Merge branch 'main' into cognito-cf-endpoint

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+/packages/aws-cdk/ @aws/aws-cdk-core-team
+/packages/@aws-cdk-testing/cli-integ/ @aws/aws-cdk-core-team
+/packages/aws-cdk-lib/core/ @aws/aws-cdk-core-team
+/packages/@aws-cdk/cli-lib-alpha/ @aws/aws-cdk-core-team

.github/workflows/codecov.yml

@@ -28,7 +28,7 @@ jobs:
         run: cd packages/aws-cdk && yarn test
 
       - name: Upload results to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           directory: packages/aws-cdk/coverage
           fail_ci_if_error: true

.github/workflows/lambda-runtime-tests.yml

@@ -0,0 +1,47 @@
+name: Lambda Runtime Tests Update
+on:
+  pull_request:
+    paths:
+      - 'packages/aws-cdk-lib/aws-lambda/lib/runtime.ts'
+
+jobs:
+  update-lambda-tests:
+    if: github.repository == 'aws/aws-cdk'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "*"
+        env:
+          NODE_OPTIONS: "--max-old-space-size=8196 --experimental-worker ${NODE_OPTIONS:-}"
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile && cd tools/@aws-cdk/lambda-integration-test-updater && yarn build+test
+
+      - name: Update Lambda Runtime Tests
+        run: |
+          cd tools/@aws-cdk/lambda-integration-test-updater
+          ./bin/update-lambda-runtimestes-integ-testing
+
+      - name: Check for changes
+        id: git-check
+        run: |
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo "changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Commit & Push changes
+        if: steps.git-check.outputs.changes == 'true'
+        run: |
+          git config --global user.name 'aws-cdk-automation'
+          git config --global user.email 'aws-cdk-automation@users.noreply.github.com'
+          git add .
+          git commit -m "chore: update lambda runtime integration tests"
+          git push origin ${{ github.event.pull_request.head.ref }}

CHANGELOG.v2.alpha.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.171.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.170.0-alpha.0...v2.171.0-alpha.0) (2024-11-25)
+
+## [2.170.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.169.0-alpha.0...v2.170.0-alpha.0) (2024-11-22)
+
 ## [2.169.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.168.0-alpha.0...v2.169.0-alpha.0) (2024-11-21)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,37 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.171.0](https://github.com/aws/aws-cdk/compare/v2.170.0...v2.171.0) (2024-11-25)
+
+
+### Features
+
+* **rds:** enhanced monitoring configuration at the cluster level ([#32157](https://github.com/aws/aws-cdk/issues/32157)) ([01f2dcd](https://github.com/aws/aws-cdk/commit/01f2dcd6fb892905afae735c791ddbb3e6adbcb1)), closes [#32151](https://github.com/aws/aws-cdk/issues/32151)
+* **rds:** support zero ACU for Aurora Serverless V2 ([#32231](https://github.com/aws/aws-cdk/issues/32231)) ([d1b07d9](https://github.com/aws/aws-cdk/commit/d1b07d9aeadab65db5672272050e64672e7d6beb))
+
+
+### Bug Fixes
+
+* **cli:** sso with proxy fails  ([#32261](https://github.com/aws/aws-cdk/issues/32261)) ([bedcf16](https://github.com/aws/aws-cdk/commit/bedcf164a2b7cbd613ac645d477302c93ddfa4b6))
+
+## [2.170.0](https://github.com/aws/aws-cdk/compare/v2.169.0...v2.170.0) (2024-11-22)
+
+
+### Features
+
+* **lambda:** support for Provisioned Pollers ([#32205](https://github.com/aws/aws-cdk/issues/32205)) ([68b969e](https://github.com/aws/aws-cdk/commit/68b969e6006212b2930844226f7817c81cfd8e18))
+* **vpcv2:** vpc peering connection construct ([#31645](https://github.com/aws/aws-cdk/issues/31645)) ([e1195f9](https://github.com/aws/aws-cdk/commit/e1195f93f9ee12b86d38bc7a64b2118ba204ef9e)), closes [RFC#507](https://github.com/aws/RFC/issues/507) [1#L252](https://github.com/aws/1/issues/L252)
+
+
+### Bug Fixes
+
+* **cli:** sts retry options are ignored ([#32227](https://github.com/aws/aws-cdk/issues/32227)) ([193ab8c](https://github.com/aws/aws-cdk/commit/193ab8cf892a3d2a3dbafc6db9f7a1d246fab2ec))
+
+
+### Reverts
+
+* "fix(ecr): allow creating repository uri to use tokens like cfn params" ([#32241](https://github.com/aws/aws-cdk/issues/32241)) ([b3e39a9](https://github.com/aws/aws-cdk/commit/b3e39a9a264511475ebb2bc8889325a096780d93)), closes [#32238](https://github.com/aws/aws-cdk/issues/32238)
+
 ## [2.169.0](https://github.com/aws/aws-cdk/compare/v2.168.0...v2.169.0) (2024-11-21)
 
 

lerna.json

@@ -19,6 +19,7 @@
     "tools/@aws-cdk/spec2cdk",
     "tools/@aws-cdk/yarn-cling",
     "tools/@aws-cdk/lazify",
+    "tools/@aws-cdk/lambda-integration-test-updater",
     "scripts/@aws-cdk/script-tests"
   ],
   "rejectCycles": true,

package.json

@@ -87,6 +87,7 @@
       "tools/@aws-cdk/spec2cdk",
       "tools/@aws-cdk/yarn-cling",
       "tools/@aws-cdk/lazify",
+      "tools/@aws-cdk/lambda-integration-test-updater",
       "scripts/@aws-cdk/script-tests"
     ],
     "nohoist": [

packages/@aws-cdk-testing/cli-integ/package.json

@@ -59,6 +59,7 @@
     "jest": "^29.7.0",
     "jest-junit": "^14.0.1",
     "make-runnable": "^1.4.1",
+    "mockttp": "^3.15.4",
     "npm": "^8.19.4",
     "p-queue": "^6.6.2",
     "semver": "^7.6.3",

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts

@@ -1,4 +1,4 @@
-import { promises as fs, existsSync } from 'fs';
+import { existsSync, promises as fs } from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import {
@@ -22,21 +22,22 @@ import { InvokeCommand } from '@aws-sdk/client-lambda';
 import { PutObjectLockConfigurationCommand } from '@aws-sdk/client-s3';
 import { CreateTopicCommand, DeleteTopicCommand } from '@aws-sdk/client-sns';
 import { AssumeRoleCommand, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
+import * as mockttp from 'mockttp';
 import {
-  integTest,
   cloneDirectory,
-  shell,
-  withDefaultFixture,
-  retry,
-  sleep,
+  integTest,
   randomInteger,
-  withSamIntegrationFixture,
+  randomString,
   RESOURCES_DIR,
+  retry,
+  shell,
+  sleep,
   withCDKMigrateFixture,
+  withDefaultFixture,
   withExtendedTimeoutFixture,
-  randomString,
-  withSpecificFixture,
   withoutBootstrap,
+  withSamIntegrationFixture,
+  withSpecificFixture,
 } from '../../lib';
 
 jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
@@ -2809,3 +2810,46 @@ integTest('cdk notices are displayed correctly', withDefaultFixture(async (fixtu
   expect(output).toContain(`AffectedEnvironments:<aws://${await fixture.aws.account()}/${fixture.aws.region}>`);
 
 }));
+
+integTest('requests go through a proxy when configured',
+  withDefaultFixture(async (fixture) => {
+    // Set up key and certificate
+    const { key, cert } = await mockttp.generateCACertificate();
+    const certDir = await fs.mkdtemp(path.join(os.tmpdir(), 'cdk-'));
+    const certPath = path.join(certDir, 'cert.pem');
+    const keyPath = path.join(certDir, 'key.pem');
+    await fs.writeFile(keyPath, key);
+    await fs.writeFile(certPath, cert);
+
+    const proxyServer = mockttp.getLocal({
+      https: { keyPath, certPath },
+    });
+
+    // We don't need to modify any request, so the proxy
+    // passes through all requests to the host.
+    const endpoint = await proxyServer
+      .forAnyRequest()
+      .thenPassThrough();
+
+    proxyServer.enableDebug();
+    await proxyServer.start();
+
+    // The proxy is now ready to intercept requests
+
+    try {
+      await fixture.cdkDeploy('test-2', {
+        captureStderr: true,
+        options: [
+          '--proxy', proxyServer.url,
+          '--ca-bundle-path', certPath,
+        ],
+      });
+    } finally {
+      await fs.rm(certDir, { recursive: true, force: true });
+    }
+
+    // Checking that there was some interaction with the proxy
+    const requests = await endpoint.getSeenRequests();
+    expect(requests.length).toBeGreaterThan(0);
+  }),
+);

packages/@aws-cdk-testing/framework-integ/test/aws-lambda-event-sources/test/integ.kafka-selfmanaged.js.snapshot/lambda-event-source-kafka-self-managed.template.json

@@ -322,6 +322,138 @@
      "my-test-topic2"
     ]
    }
+  },
+  "F3ServiceRole2F65FFC0": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   }
+  },
+  "F3ServiceRoleDefaultPolicy1C0463D1": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": [
+        "secretsmanager:DescribeSecret",
+        "secretsmanager:GetSecretValue"
+       ],
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Ref": "S509448A1"
+        },
+        {
+         "Ref": "SC0855C491"
+        }
+       ]
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "F3ServiceRoleDefaultPolicy1C0463D1",
+    "Roles": [
+     {
+      "Ref": "F3ServiceRole2F65FFC0"
+     }
+    ]
+   }
+  },
+  "F38FF9B13A": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "ZipFile": "exports.handler = async function handler(event) {\n    console.log('event:', JSON.stringify(event, undefined, 2));\n    return { event };\n}"
+    },
+    "Handler": "index.handler",
+    "Role": {
+     "Fn::GetAtt": [
+      "F3ServiceRole2F65FFC0",
+      "Arn"
+     ]
+    },
+    "Runtime": "nodejs18.x"
+   },
+   "DependsOn": [
+    "F3ServiceRoleDefaultPolicy1C0463D1",
+    "F3ServiceRole2F65FFC0"
+   ]
+  },
+  "F3KafkaEventSource838c4d5ff3c99c1a617120adfca83e5bmytesttopic3ED015F25": {
+   "Type": "AWS::Lambda::EventSourceMapping",
+   "Properties": {
+    "BatchSize": 100,
+    "FilterCriteria": {
+     "Filters": [
+      {
+       "Pattern": "{\"numericEquals\":[{\"numeric\":[\"=\",1]}]}"
+      }
+     ]
+    },
+    "FunctionName": {
+     "Ref": "F38FF9B13A"
+    },
+    "ProvisionedPollerConfig": {
+     "MaximumPollers": 3,
+     "MinimumPollers": 1
+    },
+    "SelfManagedEventSource": {
+     "Endpoints": {
+      "KafkaBootstrapServers": [
+       "my-self-hosted-kafka-broker-1:9092",
+       "my-self-hosted-kafka-broker-2:9092",
+       "my-self-hosted-kafka-broker-3:9092"
+      ]
+     }
+    },
+    "SelfManagedKafkaEventSourceConfig": {
+     "ConsumerGroupId": "myTestConsumerGroup3"
+    },
+    "SourceAccessConfigurations": [
+     {
+      "Type": "CLIENT_CERTIFICATE_TLS_AUTH",
+      "URI": {
+       "Ref": "SC0855C491"
+      }
+     },
+     {
+      "Type": "SERVER_ROOT_CA_CERTIFICATE",
+      "URI": {
+       "Ref": "S509448A1"
+      }
+     }
+    ],
+    "StartingPosition": "TRIM_HORIZON",
+    "Topics": [
+     "my-test-topic3"
+    ]
+   }
   }
  },
  "Parameters": {