konokenj.cdk-api-mcp-server 0.31.0__py3-none-any.whl → 0.57.0__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2/integ.alb-target-group-attributes.ts

@@ -0,0 +1,45 @@
+import { ExpectedResult, IntegTest, Match } from '@aws-cdk/integ-tests-alpha';
+import { Stack, aws_ec2 as ec2, aws_elasticloadbalancingv2 as elbv2, App } from 'aws-cdk-lib';
+
+const app = new App();
+const stack = new Stack(app, 'alb-target-group-attributes');
+
+const vpc = new ec2.Vpc(stack, 'Stack');
+
+const targetGroup = new elbv2.ApplicationTargetGroup(stack, 'TargetGroup', {
+  vpc,
+  port: 80,
+  targetGroupHealth: {
+    dnsMinimumHealthyTargetCount: 3,
+    dnsMinimumHealthyTargetPercentage: 70,
+    routingMinimumHealthyTargetCount: 2,
+    routingMinimumHealthyTargetPercentage: 50,
+  },
+});
+
+const integTest = new IntegTest(app, 'alb-target-group-attributes-test', {
+  testCases: [stack],
+});
+
+integTest.assertions.awsApiCall('elbv2', 'describeTargetGroupAttributes', {
+  TargetGroupArn: targetGroup.targetGroupArn,
+}).expect(ExpectedResult.objectLike({
+  Attributes: Match.arrayWith([
+    {
+      Key: 'target_group_health.unhealthy_state_routing.minimum_healthy_targets.percentage',
+      Value: '50',
+    },
+    {
+      Key: 'target_group_health.dns_failover.minimum_healthy_targets.percentage',
+      Value: '70',
+    },
+    {
+      Key: 'target_group_health.unhealthy_state_routing.minimum_healthy_targets.count',
+      Value: '2',
+    },
+    {
+      Key: 'target_group_health.dns_failover.minimum_healthy_targets.count',
+      Value: '3',
+    },
+  ]),
+}));

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2/integ.alb.oidc.ts

@@ -186,7 +186,7 @@ const signinFunction = new lambda.Function(testCase, 'Signin', {
   functionName: 'cdk-integ-alb-oidc-signin-handler',
   code: lambda.Code.fromAsset('alb-oidc-signin-handler', { exclude: ['*.ts'] }),
   handler: 'index.handler',
-  runtime: lambda.Runtime.NODEJS_18_X,
+  runtime: lambda.Runtime.NODEJS_20_X,
   environment: {
     TEST_USERNAME: testUser.username,
     TEST_PASSWORD: testUser.password,

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2/integ.nlb-target-group-attributes.ts

@@ -0,0 +1,45 @@
+import { ExpectedResult, IntegTest, Match } from '@aws-cdk/integ-tests-alpha';
+import { Stack, aws_ec2 as ec2, aws_elasticloadbalancingv2 as elbv2, App } from 'aws-cdk-lib';
+
+const app = new App();
+const stack = new Stack(app, 'nlb-target-group-attributes');
+
+const vpc = new ec2.Vpc(stack, 'Stack');
+
+const targetGroup = new elbv2.NetworkTargetGroup(stack, 'TargetGroup', {
+  vpc,
+  port: 80,
+  targetGroupHealth: {
+    dnsMinimumHealthyTargetCount: 3,
+    dnsMinimumHealthyTargetPercentage: 70,
+    routingMinimumHealthyTargetCount: 2,
+    routingMinimumHealthyTargetPercentage: 50,
+  },
+});
+
+const integTest = new IntegTest(app, 'nlb-target-group-attributes-test', {
+  testCases: [stack],
+});
+
+integTest.assertions.awsApiCall('elbv2', 'describeTargetGroupAttributes', {
+  TargetGroupArn: targetGroup.targetGroupArn,
+}).expect(ExpectedResult.objectLike({
+  Attributes: Match.arrayWith([
+    {
+      Key: 'target_group_health.unhealthy_state_routing.minimum_healthy_targets.count',
+      Value: '2',
+    },
+    {
+      Key: 'target_group_health.unhealthy_state_routing.minimum_healthy_targets.percentage',
+      Value: '50',
+    },
+    {
+      Key: 'target_group_health.dns_failover.minimum_healthy_targets.count',
+      Value: '3',
+    },
+    {
+      Key: 'target_group_health.dns_failover.minimum_healthy_targets.percentage',
+      Value: '70',
+    },
+  ]),
+}));

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2/integ.nlb.security-group.ts

@@ -0,0 +1,70 @@
+import { ExpectedResult, IntegTest, Match } from '@aws-cdk/integ-tests-alpha';
+import { Stack, aws_ec2 as ec2, aws_elasticloadbalancingv2 as elbv2, App } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+
+class TestStack extends Stack {
+  public readonly lbWithSg: elbv2.NetworkLoadBalancer;
+  public readonly lbWithSg2: elbv2.NetworkLoadBalancer;
+  public readonly lbWithoutSg: elbv2.NetworkLoadBalancer;
+
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const vpc = new ec2.Vpc(this, 'Stack', {
+      maxAzs: 1,
+      natGateways: 0,
+    });
+
+    this.lbWithSg = new elbv2.NetworkLoadBalancer(this, 'NlbWithSecurityGroup', {
+      vpc,
+    });
+    this.lbWithSg2 = new elbv2.NetworkLoadBalancer(this, 'NlbWithSecurityGroup2', {
+      vpc,
+      securityGroups: [new ec2.SecurityGroup(this, 'SecurityGroup', {
+        vpc,
+        allowAllOutbound: true,
+      })],
+    });
+    this.lbWithSg.connections.allowTo(this.lbWithSg2, ec2.Port.tcp(1229));
+    this.lbWithoutSg = new elbv2.NetworkLoadBalancer(this, 'NlbWithoutSecurityGroup', {
+      vpc,
+      disableSecurityGroups: true,
+    });
+  }
+}
+
+const app = new App({
+  postCliContext: {
+    '@aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault': true,
+  },
+});
+const stack = new TestStack(app, 'NlbSecurityGroupStack');
+const integ = new IntegTest(app, 'NlbSecurityGroupInteg', {
+  testCases: [stack],
+});
+integ.assertions.awsApiCall('elastic-load-balancing-v2', 'describeLoadBalancers', {
+  LoadBalancerArns: [
+    stack.lbWithSg.loadBalancerArn,
+    stack.lbWithSg2.loadBalancerArn,
+    stack.lbWithoutSg.loadBalancerArn,
+  ],
+}).expect(ExpectedResult.objectLike({
+  LoadBalancers: [
+    Match.objectLike({
+      LoadBalancerArn: stack.lbWithSg.loadBalancerArn,
+      SecurityGroups: Match.arrayWith([
+        Match.stringLikeRegexp('sg-[0-9a-f]{8,17}'),
+      ]),
+    }),
+    Match.objectLike({
+      LoadBalancerArn: stack.lbWithSg2.loadBalancerArn,
+      SecurityGroups: Match.arrayWith([
+        Match.stringLikeRegexp('sg-[0-9a-f]{8,17}'),
+      ]),
+    }),
+    Match.objectLike({
+      LoadBalancerArn: stack.lbWithoutSg.loadBalancerArn,
+      SecurityGroups: undefined,
+    }),
+  ],
+}));

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2-actions/integ.cognito.ts

@@ -206,7 +206,7 @@ const signinFunction = new lambda.Function(testCase, 'Signin', {
   functionName: 'cdk-integ-alb-cognito-signin-handler',
   code: lambda.Code.fromAsset('alb-cognito-signin-handler', { exclude: ['*.ts'] }),
   handler: 'index.handler',
-  runtime: lambda.Runtime.NODEJS_18_X,
+  runtime: lambda.Runtime.NODEJS_20_X,
   environment: {
     TEST_USERNAME: testUser.username,
     TEST_PASSWORD: testUser.password,

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-events/README.md

@@ -332,6 +332,45 @@ new events.EventBus(this, 'Bus', {
 });
 ```
 
-**Note**: Archives and schema discovery are not supported for event buses encrypted using a customer managed key.
-To enable archives or schema discovery on an event bus, choose to use an AWS owned key.
+To use a customer managed key for an archive, use the `kmsKey` attribute. 
+
+Note: When you attach a customer managed key to either an EventBus or an Archive, a policy that allows EventBridge to interact with your resource will be added. 
+
+```ts
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { Archive, EventBus } from 'aws-cdk-lib/aws-events';
+
+const stack = new Stack();
+
+declare const kmsKey: kms.IKey;
+
+const eventBus = new EventBus(stack, 'Bus');
+
+const archive = new Archive(stack, 'Archive', {
+  kmsKey: kmsKey,
+  sourceEventBus: eventBus,
+  eventPattern: {
+    source: ['aws.ec2']
+  },
+});
+```
+
+To enable archives or schema discovery on an event bus, customers has the choice of using either an AWS owned key or a customer managed key.
 For more information, see [KMS key options for event bus encryption](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-encryption-at-rest-key-options.html).
+
+## Configuring logging
+
+To configure logging for an Event Bus, leverage the LogConfig property. It allows different level of logging (NONE, INFO, TRACE, ERROR) and wether to include details or not.
+
+```ts
+import { EventBus, IncludeDetail, Level } from 'aws-cdk-lib/aws-events';
+
+const bus =  new EventBus(this, 'Bus', {
+      logConfig: {
+        includeDetail: IncludeDetail.FULL,
+        level: Level.TRACE,
+      },
+    });
+```
+
+See more [Specifying event bus log level](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus-logs.html#eb-event-bus-logs-level)

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-events/integ.api-destination.ts

@@ -0,0 +1,42 @@
+import { App, CfnOutput, SecretValue, Stack } from 'aws-cdk-lib';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import * as events from 'aws-cdk-lib/aws-events';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+
+const app = new App();
+
+const stack = new Stack(app, 'events-api-destination-stack');
+
+const secret = new secretsmanager.Secret(stack, 'Secret', {
+  secretStringValue: SecretValue.unsafePlainText('abc123'),
+});
+
+const connection = new events.Connection(stack, 'Connection', {
+  authorization: events.Authorization.apiKey('x-api-key', secret.secretValue),
+  description: 'Connection with API Key x-api-key',
+  connectionName: 'MyConnection',
+});
+
+const destination = new events.ApiDestination(stack, 'Destination', {
+  connection,
+  endpoint: 'https://httpbin.org/headers',
+  httpMethod: events.HttpMethod.GET,
+  apiDestinationName: 'MyDestination',
+  rateLimitPerSecond: 1,
+  description: 'Calling example.com with API key x-api-key',
+});
+
+// arn:aws:events:{region}:{account}:api-destination/{destination-name}/11111111-1111-1111-1111-111111111111
+new CfnOutput(stack, 'DestinationArn', {
+  value: destination.apiDestinationArn,
+  description: 'The ARN of the API destination',
+});
+// arn:aws:events:{region}:{account}:api-destination/{destination-name}
+new CfnOutput(stack, 'DestinationArnForPolicy', {
+  value: destination.apiDestinationArnForPolicy || '',
+  description: 'The ARN of the API destination in resource format',
+});
+
+new IntegTest(app, 'events-api-destination-integ', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-events/integ.archive-customer-managed-key.ts

@@ -0,0 +1,23 @@
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { App, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import { Archive, EventBus } from 'aws-cdk-lib/aws-events';
+
+const app = new App();
+const stack = new Stack(app, 'archive-customer-managed-key');
+
+const kmsKey = new kms.Key(stack, 'KmsKey', {
+  removalPolicy: RemovalPolicy.DESTROY,
+});
+
+new Archive(stack, 'Archive', {
+  kmsKey: kmsKey,
+  sourceEventBus: EventBus.fromEventBusName(stack, 'DefaultEventBus', 'default'),
+  eventPattern: {
+    source: ['test'],
+  },
+});
+
+new IntegTest(app, 'archive-customer-managed-key-test', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-events/integ.eventbus.ts

@@ -2,21 +2,31 @@ import * as iam from 'aws-cdk-lib/aws-iam';
 import * as sqs from 'aws-cdk-lib/aws-sqs';
 import { App, Stack } from 'aws-cdk-lib';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
-import { EventBus } from 'aws-cdk-lib/aws-events';
+import { EventBus, IncludeDetail, Level } from 'aws-cdk-lib/aws-events';
 
 const app = new App();
 const stack = new Stack(app, 'Stack');
 
 const dlq = new sqs.Queue(stack, 'DLQ');
 
+const eventBusRole = new iam.Role(stack, 'EventBusRole', {
+  assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+  description: 'Role for accessing EventBus',
+  roleName: 'EventBusAccessRole',
+});
+
 const bus = new EventBus(stack, 'Bus', {
   deadLetterQueue: dlq,
   description: 'myEventBus',
+  logConfig: {
+    includeDetail: IncludeDetail.FULL,
+    level: Level.ERROR,
+  },
 });
 
 bus.addToResourcePolicy(new iam.PolicyStatement({
   effect: iam.Effect.ALLOW,
-  principals: [new iam.AccountPrincipal(stack.account)],
+  principals: [eventBusRole],
   actions: ['events:PutEvents'],
   sid: 'Statement1',
   resources: [bus.eventBusArn],
@@ -24,7 +34,7 @@ bus.addToResourcePolicy(new iam.PolicyStatement({
 
 bus.addToResourcePolicy(new iam.PolicyStatement({
   effect: iam.Effect.ALLOW,
-  principals: [new iam.AccountPrincipal(stack.account)],
+  principals: [eventBusRole],
   actions: ['events:PutRule'],
   sid: 'Statement2',
   resources: [bus.eventBusArn],

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-events-targets/README.md

@@ -15,9 +15,11 @@ Currently supported are:
   - [Start a StepFunctions state machine](#start-a-stepfunctions-state-machine)
   - [Queue a Batch job](#queue-a-batch-job)
   - [Invoke an API Gateway REST API](#invoke-an-api-gateway-rest-api)
+  - [Invoke an AWS API](#invoke-an-aws-api)
   - [Invoke an API Destination](#invoke-an-api-destination)
   - [Invoke an AppSync GraphQL API](#invoke-an-appsync-graphql-api)
   - [Put an event on an EventBridge bus](#put-an-event-on-an-eventbridge-bus)
+  - [Put an event on a Firehose delivery stream](#put-an-event-on-a-firehose-delivery-stream)
   - [Run an ECS Task](#run-an-ecs-task)
     - [Tagging Tasks](#tagging-tasks)
     - [Launch type for ECS Task](#launch-type-for-ecs-task)
@@ -333,6 +335,67 @@ declare const rule: events.Rule;
 rule.addTarget(new targets.ApiGatewayV2(httpApi));
 ```
 
+## Invoke an AWS API
+
+Use the `AwsApi` target to make direct AWS API calls from EventBridge rules. This is useful for invoking AWS services that don't have a dedicated EventBridge target.
+
+### Basic Usage
+
+The following example shows how to update an ECS service when a rule is triggered:
+
+```ts
+const rule = new events.Rule(this, 'Rule', {
+  schedule: events.Schedule.rate(Duration.hours(1)),
+});
+
+rule.addTarget(new targets.AwsApi({
+  service: 'ECS',
+  action: 'updateService',
+  parameters: {
+    service: 'my-service',
+    forceNewDeployment: true,
+  },
+}));
+```
+
+### IAM Permissions
+
+By default, the AwsApi target automatically creates the necessary IAM permissions based on the service and action you specify. The permission format follows the pattern: `service:Action`.
+
+For example:
+
+- `ECS` service with `updateService` action → `ecs:UpdateService` permission
+- `RDS` service with `createDBSnapshot` action → `rds:CreateDBSnapshot` permission
+
+### Custom IAM Policy
+
+In some cases, you may need to provide a custom IAM policy statement, especially when:
+
+- You need to restrict permissions to specific resources (instead of `*`)
+- The service requires additional permissions beyond the main action
+- You want more granular control over the permissions
+
+```ts
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+
+declare const rule: events.Rule;
+declare const bucket: s3.Bucket;
+
+rule.addTarget(new targets.AwsApi({
+  service: 's3',
+  action: 'GetBucketEncryption',
+  parameters: {
+    Bucket: bucket.bucketName,
+  },
+  policyStatement: new iam.PolicyStatement({
+    effect: iam.Effect.ALLOW,
+    actions: ['s3:GetEncryptionConfiguration'],
+    resources: [bucket.bucketArn],
+  }),
+}));
+```
+
 ## Invoke an API Destination
 
 Use the `targets.ApiDestination` target to trigger an external API. You need to
@@ -369,11 +432,16 @@ const connection = events.Connection.fromEventBusArn(
   'arn:aws:secretsmanager:us-east-1:123456789012:secret:SecretName-f3gDy9',
 );
 
-const apiDestinationArn = 'arn:aws:events:us-east-1:123456789012:api-destination/DestinationName';
+const apiDestinationArn = 'arn:aws:events:us-east-1:123456789012:api-destination/DestinationName/11111111-1111-1111-1111-111111111111';
+const apiDestinationArnForPolicy = 'arn:aws:events:us-east-1:123456789012:api-destination/DestinationName';
 const destination = events.ApiDestination.fromApiDestinationAttributes(
   this,
   'Destination',
-  { apiDestinationArn, connection },
+  {
+    apiDestinationArn,
+    connection,
+    apiDestinationArnForPolicy // optional
+  },
 );
 
 const rule = new events.Rule(this, 'OtherRule', {
@@ -461,6 +529,27 @@ rule.addTarget(new targets.EventBus(
 ));
 ```
 
+## Put an event on a Firehose delivery stream
+
+Use the `FirehoseDeliveryStream` target to put event to an Amazon Data Firehose delivery stream.
+
+The code snippet below creates the scheduled event rule that put events to an Amazon Data Firehose delivery stream.
+
+```ts
+import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+
+declare const bucket: s3.Bucket;
+const stream = new firehose.DeliveryStream(this, 'DeliveryStream', {
+  destination: new firehose.S3Bucket(bucket),
+});
+
+const rule = new events.Rule(this, 'Rule', {
+  schedule: events.Schedule.expression('rate(1 minute)'),
+});
+rule.addTarget(new targets.FirehoseDeliveryStream(stream));
+```
+
 ## Run an ECS Task
 
 Use the `EcsTask` target to run an ECS Task.
@@ -631,7 +720,7 @@ rule.addTarget(new targets.RedshiftQuery(workgroup.attrWorkgroupWorkgroupArn, {
 
 ## Publish to an SNS Topic
 
-Use the `SnsTopic` target to publish to an SNS Topic. 
+Use the `SnsTopic` target to publish to an SNS Topic.
 
 The code snippet below creates the scheduled event rule that publishes to an SNS Topic using a resource policy.
 
@@ -659,4 +748,4 @@ const rule = new events.Rule(this, 'Rule', {
 });
 
 rule.addTarget(new targets.SnsTopic(topic, { authorizeUsingRole: true }));
-```
+```

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-events-targets/integ.firehose-delivery-stream.ts

@@ -0,0 +1,51 @@
+import * as events from 'aws-cdk-lib/aws-events';
+import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as cdk from 'aws-cdk-lib';
+import * as targets from 'aws-cdk-lib/aws-events-targets';
+import { IntegTest, ExpectedResult, AwsApiCall } from '@aws-cdk/integ-tests-alpha';
+
+// ---------------------------------
+// Define a rule that triggers a put to a Firehose delivery stream every 1min.
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'aws-cdk-firehose-event-target');
+
+const bucket = new s3.Bucket(stack, 'firehose-bucket', {
+  autoDeleteObjects: true,
+  removalPolicy: cdk.RemovalPolicy.DESTROY,
+});
+const deliveryStream = new firehose.DeliveryStream(stack, 'MyDeliveryStream', {
+  destination: new firehose.S3Bucket(bucket, {
+    bufferingInterval: cdk.Duration.seconds(30),
+  }),
+});
+
+const event = new events.Rule(stack, 'EveryMinute', {
+  schedule: events.Schedule.rate(cdk.Duration.minutes(1)),
+});
+
+event.addTarget(new targets.FirehoseDeliveryStream(deliveryStream));
+
+const testCase = new IntegTest(app, 'firehose-event-target-integ', {
+  testCases: [stack],
+});
+
+const s3ApiCall = testCase.assertions.awsApiCall('S3', 'listObjectsV2', {
+  Bucket: bucket.bucketName,
+  MaxKeys: 1,
+}).expect(ExpectedResult.objectLike({
+  KeyCount: 1,
+})).waitForAssertions({
+  interval: cdk.Duration.seconds(30),
+  totalTimeout: cdk.Duration.minutes(10),
+});
+
+if (s3ApiCall instanceof AwsApiCall) {
+  s3ApiCall.waiterProvider?.addToRolePolicy({
+    Effect: 'Allow',
+    Action: ['s3:GetObject', 's3:ListBucket'],
+    Resource: ['*'],
+  });
+}

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-iam/integ.custom-permissions-boundary-aspect.ts

@@ -0,0 +1,50 @@
+/**
+ * This integration test tests the case of a customer setting a permissions boundary using a custom aspect,
+ * then trying to override at a more specific level using the PermissionsBoundary.of() API.
+ *
+ * Overriding should work.
+ */
+import { App, Stack, IAspect, Aspects } from 'aws-cdk-lib';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import { CfnRole, ManagedPolicy, PermissionsBoundary, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { IConstruct } from 'constructs';
+
+class CustomAspect implements IAspect {
+  public visit(node: IConstruct): void {
+    if (node instanceof CfnRole) {
+      node.addPropertyOverride('PermissionsBoundary', 'arn:aws:iam::aws:policy/ReadOnlyAccess');
+    }
+  }
+}
+
+const app = new App({
+  postCliContext: {
+    // Force the intended behavior, from before we found this bug
+    '@aws-cdk/core:aspectPrioritiesMutating': false,
+  },
+});
+
+const stack = new Stack(app, 'integ-permissions-boundary', {
+  env: {
+    account: process.env.CDK_INTEG_ACCOUNT ?? process.env.CDK_DEFAULT_ACCOUNT,
+    region: process.env.CDK_INTEG_REGION ?? process.env.CDK_DEFAULT_REGION,
+  },
+});
+
+Aspects.of(stack).add(new CustomAspect());
+
+new Role(stack, 'NormalRole', {
+  assumedBy: new ServicePrincipal('sqs.amazonaws.com'),
+});
+
+const powerRole = new Role(stack, 'PowerRole', {
+  assumedBy: new ServicePrincipal('sqs.amazonaws.com'),
+});
+
+PermissionsBoundary.of(powerRole).apply(ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'));
+
+new IntegTest(app, 'integ-test', {
+  testCases: [stack],
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-iam/integ.managed-policy.ts

@@ -1,6 +1,7 @@
 import { App, Stack } from 'aws-cdk-lib';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 import { AccountRootPrincipal, Grant, ManagedPolicy, PolicyStatement, Role, User } from 'aws-cdk-lib/aws-iam';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
 
 const app = new App();
 
@@ -34,6 +35,14 @@ policy.attachToRole(role);
 const importedRole = Role.fromRoleArn(stack, 'ImportedRole', role.roleArn);
 policy.attachToRole(importedRole);
 
+// Can be passed to grantInvoke, see https://github.com/aws/aws-cdk/issues/32980
+const func = new lambda.Function(stack, 'Function', {
+  runtime: lambda.Runtime.NODEJS_LATEST,
+  handler: 'index.handler',
+  code: lambda.Code.fromInline('export const handler = async () => null'),
+});
+func.grantInvoke(policy);
+
 new IntegTest(app, 'ManagedPolicyInteg', {
   testCases: [stack],
 });

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-iam/integ.policy.ts

@@ -1,6 +1,7 @@
 import { App, Stack } from 'aws-cdk-lib';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 import { AccountRootPrincipal, Grant, Policy, PolicyStatement, Role, User } from 'aws-cdk-lib/aws-iam';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
 
 const app = new App();
 
@@ -21,6 +22,14 @@ role.grantAssumeRole(user);
 
 Grant.addToPrincipal({ actions: ['iam:*'], resourceArns: [role.roleArn], grantee: policy2 });
 
+// Can be passed to grantInvoke, see https://github.com/aws/aws-cdk/issues/32980
+const func = new lambda.Function(stack, 'Function', {
+  runtime: lambda.Runtime.NODEJS_LATEST,
+  handler: 'index.handler',
+  code: lambda.Code.fromInline('export const handler = async () => null'),
+});
+func.grantInvoke(policy);
+
 new IntegTest(app, 'PolicyInteg', {
   testCases: [stack],
 });