html):
+
+```ts
+new backup.BackupVault(this, 'Vault', {
+  lockConfiguration: {
+    minRetention: Duration.days(30),
+  },
+});
+```
+
+## Importing existing backup vault
+
+To import an existing backup vault into your CDK application, use the `BackupVault.fromBackupVaultArn` or `BackupVault.fromBackupVaultName`
+static method. Here is an example of giving an IAM Role permission to start a backup job:
+
+```ts
+const importedVault = backup.BackupVault.fromBackupVaultName(this, 'Vault', 'myVaultName');
+
+const role = new iam.Role(this, 'Access Role', { assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com') });
+
+importedVault.grant(role, 'backup:StartBackupJob');
+```