chore(release): 1.38.0

.github/workflows/close-stale-issues.yml

@@ -14,14 +14,14 @@ jobs:
       with:
         # Setting messages to an empty string will cause the automation to skip
         # that category
-        ancient-issue-message: This issue has not received any attention in 3 years. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
+        ancient-issue-message: This issue has not received any attention in 2 years. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
         stale-issue-message: This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
         stale-pr-message: This PR has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
 
         # These labels are required
         stale-issue-label: closing-soon
         exempt-issue-label: no-autoclose
-        stale-pr-label: pr/no-activity
+        stale-pr-label: closing-soon
         exempt-pr-label: no-autoclose
         response-requested-label: response-requested
 
@@ -32,7 +32,7 @@ jobs:
         # Issue timing
         days-before-stale: 7
         days-before-close: 4
-        days-before-ancient: 1095
+        days-before-ancient: 730
 
         # If you don't want to mark a issue as being ancient based on a
         # threshold of "upvotes", you can set this here. An "upvote" is
@@ -43,4 +43,4 @@ jobs:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         # loglevel: DEBUG
         # Set dry-run to true to not perform label or close actions.
-        dry-run: true
+        dry-run: false

CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.38.0](https://github.com/aws/aws-cdk/compare/v1.37.0...v1.38.0) (2020-05-08)
+
+
+### Features
+
+* **cloudfront:** support geo restrictions for cloudfront distribution ([#7345](https://github.com/aws/aws-cdk/issues/7345)) ([cf25ba0](https://github.com/aws/aws-cdk/commit/cf25ba0dc3baae8db40219611f7aa919b108c739)), closes [#3456](https://github.com/aws/aws-cdk/issues/3456)
+* **cloudwatch:** legend positions in GraphWidgets ([ada0de1](https://github.com/aws/aws-cdk/commit/ada0de1f051a72768523544b5bca27e0768632a9)), closes [#3625](https://github.com/aws/aws-cdk/issues/3625)
+* **codebuild:** add support for test reports ([4befefc](https://github.com/aws/aws-cdk/commit/4befefc4792c6d6415f356f8d40e115e9e602802)), closes [#7367](https://github.com/aws/aws-cdk/issues/7367)
+* **core:** custom resource provider helper ([4a76973](https://github.com/aws/aws-cdk/commit/4a7697370c9d04fdbb2c9fb0be71d67122573390))
+* **ec2:** EBS volume configuration for BastionHostLinux ([207a8ec](https://github.com/aws/aws-cdk/commit/207a8ecf233511ad478827620b9caf0ff5fbb815)), closes [#6945](https://github.com/aws/aws-cdk/issues/6945)
+* **ecs:** support multiple security groups when creating an ecs service ([#7850](https://github.com/aws/aws-cdk/issues/7850)) ([456c469](https://github.com/aws/aws-cdk/commit/456c469dd4b92a6a863e4c40125adf573d4df239))
+* **iam:** openid connect providers ([20621ac](https://github.com/aws/aws-cdk/commit/20621acf6c1adbf144d47a029888fe481d5abb78)), closes [#5388](https://github.com/aws/aws-cdk/issues/5388) [#3949](https://github.com/aws/aws-cdk/issues/3949) [#6308](https://github.com/aws/aws-cdk/issues/6308)
+* add an example construct package ([#7748](https://github.com/aws/aws-cdk/issues/7748)) ([2223584](https://github.com/aws/aws-cdk/commit/2223584d5f9811294125c6d6068d1f5bb4e48349))
+* **lambda-nodejs:** run parcel in a docker container ([d86e500](https://github.com/aws/aws-cdk/commit/d86e5001e08c21b846c47ed051f6c17fc9826d1a)), closes [#7169](https://github.com/aws/aws-cdk/issues/7169)
+* cloudformation spec v14.1.0 ([#7822](https://github.com/aws/aws-cdk/issues/7822)) ([e133027](https://github.com/aws/aws-cdk/commit/e1330273fbc700285d737e57a8d20f2857be2f82))
+* **s3:** new `s3UrlForObject` method on `IBucket` ([#7508](https://github.com/aws/aws-cdk/issues/7508)) ([8fe4015](https://github.com/aws/aws-cdk/commit/8fe4015a9357623434fb2825e3342ffc145a13f8)), closes [#7507](https://github.com/aws/aws-cdk/issues/7507)
+* **stepfunctions:** custom state as an escape hatch ([c498f60](https://github.com/aws/aws-cdk/commit/c498f60d34b5bd01fc95f7999bc605e10edbb717))
+
+
+### Bug Fixes
+
+* **assets): fix(assets:** invalid fingerprint when 'exclude' captures root directory name ([#7719](https://github.com/aws/aws-cdk/issues/7719)) ([a5c06a3](https://github.com/aws/aws-cdk/commit/a5c06a3a27b39a5315d0cfd0d34b3c1b25cfc464)), closes [#7718](https://github.com/aws/aws-cdk/issues/7718)
+* **aws-batch:** gpuCount was ignored in JobDefinition creation ([#7587](https://github.com/aws/aws-cdk/issues/7587)) ([0f1bf23](https://github.com/aws/aws-cdk/commit/0f1bf23817774eb94505a6c68f1daa8a117bbd42))
+* **cli:** parameter value reuse is not configurable ([44310c9](https://github.com/aws/aws-cdk/commit/44310c93af939f8aaf9ca4245c944b5c93f61ab7)), closes [#7041](https://github.com/aws/aws-cdk/issues/7041)
+* **core:** docs refer to "createNamingScheme" which was renamed to "allocateLogicalId" ([#7840](https://github.com/aws/aws-cdk/issues/7840)) ([d79595d](https://github.com/aws/aws-cdk/commit/d79595d854adf160c0a6395a5f535ee270bbdf69)), closes [#7527](https://github.com/aws/aws-cdk/issues/7527)
+* **ecs:** update minHealthyPercent constrain for ec2service using daemon strategy ([#7814](https://github.com/aws/aws-cdk/issues/7814)) ([19e3fd8](https://github.com/aws/aws-cdk/commit/19e3fd800af5a32dfb359f4be4717fbf3adb91df))
+* **ecs:** using secret JSON field with fargate task does not fail ([#7317](https://github.com/aws/aws-cdk/issues/7317)) ([cb03a60](https://github.com/aws/aws-cdk/commit/cb03a601599b56539081caf602647d1f431d2d59)), closes [#7272](https://github.com/aws/aws-cdk/issues/7272)
+* **eks:** "vendor response doesn't contain attribute" when updating version ([#7830](https://github.com/aws/aws-cdk/issues/7830)) ([8cabae0](https://github.com/aws/aws-cdk/commit/8cabae0a03cc526f5f7fbfebf22978ad88efcb4f)), closes [#7526](https://github.com/aws/aws-cdk/issues/7526) [#7794](https://github.com/aws/aws-cdk/issues/7794)
+* **s3:** grantDelete with KMS SSE ([#7528](https://github.com/aws/aws-cdk/issues/7528)) ([c6d1a21](https://github.com/aws/aws-cdk/commit/c6d1a21b09967d787404101829058106ed74852a)), closes [#4380](https://github.com/aws/aws-cdk/issues/4380)
+* **secretsmanager:** add kms policy to allow secret to use kms key ([5460717](https://github.com/aws/aws-cdk/commit/54607175115663bd49d8a57cb82b814414e7e78a))
+
 ## [1.37.0](https://github.com/aws/aws-cdk/compare/v1.36.0...v1.37.0) (2020-05-05)
 
 
@@ -23,7 +54,6 @@ maps to the domain root.
 * **core:** move all types from "aws-cloudformation" to "core" ([#7736](https://github.com/aws/aws-cdk/issues/7736)) ([40fa93a](https://github.com/aws/aws-cdk/commit/40fa93a22ffbdf18b0563d1cef63bbf5814dcc3f)), closes [#4896](https://github.com/aws/aws-cdk/issues/4896) [#7035](https://github.com/aws/aws-cdk/issues/7035) [#7034](https://github.com/aws/aws-cdk/issues/7034)
 * **core:** stack termination protection ([#7610](https://github.com/aws/aws-cdk/issues/7610)) ([7ed60b8](https://github.com/aws/aws-cdk/commit/7ed60b8a5d42e93e556e3b6e9ee3618931747ac2)), closes [#1682](https://github.com/aws/aws-cdk/issues/1682)
 * **ecr:** support imageScanOnPush when creating the repository ([9df5486](https://github.com/aws/aws-cdk/commit/9df5486306fda01d963f4b1195fe8c8532cc4668)), closes [#7471](https://github.com/aws/aws-cdk/issues/7471)
-* **lambda-nodejs:** use docker instead of npm package for parcel-bundler ([55c4d0b](https://github.com/aws/aws-cdk/commit/55c4d0bb35aad7b026a88cf1a38a37af9af33f9f))
 
 
 ### Bug Fixes

CONTRIBUTING.md

@@ -51,7 +51,7 @@ For day-to-day development and normal contributions, the following SDKs and tool
  - [Node.js 10.13.0](https://nodejs.org/download/release/latest-v10.x/)
  - [Yarn >= 1.19.1](https://yarnpkg.com/lang/en/docs/install)
  - [Java OpenJDK 8](http://openjdk.java.net/install/)
- - [.NET Core SDK 3.0](https://www.microsoft.com/net/download)
+ - [.NET Core SDK 3.1](https://www.microsoft.com/net/download)
  - [Python 3.6.5](https://www.python.org/downloads/release/python-365/)
  - [Ruby 2.5.1](https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/)
 
@@ -131,6 +131,11 @@ Work your magic. Here are some guidelines:
 * Try to maintain a single feature/bugfix per pull request. It's okay to introduce a little bit of housekeeping
    changes along the way, but try to avoid conflating multiple features. Eventually all these are going to go into a
    single commit, so you can use that to frame your scope.
+* If your change introduces a new construct, take a look at the our
+  [example Construct Library](packages/@aws-cdk/example-construct-library) for an explanation of the common patterns we use.
+  Feel free to start your contribution by copy&pasting files from that project,
+  and then edit and rename them as appropriate -
+  it might be easier to get started that way.
 
 #### Integration Tests
 

allowed-breaking-changes.txt

@@ -49,3 +49,6 @@ incompatible-argument:@aws-cdk/aws-iam.PrincipalPolicyFragment.<initializer>
 changed-type:@aws-cdk/aws-iam.FederatedPrincipal.conditions
 changed-type:@aws-cdk/aws-iam.PrincipalPolicyFragment.conditions
 changed-type:@aws-cdk/aws-iam.PrincipalWithConditions.conditions
+# Changing untyped property blob into typed property blob
+change-return-type:@aws-cdk/cloud-assembly-schema.Manifest.load
+incompatible-argument:@aws-cdk/cloud-assembly-schema.Manifest.save

buildspec-pr.yaml

@@ -5,6 +5,10 @@ version: 0.2
 phases:
   install:
     commands:
+      # Start docker daemon inside the container
+      - nohup /usr/bin/dockerd --host=unix:///var/run/docker.sock --host=tcp://127.0.0.1:2375 --storage-driver=overlay2&
+      - timeout 15 sh -c "until docker info; do echo .; sleep 1; done"
+
       # Install yarn if it wasn't already present in the image
       - yarn --version || npm -g install yarn
   build:

buildspec.yaml

@@ -5,6 +5,10 @@ version: 0.2
 phases:
   install:
     commands:
+      # Start docker daemon inside the container
+      - nohup /usr/bin/dockerd --host=unix:///var/run/docker.sock --host=tcp://127.0.0.1:2375 --storage-driver=overlay2&
+      - timeout 15 sh -c "until docker info; do echo .; sleep 1; done"
+
       # Install yarn if it wasn't already present in the image
       - yarn --version || npm -g install yarn
   pre_build:

lerna.json

@@ -10,5 +10,5 @@
     "tools/*"
   ],
   "rejectCycles": "true",
-  "version": "1.37.0"
+  "version": "1.38.0"
 }

package.json

@@ -16,14 +16,18 @@
   "devDependencies": {
     "conventional-changelog-cli": "^2.0.31",
     "fs-extra": "^8.1.0",
-    "jsii-diff": "^1.4.1",
-    "jsii-pacmak": "^1.4.1",
-    "jsii-rosetta": "^1.4.1",
+    "jsii-diff": "^1.5.0",
+    "jsii-pacmak": "^1.5.0",
+    "jsii-rosetta": "^1.5.0",
     "lerna": "^3.20.2",
-    "standard-version": "^7.1.0",
+    "standard-version": "^8.0.0",
     "graceful-fs": "^4.2.4",
     "typescript": "~3.8.3"
   },
+  "resolutions-comment": "should be removed or reviewed when nodeunit dependency is dropped or adjusted",
+  "resolutions": {
+    "tap-mocha-reporter": "^5.0.1"
+  },
   "repository": {
     "type": "git",
     "url": "git://github.com/aws/aws-cdk"

packages/@aws-cdk/assert/package.json

@@ -33,7 +33,7 @@
     "cdk-build-tools": "0.0.0",
     "jest": "^25.5.4",
     "pkglint": "0.0.0",
-    "ts-jest": "^25.4.0"
+    "ts-jest": "^25.5.0"
   },
   "dependencies": {
     "@aws-cdk/cloudformation-diff": "0.0.0",

packages/@aws-cdk/aws-batch/lib/job-definition.ts

@@ -337,6 +337,9 @@ export class JobDefinition extends Resource implements IJobDefinition {
       memory: container.memoryLimitMiB || 4,
       mountPoints: container.mountPoints,
       privileged: container.privileged || false,
+      resourceRequirements: container.gpuCount
+        ? [{ type: 'GPU', value: String(container.gpuCount) }]
+        : undefined,
       readonlyRootFilesystem: container.readOnly || false,
       ulimits: container.ulimits,
       user: container.user,

packages/@aws-cdk/aws-batch/test/job-definition.test.ts

@@ -78,6 +78,7 @@ describe('Batch Job Definition', () => {
         MountPoints: [],
         Privileged: jobDefProps.container.privileged,
         ReadonlyRootFilesystem: jobDefProps.container.readOnly,
+        ResourceRequirements: [{ Type: 'GPU', Value: String(jobDefProps.container.gpuCount)}],
         Ulimits: [],
         User: jobDefProps.container.user,
         Vcpus: jobDefProps.container.vcpus,

packages/@aws-cdk/aws-cloudformation/test/core-custom-resource-provider-fixture/index.ts

@@ -0,0 +1,10 @@
+// tslint:disable: no-console
+
+export function handler(event: any) {
+  console.log('I am a custom resource');
+  console.log(event);
+  return {
+    PhysicalResourceId: event.ResourceProperties.physicalResourceId,
+    Data: event.ResourceProperties.attributes,
+  };
+}

packages/@aws-cdk/aws-cloudformation/test/integ.core-custom-resources.expected.json

@@ -0,0 +1,137 @@
+{
+  "Resources": {
+    "CustomReflectCustomResourceProviderRoleB4B29AEC": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ]
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          }
+        ]
+      }
+    },
+    "CustomReflectCustomResourceProviderHandler2E189D0B": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "S3Bucket": {
+            "Ref": "AssetParametersd46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7aS3Bucket1D703CB8"
+          },
+          "S3Key": {
+            "Fn::Join": [
+              "",
+              [
+                {
+                  "Fn::Select": [
+                    0,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParametersd46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7aS3VersionKey01A97AE3"
+                        }
+                      ]
+                    }
+                  ]
+                },
+                {
+                  "Fn::Select": [
+                    1,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParametersd46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7aS3VersionKey01A97AE3"
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            ]
+          }
+        },
+        "Timeout": 900,
+        "MemorySize": 128,
+        "Handler": "__entrypoint__.handler",
+        "Role": {
+          "Fn::GetAtt": [
+            "CustomReflectCustomResourceProviderRoleB4B29AEC",
+            "Arn"
+          ]
+        },
+        "Runtime": "nodejs12.x"
+      },
+      "DependsOn": [
+        "CustomReflectCustomResourceProviderRoleB4B29AEC"
+      ]
+    },
+    "MyResource": {
+      "Type": "Custom::Reflect",
+      "Properties": {
+        "ServiceToken": {
+          "Fn::GetAtt": [
+            "CustomReflectCustomResourceProviderHandler2E189D0B",
+            "Arn"
+          ]
+        },
+        "physicalResourceId": "MyPhysicalReflectBack",
+        "attributes": {
+          "Attribute1": "foo",
+          "Attribute2": 1234
+        }
+      },
+      "UpdateReplacePolicy": "Delete",
+      "DeletionPolicy": "Delete"
+    }
+  },
+  "Parameters": {
+    "AssetParametersd46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7aS3Bucket1D703CB8": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"d46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7a\""
+    },
+    "AssetParametersd46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7aS3VersionKey01A97AE3": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"d46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7a\""
+    },
+    "AssetParametersd46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7aArtifactHash16A571C9": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"d46d1ebe2c1958c6352664721f77acb9c78131013956eb82d3d36cf503098e7a\""
+    }
+  },
+  "Outputs": {
+    "Ref": {
+      "Value": {
+        "Ref": "MyResource"
+      }
+    },
+    "GetAttAttribute1": {
+      "Value": {
+        "Fn::GetAtt": [
+          "MyResource",
+          "Attribute1"
+        ]
+      }
+    },
+    "GetAttAttribute2": {
+      "Value": {
+        "Fn::GetAtt": [
+          "MyResource",
+          "Attribute2"
+        ]
+      }
+    }
+  }
+}

packages/@aws-cdk/aws-cloudformation/test/integ.core-custom-resources.ts

@@ -0,0 +1,42 @@
+/*
+ * Stack verification steps:
+ * - Deploy with `--no-clean`
+ * - Verify that the CloudFormation stack outputs have the following values:
+ *   - Ref: "MyPhysicalReflectBack"
+ *   - GetAtt.Attribute1: "foo"
+ *   - GetAtt.Attribute2: 1234
+ */
+import { App, CfnOutput, Construct, CustomResource, CustomResourceProvider, CustomResourceProviderRuntime, Stack, Token } from '@aws-cdk/core';
+
+class TestStack extends Stack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const resourceType = 'Custom::Reflect';
+
+    const serviceToken = CustomResourceProvider.getOrCreate(this, resourceType, {
+      codeDirectory: `${__dirname}/core-custom-resource-provider-fixture`,
+      runtime: CustomResourceProviderRuntime.NODEJS_12,
+    });
+
+    const cr = new CustomResource(this, 'MyResource', {
+      resourceType,
+      serviceToken,
+      properties: {
+        physicalResourceId: 'MyPhysicalReflectBack',
+        attributes: {
+          Attribute1: 'foo',
+          Attribute2: 1234,
+        },
+      },
+    });
+
+    new CfnOutput(this, 'Ref', { value: cr.ref });
+    new CfnOutput(this, 'GetAtt.Attribute1', { value: Token.asString(cr.getAtt('Attribute1')) });
+    new CfnOutput(this, 'GetAtt.Attribute2', { value: Token.asString(cr.getAtt('Attribute2')) });
+  }
+}
+
+const app = new App();
+new TestStack(app, 'custom-resource-test');
+app.synth();

packages/@aws-cdk/aws-cloudformation/test/test.nested-stack.ts

@@ -912,7 +912,7 @@ export = {
     const app = new App();
     const stack = new Stack(app, 'ParentStack', { env: { account: '1234account', region: 'us-east-44' } });
     const nestedStack = new NestedStack(stack, 'nested');
-    const provider = 'dummyProvider';
+    const provider = 'availability-zones';
     const expectedKey = ContextProvider.getKey(nestedStack, {
       provider,
     }).key;