konokenj.cdk-api-mcp-server 0.31.0__py3-none-any.whl → 0.57.0__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-route53/integ.route53.ts

@@ -1,6 +1,6 @@
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as cdk from 'aws-cdk-lib';
-import { ARecord, CaaAmazonRecord, CnameRecord, Continent, GeoLocation, PrivateHostedZone, PublicHostedZone, RecordTarget, TxtRecord } from 'aws-cdk-lib/aws-route53';
+import { Alpn, ARecord, CaaAmazonRecord, CnameRecord, Continent, GeoLocation, HttpsRecord, HttpsRecordValue, PrivateHostedZone, PublicHostedZone, RecordTarget, SvcbRecord, SvcbRecordValue, TxtRecord } from 'aws-cdk-lib/aws-route53';
 
 const app = new cdk.App();
 
@@ -92,6 +92,56 @@ new TxtRecord(stack, 'TXT', {
   ],
 });
 
+new SvcbRecord(stack, 'SVCB-AliasMode', {
+  zone: publicZone,
+  recordName: '_8080._svcb-alias',
+  values: [SvcbRecordValue.alias('service.example.com')],
+});
+new SvcbRecord(stack, 'SVCB-ServiceMode', {
+  zone: publicZone,
+  recordName: '_8080._svcb-service',
+  values: [SvcbRecordValue.service({ alpn: [Alpn.H3, Alpn.H2] })],
+});
+new SvcbRecord(stack, 'SVCB-ServiceMode-FullParams', {
+  zone: publicZone,
+  recordName: '_8080._svcb-service-fullparams',
+  values: [SvcbRecordValue.service({
+    priority: 2,
+    targetName: 'service.example.com',
+    mandatory: ['alpn'],
+    alpn: [Alpn.H3, Alpn.H2, Alpn.HTTP1_1, Alpn.of('h3-29')],
+    noDefaultAlpn: true,
+    port: 8443,
+    ipv4hint: ['127.0.0.1'],
+    ipv6hint: ['::1'],
+  })],
+});
+
+new HttpsRecord(stack, 'HTTPS-AliasMode', {
+  zone: publicZone,
+  recordName: 'https-alias',
+  values: [HttpsRecordValue.alias('service.example.com')],
+});
+new HttpsRecord(stack, 'HTTPS-ServiceMode', {
+  zone: publicZone,
+  recordName: 'https-service',
+  values: [HttpsRecordValue.service({ alpn: [Alpn.H3, Alpn.H2] })],
+});
+new HttpsRecord(stack, 'HTTPS-ServiceMode-FullParams', {
+  zone: publicZone,
+  recordName: 'https-service-fullparams',
+  values: [HttpsRecordValue.service({
+    priority: 2,
+    targetName: 'service.example.com',
+    mandatory: ['alpn'],
+    alpn: [Alpn.H3, Alpn.H2, Alpn.HTTP1_1, Alpn.of('h3-29')],
+    noDefaultAlpn: true,
+    port: 8443,
+    ipv4hint: ['127.0.0.1'],
+    ipv6hint: ['::1'],
+  })],
+});
+
 new cdk.CfnOutput(stack, 'PrivateZoneId', { value: privateZone.hostedZoneId });
 new cdk.CfnOutput(stack, 'PublicZoneId', { value: publicZone.hostedZoneId });
 

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-route53/integ.zone-delegation-iam-stack.ts

@@ -0,0 +1,66 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as cdk from 'aws-cdk-lib';
+import * as route53 from 'aws-cdk-lib/aws-route53';
+import { Construct } from 'constructs';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+
+class ZoneDelegationIamStack extends cdk.Stack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const parentZone = new route53.PublicHostedZone(this, 'ParentZone', {
+      zoneName: 'uniqueexample.com',
+    });
+
+    const trusteeRoleArns = this.formatArn({
+      service: 'iam',
+      region: '',
+      resource: 'role',
+      resourceName: 'ZoneDelegationStack-*',
+    });
+
+    const delegationRole = new iam.Role(this, 'ZoneDelegationRole', {
+      roleName: 'ExampleDelegationRole',
+      assumedBy: new iam.AccountRootPrincipal().withConditions({
+        ArnLike: {
+          'aws:PrincipalArn': trusteeRoleArns,
+        },
+      }),
+    });
+
+    const delegationGrant = parentZone.grantDelegation(delegationRole, {
+      delegatedZoneNames: [
+        'sub1.uniqueexample.com',
+        'sub2_*$.uniqueexample.com', // should result in octal codes in iam condition
+      ],
+    });
+
+    const subZone = new route53.PublicHostedZone(this, 'SubZone', {
+      zoneName: 'sub1.uniqueexample.com',
+    });
+
+    new route53.CrossAccountZoneDelegationRecord(subZone, 'ZoneDelegation', {
+      delegatedZone: subZone,
+      parentHostedZoneName: parentZone.zoneName,
+      delegationRole: delegationRole,
+    }).node.addDependency(delegationGrant);
+
+    const subZoneWithSpecialChars = new route53.PublicHostedZone(this, 'SubZoneSpecialChars', {
+      zoneName: 'sub2_*$.uniqueexample.com',
+    });
+
+    new route53.CrossAccountZoneDelegationRecord(subZoneWithSpecialChars, 'ZoneDelegation', {
+      delegatedZone: subZoneWithSpecialChars,
+      parentHostedZoneName: parentZone.zoneName,
+      delegationRole: delegationRole,
+    }).node.addDependency(delegationGrant);
+  }
+}
+
+const app = new cdk.App();
+
+const stack = new ZoneDelegationIamStack(app, 'ZoneDelegationStack');
+
+new IntegTest(app, 'ZoneDelegationIam', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-route53-targets/integ.cloudfront-alias-target.ts

@@ -3,6 +3,7 @@ import * as route53 from 'aws-cdk-lib/aws-route53';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as cdk from 'aws-cdk-lib';
 import * as targets from 'aws-cdk-lib/aws-route53-targets';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 
 const app = new cdk.App();
 
@@ -31,4 +32,18 @@ new route53.ARecord(zone, 'Alias', {
   target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(distribution)),
 });
 
-app.synth();
+new route53.AaaaRecord(zone, 'AaaaAlias', {
+  zone,
+  recordName: '_foo',
+  target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(distribution)),
+});
+
+new route53.HttpsRecord(zone, 'HttpsAlias', {
+  zone,
+  recordName: '_foo',
+  target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(distribution)),
+});
+
+new IntegTest(app, 'aws-cdk-route53-cloudfront-alias-integ-test', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-route53-targets/integ.elastic-beanstalk-hostedzoneid.ts

@@ -6,7 +6,7 @@ import * as targets from 'aws-cdk-lib/aws-route53-targets';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 import * as elasticbeanstalk from 'aws-cdk-lib/aws-elasticbeanstalk';
 import * as custom from 'aws-cdk-lib/custom-resources';
-import { RegionInfo } from 'aws-cdk-lib/region-info';
+import { RegionInfo } from '@aws-cdk/region-info';
 
 const app = new App({
   postCliContext: {

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3/integ.bucket.notifications-scoped-permissions.ts

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import * as cdk from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as s3n from 'aws-cdk-lib/aws-s3-notifications';
+import { Match, Template } from 'aws-cdk-lib/assertions';
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'aws-cdk-s3-notifications-scoped-permissions');
+
+// Create multiple buckets to test consolidated policy with scoped permissions
+const bucket1 = new s3.Bucket(stack, 'Bucket1', {
+  removalPolicy: cdk.RemovalPolicy.DESTROY,
+});
+
+const bucket2 = new s3.Bucket(stack, 'Bucket2', {
+  removalPolicy: cdk.RemovalPolicy.DESTROY,
+});
+
+const topic = new sns.Topic(stack, 'Topic');
+const queue = new sqs.Queue(stack, 'Queue', {
+  removalPolicy: cdk.RemovalPolicy.DESTROY,
+});
+
+// Add notifications to multiple buckets with different event types - this should create scoped IAM permissions
+bucket1.addEventNotification(s3.EventType.OBJECT_CREATED_PUT, new s3n.SnsDestination(topic));
+bucket1.addEventNotification(s3.EventType.OBJECT_CREATED_POST, new s3n.SqsDestination(queue));
+bucket2.addEventNotification(s3.EventType.OBJECT_REMOVED_DELETE, new s3n.SnsDestination(topic));
+bucket2.addEventNotification(s3.EventType.OBJECT_REMOVED_DELETE_MARKER_CREATED, new s3n.SnsDestination(topic));
+
+// Create integration test with snapshot comparison enabled
+new integ.IntegTest(app, 'ScopedPermissionsTest', {
+  testCases: [stack],
+  diffAssets: true,
+});
+
+// Add assertions to verify IAM policies are scoped to specific bucket ARNs
+const template = Template.fromStack(stack);
+
+// Verify that IAM policies do not contain wildcard permissions
+template.hasResourceProperties('AWS::IAM::Policy', {
+  PolicyDocument: {
+    Statement: Match.arrayWith([
+      Match.objectLike({
+        Effect: 'Allow',
+        Action: 's3:PutBucketNotification',
+        Resource: Match.not('*'), // Ensure no wildcard permissions
+      }),
+    ]),
+  },
+});
+
+// Verify that the IAM policy contains specific bucket ARNs
+template.hasResourceProperties('AWS::IAM::Policy', {
+  PolicyDocument: {
+    Statement: Match.arrayWith([
+      Match.objectLike({
+        Effect: 'Allow',
+        Action: 's3:PutBucketNotification',
+        Resource: Match.arrayWith([
+          Match.objectLike({
+            'Fn::GetAtt': Match.arrayWith([Match.stringLikeRegexp('Bucket[12]'), 'Arn']),
+          }),
+        ]),
+      }),
+    ]),
+  },
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-assets/integ.assets.bundling.docker-opts.ts

@@ -9,7 +9,10 @@ const stack = new Stack(app, 'cdk-integ-assets-bundling-docker-opts');
 new assets.Asset(stack, 'BundledAsset', {
   path: path.join(__dirname, 'markdown-asset'), // /asset-input and working directory in the container
   bundling: {
-    image: DockerImage.fromBuild(path.join(__dirname, 'alpine-markdown')), // Build an image
+    // Build an image
+    image: DockerImage.fromBuild(path.join(__dirname, 'alpine-markdown'), {
+      platform: 'linux/amd64',
+    }),
     command: [
       'sh', '-c', `
         markdown index.md > /asset-output/index.html

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/README.md

@@ -1,6 +1,5 @@
 # AWS S3 Deployment Construct Library
 
-
 This library allows populating an S3 bucket with the contents of .zip files
 from other S3 buckets or from local disk.
 
@@ -83,7 +82,7 @@ User: *** is not authorized to perform: kms:Decrypt on the resource associated w
 because no identity-based policy allows the kms:Decrypt action
 ```
 
-When this happens, users can use the public `handlerRole` property of `BucketDeployment` to manually 
+When this happens, users can use the public `handlerRole` property of `BucketDeployment` to manually
 add the KMS permissions:
 
 ```ts
@@ -325,6 +324,24 @@ new s3deploy.BucketDeployment(this, 'DeployWithInvalidation', {
 });
 ```
 
+By default, the deployment will wait for invalidation to succeed to complete. This will poll Cloudfront for a maximum of 13 minutes to check for a successful invalidation. The drawback to this is that the deployment will fail if invalidation fails or if it takes longer than 13 minutes. As a workaround, there is the option `waitForDistributionInvalidation`, which can be set to false to skip waiting for the invalidation, but this can be risky as invalidation errors will not be reported.
+
+```ts
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
+
+declare const bucket: s3.IBucket;
+declare const distribution: cloudfront.IDistribution;
+
+new s3deploy.BucketDeployment(this, 'DeployWithInvalidation', {
+  sources: [s3deploy.Source.asset('./website-dist')],
+  destinationBucket: bucket,
+  distribution,
+  distributionPaths: ['/images/*.png'],
+  // Invalidate cache but don't wait or verify that invalidation has completed successfully.
+  waitForDistributionInvalidation: false
+});
+```
+
 ## Signed Content Payloads
 
 By default, deployment uses streaming uploads which set the `x-amz-content-sha256`
@@ -357,6 +374,7 @@ resource handler.
 > of memory and storage size.
 
 ## JSON-Aware Source Processing
+
 When using `Source.jsonData` with CDK Tokens (references to construct properties), you may need to enable the escaping option. This is particularly important when the referenced properties might contain special characters that require proper JSON escaping (like double quotes, line breaks, etc.).
 
 ```ts
@@ -444,7 +462,7 @@ to make from placeholders in a local file which will be resolved during deployme
 is especially useful in situations like creating an API from a spec file, where users might
 want to reference other CDK resources they have created.
 
-The syntax for template variables is `{{ variableName }}` in your local file. Then, you would 
+The syntax for template variables is `{{ variableName }}` in your local file. Then, you would
 specify the substitutions in CDK like this:
 
 ```ts
@@ -468,7 +486,7 @@ new s3deploy.DeployTimeSubstitutedFile(this, 'MyFile', {
 ```
 
 Nested variables, like `{{ {{ foo }} }}` or `{{ foo {{ bar }} }}`, are not supported by this
-construct. In the first case of a single variable being is double nested `{{ {{ foo }} }}`, only 
+construct. In the first case of a single variable being is double nested `{{ {{ foo }} }}`, only
 the `{{ foo }}` would be replaced by the substitution, and the extra brackets would remain in the file.
 In the second case of two nexted variables `{{ foo {{ bar }} }}`, only the `{{ bar }}` would be replaced
 in the file.
@@ -515,6 +533,67 @@ new cdk.CfnOutput(this, 'ObjectKey', {
 });
 ```
 
+## Specifying a Custom VPC, Subnets, and Security Groups in BucketDeployment
+
+By default, the AWS CDK BucketDeployment construct runs in a publicly accessible environment. However, for enhanced security and compliance, you may need to deploy your assets from within a VPC while restricting network access through custom subnets and security groups.
+
+### Using a Custom VPC
+
+To deploy assets within a private network, specify the vpc property in BucketDeploymentProps. This ensures that the deployment Lambda function executes within your specified VPC.
+
+```ts
+const vpc = ec2.Vpc.fromLookup(this, 'ExistingVPC', { vpcId: 'vpc-12345678' });
+const bucket = new s3.Bucket(this, 'MyBucket');
+
+new s3deploy.BucketDeployment(this, 'DeployToS3', {
+    destinationBucket: bucket,
+    vpc: vpc, 
+    sources: [s3deploy.Source.asset('./website')],
+});
+```
+
+### Specifying Subnets for Deployment
+
+By default, when you specify a VPC, the BucketDeployment function is deployed in the private subnets of that VPC.
+However, you can customize the subnet selection using the vpcSubnets property.
+
+```ts
+const vpc = ec2.Vpc.fromLookup(this, 'ExistingVPC', { vpcId: 'vpc-12345678' });
+const bucket = new s3.Bucket(this, 'MyBucket');
+
+new s3deploy.BucketDeployment(this, 'DeployToS3', {
+    destinationBucket: bucket,
+    vpc: vpc,
+    vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
+    sources: [s3deploy.Source.asset('./website')],
+});
+```
+
+### Defining Custom Security Groups
+
+For enhanced network security, you can now specify custom security groups in BucketDeploymentProps.
+This allows fine-grained control over ingress and egress rules for the deployment Lambda function.
+
+```ts
+const vpc = ec2.Vpc.fromLookup(this, 'ExistingVPC', { vpcId: 'vpc-12345678' });
+const bucket = new s3.Bucket(this, 'MyBucket');
+
+const securityGroup = new ec2.SecurityGroup(this, 'CustomSG', {
+    vpc: vpc,
+    description: 'Allow HTTPS outbound access',
+    allowAllOutbound: false,
+});
+
+securityGroup.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS traffic');
+
+new s3deploy.BucketDeployment(this, 'DeployWithSecurityGroup', {
+    destinationBucket: bucket,
+    vpc: vpc,
+    securityGroups: [securityGroup],
+    sources: [s3deploy.Source.asset('./website')],
+});
+```
+
 ## Notes
 
 - This library uses an AWS CloudFormation custom resource which is about 10MiB in

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/integ.bucket-deployment-big-response.ts

@@ -11,6 +11,12 @@ import { ExpectedResult } from '@aws-cdk/integ-tests-alpha';
 
 const numFiles = 50;
 
+/**
+ * Integration test for bucket deployment with many sources (big response):
+ * - Tests deployment with 50 source files to validate response size handling
+ * - Uses increased memory limit (2048MB) for large deployments
+ * - Validates that objectKeys output is disabled when outputObjectKeys is false
+ */
 class TestBucketDeployment extends cdk.Stack {
   public readonly destinationBucket: s3.IBucket;
   constructor(scope: Construct, id: string, props?: cdk.StackProps) {
@@ -21,9 +27,14 @@ class TestBucketDeployment extends cdk.Stack {
       autoDeleteObjects: true, // needed for integration test cleanup
     });
 
+    // Create multiple source files to test big response handling
     const sources = [];
     for (let i = 0; i < numFiles; i++) {
       const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tmpcdk'));
+      process.on('exit', () => {
+        fs.rmSync(tempDir, { force: true, recursive: true });
+      });
+
       fs.mkdirSync(tempDir, { recursive: true });
       const fileName = `${i+1}.txt`;
       const filePath = path.join(tempDir, fileName);
@@ -31,17 +42,17 @@ class TestBucketDeployment extends cdk.Stack {
       sources.push(s3deploy.Source.asset(tempDir));
     }
 
-    const deploymentBucket = new s3deploy.BucketDeployment(this, 'DeployMe', {
+    const deployment = new s3deploy.BucketDeployment(this, 'DeployWithManySources', {
       sources: sources,
       destinationBucket: this.destinationBucket,
       memoryLimit: 2048,
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
+      retainOnDelete: false,
       outputObjectKeys: false,
     });
 
     new CfnOutput(this, 'customResourceData', {
       value: Fn.sub('Object Keys are${keys}', {
-        keys: Fn.join(',', deploymentBucket.objectKeys),
+        keys: Fn.join(',', deployment.objectKeys),
       }),
     });
   }
@@ -54,12 +65,12 @@ const app = new cdk.App({
 });
 const testCase = new TestBucketDeployment(app, 'test-bucket-deployments-too-many-sources');
 
-const integTest = new integ.IntegTest(app, 'integ-test-bucket-deployments', {
+const integTest = new integ.IntegTest(app, 'integ-test-bucket-deployment-big-response', {
   testCases: [testCase],
   diffAssets: true,
 });
 
-// Assert that DeployMeWithoutExtractingFilesOnDestination deploys a zip file to bucket4
+// Assert that all files were successfully deployed
 for (let i = 0; i < numFiles; i++) {
   const apiCall = integTest.assertions.awsApiCall('S3', 'getObject', {
     Bucket: testCase.destinationBucket.bucketName,
@@ -73,7 +84,7 @@ for (let i = 0; i < numFiles; i++) {
   apiCall.assertAtPath('Body', ExpectedResult.stringLikeRegexp(`This is file number ${i + 1}`));
 }
 
-// Assert that there is no object keys returned from the custom resource
+// Assert that objectKeys output is empty when outputObjectKeys is false
 const describe = integTest.assertions.awsApiCall('CloudFormation', 'describeStacks', {
   StackName: 'test-bucket-deployments-too-many-sources',
 });

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/integ.bucket-deployment-cloudfront.ts

@@ -1,27 +1,29 @@
 import * as path from 'path';
 import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
+import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as cdk from 'aws-cdk-lib';
 import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
-import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
 
-class TestBucketDeployment extends cdk.Stack {
-  constructor(scope: cdk.App, id: string) {
-    super(scope, id);
+/**
+ * Integration test for bucket deployment with CloudFront distribution invalidation:
+ * - Deploys files to S3 bucket behind CloudFront distribution
+ * - Tests that CloudFront cache invalidation works with bucket deployments
+ */
+class TestBucketDeploymentCloudFront extends cdk.Stack {
+  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
 
-    const bucket = new s3.Bucket(this, 'Destination3', {
+    const bucket = new s3.Bucket(this, 'Destination', {
       removalPolicy: cdk.RemovalPolicy.DESTROY,
       autoDeleteObjects: true, // needed for integration test cleanup
     });
-    const distribution = new cloudfront.CloudFrontWebDistribution(this, 'Distribution', {
-      originConfigs: [
-        {
-          s3OriginSource: {
-            s3BucketSource: bucket,
-          },
-          behaviors: [{ isDefaultBehavior: true }],
-        },
-      ],
+    const distribution = new cloudfront.Distribution(this, 'Distribution', {
+      defaultBehavior: {
+        origin: origins.S3BucketOrigin.withOriginAccessControl(bucket),
+      },
     });
 
     new s3deploy.BucketDeployment(this, 'DeployWithInvalidation', {
@@ -29,7 +31,7 @@ class TestBucketDeployment extends cdk.Stack {
       destinationBucket: bucket,
       distribution,
       distributionPaths: ['/images/*.png'],
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
+      retainOnDelete: false,
     });
   }
 }
@@ -41,10 +43,10 @@ const app = new cdk.App({
   },
 });
 
-const stack = new TestBucketDeployment(app, 'test-bucket-deployments-1');
+const testCase = new TestBucketDeploymentCloudFront(app, 'test-bucket-deployment-cloudfront');
 
-new IntegTest(app, 'TestBucketDeploymentInteg', {
-  testCases: [stack],
+new integ.IntegTest(app, 'integ-test-bucket-deployment-cloudfront', {
+  testCases: [testCase],
   diffAssets: true,
 });
 

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/integ.bucket-deployment-cross-nested-stack-source.ts

@@ -0,0 +1,64 @@
+import { App, Stack, NestedStack, StackProps, NestedStackProps } from 'aws-cdk-lib';
+import { UserPool, IUserPool } from 'aws-cdk-lib/aws-cognito';
+import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import { Bucket } from 'aws-cdk-lib/aws-s3';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { ExpectedResult } from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
+
+/**
+ * Integration test for bucket deployment with cross-nested-stack references:
+ * - Tests that Source.jsonData() can use values from resources in nested stacks
+ * - Validates that cross-nested-stack token resolution works correctly
+ * - Tests token substitution across nested stack boundaries
+ */
+class ResourceNestedStack extends NestedStack {
+  userPool: UserPool;
+  constructor (scope: Construct, id: string, props: NestedStackProps = {}) {
+    super(scope, id, props);
+    this.userPool = new UserPool(this, 'UserPool');
+  }
+}
+
+interface DeploymentNestedStackProps extends NestedStackProps {
+  userPool: IUserPool;
+}
+
+class DeploymentNestedStack extends NestedStack {
+  bucket: Bucket;
+  constructor (scope: Construct, id: string, props: DeploymentNestedStackProps) {
+    super(scope, id, props);
+    this.bucket = new Bucket(this, 'Bucket');
+    new BucketDeployment(this, 'DeployWithCrossNestedStackSource', {
+      destinationBucket: this.bucket,
+      sources: [
+        Source.jsonData('appconfig.json', { userPoolId: props.userPool.userPoolId }),
+      ],
+    });
+  }
+}
+
+class MainStack extends Stack {
+  resourceNestedStack: ResourceNestedStack;
+  deploymentNestedStack: DeploymentNestedStack;
+
+  constructor (scope: Construct, id: string, props: StackProps = {}) {
+    super(scope, id, props);
+    this.resourceNestedStack = new ResourceNestedStack(this, 'ResourceNestedStack');
+    this.deploymentNestedStack = new DeploymentNestedStack(this, 'DeploymentNestedStack', { userPool: this.resourceNestedStack.userPool });
+  }
+}
+
+const app = new App();
+const stack = new MainStack(app, 'MainStack');
+
+const integTest = new integ.IntegTest(app, 'integ-cross-nested-stack-source', {
+  testCases: [stack],
+});
+
+integTest.assertions.awsApiCall('S3', 'getObject', {
+  Bucket: stack.deploymentNestedStack.bucket.bucketName,
+  Key: 'appconfig.json',
+}).expect(ExpectedResult.objectLike({
+  Body: JSON.stringify({ userPoolId: stack.resourceNestedStack.userPool.userPoolId }),
+}));

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/integ.bucket-deployment-cross-stack-source.ts

@@ -0,0 +1,53 @@
+import { App, Stack, StackProps } from 'aws-cdk-lib';
+import { UserPool } from 'aws-cdk-lib/aws-cognito';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { ExpectedResult } from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
+import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import { Bucket } from 'aws-cdk-lib/aws-s3';
+
+/**
+ * Integration test for bucket deployment with cross-stack references:
+ * - Tests that Source.data() can use values from resources in other stacks
+ * - Validates that cross-stack token resolution works correctly
+ */
+class Stack2 extends Stack {
+  userPool: UserPool;
+
+  constructor (scope: Construct, id: string, props: StackProps = {}) {
+    super(scope, id, props);
+    this.userPool = new UserPool(this, 'userpool');
+  }
+}
+
+class Stack1 extends Stack {
+  bucket: Bucket;
+
+  constructor (scope: Construct, id: string, props: { userPool: UserPool }) {
+    super(scope, id);
+    this.bucket = new Bucket(this, 'bucket');
+    new BucketDeployment(this, 'DeployWithCrossStackSource', {
+      destinationBucket: this.bucket,
+      sources: [
+        Source.data('test.txt', props.userPool.userPoolId),
+      ],
+    });
+  }
+}
+
+const app = new App();
+const stack2 = new Stack2(app, 'stack2');
+const stack1 = new Stack1(app, 'stack1', { userPool: stack2.userPool });
+
+const integTest = new integ.IntegTest(app, 'integ-cross-stack-source', {
+  testCases: [
+    stack1,
+  ],
+});
+
+integTest.assertions.awsApiCall('S3', 'getObject', {
+  Bucket: stack1.bucket.bucketName,
+  Key: 'test.txt',
+}).expect(ExpectedResult.objectLike({
+  Body: stack2.userPool.userPoolId,
+}));