Merge branch 'main' into location-service-map

.github/workflows/request-cli-integ-test.yml

@@ -54,7 +54,7 @@ jobs:
           git config --global user.email 'aws-cdk-automation@users.noreply.github.com'
           git push --force --atomic https://github.com/${{ github.repository }}.git FETCH_HEAD:test-main-pipeline
       - name: Explain next steps
-        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
         with:
           message: |
             :arrow_right: **PR build request submitted to `test-main-pipeline`** :arrow_left:

.mergify.yml

@@ -4,7 +4,17 @@ queue_rules:
     update_method: merge
     merge_method: merge
     conditions:
+      - -title~=(WIP|wip)
+      - -label~=(blocked|do-not-merge)
+      # Only if no-squash is set
+      - label~=no-squash
+      - -merged
+      - -closed
+      - "#approved-reviews-by>=1"
+      - -approved-reviews-by~=author
+      - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
+      - status-success=validate-pr
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}
@@ -13,7 +23,16 @@ queue_rules:
     update_method: merge
     merge_method: squash
     conditions:
+      - base!=release
+      - -title~=(WIP|wip)
+      - -label~=(blocked|do-not-merge|no-squash)
+      - -merged
+      - -closed
+      - "#approved-reviews-by>=1"
+      - -approved-reviews-by~=author
+      - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
+      - status-success=validate-pr
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}

CHANGELOG.v2.alpha.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.165.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.164.1-alpha.0...v2.165.0-alpha.0) (2024-10-31)
+
+
+### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
+
+* **ec2-alpha:** The new `VpcCidrBlock` L2 construct replaces `CfnVPCCidrBlock`. This change alters the logical ID of `AWS::EC2::VPCCidrBlock` resources in CloudFormation templates. Existing deployments will see errors like `CIDR range conflicts with x.xx.xx.xx/xx with association ID vpc-cidr-assoc-ABCD`. To resolve this, you must recreate your existing stacks to use the new module.
+
+### Features
+
+* **apprunner:** support vpc ingress connection ([#30623](https://github.com/aws/aws-cdk/issues/30623)) ([048e753](https://github.com/aws/aws-cdk/commit/048e7538dd71d69c2add28ff454b6d9c69b4f256)), closes [#22850](https://github.com/aws/aws-cdk/issues/22850)
+* **ec2-alpha:** adding imports for SubnetV2 and VpcV2 ([#31765](https://github.com/aws/aws-cdk/issues/31765)) ([d108a80](https://github.com/aws/aws-cdk/commit/d108a8003e463301acea15076501cd815b0eda4a))
+* **location:** support Tracker and TrackerConsumer ([#31268](https://github.com/aws/aws-cdk/issues/31268)) ([046f041](https://github.com/aws/aws-cdk/commit/046f0418a3de08a59c940a7a3d93148cb5f0659b)), closes [#30712](https://github.com/aws/aws-cdk/issues/30712)
+* **pipes-enrichments:** support API Gateway enrichment ([#31794](https://github.com/aws/aws-cdk/issues/31794)) ([09052c2](https://github.com/aws/aws-cdk/commit/09052c2060c410028896fd54e76a857b2141c8a4)), closes [#29384](https://github.com/aws/aws-cdk/issues/29384)
+* **pipes-targets:** add SageMaker ([#30696](https://github.com/aws/aws-cdk/issues/30696)) ([a5fdf57](https://github.com/aws/aws-cdk/commit/a5fdf570beb1456b1307276f56d90fd1ba0b46d8))
+* **redshift-alpha:** query execution timeout setting during table creation ([#31818](https://github.com/aws/aws-cdk/issues/31818)) ([40f07ae](https://github.com/aws/aws-cdk/commit/40f07ae330d074cfa7861e24a0427da7ec427f68)), closes [#31329](https://github.com/aws/aws-cdk/issues/31329)
+* **kinesisfirehose-alpha:** kinesis firehose and kinesis firehose destinations modules are now in Developer Preview ([#31952](https://github.com/aws/aws-cdk/pull/31952))
+
+### Bug Fixes
+
+* **location:** remove base class from PlaceIndex class ([#31287](https://github.com/aws/aws-cdk/issues/31287)) ([bc67866](https://github.com/aws/aws-cdk/commit/bc67866f579c401556d427eb150bcd118d69bd17)), closes [#30711](https://github.com/aws/aws-cdk/issues/30711) [#30682](https://github.com/aws/aws-cdk/issues/30682) 
+* **scheduler-alpha:** scheduler input always get transformed to string with extra double quotes ([#31894](https://github.com/aws/aws-cdk/issues/31894)) ([186b8ab](https://github.com/aws/aws-cdk/commit/186b8abfab8452b31cba13b56998242f63c43159))
+* **scheduler-alpha:** too many KMS permissions granted ([#31923](https://github.com/aws/aws-cdk/issues/31923)) ([06678a3](https://github.com/aws/aws-cdk/commit/06678a39e029582af14c8b021f946b9ce9cac9be)), closes [#31785](https://github.com/aws/aws-cdk/issues/31785)
+
 ## [2.164.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.164.0-alpha.0...v2.164.1-alpha.0) (2024-10-25)
 
 ## [2.164.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.163.1-alpha.0...v2.164.0-alpha.0) (2024-10-24)

CHANGELOG.v2.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.165.0](https://github.com/aws/aws-cdk/compare/v2.164.1...v2.165.0) (2024-10-31)
+
+
+### Features
+
+* **bootstrap:** add lifecycle rule to abort multipart uploads after 7 days ([#31956](https://github.com/aws/aws-cdk/issues/31956)) ([b800da8](https://github.com/aws/aws-cdk/commit/b800da8172919a1ab27f885549e701d98323c9bb)), closes [#29045](https://github.com/aws/aws-cdk/issues/29045)
+* **bootstrap:** delete noncurrent versions after 30 days ([#31949](https://github.com/aws/aws-cdk/issues/31949)) ([579041e](https://github.com/aws/aws-cdk/commit/579041e5d41e780ce1f6fb9f778c353868fb6938))
+* **cli:** garbage collect ecr assets (under --unstable flag) ([#31841](https://github.com/aws/aws-cdk/issues/31841)) ([da85e54](https://github.com/aws/aws-cdk/commit/da85e54d7d3dfb4e33942f58564e91039e7d22ff)), closes [#31611](https://github.com/aws/aws-cdk/issues/31611)
+* **codebuild:** add support of organization webhook in github source ([#31740](https://github.com/aws/aws-cdk/issues/31740)) ([8c15b5f](https://github.com/aws/aws-cdk/commit/8c15b5f19a0c289fd0dad8c35b6734232d957836)), closes [#31736](https://github.com/aws/aws-cdk/issues/31736)
+* **cognito:** support UserPoolGroup ([#31351](https://github.com/aws/aws-cdk/issues/31351)) ([408b20f](https://github.com/aws/aws-cdk/commit/408b20f92122069a04ff5776b4783ae220d04a56)), closes [#21026](https://github.com/aws/aws-cdk/issues/21026)
+* update L1 CloudFormation resource definitions ([#31917](https://github.com/aws/aws-cdk/issues/31917)) ([8c93291](https://github.com/aws/aws-cdk/commit/8c93291f789b441397bc5a64308816e89f682199))
+
+
+### Bug Fixes
+
+* **assertions:** throw error or warn when `synth` is called multiple times on mutated construct tree ([#31865](https://github.com/aws/aws-cdk/issues/31865)) ([a261c9d](https://github.com/aws/aws-cdk/commit/a261c9d8a316ec389f19c873122691d48c5ca16d)), closes [#24689](https://github.com/aws/aws-cdk/issues/24689)
+* **cli:** ecr garbage collection hangs when repository has no images ([#31951](https://github.com/aws/aws-cdk/issues/31951)) ([a235a9f](https://github.com/aws/aws-cdk/commit/a235a9fad29bf0da141b27ca391861fa613f42b8))
+* **cli:** garbage collection ignores review_in_progress stacks ([#31906](https://github.com/aws/aws-cdk/issues/31906)) ([cb3ecfe](https://github.com/aws/aws-cdk/commit/cb3ecfe8f255e626db3706632c9590c86c28bea5))
+* **s3-assets:** cannot publish a file without extension ([#30597](https://github.com/aws/aws-cdk/issues/30597)) ([ccab485](https://github.com/aws/aws-cdk/commit/ccab485b87a7090ddf0773508d7b8ee84ff654b0)), closes [#30471](https://github.com/aws/aws-cdk/issues/30471)
+* **sqs:** queue with `fifo: false` does not deploy ([#31922](https://github.com/aws/aws-cdk/issues/31922)) ([a9d3b02](https://github.com/aws/aws-cdk/commit/a9d3b02783104fe862a3e863e8c89af845b49c8c)), closes [#8550](https://github.com/aws/aws-cdk/issues/8550)
+* enable node-fips compatible body checksums for S3 ([#31883](https://github.com/aws/aws-cdk/issues/31883)) ([4f29c1d](https://github.com/aws/aws-cdk/commit/4f29c1d04533b68535c1a5706855066d1d1ea577))
+
+
 ## [2.164.1](https://github.com/aws/aws-cdk/compare/v2.164.0...v2.164.1) (2024-10-25)
 
 

CONTRIBUTORS.md

@@ -17,16 +17,16 @@ Shout out to our top contributors!
 - [comcalvi](https://github.com/comcalvi)
 - [madeline-k](https://github.com/madeline-k)
 - [NetaNir](https://github.com/NetaNir)
-- [robertd](https://github.com/robertd)
 - [go-to-k](https://github.com/go-to-k)
+- [robertd](https://github.com/robertd)
+- [mazyu36](https://github.com/mazyu36)
 - [MrArnoldPalmer](https://github.com/MrArnoldPalmer)
 - [lpizzinidev](https://github.com/lpizzinidev)
 - [peterwoodworth](https://github.com/peterwoodworth)
-- [mazyu36](https://github.com/mazyu36)
-- [colifran](https://github.com/colifran)
 - [badmintoncryer](https://github.com/badmintoncryer)
+- [colifran](https://github.com/colifran)
 - [msambol](https://github.com/msambol)
 - [watany-dev](https://github.com/watany-dev)
 
 
-_Last updated: Tue, 01 Oct 24 00:12:17 +0000_
+_Last updated: Fri, 01 Nov 24 00:12:22 +0000_

lerna.json

@@ -10,6 +10,7 @@
     "packages/@aws-cdk-testing/*",
     "packages/@aws-cdk/*/lambda-packages/*",
     "tools/@aws-cdk/cdk-build-tools",
+    "tools/@aws-cdk/yargs-gen",
     "tools/@aws-cdk/cdk-release",
     "tools/@aws-cdk/node-bundle",
     "tools/@aws-cdk/pkglint",

package.json

@@ -35,7 +35,7 @@
     "standard-version": "^9.5.0",
     "ts-jest": "^29.2.5",
     "ts-node": "^10.9.2",
-    "typescript": "~5.4.5"
+    "typescript": "~5.5.2"
   },
   "resolutions": {
     "colors": "1.4.0",
@@ -78,6 +78,7 @@
       "packages/@aws-cdk-testing/*",
       "packages/@aws-cdk/*/lambda-packages/*",
       "tools/@aws-cdk/cdk-build-tools",
+      "tools/@aws-cdk/yargs-gen",
       "tools/@aws-cdk/cdk-release",
       "tools/@aws-cdk/node-bundle",
       "tools/@aws-cdk/pkglint",

packages/@aws-cdk-testing/cli-integ/lib/aws.ts

@@ -127,7 +127,7 @@ export class AwsClients {
     }
   }
 
-  public async emptyBucket(bucketName: string) {
+  public async emptyBucket(bucketName: string, options?: { bypassGovernance?: boolean }) {
     const objects = await this.s3.send(
       new ListObjectVersionsCommand({
         Bucket: bucketName,
@@ -154,6 +154,7 @@ export class AwsClients {
           Objects: deletes,
           Quiet: false,
         },
+        BypassGovernanceRetention: options?.bypassGovernance ? true : undefined,
       }),
     );
   }

packages/@aws-cdk-testing/cli-integ/lib/npm.ts

@@ -10,4 +10,32 @@ export function typescriptVersionsSync(): string[] {
 
   const versions: string[] = JSON.parse(stdout);
   return Array.from(new Set(versions.map(v => v.split('.').slice(0, 2).join('.'))));
-}
+}
+
+/**
+ * Use NPM preinstalled on the machine to query publish times of versions
+ */
+export function typescriptVersionsYoungerThanDaysSync(days: number, versions: string[]): string[] {
+  const { stdout } = spawnSync('npm', ['--silent', 'view', 'typescript', 'time', '--json'], { encoding: 'utf-8' });
+  const versionTsMap: Record<string, string> = JSON.parse(stdout);
+
+  const cutoffDate = new Date(Date.now() - (days * 24 * 3600 * 1000));
+  const cutoffDateS = cutoffDate.toISOString();
+
+  const recentVersions = Object.entries(versionTsMap)
+    .filter(([_, dateS]) => dateS > cutoffDateS)
+    .map(([v]) => v);
+
+  // Input versions are of the form 3.9, 5.2, etc.
+  // Actual versions are of the form `3.9.15`, `5.3.0-dev.20511311`.
+  // Return only 2-digit versions for which there is a non-prerelease version in the set of recentVersions
+  // So a 2-digit versions that is followed by `.<digits>` until the end of the string.
+  return versions.filter((twoV) => {
+    const re = new RegExp(`^${reQuote(twoV)}\\.\\d+$`);
+    return recentVersions.some(fullV => fullV.match(re));
+  });
+}
+
+function reQuote(str: string): string {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

packages/@aws-cdk-testing/cli-integ/lib/package-sources/release-source.ts

@@ -60,6 +60,10 @@ export class ReleasePackageSource implements IPackageSource {
     return this.version.split('.')[0] as string;
   }
 
+  public requestedCliVersion() {
+    return this.version;
+  }
+
   public requestedFrameworkVersion() {
     return process.env.FRAMEWORK_VERSION!;
   }

packages/@aws-cdk-testing/cli-integ/lib/package-sources/repo-source.ts

@@ -49,6 +49,10 @@ export class RepoPackageSource implements IPackageSource {
     return releaseJson.majorVersion;
   }
 
+  public requestedCliVersion(): string {
+    return '*';
+  }
+
   public requestedFrameworkVersion(): string {
     return '*';
   }

packages/@aws-cdk-testing/cli-integ/lib/package-sources/source.ts

@@ -14,6 +14,11 @@ export interface IPackageSource {
 
   initializeDotnetPackages(targetDir: string): Promise<void>;
 
+  /**
+   * CLI version
+   */
+  requestedCliVersion(): string;
+
   /**
    * Framework version if it's different than the CLI version
    *

packages/@aws-cdk-testing/cli-integ/lib/with-aws.ts

@@ -10,11 +10,11 @@ export type AwsContext = { readonly aws: AwsClients };
  *
  * Allocate the next region from the REGION pool and dispose it afterwards.
  */
-export function withAws(
-  block: (context: TestContext & AwsContext & DisableBootstrapContext) => Promise<void>,
+export function withAws<A extends TestContext>(
+  block: (context: A & AwsContext & DisableBootstrapContext) => Promise<void>,
   disableBootstrap: boolean = false,
-): (context: TestContext) => Promise<void> {
-  return (context: TestContext) => regionPool().using(async (region) => {
+): (context: A) => Promise<void> {
+  return (context: A) => regionPool().using(async (region) => {
     const aws = await AwsClients.forRegion(region, context.output);
     await sanityCheck(aws);
 

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts

@@ -17,6 +17,7 @@ import {
   PutRolePolicyCommand,
 } from '@aws-sdk/client-iam';
 import { InvokeCommand } from '@aws-sdk/client-lambda';
+import { PutObjectLockConfigurationCommand } from '@aws-sdk/client-s3';
 import { CreateTopicCommand, DeleteTopicCommand } from '@aws-sdk/client-sns';
 import { AssumeRoleCommand, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
 import {
@@ -1318,6 +1319,43 @@ integTest(
   }),
 );
 
+integTest('deploy stack with Lambda Asset to Object Lock-enabled asset bucket', withoutBootstrap(async (fixture) => {
+  // Bootstrapping with custom toolkit stack name and qualifier
+  const qualifier = fixture.qualifier;
+  const toolkitStackName = fixture.bootstrapStackName;
+  await fixture.cdkBootstrapModern({
+    verbose: true,
+    toolkitStackName: toolkitStackName,
+    qualifier: qualifier,
+  });
+
+  const bucketName = `cdk-${qualifier}-assets-${await fixture.aws.account()}-${fixture.aws.region}`;
+  await fixture.aws.s3.send(new PutObjectLockConfigurationCommand({
+    Bucket: bucketName,
+    ObjectLockConfiguration: {
+      ObjectLockEnabled: 'Enabled',
+      Rule: {
+        DefaultRetention: {
+          Days: 1,
+          Mode: 'GOVERNANCE',
+        },
+      },
+    },
+  }));
+
+  // Deploy a stack that definitely contains a file asset
+  await fixture.cdkDeploy('lambda', {
+    options: [
+      '--toolkit-stack-name', toolkitStackName,
+      '--context', `@aws-cdk/core:bootstrapQualifier=${qualifier}`,
+    ],
+  });
+
+  // THEN - should not fail. Now clean the bucket with governance bypass: a regular delete
+  // operation will fail.
+  await fixture.aws.emptyBucket(bucketName, { bypassGovernance: true });
+}));
+
 integTest(
   'cdk ls',
   withDefaultFixture(async (fixture) => {

packages/@aws-cdk-testing/cli-integ/tests/init-typescript-app/init-typescript-app.integtest.ts

@@ -1,7 +1,7 @@
 import { promises as fs } from 'fs';
 import * as path from 'path';
 import { integTest, withTemporaryDirectory, ShellHelper, withPackages, TemporaryDirectoryContext } from '../../lib';
-import { typescriptVersionsSync } from '../../lib/npm';
+import { typescriptVersionsSync, typescriptVersionsYoungerThanDaysSync } from '../../lib/npm';
 
 ['app', 'sample-app'].forEach(template => {
   integTest(`typescript init ${template}`, withTemporaryDirectory(withPackages(async (context) => {
@@ -19,10 +19,18 @@ import { typescriptVersionsSync } from '../../lib/npm';
   })));
 });
 
+// Same as https://github.com/DefinitelyTyped/DefinitelyTyped?tab=readme-ov-file#support-window
+const TYPESCRIPT_VERSION_AGE_DAYS = 2 * 365;
+
+const TYPESCRIPT_VERSIONS = typescriptVersionsYoungerThanDaysSync(TYPESCRIPT_VERSION_AGE_DAYS, typescriptVersionsSync());
+
+// eslint-disable-next-line no-console
+console.log(TYPESCRIPT_VERSIONS);
+
 /**
  * Test our generated code with various versions of TypeScript
  */
-typescriptVersionsSync().forEach(tsVersion => {
+TYPESCRIPT_VERSIONS.forEach(tsVersion => {
   integTest(`typescript ${tsVersion} init app`, withTemporaryDirectory(withPackages(async (context) => {
     const shell = ShellHelper.fromContext(context);
     await context.packages.makeCliAvailable();