konokenj.cdk-api-mcp-server 0.31.0__py3-none-any.whl → 0.57.0__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/integ.bucket-deployment-vpc-security-groups.ts

@@ -0,0 +1,72 @@
+import * as path from 'path';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as cdk from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
+import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
+
+/**
+ * Integration test for bucket deployment with VPC and custom security groups:
+ * - Lambda function runs in VPC with custom security group
+ * - Security group allows all outbound traffic for S3 access
+ */
+class TestBucketDeploymentVpcSecurityGroups extends cdk.Stack {
+  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+
+    // VPC with specific security groups
+    // Use isolated subnets with S3 VPC endpoint - no NAT Gateway or Elastic IP needed
+    const vpc = new ec2.Vpc(this, 'SgVpc', {
+      restrictDefaultSecurityGroup: false,
+      natGateways: 0,
+      subnetConfiguration: [
+        {
+          cidrMask: 24,
+          name: 'Isolated',
+          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+        },
+      ],
+    });
+
+    // Add S3 Gateway endpoint so Lambda can access S3 without NAT Gateway
+    vpc.addGatewayEndpoint('S3Endpoint', {
+      service: ec2.GatewayVpcEndpointAwsService.S3,
+    });
+
+    const securityGroup = new ec2.SecurityGroup(this, 'CustomSecurityGroup', {
+      vpc: vpc,
+      description: 'Custom security group for bucket deployment',
+      allowAllOutbound: true,
+    });
+
+    const bucket = new s3.Bucket(this, 'Destination', {
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    });
+
+    new s3deploy.BucketDeployment(this, 'DeployWithVpcAndSecurityGroup', {
+      sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
+      destinationBucket: bucket,
+      destinationKeyPrefix: 'sg-vpc/',
+      vpc: vpc,
+      securityGroups: [securityGroup],
+      retainOnDelete: false,
+    });
+  }
+}
+
+const app = new cdk.App({
+  postCliContext: {
+    '@aws-cdk/aws-lambda:useCdkManagedLogGroup': false,
+  },
+});
+
+const testCase = new TestBucketDeploymentVpcSecurityGroups(app, 'test-bucket-deployment-vpc-security-groups');
+
+new integ.IntegTest(app, 'integ-test-bucket-deployment-vpc-security-groups', {
+  testCases: [testCase],
+  diffAssets: false,
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/integ.bucket-deployment-vpc-subnet-selection.ts

@@ -0,0 +1,70 @@
+import * as path from 'path';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as cdk from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
+import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
+
+/**
+ * Integration test for bucket deployment with VPC and explicit subnet selection:
+ * - Lambda function runs in VPC with explicit subnet type selection
+ * - Tests vpcSubnets property for controlling which subnets Lambda uses
+ */
+class TestBucketDeploymentVpcSubnetSelection extends cdk.Stack {
+  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+
+    // VPC with specific subnets
+    // Use isolated subnets with S3 VPC endpoint - no NAT Gateway or Elastic IP needed
+    // Use a different CIDR to avoid conflicts with existing stacks
+    const vpc = new ec2.Vpc(this, 'SubnetVpc', {
+      restrictDefaultSecurityGroup: false,
+      natGateways: 0,
+      ipAddresses: ec2.IpAddresses.cidr('10.1.0.0/16'),
+      subnetConfiguration: [
+        {
+          cidrMask: 24,
+          name: 'Isolated',
+          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+        },
+      ],
+    });
+
+    // Add S3 Gateway endpoint so Lambda can access S3 without NAT Gateway
+    vpc.addGatewayEndpoint('S3Endpoint', {
+      service: ec2.GatewayVpcEndpointAwsService.S3,
+    });
+
+    const bucket = new s3.Bucket(this, 'Destination', {
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    });
+
+    new s3deploy.BucketDeployment(this, 'DeployWithVpcAndSubnets', {
+      sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
+      destinationBucket: bucket,
+      destinationKeyPrefix: 'subnet-vpc/',
+      vpc: vpc,
+      vpcSubnets: {
+        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+      },
+      retainOnDelete: false,
+    });
+  }
+}
+
+const app = new cdk.App({
+  postCliContext: {
+    '@aws-cdk/aws-lambda:useCdkManagedLogGroup': false,
+  },
+});
+
+const testCase = new TestBucketDeploymentVpcSubnetSelection(app, 'test-bucket-deployment-vpc-subnet-selection');
+
+new integ.IntegTest(app, 'integ-test-bucket-deployment-vpc-subnet-selection', {
+  testCases: [testCase],
+  diffAssets: false,
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-deployment/integ.bucket-deployment.ts

@@ -1,5 +1,4 @@
 import * as path from 'path';
-import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as cdk from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
@@ -7,115 +6,93 @@ import { Match } from '@aws-cdk/integ-tests-alpha';
 import { Construct } from 'constructs';
 import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
 
+/**
+ * Integration test for core bucket deployment features:
+ * - Basic deployment functionality
+ * - Prune behavior (deleting files not in source)
+ * - Exclude filters
+ * - Extract behavior (extracting vs keeping zip files)
+ * - addSource() method for dynamically adding sources
+ * - objectKeys output property and outputObjectKeys flag
+ */
 class TestBucketDeployment extends cdk.Stack {
-  public readonly bucket5: s3.IBucket;
+  public readonly bucketWithAddSource: s3.IBucket;
   constructor(scope: Construct, id: string, props?: cdk.StackProps) {
     super(scope, id, props);
 
-    const destinationBucket = new s3.Bucket(this, 'Destination', {
-      websiteIndexDocument: 'index.html',
-      publicReadAccess: false,
+    const commonBucketProps = {
       removalPolicy: cdk.RemovalPolicy.DESTROY,
       autoDeleteObjects: true, // needed for integration test cleanup
-    });
+    };
 
-    new s3deploy.BucketDeployment(this, 'DeployMe', {
-      sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
-      destinationBucket,
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
+    const destinationBucket = new s3.Bucket(this, 'Destination', {
+      ...commonBucketProps,
     });
 
-    new s3deploy.BucketDeployment(this, 'DeployMeWithEfsStorage', {
+    // Test basic deployment functionality
+    new s3deploy.BucketDeployment(this, 'DeployWithBasic', {
       sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
       destinationBucket,
-      destinationKeyPrefix: 'efs/',
-      useEfs: true,
-      vpc: new ec2.Vpc(this, 'InlineVpc', { restrictDefaultSecurityGroup: false }),
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
-    });
-
-    const bucket2 = new s3.Bucket(this, 'Destination2', {
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true, // needed for integration test cleanup
-    });
-
-    new s3deploy.BucketDeployment(this, 'DeployWithPrefix', {
-      sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
-      destinationBucket: bucket2,
-      destinationKeyPrefix: 'deploy/here/',
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
-    });
-
-    const bucket3 = new s3.Bucket(this, 'Destination3', {
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true, // needed for integration test cleanup
-    });
-
-    new s3deploy.BucketDeployment(this, 'DeployWithMetadata', {
-      sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
-      destinationBucket: bucket3,
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
-      cacheControl: [s3deploy.CacheControl.setPublic(), s3deploy.CacheControl.maxAge(cdk.Duration.minutes(1))],
-      contentType: 'text/html',
-      metadata: { A: 'aaa', B: 'bbb', C: 'ccc' },
+      retainOnDelete: false,
     });
 
-    new s3deploy.BucketDeployment(this, 'DeployMeWithoutDeletingFilesOnDestination', {
+    // Test that files not in source are preserved when prune is disabled
+    new s3deploy.BucketDeployment(this, 'DeployWithPruneDisabled', {
       sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
       destinationBucket,
       prune: false,
       retainOnDelete: false,
     });
 
-    new s3deploy.BucketDeployment(this, 'DeployMeWithExcludedFilesOnDestination', {
+    // Test exclude filters to skip certain files from deployment
+    new s3deploy.BucketDeployment(this, 'DeployWithExclude', {
       sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
       destinationBucket,
       exclude: ['*.gif'],
       retainOnDelete: false,
     });
 
-    const bucket4 = new s3.Bucket(this, 'Destination4', {
-      publicReadAccess: false,
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true, // needed for integration test cleanup
+    const bucketWithoutExtract = new s3.Bucket(this, 'BucketWithoutExtract', {
+      ...commonBucketProps,
     });
 
-    new s3deploy.BucketDeployment(this, 'DeployMeWithoutExtractingFilesOnDestination', {
+    // Test that zip files are uploaded as-is when extract is disabled
+    new s3deploy.BucketDeployment(this, 'DeployWithoutExtract', {
       sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website'))],
-      destinationBucket: bucket4,
+      destinationBucket: bucketWithoutExtract,
       extract: false,
       retainOnDelete: false,
     });
 
-    this.bucket5 = new s3.Bucket(this, 'Destination5', {
-      publicReadAccess: false,
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true, // needed for integration test cleanup
+    this.bucketWithAddSource = new s3.Bucket(this, 'BucketWithAddSource', {
+      ...commonBucketProps,
     });
 
-    const deploy5 = new s3deploy.BucketDeployment(this, 'DeployMe5', {
+    // Test addSource() method for dynamically adding sources after construction
+    // and validate objectKeys output property returns both asset files and added sources
+    const deployWithAddSource = new s3deploy.BucketDeployment(this, 'DeployWithAddSource', {
       sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website-second'))],
-      destinationBucket: this.bucket5,
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
+      destinationBucket: this.bucketWithAddSource,
+      retainOnDelete: false,
     });
-    deploy5.addSource(s3deploy.Source.data('some-key', 'helloworld'));
+    deployWithAddSource.addSource(s3deploy.Source.data('some-key', 'helloworld'));
 
+    // Output objectKeys to validate they are returned in CloudFormation outputs
     new cdk.CfnOutput(this, 'customResourceData', {
       value: cdk.Fn.sub('Object Keys are ${keys}', {
-        keys: cdk.Fn.join(',', deploy5.objectKeys),
+        keys: cdk.Fn.join(',', deployWithAddSource.objectKeys),
       }),
     });
 
-    const bucket6 = new s3.Bucket(this, 'Destination6', {
-      publicReadAccess: false,
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true, // needed for integration test cleanup
+    const bucketWithoutObjectKeys = new s3.Bucket(this, 'BucketWithoutObjectKeys', {
+      ...commonBucketProps,
     });
 
-    new s3deploy.BucketDeployment(this, 'DeployMe6', {
+    // Test that objectKeys are not returned when outputObjectKeys is disabled
+    new s3deploy.BucketDeployment(this, 'DeployWithoutObjectKeys', {
       sources: [s3deploy.Source.asset(path.join(__dirname, 'my-website-second'))],
-      destinationBucket: bucket6,
-      retainOnDelete: false, // default is true, which will block the integration test cleanup
+      destinationBucket: bucketWithoutObjectKeys,
+      retainOnDelete: false,
       outputObjectKeys: false,
     });
   }
@@ -128,13 +105,14 @@ const app = new cdk.App({
 });
 const testCase = new TestBucketDeployment(app, 'test-bucket-deployments');
 
-// Assert that DeployMeWithoutExtractingFilesOnDestination deploys a zip file to bucket4
 const integTest = new integ.IntegTest(app, 'integ-test-bucket-deployments', {
   testCases: [testCase],
   diffAssets: true,
 });
+
+// Assert that addSource() successfully adds the data source alongside the asset source
 const listObjectsCall = integTest.assertions.awsApiCall('S3', 'listObjects', {
-  Bucket: testCase.bucket5.bucketName,
+  Bucket: testCase.bucketWithAddSource.bucketName,
 });
 listObjectsCall.provider.addToRolePolicy({
   Effect: 'Allow',
@@ -154,12 +132,12 @@ listObjectsCall.expect(integ.ExpectedResult.objectLike({
   ),
 }));
 
-// Assert that there is one object key returned from the custom resource
+// Assert that objectKeys output contains the deployed object keys when outputObjectKeys is enabled (default)
 const describe = integTest.assertions.awsApiCall('CloudFormation', 'describeStacks', {
   StackName: 'test-bucket-deployments',
 });
 
 describe.assertAtPath('Stacks.0.Outputs.0.OutputKey', integ.ExpectedResult.stringLikeRegexp('customResourceData'));
-describe.assertAtPath('Stacks.0.Outputs.0.OutputValue', integ.ExpectedResult.stringLikeRegexp('Object Keys are ([0-9a-f])+\.zip'));
+describe.assertAtPath('Stacks.0.Outputs.0.OutputValue', integ.ExpectedResult.stringLikeRegexp('Object Keys are ([0-9a-f])+\\.zip(,([0-9a-f])+\\.zip)*'));
 
 app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-s3-notifications/integ.bucket-notifications.ts

@@ -1,68 +1,106 @@
+import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as s3 from 'aws-cdk-lib/aws-s3';
-import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as cdk from 'aws-cdk-lib';
-import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as s3n from 'aws-cdk-lib/aws-s3-notifications';
+import { STANDARD_NODEJS_RUNTIME } from '../../../config';
+import * as constructs from 'constructs';
+import * as integ from '@aws-cdk/integ-tests-alpha';
 
 const app = new cdk.App({
   postCliContext: {
+    '@aws-cdk/aws-lambda:useCdkManagedLogGroup': false,
     '@aws-cdk/aws-s3:keepNotificationInImportedBucket': false,
   },
 });
 
-const stack = new cdk.Stack(app, 'sqs-bucket-notifications');
+const stack = new cdk.Stack(app, 'cdk-integ-lambda-bucket-s3-notifications');
 
-const bucket1 = new s3.Bucket(stack, 'Bucket1', {
+const bucketA = new s3.Bucket(stack, 'MyBucket', {
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
-const queue = new sqs.Queue(stack, 'MyQueue');
 
-bucket1.addObjectCreatedNotification(new s3n.SqsDestination(queue));
+const fn = new lambda.Function(stack, 'MyFunction', {
+  runtime: STANDARD_NODEJS_RUNTIME,
+  handler: 'index.handler',
+  code: lambda.Code.fromInline(`exports.handler = ${handler.toString()}`),
+});
 
-const bucket2 = new s3.Bucket(stack, 'Bucket2', {
+const bucketB = new s3.Bucket(stack, 'YourBucket', {
   removalPolicy: cdk.RemovalPolicy.DESTROY,
-  autoDeleteObjects: true,
 });
-bucket2.addObjectCreatedNotification(new s3n.SqsDestination(queue), { suffix: '.png' });
 
-const encryptedQueue = new sqs.Queue(stack, 'EncryptedQueue', { encryption: sqs.QueueEncryption.KMS });
-bucket1.addObjectRemovedNotification(new s3n.SqsDestination(encryptedQueue));
+bucketB.addEventNotification(s3.EventType.OBJECT_REMOVED, new s3n.LambdaDestination(fn));
 
-const bucket3 = new s3.Bucket(stack, 'Bucket3WithSkipDestinationValidation', {
-  notificationsSkipDestinationValidation: true,
-  removalPolicy: cdk.RemovalPolicy.DESTROY,
-});
-const queueWithIncorrectS3Permissions = new sqs.Queue(stack, 'MyQueueWithIncorrectS3Permissions');
-queueWithIncorrectS3Permissions.addToResourcePolicy(
-  new cdk.aws_iam.PolicyStatement({
-    effect: cdk.aws_iam.Effect.DENY,
-    actions: ['sqs:SendMessage'],
-    principals: [new cdk.aws_iam.ServicePrincipal('s3.amazonaws.com')],
-    resources: [queueWithIncorrectS3Permissions.queueArn],
-  }));
-bucket3.addEventNotification(s3.EventType.OBJECT_TAGGING_PUT, new s3n.SqsDestination(queueWithIncorrectS3Permissions));
+const c1 = new constructs.Construct(stack, 'Construct1');
+const unmanagedBucket = s3.Bucket.fromBucketName(c1, 'IntegUnmanagedBucket1', bucketA.bucketName);
 
-const integTest = new integ.IntegTest(app, 'SQSBucketNotificationsTest', {
+unmanagedBucket.addObjectCreatedNotification(new s3n.LambdaDestination(fn), { prefix: 'TEST1/', suffix: '.png' });
+unmanagedBucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.LambdaDestination(fn), { prefix: 'TEST2/' });
+
+/* eslint-disable no-console */
+function handler(event: any, _context: any, callback: any) {
+  console.log(JSON.stringify(event, undefined, 2));
+  return callback(null, event);
+}
+
+const integTest = new integ.IntegTest(app, 'LambdaBucketNotificationsTest', {
+  cdkCommandOptions: {
+    deploy: {
+      args: {
+        rollback: false,
+      },
+    },
+  },
   testCases: [stack],
   diffAssets: true,
 });
 
-integTest.assertions
-  // First remove the test notifications
-  .awsApiCall('SQS', 'purgeQueue', {
-    QueueUrl: queue.queueUrl,
-  })
-  .next(integTest.assertions
-    .awsApiCall('S3', 'putObject', {
-      Bucket: bucket2.bucketName,
-      Key: 'image.png',
-      Body: 'Some content',
-    }))
-  .next(integTest.assertions
-    .awsApiCall('SQS', 'receiveMessage', {
-      QueueUrl: queue.queueUrl,
-      WaitTimeSeconds: 20,
-    })
-    .assertAtPath('Messages.0.Body.Records.0.s3.object.key', integ.ExpectedResult.stringLikeRegexp('image\\.png')));
+const getNotifications = integTest.assertions
+  .awsApiCall('S3', 'getBucketNotificationConfiguration', {
+    Bucket: unmanagedBucket.bucketName,
+  });
+getNotifications.provider.addToRolePolicy({
+  Effect: 'Allow',
+  Action: ['s3:GetBucketNotification'],
+  Resource: ['*'],
+});
 
+getNotifications.expect(integ.ExpectedResult.objectLike({
+  LambdaFunctionConfigurations: [
+    {
+      Events: [
+        's3:ObjectCreated:*',
+      ],
+      Filter: {
+        Key: {
+          FilterRules: [
+            {
+              Name: 'Prefix',
+              Value: 'TEST1/',
+            },
+            {
+              Name: 'Suffix',
+              Value: '.png',
+            },
+          ],
+        },
+      },
+    },
+    {
+      Events: [
+        's3:ObjectCreated:*',
+      ],
+      Filter: {
+        Key: {
+          FilterRules: [
+            {
+              Name: 'Prefix',
+              Value: 'TEST2/',
+            },
+          ],
+        },
+      },
+    },
+  ],
+}));
 app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-secretsmanager/integ.secret.dynamic-reference-key.ts

@@ -0,0 +1,38 @@
+import * as cdk from 'aws-cdk-lib';
+import { SecretValue } from 'aws-cdk-lib';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+
+class TestStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string) {
+    super(scope, id);
+
+    // Create a default secret
+    const secret = new secretsmanager.Secret(this, 'Secret');
+
+    // Create a JSON secret containing cfnDynamicReferenceKey values extracted from the default secret
+    new secretsmanager.Secret(this, 'JSONSecret', {
+      secretObjectValue: {
+        cfnDynamicReferenceKeyWithDefaults: SecretValue.unsafePlainText(secret.cfnDynamicReferenceKey()),
+        cfnDynamicReferenceKeyWithJsonFieldAndVersionStage: SecretValue.unsafePlainText(secret.cfnDynamicReferenceKey({
+          jsonField: 'json-key',
+          versionStage: 'version-stage',
+        })),
+        cfnDynamicReferenceKeyWithJsonFieldAndVersionId: SecretValue.unsafePlainText(secret.cfnDynamicReferenceKey({
+          jsonField: 'json-key',
+          versionId: 'version-id',
+        })),
+      },
+    });
+  }
+}
+
+const app = new cdk.App();
+
+const stack = new TestStack(app, 'cdk-integ-secrets-dynamic-reference-key');
+
+new integ.IntegTest(app, 'cdk-integ-secrets-dynamic-reference-key-test', {
+  testCases: [stack],
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-signer/integ.signing-profile.ts

@@ -16,6 +16,11 @@ new signer.SigningProfile(stack, 'SigningProfileOCI', {
   signatureValidity: cdk.Duration.days(60),
 });
 
+new signer.SigningProfile(stack, 'SigningProfileWithName', {
+  platform: signer.Platform.AWS_LAMBDA_SHA384_ECDSA,
+  signingProfileName: 'test-signing-profile-name',
+});
+
 new IntegTest(app, 'cdk-integ-signer-signing-profile', {
   testCases: [stack],
 });

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-sns/README.md

@@ -121,6 +121,7 @@ declare const fn: lambda.Function;
 
 // Lambda should receive only message matching the following conditions on message body:
 // color: 'red' or 'orange'
+// store: property must not be present
 myTopic.addSubscription(new subscriptions.LambdaSubscription(fn, {
   filterPolicyWithMessageBody: {
     background: sns.FilterOrPolicy.policy({
@@ -128,6 +129,7 @@ myTopic.addSubscription(new subscriptions.LambdaSubscription(fn, {
         allowlist: ['red', 'orange'],
       })),
     }),
+    store: sns.FilterOrPolicy.filter(sns.SubscriptionFilter.notExistsFilter()),
   },
 }));
 ```

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-sns-subscriptions/integ.sns-sqs-subscription-filter.ts

@@ -0,0 +1,75 @@
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as cdk from 'aws-cdk-lib';
+import { IntegTest, ExpectedResult } from '@aws-cdk/integ-tests-alpha';
+import * as subs from 'aws-cdk-lib/aws-sns-subscriptions';
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'sns-sqs-subscription-filter');
+
+const topic = new sns.Topic(stack, 'MyTopic');
+
+const queue1 = new sqs.Queue(stack, 'MyQueue1');
+const queue2 = new sqs.Queue(stack, 'MyQueue2');
+
+topic.addSubscription(new subs.SqsSubscription(queue1, {
+  filterPolicyWithMessageBody: {
+    background: sns.Policy.policy({
+      color: sns.Filter.filter(sns.SubscriptionFilter.stringFilter({
+        allowlist: ['red', 'green'],
+      })),
+    }),
+    price: sns.Filter.filter(sns.SubscriptionFilter.numericFilter({
+      allowlist: [100, 200],
+    })),
+    store: sns.Filter.filter(sns.SubscriptionFilter.existsFilter()),
+  },
+  rawMessageDelivery: true,
+}));
+
+topic.addSubscription(new subs.SqsSubscription(queue2, {
+  filterPolicyWithMessageBody: {
+    background: sns.Policy.policy({
+      color: sns.Filter.filter(sns.SubscriptionFilter.stringFilter({
+        denylist: ['red', 'green'],
+      })),
+    }),
+    price: sns.Filter.filter(sns.SubscriptionFilter.numericFilter({
+      betweenStrict: { start: 100, stop: 200 },
+    })),
+    store: sns.Filter.filter(sns.SubscriptionFilter.notExistsFilter()),
+  },
+  rawMessageDelivery: true,
+}));
+
+const integTest = new IntegTest(app, 'SNS Subscription filters', {
+  testCases: [stack],
+});
+
+const message1 = JSON.stringify({ background: { color: 'green' }, price: 200, store: 'fans' }); // matches queue1 subscription filter
+const message2 = JSON.stringify({ background: { color: 'blue' }, price: 150 }); // matches queue2 subscription filter
+
+// publish messages to SNS topic
+integTest.assertions.awsApiCall('SNS', 'publish', {
+  Message: message1,
+  TopicArn: topic.topicArn,
+});
+integTest.assertions.awsApiCall('SNS', 'publish', {
+  Message: message2,
+  TopicArn: topic.topicArn,
+});
+
+// check messages arrived at expected destination queue
+integTest.assertions.awsApiCall('SQS', 'receiveMessage', {
+  QueueUrl: queue1.queueUrl,
+  WaitTimeSeconds: 20,
+}).expect(ExpectedResult.objectLike({
+  Messages: [{ Body: message1 }],
+}));
+integTest.assertions.awsApiCall('SQS', 'receiveMessage', {
+  QueueUrl: queue2.queueUrl,
+  WaitTimeSeconds: 20,
+}).expect(ExpectedResult.objectLike({
+  Messages: [{ Body: message2 }],
+}));