konokenj.cdk-api-mcp-server 0.42.0__py3-none-any.whl → 0.44.0__py3-none-any.whl

cdk_api_mcp_server/__about__.py

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: 2025-present Kenji Kono <konoken@amazon.co.jp>
 #
 # SPDX-License-Identifier: MIT
-__version__ = "0.42.0"
+__version__ = "0.44.0"

cdk_api_mcp_server/resources/aws-cdk/constructs/@aws-cdk/aws-glue-alpha/README.md

@@ -68,7 +68,7 @@ for more granular details.
 
 ### Spark Jobs
 
-1. **ETL Jobs**
+#### ETL Jobs
 
 ETL jobs support pySpark and Scala languages, for which there are separate but
 similar constructors. ETL jobs default to the G2 worker type, but you can
@@ -130,7 +130,7 @@ new glue.PySparkEtlJob(stack, 'PySparkETLJob', {
 });
 ```
 
-**Streaming Jobs**
+#### Streaming Jobs
 
 Streaming jobs are similar to ETL jobs, except that they perform ETL on data
 streams using the Apache Spark Structured Streaming framework. Some Spark
@@ -186,7 +186,7 @@ new glue.PySparkStreamingJob(stack, 'PySparkStreamingJob', {
 });
 ```
 
-**Flex Jobs**
+#### Flex Jobs
 
 The flexible execution class is appropriate for non-urgent jobs such as
 pre-production jobs, testing, and one-time data loads. Flexible jobs default
@@ -419,14 +419,14 @@ override it if you prefer for your trigger not to start on creation.
 Reference the workflow-triggers.test.ts unit tests for examples of creating
 workflows and triggers.
 
-1. **On-Demand Triggers**
+#### **1. On-Demand Triggers**
 
 On-demand triggers can start glue jobs or crawlers. This construct provides
 convenience functions to create on-demand crawler or job triggers. The constructor
 takes an optional description parameter, but abstracts the requirement of an
 actions list using the job or crawler objects using conditional types.
 
-1. **Scheduled Triggers**
+#### **2. Scheduled Triggers**
 
 You can create scheduled triggers using cron expressions. This construct
 provides daily, weekly, and monthly convenience functions,
@@ -454,13 +454,13 @@ The trigger actions are executed when the predicateCondition is true.
 A `Connection` allows Glue jobs, crawlers and development endpoints to access
 certain types of data stores.
 
-***Secrets Management
-    **You must specify JDBC connection credentials in Secrets Manager and
+* **Secrets Management**
+    You must specify JDBC connection credentials in Secrets Manager and
     provide the Secrets Manager Key name as a property to the job connection.
 
 * **Networking - the CDK determines the best fit subnet for Glue connection
-configuration
-    **The prior version of the glue-alpha-module requires the developer to
+configuration**
+    The prior version of the glue-alpha-module requires the developer to
     specify the subnet of the Connection when it’s defined. Now, you can still
     specify the specific subnet you want to use, but are no longer required
     to. You are only required to provide a VPC and either a public or private

cdk_api_mcp_server/resources/aws-cdk/constructs/@aws-cdk/aws-iot-alpha/README.md

@@ -150,7 +150,7 @@ new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
   checkConfiguration: {
     deviceCertificateAgeCheck: true,
     // The default value is 365 days
-    // Valid values range from 30 days (minimum) to 3652 days (10 years, maximum)
+    // Valid values range from 30 days (minimum) to 3650 days (10 years, maximum)
     deviceCertificateAgeCheckDuration: Duration.days(365),
   },
 });

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-apigatewayv2/README.md

@@ -524,6 +524,14 @@ const arn = api.arnForExecuteApiV2('$connect', 'dev');
 
 For a detailed explanation of this function, including usage and examples, please refer to the [Generating ARN for Execute API](#generating-arn-for-execute-api) section under HTTP API.
 
+To disable schema validation, set `disableSchemaValidation` to true.
+
+```ts
+new apigwv2.WebSocketApi(this, 'api', {
+  disableSchemaValidation: true,
+});
+```
+
 You can configure IP address type for the API endpoint using `ipAddressType` property.
 Valid values are `IPV4` (default) and `DUAL_STACK`.
 

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-apigatewayv2/integ.api.ts

@@ -8,6 +8,10 @@ const stack = new cdk.Stack(app, 'aws-cdk-aws-apigatewayv2');
 
 new apigw.WebSocketApi(stack, 'WebSocketApi');
 
+new apigw.WebSocketApi(stack, 'WebSocketApiWithProps', {
+  disableSchemaValidation: true,
+});
+
 new IntegTest(app, 'web-socket-api', {
   testCases: [stack],
 });

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-batch/README.md

@@ -532,6 +532,40 @@ const jobDefn = new batch.EcsJobDefinition(this, 'JobDefn', {
 });
 ```
 
+### Enable Execute Command (ECS Exec)
+
+You can enable [ECS Exec](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html) for interactive debugging and troubleshooting by setting `enableExecuteCommand` to `true`.
+When enabled, you'll be able to execute commands interactively in running containers.
+
+```ts
+const jobDefn = new batch.EcsJobDefinition(this, 'JobDefn', {
+  container: new batch.EcsEc2ContainerDefinition(this, 'Ec2Container', {
+    image: ecs.ContainerImage.fromRegistry('public.ecr.aws/amazonlinux/amazonlinux:latest'),
+    memory: cdk.Size.mebibytes(2048),
+    cpu: 256,
+    enableExecuteCommand: true, // Enable ECS Exec
+  }),
+});
+```
+
+The same functionality is available for Fargate containers:
+
+```ts
+const jobDefn = new batch.EcsJobDefinition(this, 'JobDefn', {
+  container: new batch.EcsFargateContainerDefinition(this, 'FargateContainer', {
+    image: ecs.ContainerImage.fromRegistry('public.ecr.aws/amazonlinux/amazonlinux:latest'),
+    memory: cdk.Size.mebibytes(2048),
+    cpu: 256,
+    enableExecuteCommand: true, // Enable ECS Exec for Fargate
+  }),
+});
+```
+
+When `enableExecuteCommand` is set to `true`:
+
+- If no `jobRole` is provided, a new IAM role will be automatically created with the required SSM permissions
+- If a `jobRole` is already provided, the necessary SSM permissions will be added to the existing role
+
 ### Secrets
 
 You can expose SecretsManager Secret ARNs or SSM Parameters to your container as environment variables.

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-batch/integ.ecs-exec-batch-job.ts

@@ -0,0 +1,148 @@
+import * as batch from 'aws-cdk-lib/aws-batch';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as cdk from 'aws-cdk-lib';
+import { IntegTest, ExpectedResult } from '@aws-cdk/integ-tests-alpha';
+
+class EcsExecBatchStack extends cdk.Stack {
+  public readonly ec2ComputeEnvironment: batch.ManagedEc2EcsComputeEnvironment;
+  public readonly fargateComputeEnvironment: batch.FargateComputeEnvironment;
+  public readonly ec2JobQueue: batch.JobQueue;
+  public readonly fargateJobQueue: batch.JobQueue;
+  public readonly ec2JobDefinition: batch.EcsJobDefinition;
+  public readonly fargateJobDefinition: batch.EcsJobDefinition;
+
+  constructor(scope: cdk.App, id: string, props: cdk.StackProps = {}) {
+    super(scope, id, props);
+
+    const vpc = new ec2.Vpc(this, 'Vpc', {
+      maxAzs: 2,
+    });
+
+    this.ec2ComputeEnvironment = new batch.ManagedEc2EcsComputeEnvironment(this, 'ComputeEnv', {
+      vpc,
+      instanceTypes: [ec2.InstanceType.of(ec2.InstanceClass.M5, ec2.InstanceSize.LARGE)],
+      minvCpus: 0,
+      maxvCpus: 256,
+    });
+
+    this.ec2JobQueue = new batch.JobQueue(this, 'JobQueue', {
+      computeEnvironments: [
+        {
+          order: 1,
+          computeEnvironment: this.ec2ComputeEnvironment,
+        },
+      ],
+    });
+
+    this.ec2JobDefinition = new batch.EcsJobDefinition(this, 'EcsExecEc2JobDefinition', {
+      jobDefinitionName: 'EcsExecEc2TestJob',
+      container: new batch.EcsEc2ContainerDefinition(this, 'Ec2Container', {
+        image: ecs.ContainerImage.fromRegistry('public.ecr.aws/amazonlinux/amazonlinux:latest'),
+        cpu: 2,
+        memory: cdk.Size.mebibytes(2048),
+        enableExecuteCommand: true,
+        command: ['sh', '-c', 'echo "Job started with ECS Exec enabled"; sleep 300'], // Keep container running
+      }),
+    });
+
+    this.fargateJobDefinition = new batch.EcsJobDefinition(this, 'EcsExecFargateJobDefinition', {
+      container: new batch.EcsFargateContainerDefinition(this, 'FargateContainer', {
+        image: ecs.ContainerImage.fromRegistry('public.ecr.aws/amazonlinux/amazonlinux:latest'),
+        cpu: 0.25,
+        memory: cdk.Size.gibibytes(1),
+        enableExecuteCommand: true, // Enable ECS Exec
+        command: ['sh', '-c', 'echo "Fargate Job started with ECS Exec enabled"; sleep 300'], // Keep container running
+      }),
+    });
+
+    // Create Fargate compute environment
+    this.fargateComputeEnvironment = new batch.FargateComputeEnvironment(this, 'FargateComputeEnv', {
+      vpc,
+    });
+
+    this.fargateJobQueue = new batch.JobQueue(this, 'FargateJobQueue', {
+      computeEnvironments: [
+        {
+          order: 1,
+          computeEnvironment: this.fargateComputeEnvironment,
+        },
+      ],
+    });
+  }
+}
+
+const app = new cdk.App();
+const stack = new EcsExecBatchStack(app, 'EcsExecBatchStack');
+
+const integ = new IntegTest(app, 'EcsExecBatchTest', {
+  testCases: [stack],
+});
+
+// Helper function to test ECS Exec for a job
+function testEcsExecForJob(
+  jobName: string,
+  jobQueue: batch.JobQueue,
+  jobDefinition: batch.EcsJobDefinition,
+  computeEnvironment: batch.IManagedComputeEnvironment,
+) {
+  // Get cluster ARN from compute environment
+  const describeComputeEnv = integ.assertions.awsApiCall('Batch', 'describeComputeEnvironments', {
+    computeEnvironments: [computeEnvironment.computeEnvironmentArn],
+  });
+
+  const clusterArn = describeComputeEnv.getAttString('computeEnvironments.0.ecsClusterArn');
+
+  // Submit the job
+  const submitJobResult = describeComputeEnv.next(
+    integ.assertions.awsApiCall('Batch', 'submitJob', {
+      jobName,
+      jobQueue: jobQueue.jobQueueArn,
+      jobDefinition: jobDefinition.jobDefinitionArn,
+    }),
+  ).waitForAssertions();
+
+  // Get the job ID from the submit response
+  const jobId = submitJobResult.getAttString('jobId');
+
+  // Wait for job to reach RUNNING state and have a task ARN
+  const waitForJobRunning = integ.assertions.awsApiCall('Batch', 'describeJobs', {
+    jobs: [jobId],
+  }).assertAtPath('jobs.0.status', ExpectedResult.stringLikeRegexp('RUNNING'))
+    .waitForAssertions({
+      totalTimeout: cdk.Duration.minutes(10),
+      interval: cdk.Duration.seconds(30),
+    });
+
+  const taskArn = waitForJobRunning.getAttString('jobs.0.container.taskArn');
+
+  // Execute ECS command to verify ECS Exec is enabled
+  waitForJobRunning.next(
+    integ.assertions.awsApiCall('ECS', 'executeCommand', {
+      cluster: clusterArn,
+      task: taskArn,
+      container: 'default',
+      interactive: true,
+      command: '/bin/bash',
+    }).waitForAssertions({
+      totalTimeout: cdk.Duration.minutes(10),
+      interval: cdk.Duration.seconds(30),
+    }),
+  );
+}
+
+// Test EC2 job
+testEcsExecForJob(
+  'test-ecs-exec-ec2-job',
+  stack.ec2JobQueue,
+  stack.ec2JobDefinition,
+  stack.ec2ComputeEnvironment,
+);
+
+// Test Fargate job
+testEcsExecForJob(
+  'test-ecs-exec-fargate-job',
+  stack.fargateJobQueue,
+  stack.fargateJobDefinition,
+  stack.fargateComputeEnvironment,
+);

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-certificatemanager/README.md

@@ -146,6 +146,17 @@ new acm.PrivateCertificate(this, 'PrivateCertificate', {
 });
 ```
 
+## Requesting public SSL/TLS certificates exportable to use anywhere
+
+AWS Certificate Manager can issue an exportable public certificate. There is a charge at certificate issuance and again when the certificate renews. See [opting out of certificate transparency logging](https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html) for details.
+
+```ts
+new acm.Certificate(this, 'Certificate', {
+  domainName: 'test.example.com',
+  allowExport: true,
+});
+```
+
 ## Requesting certificates without transparency logging
 
 Transparency logging can be opted out of for AWS Certificate Manager certificates. See [opting out of certificate transparency logging](https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency) for limits.

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-cloudwatch/README.md

@@ -600,6 +600,19 @@ dashboard.addWidgets(new cloudwatch.GraphWidget({
 }));
 ```
 
+The `displayLabelsOnChart` property can be set to `true` to show labels on the chart. Note that this only has an effect when the `view` property is set to `cloudwatch.GraphWidgetView.PIE`.
+
+```ts
+declare const dashboard: cloudwatch.Dashboard;
+
+dashboard.addWidgets(new cloudwatch.GraphWidget({
+  // ...
+
+  view: cloudwatch.GraphWidgetView.PIE,
+  displayLabelsOnChart: true,
+}));
+```
+
 The `start` and `end` properties can be used to specify the time range for each graph widget independently from those of the dashboard.
 The parameters can be specified at `GraphWidget`, `GaugeWidget`, and `SingleValueWidget`.
 

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-cloudwatch/integ.dashboard-with-graphwidget-with-labels-visible.ts

@@ -0,0 +1,92 @@
+import { App, Stack, StackProps } from 'aws-cdk-lib';
+import {
+  Dashboard,
+  GraphWidget,
+  GraphWidgetProps,
+  GraphWidgetView,
+  Metric,
+  Shading,
+  Stats,
+  VerticalShading,
+} from 'aws-cdk-lib/aws-cloudwatch';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+
+class DashboardWithGraphWidgetWithLabelsVisibleIntegrationTest extends Stack {
+  constructor(scope: App, id: string, props?: StackProps) {
+    super(scope, id, props);
+    const dashboard = new Dashboard(this, 'Dash');
+    const metrics = [
+      new Metric({
+        namespace: 'CDK/Test',
+        metricName: 'Metric',
+        label: 'Metric left 1 - p99',
+        statistic: Stats.p(99),
+      }),
+
+      new Metric({
+        namespace: 'CDK/Test',
+        metricName: 'Metric',
+        label: 'Metric left 2 - TC_10P_90P',
+        statistic: Stats.tc(10, 90),
+      }),
+
+      new Metric({
+        namespace: 'CDK/Test',
+        metricName: 'Metric',
+        label: 'Metric left 3 - TS(5%:95%)',
+        statistic: 'TS(5%:95%)',
+      }),
+    ];
+
+    const widgetProps: GraphWidgetProps = {
+      title: 'My fancy graph',
+      left: metrics,
+      right: [],
+      view: GraphWidgetView.PIE,
+      leftAnnotations: [
+        {
+          value: 10,
+          label: 'Left annotation',
+          color: '#00ff00',
+          fill: Shading.ABOVE,
+          visible: true,
+        },
+      ],
+      rightAnnotations: [
+        {
+          value: 20,
+          label: 'Right annotation',
+          color: '#e30d0d',
+          fill: Shading.BELOW,
+          visible: false,
+        },
+      ],
+      verticalAnnotations: [
+        {
+          date: '2023-08-20T00:00:00.000Z',
+          label: 'Vertical annotation',
+          color: '#2556f6',
+          fill: VerticalShading.AFTER,
+          visible: true,
+        },
+      ],
+    };
+
+    dashboard.addWidgets(
+      new GraphWidget({
+        ...widgetProps,
+        displayLabelsOnChart: true,
+      }),
+      new GraphWidget({
+        ...widgetProps,
+        displayLabelsOnChart: false,
+      }),
+      new GraphWidget(widgetProps),
+    );
+  }
+}
+
+const app = new App();
+new IntegTest(app, 'cdk-integ-dashboard-with-graph-widget-with-annotations', {
+  testCases: [new DashboardWithGraphWidgetWithLabelsVisibleIntegrationTest(app, 'DashboardWithGraphWidgetWithLabelsVisibleIntegrationTest')],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-codebuild/README.md

@@ -376,6 +376,7 @@ can use the `environment` property to customize the build environment:
   details on how to define build images.
 * `certificate` defines the location of a PEM encoded certificate to import.
 * `computeType` defines the instance type used for the build.
+* `dockerServer` defines the docker server used for the build.
 * `privileged` can be set to `true` to allow privileged access.
 * `environmentVariables` can be set at this level (and also at the project
   level).

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-codebuild/integ.project-docker-server.ts

@@ -0,0 +1,44 @@
+import { App, Stack } from 'aws-cdk-lib';
+import { Project, BuildSpec, DockerServerComputeType, Source, ComputeType } from 'aws-cdk-lib/aws-codebuild';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+
+const app = new App();
+const stack = new Stack(app, 'codebuild-project-docker-server');
+
+const vpc = new ec2.Vpc(stack, 'Vpc', { restrictDefaultSecurityGroup: false });
+const sg = new ec2.SecurityGroup(stack, 'SecurityGroup', { vpc });
+
+const project = new Project(stack, 'MyProject', {
+  source: Source.gitHub({
+    owner: 'dockersamples',
+    repo: 'helloworld-demo-python',
+  }),
+  buildSpec: BuildSpec.fromObject({
+    version: '0.2',
+    phases: {
+      build: {
+        commands: [
+          'cd sample',
+          'docker buildx build .',
+        ],
+      },
+    },
+  }),
+  environment: {
+    computeType: ComputeType.SMALL,
+    dockerServer: {
+      computeType: DockerServerComputeType.SMALL,
+      securityGroups: [sg],
+    },
+  },
+});
+
+const integ = new IntegTest(app, 'codebuild-project-docker-server-integ', {
+  testCases: [stack],
+});
+
+// Execute the `startBuild` API to confirm that the build can be done correctly.
+integ.assertions.awsApiCall('CodeBuild', 'startBuild', {
+  projectName: project.projectName,
+}).waitForAssertions();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-codepipeline-actions/integ.pipeline-elastic-beanstalk-deploy.ts

@@ -2,11 +2,13 @@ import * as path from 'path';
 import * as codepipeline from 'aws-cdk-lib/aws-codepipeline';
 import * as elasticbeanstalk from 'aws-cdk-lib/aws-elasticbeanstalk';
 import * as iam from 'aws-cdk-lib/aws-iam';
+import { IManagedPolicy, ManagedPolicyReference } from 'aws-cdk-lib/aws-iam';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as deploy from 'aws-cdk-lib/aws-s3-deployment';
-import { App, Fn, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { App, Fn, RemovalPolicy, Stack, UnscopedValidationError } from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as cpactions from 'aws-cdk-lib/aws-codepipeline-actions';
+import { Node } from 'constructs';
 
 /**
  * To validate that the deployment actually succeeds, perform the following actions:
@@ -43,16 +45,26 @@ const artifact = new deploy.BucketDeployment(stack, 'DeployApp', {
   extract: false,
 });
 
+function makePolicy(arn: string): IManagedPolicy {
+  return {
+    managedPolicyArn: arn,
+    get managedPolicyRef(): ManagedPolicyReference {
+      return {
+        policyArn: this.managedPolicyArn,
+      };
+    },
+    get node(): Node {
+      throw new UnscopedValidationError('The result of fromAwsManagedPolicyName can not be used in this API');
+    },
+  };
+}
+
 const serviceRole = new iam.Role(stack, 'service-role', {
   roleName: 'codepipeline-elasticbeanstalk-action-test-serivce-role',
   assumedBy: new iam.ServicePrincipal('elasticbeanstalk.amazonaws.com'),
   managedPolicies: [
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth',
-    },
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy',
-    },
+    makePolicy('arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth'),
+    makePolicy('arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy'),
   ],
 });
 
@@ -60,15 +72,9 @@ const instanceProfileRole = new iam.Role(stack, 'instance-profile-role', {
   roleName: 'codepipeline-elasticbeanstalk-action-test-instance-profile-role',
   assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
   managedPolicies: [
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier',
-    },
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker',
-    },
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier',
-    },
+    makePolicy('arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier'),
+    makePolicy('arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker'),
+    makePolicy('arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier'),
   ],
 });
 

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecr-assets/README.md

@@ -163,6 +163,10 @@ This will instruct the toolkit to add the tarball as a file asset. During deploy
 from `local-image.tar`, push it to an Amazon ECR repository and wire the name of the repository as CloudFormation parameters
 to your stack.
 
+Similar to `DockerImageAsset`, you can set the `CDK_DOCKER` environment variable to provide a custom Docker executable 
+command or path. This may be needed when building in environments where the standard docker cannot be executed or when 
+using alternative container runtimes like Finch.
+
 ## Publishing images to ECR repositories
 
 `DockerImageAsset` is designed for seamless build & consumption of image assets by CDK code deployed to multiple environments

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/README.md

@@ -1591,6 +1591,8 @@ it in the constructor. Then add the Capacity Provider to the cluster. Finally,
 you can refer to the Provider by its name in your service's or task's Capacity
 Provider strategy.
 
+> **Note**: Cross-stack capacity provider registration is not supported. The ECS cluster and its capacity providers must be created in the same stack to avoid circular dependency issues.
+
 By default, Auto Scaling Group Capacity Providers will manage the scale-in and
 scale-out behavior of the auto scaling group based on the load your tasks put on
 the cluster, this is called [Managed Scaling](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/asg-capacity-providers.html#asg-capacity-providers-managed-scaling). If you'd

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-events-targets/README.md

@@ -15,6 +15,7 @@ Currently supported are:
   - [Start a StepFunctions state machine](#start-a-stepfunctions-state-machine)
   - [Queue a Batch job](#queue-a-batch-job)
   - [Invoke an API Gateway REST API](#invoke-an-api-gateway-rest-api)
+  - [Invoke an AWS API](#invoke-an-aws-api)
   - [Invoke an API Destination](#invoke-an-api-destination)
   - [Invoke an AppSync GraphQL API](#invoke-an-appsync-graphql-api)
   - [Put an event on an EventBridge bus](#put-an-event-on-an-eventbridge-bus)
@@ -333,6 +334,67 @@ declare const rule: events.Rule;
 rule.addTarget(new targets.ApiGatewayV2(httpApi));
 ```
 
+## Invoke an AWS API
+
+Use the `AwsApi` target to make direct AWS API calls from EventBridge rules. This is useful for invoking AWS services that don't have a dedicated EventBridge target.
+
+### Basic Usage
+
+The following example shows how to update an ECS service when a rule is triggered:
+
+```ts
+const rule = new events.Rule(this, 'Rule', {
+  schedule: events.Schedule.rate(Duration.hours(1)),
+});
+
+rule.addTarget(new targets.AwsApi({
+  service: 'ECS',
+  action: 'updateService',
+  parameters: {
+    service: 'my-service',
+    forceNewDeployment: true,
+  },
+}));
+```
+
+### IAM Permissions
+
+By default, the AwsApi target automatically creates the necessary IAM permissions based on the service and action you specify. The permission format follows the pattern: `service:Action`.
+
+For example:
+
+- `ECS` service with `updateService` action → `ecs:UpdateService` permission
+- `RDS` service with `createDBSnapshot` action → `rds:CreateDBSnapshot` permission
+
+### Custom IAM Policy
+
+In some cases, you may need to provide a custom IAM policy statement, especially when:
+
+- You need to restrict permissions to specific resources (instead of `*`)
+- The service requires additional permissions beyond the main action
+- You want more granular control over the permissions
+
+```ts
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+
+declare const rule: events.Rule;
+declare const bucket: s3.Bucket;
+
+rule.addTarget(new targets.AwsApi({
+  service: 's3',
+  action: 'GetBucketEncryption',
+  parameters: {
+    Bucket: bucket.bucketName,
+  },
+  policyStatement: new iam.PolicyStatement({
+    effect: iam.Effect.ALLOW,
+    actions: ['s3:GetEncryptionConfiguration'],
+    resources: [bucket.bucketArn],
+  }),
+}));
+```
+
 ## Invoke an API Destination
 
 Use the `targets.ApiDestination` target to trigger an external API. You need to
@@ -636,7 +698,7 @@ rule.addTarget(new targets.RedshiftQuery(workgroup.attrWorkgroupWorkgroupArn, {
 
 ## Publish to an SNS Topic
 
-Use the `SnsTopic` target to publish to an SNS Topic. 
+Use the `SnsTopic` target to publish to an SNS Topic.
 
 The code snippet below creates the scheduled event rule that publishes to an SNS Topic using a resource policy.
 
@@ -664,4 +726,4 @@ const rule = new events.Rule(this, 'Rule', {
 });
 
 rule.addTarget(new targets.SnsTopic(topic, { authorizeUsingRole: true }));
-```
+```