Merge branch 'main' into mrgrain/chore/build-with-finch

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,17 +1,16 @@
+> REPLACE THIS TEXT BLOCK
+>
+> Describe the reason for this change, what the solution is, and any
+> important design decisions you made. 
+>
+> Remember to follow the [CONTRIBUTING GUIDE] and [DESIGN GUIDELINES] for any
+> code you submit.
+>
+> [CONTRIBUTING GUIDE]: https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md
+> [DESIGN GUIDELINES]: https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md
+
+Closes #<issue number here>.
 
 ----
 
-### All Submissions:
-
-* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)
-
-### Adding new Construct Runtime Dependencies:
-
-* [ ] This PR adds new construct runtime dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-construct-runtime-dependencies)
-
-### New Features
-
-* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
-	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?
-
 *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

.github/workflows/close-stale-issues.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Stale issue job
     steps:
-    - uses: aws-actions/stale-issue-cleanup@v5
+    - uses: aws-actions/stale-issue-cleanup@v6
       with:
         # Setting messages to an empty string will cause the automation to skip
         # that category

CHANGELOG.v2.alpha.md

@@ -2,6 +2,8 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.62.2-alpha.0](https://github.com/aws/aws-cdk/compare/v2.62.1-alpha.0...v2.62.2-alpha.0) (2023-01-27)
+
 ## [2.62.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.62.0-alpha.0...v2.62.1-alpha.0) (2023-01-26)
 
 ## [2.62.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.61.1-alpha.0...v2.62.0-alpha.0) (2023-01-25)

CHANGELOG.v2.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.62.2](https://github.com/aws/aws-cdk/compare/v2.62.1...v2.62.2) (2023-01-27)
+
+
+### Bug Fixes
+
+* imports from ESM modules cannot find correct type definitions ([#23870](https://github.com/aws/aws-cdk/issues/23870)) ([1b9f3f7](https://github.com/aws/aws-cdk/commit/1b9f3f7d3fa447a21e9ed38026cc428f7797390f))
+
 ## [2.62.1](https://github.com/aws/aws-cdk/compare/v2.62.0...v2.62.1) (2023-01-26)
 
 

packages/@aws-cdk/aws-appsync/lib/data-source.ts

@@ -125,7 +125,7 @@ export abstract class BaseDataSource extends Construct {
       serviceRoleArn: this.serviceRole?.roleArn,
       ...extended,
     });
-    this.name = name;
+    this.name = supportedName;
     this.api = props.api;
   }
 

packages/@aws-cdk/aws-appsync/test/appsync-none.test.ts

@@ -54,6 +54,20 @@ describe('None Data Source configuration', () => {
     });
   });
 
+  test('appsync data source exports sanitised name', () => {
+    // WHEN
+    const ds = api.addNoneDataSource('ds', {
+      name: 'Produce-Custom',
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::AppSync::DataSource', {
+      Type: 'NONE',
+      Name: 'ProduceCustom',
+    });
+    expect(ds.name).toBe('ProduceCustom');
+  });
+
   test('appsync configures name and description correctly', () => {
     // WHEN
     api.addNoneDataSource('ds', {
@@ -116,5 +130,3 @@ describe('adding none data source from imported api', () => {
     });
   });
 });
-
-

packages/@aws-cdk/aws-config/lib/rule.ts

@@ -1530,6 +1530,20 @@ export class ResourceType {
   public static readonly EVENTBRIDGE_ARCHIVE = new ResourceType('AWS::Events::Archive');
   /** Amazon EventBridge Endpoint */
   public static readonly EVENTBRIDGE_ENDPOINT = new ResourceType('AWS::Events::Endpoint');
+  /** Amazon EventBridge EventSchemas registry */
+  public static readonly EVENTSCHEMAS_REGISTRY = new ResourceType('AWS::EventSchemas::Registry');
+  /** Amazon EventBridge EventSchemas registry policy */
+  public static readonly EVENTSCHEMAS_REGISTRY_POLICY = new ResourceType('AWS::EventSchemas::RegistryPolicy');
+  /** Amazon EventBridge EventSchemas discoverer */
+  public static readonly EVENTSCHEMAS_DISCOVERER = new ResourceType('AWS::EventSchemas::Discoverer');
+  /** AWS FraudDetector label */
+  public static readonly FRAUDDETECTOR_LABEL = new ResourceType('AWS::FraudDetector::Label');
+  /** AWS FraudDetector entity type */
+  public static readonly FRAUDDETECTOR_ENTITY_TYPE = new ResourceType('AWS::FraudDetector::EntityType');
+  /** AWS FraudDetector variable */
+  public static readonly FRAUDDETECTOR_VARIABLE = new ResourceType('AWS::FraudDetector::Variable');
+  /** AWS FraudDetector outcome */
+  public static readonly FRAUDDETECTOR_OUTCOME = new ResourceType('AWS::FraudDetector::Outcome');
   /** Amazon GuardDuty detector */
   public static readonly GUARDDUTY_DETECTOR = new ResourceType('AWS::GuardDuty::Detector');
   /** Amazon GuardDuty Threat Intel Set */
@@ -1552,6 +1566,12 @@ export class ResourceType {
   public static readonly LIGHTSAIL_CERTIFICATE = new ResourceType('AWS::Lightsail::Certificate');
   /** Amazon Lightsail Disk */
   public static readonly LIGHTSAIL_DISK = new ResourceType('AWS::Lightsail::Disk');
+  /** AWS Lightsail bucket */
+  public static readonly LIGHTSAIL_BUCKET = new ResourceType('AWS::Lightsail::Bucket');
+  /** AWS Lightsail static IP */
+  public static readonly LIGHTSAIL_STATIC_IP = new ResourceType('AWS::Lightsail::StaticIp');
+  /** Amazon MQ broker */
+  public static readonly AMAZON_MQ_BROKER = new ResourceType('AWS::AmazonMQ::Broker');
   /** Amazon MSK cluster */
   public static readonly MSK_CLUSTER = new ResourceType('AWS::MSK::Cluster');
   /** Amazon Redshift cluster */
@@ -1594,6 +1614,8 @@ export class ResourceType {
   public static readonly ROUTE53_RECOVERY_READINESS_CELL = new ResourceType('AWS::Route53RecoveryReadiness::Cell');
   /** Amazon Route 53 Application Recovery Controller Readiness Check */
   public static readonly ROUTE53_RECOVERY_READINESS_READINESS_CHECK = new ResourceType('AWS::Route53RecoveryReadiness::ReadinessCheck');
+  /** Amazon Route53 recovery readiness recovery group */
+  public static readonly ROUTE53_RECOVERY_READINESS_RECOVERY_GROUP = new ResourceType('AWS::Route53RecoveryReadiness::RecoveryGroup');
   /** Amazon SQS queue */
   public static readonly SQS_QUEUE = new ResourceType('AWS::SQS::Queue');
   /** Amazon SNS topic */
@@ -1650,6 +1672,10 @@ export class ResourceType {
   public static readonly WORKSPACES_WORKSPACE = new ResourceType('AWS::WorkSpaces::Workspace');
   /** AWS AppConfig application */
   public static readonly APPCONFIG_APPLICATION = new ResourceType('AWS::AppConfig::Application');
+  /** AWS AppConfig environment */
+  public static readonly APPCONFIG_ENVIRONMENT = new ResourceType('AWS::AppConfig::Environment');
+  /** AWS AppConfig configuration profile */
+  public static readonly APPCONFIG_CONFIGURATION_PROFILE = new ResourceType('AWS::AppConfig::ConfigurationProfile');
   /** AWS AppSync GraphQL Api */
   public static readonly APPSYNC_GRAPHQL_API = new ResourceType('AWS::AppSync::GraphQLApi');
   /** AWS Backup backup plan */
@@ -1672,6 +1698,8 @@ export class ResourceType {
   public static readonly CLOUDFORMATION_STACK = new ResourceType('AWS::CloudFormation::Stack');
   /** AWS CloudTrail trail */
   public static readonly CLOUDTRAIL_TRAIL = new ResourceType('AWS::CloudTrail::Trail');
+  /** AWS Cloud9 environment EC2 */
+  public static readonly CLOUD9_ENVIRONMENT_EC2 = new ResourceType('AWS::Cloud9::EnvironmentEC2');
   /** AWS Cloud Map(ServiceDiscovery) service */
   public static readonly SERVICEDISCOVERY_SERVICE = new ResourceType('AWS::ServiceDiscovery::Service');
   /** AWS Cloud Map(ServiceDiscovery) Public Dns Namespace */
@@ -1742,6 +1770,16 @@ export class ResourceType {
   public static readonly IAM_POLICY = new ResourceType('AWS::IAM::Policy');
   /** AWS IAM AccessAnalyzer analyzer */
   public static readonly IAM_ACCESSANALYZER_ANALYZER = new ResourceType('AWS::AccessAnalyzer::Analyzer');
+  /** AWS IoT authorizer */
+  public static readonly IOT_AUTHORIZER = new ResourceType('AWS::IoT::Authorizer');
+  /** AWS IoT security profile */
+  public static readonly IOT_SECURITY_PROFILE = new ResourceType('AWS::IoT::SecurityProfile');
+  /** AWS IoT role alias */
+  public static readonly IOT_ROLE_ALIAS = new ResourceType('AWS::IoT::RoleAlias');
+  /** AWS IoT dimension */
+  public static readonly IOT_DIMENSION = new ResourceType('AWS::IoT::Dimension');
+  /** AWS IoT Analytics datastore */
+  public static readonly IOT_ANALYTICS_DATASTORE = new ResourceType('AWS::IoTAnalytics::Datastore');
   /** AWS IoT Events Input */
   public static readonly IOT_EVENTS_INPUT = new ResourceType('AWS::IoTEvents::Input');
   /** AWS IoT Events Detector Model */
@@ -1752,6 +1790,14 @@ export class ResourceType {
   public static readonly KMS_KEY = new ResourceType('AWS::KMS::Key');
   /** AWS Lambda function */
   public static readonly LAMBDA_FUNCTION = new ResourceType('AWS::Lambda::Function');
+  /** AWS Network Firewall Firewall */
+  public static readonly NETWORK_FIREWALL_FIREWALL = new ResourceType('AWS::NetworkFirewall::Firewall');
+  /** AWS Network Firewall Firewall Policy */
+  public static readonly NETWORK_FIREWALL_FIREWALL_POLICY = new ResourceType('AWS::NetworkFirewall::FirewallPolicy');
+  /** AWS Network Firewall Rule Group */
+  public static readonly NETWORK_FIREWALL_RULE_GROUP = new ResourceType('AWS::NetworkFirewall::RuleGroup');
+  /** AWS ResilienceHub resiliency policy */
+  public static readonly RESILIENCEHUB_RESILIENCY_POLICY = new ResourceType('AWS::ResilienceHub::ResiliencyPolicy');
   /**AWS Secrets Manager secret */
   public static readonly SECRETS_MANAGER_SECRET = new ResourceType('AWS::SecretsManager::Secret');
   /** AWS Service Catalog CloudFormation product */
@@ -1777,6 +1823,8 @@ export class ResourceType {
   public static readonly SYSTEMS_MANAGER_ASSOCIATION_COMPLIANCE = new ResourceType('AWS::SSM::AssociationCompliance');
   /** AWS Systems Manager file data */
   public static readonly SYSTEMS_MANAGER_FILE_DATA = new ResourceType('AWS::SSM::FileData');
+  /** AWS Transfer workflow */
+  public static readonly TRANSFER_WORKFLOW = new ResourceType('AWS::Transfer::Workflow');
   /** AWS WAF rate based rule */
   public static readonly WAF_RATE_BASED_RULE = new ResourceType('AWS::WAF::RateBasedRule');
   /** AWS WAF rule */
@@ -1811,6 +1859,8 @@ export class ResourceType {
   public static readonly ELBV2_LOAD_BALANCER = new ResourceType('AWS::ElasticLoadBalancingV2::LoadBalancer');
   /** AWS ELBv2 application load balancer listener */
   public static readonly ELBV2_LISTENER = new ResourceType('AWS::ElasticLoadBalancingV2::Listener');
+  /** AWS Elemental MediaPackage packaging group */
+  public static readonly MEDIAPACKAGE_PACKAGING_GROUP = new ResourceType('AWS::MediaPackage::PackagingGroup');
 
   /** A custom resource type to support future cases. */
   public static of(type: string): ResourceType {

packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py

@@ -82,7 +82,7 @@ def helm_handler(event, context):
 
         if repository is not None and repository.startswith('oci://'):
             tmpdir = tempfile.TemporaryDirectory()
-            chart_dir = get_chart_from_oci(tmpdir.name, release, repository, version)
+            chart_dir = get_chart_from_oci(tmpdir.name, repository, version)
             chart = chart_dir
 
         helm('upgrade', release, chart, repository, values_file, namespace, version, wait, timeout, create_namespace)
@@ -123,7 +123,7 @@ def get_oci_cmd(repository, version):
     return cmnd
 
 
-def get_chart_from_oci(tmpdir, release, repository = None, version = None):
+def get_chart_from_oci(tmpdir, repository = None, version = None):
 
     cmnd = get_oci_cmd(repository, version)
 
@@ -135,7 +135,9 @@ def get_chart_from_oci(tmpdir, release, repository = None, version = None):
             output = subprocess.check_output(cmnd, stderr=subprocess.STDOUT, cwd=tmpdir, shell=True)
             logger.info(output)
 
-            return os.path.join(tmpdir, release)
+            # effectively returns "$tmpDir/$lastPartOfOCIUrl", because this is how helm pull saves OCI artifact. 
+            # Eg. if we have oci://9999999999.dkr.ecr.us-east-1.amazonaws.com/foo/bar/pet-service repository, helm saves artifact under $tmpDir/pet-service
+            return os.path.join(tmpdir, repository.rpartition('/')[-1])
         except subprocess.CalledProcessError as exc:
             output = exc.output
             if b'Broken pipe' in output:

packages/@aws-cdk/aws-eks/test/integ.eks-helm-asset.js.snapshot/asset.1f175bea1cef6137d882d0090f49e27e44bbb46a678a86fd5d6fb29ade070a33/helm/__init__.py → packages/@aws-cdk/aws-eks/test/integ.eks-helm-asset.js.snapshot/asset.563343f1aee007876e917a1bf685464df7e56190033d5ae5b9fd14d498e9c5ee/helm/__init__.py

@@ -82,7 +82,7 @@ def helm_handler(event, context):
 
         if repository is not None and repository.startswith('oci://'):
             tmpdir = tempfile.TemporaryDirectory()
-            chart_dir = get_chart_from_oci(tmpdir.name, release, repository, version)
+            chart_dir = get_chart_from_oci(tmpdir.name, repository, version)
             chart = chart_dir
 
         helm('upgrade', release, chart, repository, values_file, namespace, version, wait, timeout, create_namespace)
@@ -123,7 +123,7 @@ def get_oci_cmd(repository, version):
     return cmnd
 
 
-def get_chart_from_oci(tmpdir, release, repository = None, version = None):
+def get_chart_from_oci(tmpdir, repository = None, version = None):
 
     cmnd = get_oci_cmd(repository, version)
 
@@ -135,7 +135,7 @@ def get_chart_from_oci(tmpdir, release, repository = None, version = None):
             output = subprocess.check_output(cmnd, stderr=subprocess.STDOUT, cwd=tmpdir, shell=True)
             logger.info(output)
 
-            return os.path.join(tmpdir, release)
+            return os.path.join(tmpdir, repository.rpartition('/')[-1])
         except subprocess.CalledProcessError as exc:
             output = exc.output
             if b'Broken pipe' in output: