Merge branch 'main' into ebs-iops-io2-max

.github/workflows/github-merit-badger.yml

@@ -17,4 +17,4 @@ jobs:
           badges: '[beginning-contributor,repeat-contributor,valued-contributor,admired-contributor,star-contributor,distinguished-contributor]'
           thresholds: '[0,3,6,13,25,50]'
           badge-type: 'achievement'
-          ignore-usernames: '[rix0rrr,MrArnoldPalmer,iliapolo,otaviomacedo,madeline-k,kaizencc,comcalvi,TheRealAmazonKendra,vinayak-kukreja,mrgrain,pahud,cgarvis,kellertk,HBobertz,sumupitchayan,SankyRed,udaypant,colifran,khushail,scanlonp,mikewrighton,moelasmar,paulhcsun,awsmjs,evgenyka,GavinZZ,aws-cdk-automation,dependabot[bot],mergify[bot]]'
+          ignore-usernames: '[rix0rrr,MrArnoldPalmer,iliapolo,otaviomacedo,madeline-k,kaizencc,comcalvi,TheRealAmazonKendra,vinayak-kukreja,mrgrain,pahud,cgarvis,kellertk,HBobertz,sumupitchayan,SankyRed,udaypant,colifran,khushail,scanlonp,mikewrighton,moelasmar,paulhcsun,awsmjs,evgenyka,GavinZZ,aaythapa,xazhao,ConnorRobertson,ssenchenko,gracelu0,jfuss,SimonCMoore,aws-cdk-automation,dependabot[bot],mergify[bot]]'

.github/workflows/request-cli-integ-test.yml

@@ -19,7 +19,7 @@ jobs:
           persist-credentials: false
       - name: Find changed cli files
         id: changed-cli-files
-        uses: tj-actions/changed-files@716b1e13042866565e00e85fd4ec490e186c4a2f
+        uses: tj-actions/changed-files@62f4729b5df35e6e0e01265fa70a82ccaf196b4b
         with:
           base_sha: ${{ github.event.pull_request.base.sha }}
           files_yaml: |

.github/workflows/sync-from-upstream.yml

@@ -11,11 +11,15 @@ jobs:
 
   # Check for the presence of a PROJEN_GITHUB_TOKEN secret.
   #
-  # This is expected to contain a personal access token of someone
-  # who pas permissions to bypass branch protection rules.
+  # This is expected to contain a personal access token of someone who has
+  # permissions to bypass branch protection rules.
   #
-  # If not present, we will use GitHub Actions Token permissions,
-  # but those are bound by branch protection rules.
+  # If not present, we can only use GitHub Actions Token permissions,
+  # but this has the following downsides:
+  #
+  # - Those are bound by branch protection rules (so automated pushing won't work).
+  # - As soon as a workflow file needs to be changed, GitHub will reject the push.
+  #   Only Apps and Users can be allowed to modify workflows.
   check-secret:
     # Don't run on the target repo itself, only forks
     if: github.repository != 'aws/aws-cdk'
@@ -52,7 +56,7 @@ jobs:
       - name: Sync from aws/aws-cdk
         run: |-
           git remote add upstream https://github.com/aws/aws-cdk.git
-          git fetch upstream
+          git fetch upstream $BRANCHES
 
           for branch in $BRANCHES; do
             git push origin --force refs/remotes/upstream/$branch:refs/heads/$branch

.mergify.yml

@@ -11,7 +11,7 @@ pull_request_rules:
       label:
         add: [ contribution/core ]
     conditions:
-      - author~=^(rix0rrr|MrArnoldPalmer|iliapolo|otaviomacedo|madeline-k|kaizencc|comcalvi|TheRealAmazonKendra|vinayak-kukreja|mrgrain|pahud|cgarvis|kellertk|HBobertz|sumupitchayan|SankyRed|udaypant|colifran|scanlonp|mikewrighton|moelasmar|paulhcsun|awsmjs|evgenyka|GavinZZ)$
+      - author~=^(rix0rrr|MrArnoldPalmer|iliapolo|otaviomacedo|madeline-k|kaizencc|comcalvi|TheRealAmazonKendra|vinayak-kukreja|mrgrain|pahud|cgarvis|kellertk|HBobertz|sumupitchayan|SankyRed|udaypant|colifran|scanlonp|mikewrighton|moelasmar|paulhcsun|awsmjs|evgenyka|GavinZZ|aaythapa|xazhao|ConnorRobertson|ssenchenko|gracelu0|jfuss|SimonCMoore)$
       - -label~="contribution/core"
   - name: automatic merge
     actions:

CHANGELOG.v2.alpha.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.121.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.121.0-alpha.0...v2.121.1-alpha.0) (2024-01-13)
+
+## [2.121.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.120.0-alpha.0...v2.121.0-alpha.0) (2024-01-12)
+
+## [2.120.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.119.0-alpha.0...v2.120.0-alpha.0) (2024-01-12)
+
+## [2.119.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.118.0-alpha.0...v2.119.0-alpha.0) (2024-01-11)
+
+
+### Features
+
+* **neptune-alpha:** engineVersion v1.3 ([#28647](https://github.com/aws/aws-cdk/issues/28647)) ([957598b](https://github.com/aws/aws-cdk/commit/957598b5fe08298a9ab52a1d0b2069d6a73d59c0)), closes [#28648](https://github.com/aws/aws-cdk/issues/28648)
+
 ## [2.118.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.117.0-alpha.0...v2.118.0-alpha.0) (2024-01-03)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,52 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.121.1](https://github.com/aws/aws-cdk/compare/v2.121.0...v2.121.1) (2024-01-13)
+
+
+### Reverts
+
+* allowing log group config for SFN CR ([#28699](https://github.com/aws/aws-cdk/issues/28699)) ([f3f217e](https://github.com/aws/aws-cdk/commit/f3f217ee30ce4b7ef232a2a8caedb456415400a2)), closes [#27310](https://github.com/aws/aws-cdk/issues/27310)
+
+## [2.121.0](https://github.com/aws/aws-cdk/compare/v2.120.0...v2.121.0) (2024-01-12)
+
+
+### Features
+
+* **ec2:** add dual stack vpc support ([#28480](https://github.com/aws/aws-cdk/issues/28480)) ([754fd99](https://github.com/aws/aws-cdk/commit/754fd99e1963db9ec883c50784d3094cc463b70b)), closes [#894](https://github.com/aws/aws-cdk/issues/894)
+
+## [2.120.0](https://github.com/aws/aws-cdk/compare/v2.119.0...v2.120.0) (2024-01-12)
+
+
+### Features
+
+* **ecs:** support for capacity provider managed instance draining ([#28672](https://github.com/aws/aws-cdk/issues/28672)) ([cf97f47](https://github.com/aws/aws-cdk/commit/cf97f47d9f9a1a8716a1673eb9b906ab365ee11b))
+
+## [2.119.0](https://github.com/aws/aws-cdk/compare/v2.118.0...v2.119.0) (2024-01-11)
+
+
+### Features
+
+* **certificatemanager:** key algorithm support for `PrivateCertificate` and `Certificate` ([#28597](https://github.com/aws/aws-cdk/issues/28597)) ([1822cc9](https://github.com/aws/aws-cdk/commit/1822cc9164fb1ec638c8e8ed7f237548eea22c84)), closes [#22887](https://github.com/aws/aws-cdk/issues/22887)
+* **cli:** option to ignore no stacks ([#28387](https://github.com/aws/aws-cdk/issues/28387)) ([37c79b9](https://github.com/aws/aws-cdk/commit/37c79b94e3093b0cecc21c77e8bc79579ea002e5)), closes [#28371](https://github.com/aws/aws-cdk/issues/28371)
+* **cloudwatch-actions:** support alarm lambda action ([#28484](https://github.com/aws/aws-cdk/issues/28484)) ([b9f4923](https://github.com/aws/aws-cdk/commit/b9f49234d2c317d1c7dc143994d3e3b3b7bc430a)), closes [#28483](https://github.com/aws/aws-cdk/issues/28483)
+* **codebuild:** X-Large Linux compute type ([#28642](https://github.com/aws/aws-cdk/issues/28642)) ([7912d88](https://github.com/aws/aws-cdk/commit/7912d88a17b87c348e68250cbae2f6e0dc363429))
+* **opensearchservice:** TLS security policy for TLS 1.3 and perfect forward secrecy ([#28583](https://github.com/aws/aws-cdk/issues/28583)) ([9cf9baa](https://github.com/aws/aws-cdk/commit/9cf9baad5eca3790d7c0b351e0a6966a3ee4f881))
+* **pipelines:** expose crossRegionReplicationBuckets ([#28447](https://github.com/aws/aws-cdk/issues/28447)) ([d184ac2](https://github.com/aws/aws-cdk/commit/d184ac2c7dde4d40e39ea31a009ff0b31d064755)), closes [#28446](https://github.com/aws/aws-cdk/issues/28446)
+* **rds:** RDS for SQL Server 15.00.4345.5.v1 ([#28614](https://github.com/aws/aws-cdk/issues/28614)) ([0f38b6e](https://github.com/aws/aws-cdk/commit/0f38b6e283d3e8e471847ff691702a94675b340d))
+* **rds:** RDS for SQL Server 16 without a specific minor version ([#28615](https://github.com/aws/aws-cdk/issues/28615)) ([382d261](https://github.com/aws/aws-cdk/commit/382d261339c1910979982aa8faf00c3f5e066673))
+* **signer:** Notation-OCI-SHA384-ECDSA platform ([#28612](https://github.com/aws/aws-cdk/issues/28612)) ([d7aa196](https://github.com/aws/aws-cdk/commit/d7aa19677682d28592fe202a8065bd06d468fd12)), closes [#28580](https://github.com/aws/aws-cdk/issues/28580)
+* update L1 CloudFormation resource definitions ([#28613](https://github.com/aws/aws-cdk/issues/28613)) ([fdf4830](https://github.com/aws/aws-cdk/commit/fdf4830b28af379917ef6cbb46d4830da8910740))
+
+
+### Bug Fixes
+
+* **cli:** `cdk diff` falsely reports resource replacements on trivial template changes ([#28336](https://github.com/aws/aws-cdk/issues/28336)) ([10ed194](https://github.com/aws/aws-cdk/commit/10ed1948beb0f83c1b978da9c0a656aa01a382cb))
+* **core:** single-file bundling breaks due to left over temp dir ([#28566](https://github.com/aws/aws-cdk/issues/28566)) ([a74aacf](https://github.com/aws/aws-cdk/commit/a74aacfb362fac08ced4ebc3e176f89a71b57dd7))
+* **ec2:** passing keypair to instance unexpectedly does nothing ([#28482](https://github.com/aws/aws-cdk/issues/28482)) ([22e6ce8](https://github.com/aws/aws-cdk/commit/22e6ce8ad211955bcfa6d189f03e86c5a9727b36)), closes [#28478](https://github.com/aws/aws-cdk/issues/28478)
+* **ecs:** unnecessary CloudWatch logs ResourcePolicy ([#28495](https://github.com/aws/aws-cdk/issues/28495)) ([5f96d13](https://github.com/aws/aws-cdk/commit/5f96d13ea16e0ed7cbf2df3954c9b371371d3e5b)), [#22307](https://github.com/aws/aws-cdk/issues/22307) [#20313](https://github.com/aws/aws-cdk/issues/20313)
+* **stepfunctions:** retry block in CustomState is always empty ([#28598](https://github.com/aws/aws-cdk/issues/28598)) ([0042e53](https://github.com/aws/aws-cdk/commit/0042e531257eb6979e1e90117316004a643c60a8)), closes [#28586](https://github.com/aws/aws-cdk/issues/28586)
+
 ## [2.118.0](https://github.com/aws/aws-cdk/compare/v2.117.0...v2.118.0) (2024-01-03)
 
 

ROADMAP.md

@@ -48,8 +48,8 @@ Security and stability of the CDK is a top priority. If you think you’ve found
 * 👂🏽 [CDK CLI Triggers](https://github.com/aws/aws-cdk-rfcs/issues/228) - CLI enhancements are also being considered for post command hooks. 
 
 ### L2 Abstractions
+* 🚀 [Enabling IPv6 on Resources and VPCs](https://github.com/aws/aws-cdk/pull/28366)
 * 🔍 [CloudFront Origin Access Control L2](https://github.com/aws/aws-cdk-rfcs/issues/491)
-* 🛠️ [Enabling IPv6 on Resources and VPCs](https://github.com/aws/aws-cdk/pull/28366)
 * 🔍 [Rewrite EKS L2](https://github.com/aws/aws-cdk-rfcs/issues/605) - drop the custom resource implementation in favor of the native L1.
 
 We are currently investigating other L2s to build out next. Feel free to create an RFC to request.

allowed-breaking-changes.txt

@@ -229,3 +229,10 @@ removed:aws-cdk-lib.aws_backup.BackupPlanRuleProps.schedule
 
 # This data identifer was added by mistake; it had never worked.
 removed:aws-cdk-lib.aws_logs.DataIdentifier.PHONENUMBER
+
+# These newly exported classes have been reverted and are no longer publicly consumeable
+removed:aws-cdk-lib.custom_resources.WaiterStateMachine
+removed:aws-cdk-lib.custom_resources.LogOptions
+removed:aws-cdk-lib.custom_resources.WaiterStateMachineProps
+removed:aws-cdk-lib.custom_resources.ProviderProps.disableWaiterStateMachineLogging
+removed:aws-cdk-lib.custom_resources.ProviderProps.waiterStateMachineLogOptions

docs/DESIGN_GUIDELINES.md

@@ -929,7 +929,7 @@ the user.
 Constructs that represent such resources should conform to the following
 guidelines.
 
-An optional prop called **role** of type **iam.IRole**should be exposed to allow
+An optional prop called **role** of type **iam.IRole** should be exposed to allow
 users to "bring their own role", and use either an owned or unowned role
 _[awslint:role-config-prop]_.
 

package.json

@@ -28,7 +28,7 @@
     "jsii-diff": "1.94.0",
     "jsii-pacmak": "1.94.0",
     "jsii-reflect": "1.94.0",
-    "jsii-rosetta": "~5.3.3",
+    "jsii-rosetta": "~5.3.4",
     "lerna": "^7.4.2",
     "nx": "^16.10.0",
     "patch-package": "^6.5.1",

packages/@aws-cdk-testing/cli-integ/package.json

@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@octokit/rest": "^18.12.0",
-    "aws-sdk": "^2.1532.0",
+    "aws-sdk": "^2.1537.0",
     "axios": "^1.6.5",
     "fs-extra": "^9.1.0",
     "glob": "^7.2.3",

packages/@aws-cdk-testing/cli-integ/resources/cdk-apps/app/app.js

@@ -65,7 +65,7 @@ class YourStack extends cdk.Stack {
   }
 }
 
-class ImportableStack extends cdk.Stack {
+class MigrateStack extends cdk.Stack {
   constructor(parent, id, props) {
     super(parent, id, props);
 
@@ -77,11 +77,22 @@ class ImportableStack extends cdk.Stack {
       new cdk.CfnOutput(this, 'QueueName', {
         value: queue.queueName,
       });
+
+      new cdk.CfnOutput(this, 'QueueUrl', {
+        value: queue.queueUrl,
+      });
+
       new cdk.CfnOutput(this, 'QueueLogicalId', {
         value: queue.node.defaultChild.logicalId,
       });
     }
 
+  }
+}
+
+class ImportableStack extends MigrateStack {
+  constructor(parent, id, props) {
+    super(parent, id, props);
     new cdk.CfnWaitConditionHandle(this, 'Handle');
   }
 }
@@ -470,6 +481,8 @@ switch (stackSet) {
 
     new ImportableStack(app, `${stackPrefix}-importable-stack`);
 
+    new MigrateStack(app, `${stackPrefix}-migrate-stack`);
+
     new ExportValueStack(app, `${stackPrefix}-export-value-stack`);
 
     new BundlingStage(app, `${stackPrefix}-bundling-stage`);

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts

@@ -1213,6 +1213,45 @@ integTest('test resource import', withDefaultFixture(async (fixture) => {
   }
 }));
 
+integTest('test migrate deployment for app with localfile source in migrate.json', withDefaultFixture(async (fixture) => {
+  const outputsFile = path.join(fixture.integTestDir, 'outputs', 'outputs.json');
+  await fs.mkdir(path.dirname(outputsFile), { recursive: true });
+
+  // Initial deploy
+  await fixture.cdkDeploy('migrate-stack', {
+    modEnv: { ORPHAN_TOPIC: '1' },
+    options: ['--outputs-file', outputsFile],
+  });
+
+  const outputs = JSON.parse((await fs.readFile(outputsFile, { encoding: 'utf-8' })).toString());
+  const stackName = fixture.fullStackName('migrate-stack');
+  const queueName = outputs[stackName].QueueName;
+  const queueUrl = outputs[stackName].QueueUrl;
+  const queueLogicalId = outputs[stackName].QueueLogicalId;
+  fixture.log(`Created queue ${queueUrl} in stack ${fixture.fullStackName}`);
+
+  // Write the migrate file based on the ID from step one, then deploy the app with migrate
+  const migrateFile = path.join(fixture.integTestDir, 'migrate.json');
+  await fs.writeFile(
+    migrateFile, JSON.stringify(
+      { Source: 'localfile', Resources: [{ ResourceType: 'AWS::SQS::Queue', LogicalResourceId: queueLogicalId, ResourceIdentifier: { QueueUrl: queueUrl } }] },
+    ),
+    { encoding: 'utf-8' },
+  );
+
+  await fixture.cdkDestroy('migrate-stack');
+  fixture.log(`Deleted stack ${fixture.fullStackName}, orphaning ${queueName}`);
+
+  // Create new stack from existing queue
+  try {
+    fixture.log(`Deploying new stack ${fixture.fullStackName}, migrating ${queueName} into stack`);
+    await fixture.cdkDeploy('migrate-stack');
+  } finally {
+    // Cleanup
+    await fixture.cdkDestroy('migrate-stack');
+  }
+}));
+
 integTest('hotswap deployment supports Lambda function\'s description and environment variables', withDefaultFixture(async (fixture) => {
   // GIVEN
   const stackArn = await fixture.cdkDeploy('lambda-hotswap', {

packages/@aws-cdk-testing/framework-integ/package.json

@@ -41,10 +41,10 @@
     "@aws-cdk/integ-tests-alpha": "0.0.0",
     "@aws-cdk/lambda-layer-kubectl-v24": "^2.0.242",
     "aws-cdk-lib": "0.0.0",
-    "aws-sdk": "^2.1532.0",
+    "aws-sdk": "^2.1537.0",
     "aws-sdk-mock": "5.6.0",
-    "cdk8s": "2.68.25",
-    "cdk8s-plus-27": "2.7.71",
+    "cdk8s": "2.68.27",
+    "cdk8s-plus-27": "2.7.73",
     "constructs": "^10.0.0"
   },
   "repository": {