aws · mergify · May 5, 2025 · Feb 28, 2025 · Mar 10, 2025 · Mar 11, 2025
diff --git a/packages/aws-cdk-lib/README.md b/packages/aws-cdk-lib/README.md
@@ -1546,4 +1546,73 @@ warning by the `id`.
 Annotations.of(this).acknowledgeWarning('IAM:Group:MaxPoliciesExceeded', 'Account has quota increased to 20');
 ```
 
+## Blueprint Property Injection
+
+The goal of Blueprint Property Injection is to provide builders an automatic way to set default property values.
+
+Construct authors can declare that a Construct can have it properties injected by adding `@propertyInjectable`
+class decorator and specifying `PROPERTY_INJECTION_ID` readonly property.  For example:
+
+```ts
+@propertyInjectable
+export class ApiKey extends ApiKeyBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.ApiKey';
+  ...
+}
+```
+
+Organizations can set default property values to a Construct by writing Injectors for builders to consume.
+
+Here is a simple example of an Injector for APiKey.  
+```ts
+export class ApiKeyPropsInjector implements IPropertyInjector {
+  readonly constructUniqueId: string;
+
+  constructor() {
+    this.constructUniqueId = ApiKey.PROPERTY_INJECTION_ID;
+  }
+
+  inject(originalProps: ApiKeyProps, context: InjectionContext): ApiKeyProps {
+    return {
+      enabled: false,
+      ...originalProps,
+    };
+  }
+}
+```
+Some notes:
+* ApiKey must have a `PROPERTY_INJECTION_ID` property, in addition to having `@propertyInjectable` class decorator.
+* We set ApiKeyProps.enabled to false, if it is not provided; otherwise it would use the value that was passed in.
+* It is also possible to force ApiKeyProps.enabled to false, and not provide a way for the builders to overwrite it.
+
+Here is an example of how builders can use the injector the org created.
+
+```ts
+const app = new App({});
+const stack = new Stack(app2, 'my-stack', {
+  propertyInjectors: [new ApiKeyPropsInjector()],
+});
+new ApiKey(stack, 'my-api-key', {});
+```
+
+This is equivalent to:
+
+```ts
+const app = new App({});
+const stack = new Stack(app, 'my-stack', {});
+new ApiKey(stack, 'my-api-key', {
+  enabled: false,
+});
+```
+
+Some notes:
+* We attach the injectors to Stack in this example, but we can also attach them to App or Stage.
+* All the ApiKey created in the scope of stack will get `enabled: false`.
+* Builders can overwrite the default value with `new ApiKey(stack, 'my-api-key', {enabled: true});`
+
+For more information, please see the [RFC](https://github.com/aws/aws-cdk-rfcs/blob/main/text/0693-property-injection.md).
+
 <!--END CORE DOCUMENTATION-->
diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/api-key.ts b/packages/aws-cdk-lib/aws-apigateway/lib/api-key.ts
@@ -8,6 +8,7 @@ import * as iam from '../../aws-iam';
 import { ArnFormat, IResource as IResourceBase, Resource, Stack } from '../../core';
 import { ValidationError } from '../../core/lib/errors';
 import { addConstructMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 
 /**
  * API keys are alphanumeric string values that you distribute to
@@ -145,7 +146,13 @@ abstract class ApiKeyBase extends Resource implements IApiKey {
  * An ApiKey can be distributed to API clients that are executing requests
  * for Method resources that require an Api Key.
  */
+@propertyInjectable
 export class ApiKey extends ApiKeyBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.ApiKey';
+
   /**
    * Import an ApiKey by its Id
    */

diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/deployment.ts b/packages/aws-cdk-lib/aws-apigateway/lib/deployment.ts
@@ -6,6 +6,7 @@ import { Lazy, RemovalPolicy, Resource, CfnResource } from '../../core';
 import { ValidationError } from '../../core/lib/errors';
 import { md5hash } from '../../core/lib/helpers-internal';
 import { addConstructMetadata, MethodMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 
 export interface DeploymentProps {
   /**
@@ -69,7 +70,13 @@ export interface DeploymentProps {
  * model. Use the `node.addDependency(dep)` method to circumvent that. This is done
  * automatically for the `restApi.latestDeployment` deployment.
  */
+@propertyInjectable
 export class Deployment extends Resource {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.Deployment';
+
   /** @attribute */
   public readonly deploymentId: string;
   public readonly api: IRestApi;

diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/domain-name.ts b/packages/aws-cdk-lib/aws-apigateway/lib/domain-name.ts
@@ -9,6 +9,7 @@ import { IBucket } from '../../aws-s3';
 import { IResource, Names, Resource, Token } from '../../core';
 import { ValidationError } from '../../core/lib/errors';
 import { addConstructMetadata, MethodMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 
 /**
  * Options for creating an api mapping
@@ -116,7 +117,13 @@ export interface IDomainName extends IResource {
   readonly domainNameAliasHostedZoneId: string;
 }
 
+@propertyInjectable
 export class DomainName extends Resource implements IDomainName {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.DomainName';
+
   /**
    * Imports an existing domain name.
    */

diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/lambda-api.ts b/packages/aws-cdk-lib/aws-apigateway/lib/lambda-api.ts
@@ -7,6 +7,7 @@ import { RestApi, RestApiProps } from './restapi';
 import * as lambda from '../../aws-lambda';
 import { UnscopedValidationError, ValidationError } from '../../core/lib/errors';
 import { addConstructMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 
 export interface LambdaRestApiProps extends RestApiProps {
   /**
@@ -51,7 +52,13 @@ export interface LambdaRestApiProps extends RestApiProps {
  * method from the specified path. If not defined, you will need to explicity
  * add resources and methods to the API.
  */
+@propertyInjectable
 export class LambdaRestApi extends RestApi {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.LambdaRestApi';
+
   constructor(scope: Construct, id: string, props: LambdaRestApiProps) {
     if (props.options?.defaultIntegration || props.defaultIntegration) {
       throw new ValidationError('Cannot specify "defaultIntegration" since Lambda integration is automatically defined', scope);

diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/method.ts b/packages/aws-cdk-lib/aws-apigateway/lib/method.ts
@@ -13,7 +13,7 @@ import { IStage } from './stage';
 import { validateHttpMethod } from './util';
 import * as cloudwatch from '../../aws-cloudwatch';
 import * as iam from '../../aws-iam';
-import { Annotations, ArnFormat, FeatureFlags, Lazy, Names, Resource, Stack } from '../../core';
+import { propertyInjectable, Annotations, ArnFormat, FeatureFlags, Lazy, Names, Resource, Stack } from '../../core';
 import { ValidationError } from '../../core/lib/errors';
 import { addConstructMetadata, MethodMetadata } from '../../core/lib/metadata-resource';
 import { APIGATEWAY_REQUEST_VALIDATOR_UNIQUE_ID } from '../../cx-api';
@@ -163,7 +163,13 @@ export interface MethodProps {
   readonly options?: MethodOptions;
 }
 
+@propertyInjectable
 export class Method extends Resource {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.Method';
+
   /** @attribute */
   public readonly methodId: string;
 

diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/restapi.ts b/packages/aws-cdk-lib/aws-apigateway/lib/restapi.ts
@@ -20,6 +20,7 @@ import * as iam from '../../aws-iam';
 import { ArnFormat, CfnOutput, IResource as IResourceBase, Resource, Stack, Token, FeatureFlags, RemovalPolicy, Size, Lazy } from '../../core';
 import { ValidationError } from '../../core/lib/errors';
 import { addConstructMetadata, MethodMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 import { APIGATEWAY_DISABLE_CLOUDWATCH_ROLE } from '../../cx-api';
 
 const RESTAPI_SYMBOL = Symbol.for('@aws-cdk/aws-apigateway.RestApiBase');
@@ -723,7 +724,13 @@ export abstract class RestApiBase extends Resource implements IRestApi, iam.IRes
  *
  * @resource AWS::ApiGateway::RestApi
  */
+@propertyInjectable
 export class SpecRestApi extends RestApiBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.SpecRestApi';
+
   /**
    * The ID of this API Gateway RestApi.
    */
@@ -818,7 +825,13 @@ export interface RestApiAttributes {
  * By default, the API will automatically be deployed and accessible from a
  * public endpoint.
  */
+@propertyInjectable
 export class RestApi extends RestApiBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.RestApi';
+
   /**
    * Return whether the given object is a `RestApi`
    */

diff --git a/packages/aws-cdk-lib/aws-apigateway/lib/stage.ts b/packages/aws-cdk-lib/aws-apigateway/lib/stage.ts
@@ -10,6 +10,7 @@ import * as cloudwatch from '../../aws-cloudwatch';
 import { ArnFormat, Duration, IResource, Resource, Stack, Token } from '../../core';
 import { ValidationError } from '../../core/lib/errors';
 import { addConstructMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 
 /**
  * Represents an APIGateway Stage.
@@ -358,7 +359,13 @@ export abstract class StageBase extends Resource implements IStage {
   }
 }
 
+@propertyInjectable
 export class Stage extends StageBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigateway.Stage';
+
   /**
    * Import a Stage by its attributes
    */

diff --git a/packages/aws-cdk-lib/aws-apigatewayv2/lib/common/domain-name.ts b/packages/aws-cdk-lib/aws-apigatewayv2/lib/common/domain-name.ts
@@ -5,6 +5,7 @@ import { IBucket } from '../../../aws-s3';
 import { IResource, Lazy, Resource, Token } from '../../../core';
 import { ValidationError } from '../../../core/lib/errors';
 import { addConstructMetadata, MethodMetadata } from '../../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../../core/lib/prop-injectors';
 
 /**
  * The minimum version of the SSL protocol that you want API Gateway to use for HTTPS connections.
@@ -152,7 +153,13 @@ export interface MTLSConfig {
 /**
  * Custom domain resource for the API
  */
+@propertyInjectable
 export class DomainName extends Resource implements IDomainName {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigatewayv2.DomainName';
+
   /**
    * Import from attributes
    */

diff --git a/packages/aws-cdk-lib/aws-apigatewayv2/lib/http/api.ts b/packages/aws-cdk-lib/aws-apigatewayv2/lib/http/api.ts
@@ -9,6 +9,7 @@ import { Metric, MetricOptions } from '../../../aws-cloudwatch';
 import { ArnFormat, Duration, Stack, Token } from '../../../core';
 import { ValidationError } from '../../../core/lib/errors';
 import { addConstructMetadata, MethodMetadata } from '../../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../../core/lib/prop-injectors';
 import { IApi } from '../common/api';
 import { ApiBase } from '../common/base';
 import { DomainMappingOptions } from '../common/stage';
@@ -352,7 +353,13 @@ export interface HttpApiAttributes {
  * Create a new API Gateway HTTP API endpoint.
  * @resource AWS::ApiGatewayV2::Api
  */
+@propertyInjectable
 export class HttpApi extends HttpApiBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigatewayv2.HttpApi';
+
   /**
    * Import an existing HTTP API into this CDK app.
    */

diff --git a/packages/aws-cdk-lib/aws-apigatewayv2/lib/http/authorizer.ts b/packages/aws-cdk-lib/aws-apigatewayv2/lib/http/authorizer.ts
@@ -5,6 +5,7 @@ import { CfnAuthorizer } from '.././index';
 import { Duration, Resource } from '../../../core';
 import { ValidationError } from '../../../core/lib/errors';
 import { addConstructMetadata } from '../../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../../core/lib/prop-injectors';
 import { IAuthorizer } from '../common';
 
 /**
@@ -135,7 +136,13 @@ export interface HttpAuthorizerAttributes {
  * An authorizer for Http Apis
  * @resource AWS::ApiGatewayV2::Authorizer
  */
+@propertyInjectable
 export class HttpAuthorizer extends Resource implements IHttpAuthorizer {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigatewayv2.HttpAuthorizer';
+
   /**
    * Import an existing HTTP Authorizer into this CDK app.
    */

diff --git a/packages/aws-cdk-lib/aws-apigatewayv2/lib/http/route.ts b/packages/aws-cdk-lib/aws-apigatewayv2/lib/http/route.ts
@@ -7,6 +7,7 @@ import * as iam from '../../../aws-iam';
 import { Aws, Resource } from '../../../core';
 import { UnscopedValidationError, ValidationError } from '../../../core/lib/errors';
 import { addConstructMetadata, MethodMetadata } from '../../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../../core/lib/prop-injectors';
 import { IRoute } from '../common';
 
 /**
@@ -173,7 +174,13 @@ enum HttpRouteAuthorizationType {
  * Route class that creates the Route for API Gateway HTTP API
  * @resource AWS::ApiGatewayV2::Route
  */
+@propertyInjectable
 export class HttpRoute extends Resource implements IHttpRoute {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-apigatewayv2.HttpRoute';
+
   public readonly routeId: string;
   public readonly httpApi: IHttpApi;
   public readonly path?: string;

diff --git a/packages/aws-cdk-lib/aws-appmesh/lib/virtual-gateway.ts b/packages/aws-cdk-lib/aws-appmesh/lib/virtual-gateway.ts
@@ -8,6 +8,7 @@ import { VirtualGatewayListener, VirtualGatewayListenerConfig } from './virtual-
 import * as iam from '../../aws-iam';
 import * as cdk from '../../core';
 import { addConstructMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 
 /**
  * Interface which all Virtual Gateway based classes must implement
@@ -129,7 +130,13 @@ abstract class VirtualGatewayBase extends cdk.Resource implements IVirtualGatewa
  *
  * @see https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html
  */
+@propertyInjectable
 export class VirtualGateway extends VirtualGatewayBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-appmesh.VirtualGateway';
+
   /**
    * Import an existing VirtualGateway given an ARN
    */

diff --git a/packages/aws-cdk-lib/aws-appmesh/lib/virtual-node.ts b/packages/aws-cdk-lib/aws-appmesh/lib/virtual-node.ts
@@ -8,6 +8,7 @@ import { VirtualNodeListener, VirtualNodeListenerConfig } from './virtual-node-l
 import * as iam from '../../aws-iam';
 import * as cdk from '../../core';
 import { addConstructMetadata, MethodMetadata } from '../../core/lib/metadata-resource';
+import { propertyInjectable } from '../../core/lib/prop-injectors';
 
 /**
  * Interface which all VirtualNode based classes must implement
@@ -133,7 +134,13 @@ abstract class VirtualNodeBase extends cdk.Resource implements IVirtualNode {
  *
  * @see https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_nodes.html
  */
+@propertyInjectable
 export class VirtualNode extends VirtualNodeBase {
+  /**
+   * Uniquely identifies this class.
+   */
+  public static readonly PROPERTY_INJECTION_ID: string = 'aws-cdk-lib.aws-appmesh.VirtualNode';
+
   /**
    * Import an existing VirtualNode given an ARN
    */