Merge branch 'master' into upparekh/support-for-elastic-inference-acc…

…elerators

.github/workflows/yarn-upgrade.yml

@@ -46,11 +46,12 @@ jobs:
         # We special-case aws-sdk because of breaking changes with TS interface exports in recent minor versions - https://github.com/aws/aws-sdk-js/issues/3453
         # We special-case typescript because it's not semantically versionned
         # We special-case constructs because we want to stay in control of the minimum compatible version
+        # We special-case lerna because we have a patch on it that stops applying if Lerna upgrades. Remove this once https://github.com/lerna/lerna/pull/2874 releases.
         run: |-
           # Upgrade dependencies at repository root
           ncu --upgrade --filter=@types/node,@types/fs-extra --target=minor
           ncu --upgrade --filter=typescript --target=patch
-          ncu --upgrade --reject=@types/node,@types/fs-extra,constructs,typescript --target=minor
+          ncu --upgrade --reject=@types/node,@types/fs-extra,constructs,typescript,lerna --target=minor
           # Upgrade all the packages
           lerna exec --parallel ncu -- --upgrade --filter=@types/node,@types/fs-extra --target=minor
           lerna exec --parallel ncu -- --upgrade --filter=typescript --target=patch

CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.98.0](https://github.com/aws/aws-cdk/compare/v1.97.0...v1.98.0) (2021-04-12)
+
+
+### Features
+
+* **codepipeline-actions:** introduce the CodeStarConnectionsSourceAction ([#13781](https://github.com/aws/aws-cdk/issues/13781)) ([8782e67](https://github.com/aws/aws-cdk/commit/8782e672d6a8f8bbe201f2572c4b0fca7589168d)), closes [#10632](https://github.com/aws/aws-cdk/issues/10632)
+* **efs:** graduate to stable 🚀 ([#14033](https://github.com/aws/aws-cdk/issues/14033)) ([3c03d87](https://github.com/aws/aws-cdk/commit/3c03d878dd81454628545b1529691ac083862247))
+* **elasticloadbalancingv2:** add grpc code matcher for alb ([#13948](https://github.com/aws/aws-cdk/issues/13948)) ([a37f178](https://github.com/aws/aws-cdk/commit/a37f178b52a91d43b237013d7cb42c44c1774307)), closes [#13570](https://github.com/aws/aws-cdk/issues/13570) [#13947](https://github.com/aws/aws-cdk/issues/13947)
+* **region-info:** graduate to stable 🚀  ([#14013](https://github.com/aws/aws-cdk/issues/14013)) ([0d2755b](https://github.com/aws/aws-cdk/commit/0d2755b97486e4222d1f3b020b8126fefeda20d0))
+* **route-53:** add ability to create NS Records ([#13895](https://github.com/aws/aws-cdk/issues/13895)) ([02c7c1d](https://github.com/aws/aws-cdk/commit/02c7c1d9aab6ed8f806052d3102a037e112b8786)), closes [#13816](https://github.com/aws/aws-cdk/issues/13816)
+
+
+### Bug Fixes
+
+* **apigateway:** cannot remove first api key from usage plan ([#13817](https://github.com/aws/aws-cdk/issues/13817)) ([036d869](https://github.com/aws/aws-cdk/commit/036d869dc1382d3fb2d8541f5adf534ea3424667)), closes [#11876](https://github.com/aws/aws-cdk/issues/11876)
+* **cloudfront:** cannot use same EdgeFunction in multiple stacks ([#13790](https://github.com/aws/aws-cdk/issues/13790)) ([8e2325c](https://github.com/aws/aws-cdk/commit/8e2325cfb7dc5377755b561532b6c81caebc688f))
+* **lambda-nodejs:** esbuild define parameters are incorrectly encoded ([#14065](https://github.com/aws/aws-cdk/issues/14065)) ([5378a77](https://github.com/aws/aws-cdk/commit/5378a7770d5897737ecf4da25d47747c2bbddd94)), closes [#13842](https://github.com/aws/aws-cdk/issues/13842)
+* **rds:** deploy fails with "SubnetGroup not found" ([#13986](https://github.com/aws/aws-cdk/issues/13986)) ([ad326da](https://github.com/aws/aws-cdk/commit/ad326da3ae392b78dcfc349f246acdf3a389f283)), closes [#13976](https://github.com/aws/aws-cdk/issues/13976)
+* **route53:** cannot set TTL to 0 ([#14060](https://github.com/aws/aws-cdk/issues/14060)) ([ecc9bf3](https://github.com/aws/aws-cdk/commit/ecc9bf386ca088ca82a332c649f13613b9793628)), closes [#14039](https://github.com/aws/aws-cdk/issues/14039)
+* **s3:** SSL enforcement doesn't apply on top level bucket requests ([#13961](https://github.com/aws/aws-cdk/issues/13961)) ([d0e831a](https://github.com/aws/aws-cdk/commit/d0e831a2f2b60eae021d10a77d1d636615b0cf04)), closes [#13760](https://github.com/aws/aws-cdk/issues/13760)
+* **stepfunctions:** state machine name validation fails when tokens are used. ([#13970](https://github.com/aws/aws-cdk/issues/13970)) ([58de0de](https://github.com/aws/aws-cdk/commit/58de0de5a54b9d8fb4658566e85ef408c8861088)), closes [#13946](https://github.com/aws/aws-cdk/issues/13946) [#13912](https://github.com/aws/aws-cdk/issues/13912)
+
 ## [1.97.0](https://github.com/aws/aws-cdk/compare/v1.96.0...v1.97.0) (2021-04-06)
 
 

package.json

@@ -11,17 +11,19 @@
     "pack": "./pack.sh",
     "compat": "./scripts/check-api-compatibility.sh",
     "bump": "./bump.sh",
-    "build-all": "tsc -b"
+    "build-all": "tsc -b",
+    "postinstall": "patch-package --error-on-fail"
   },
   "devDependencies": {
     "conventional-changelog-cli": "^2.1.1",
     "fs-extra": "^9.1.0",
     "graceful-fs": "^4.2.6",
     "jest-junit": "^12.0.0",
-    "jsii-diff": "^1.27.0",
-    "jsii-pacmak": "^1.27.0",
-    "jsii-rosetta": "^1.27.0",
+    "jsii-diff": "^1.28.0",
+    "jsii-pacmak": "^1.28.0",
+    "jsii-rosetta": "^1.28.0",
     "lerna": "^4.0.0",
+    "patch-package": "^6.4.7",
     "standard-version": "^9.2.0",
     "typescript": "~3.9.9"
   },

packages/@aws-cdk/aws-appsync/README.md

@@ -26,7 +26,7 @@ APIs that use GraphQL.
 
 ## Example
 
-## DynamoDB
+### DynamoDB
 
 Example of a GraphQL API with `AWS_IAM` authorization resolving into a DynamoDb
 backend data source.
@@ -95,7 +95,7 @@ demoDS.createResolver({
 });
 ```
 
-## Aurora Serverless
+### Aurora Serverless
 
 AppSync provides a data source for executing SQL commands against Amazon Aurora
 Serverless clusters. You can use AppSync resolvers to execute SQL statements
@@ -240,13 +240,13 @@ httpDs.createResolver({
 });
 ```
 
-### Schema
+## Schema
 
 Every GraphQL Api needs a schema to define the Api. CDK offers `appsync.Schema`
 for static convenience methods for various types of schema declaration: code-first
 or schema-first.
 
-#### Code-First
+### Code-First
 
 When declaring your GraphQL Api, CDK defaults to a code-first approach if the
 `schema` property is not configured.
@@ -274,7 +274,7 @@ const api = new appsync.GraphqlApi(stack, 'api', {
 
 See the [code-first schema](#Code-First-Schema) section for more details.
 
-#### Schema-First
+### Schema-First
 
 You can define your GraphQL Schema from a file on disk. For convenience, use
 the `appsync.Schema.fromAsset` to specify the file representing your schema.
@@ -286,7 +286,7 @@ const api = appsync.GraphqlApi(stack, 'api', {
 });
 ```
 
-### Imports
+## Imports
 
 Any GraphQL Api that has been created outside the stack can be imported from
 another stack into your CDK app. Utilizing the `fromXxx` function, you have
@@ -304,7 +304,7 @@ If you don't specify `graphqlArn` in `fromXxxAttributes`, CDK will autogenerate
 the expected `arn` for the imported api, given the `apiId`. For creating data
 sources and resolvers, an `apiId` is sufficient.
 
-### Permissions
+## Permissions
 
 When using `AWS_IAM` as the authorization type for GraphQL API, an IAM Role
 with correct permissions must be used for access to API.
@@ -358,7 +358,7 @@ const api = new appsync.GraphqlApi(stack, 'API', {
 api.grant(role, appsync.IamResource.custom('types/Mutation/fields/updateExample'), 'appsync:GraphQL')
 ```
 
-#### IamResource
+### IamResource
 
 In order to use the `grant` functions, you need to use the class `IamResource`.
 
@@ -368,7 +368,7 @@ In order to use the `grant` functions, you need to use the class `IamResource`.
 
 - `IamResource.all()` permits ALL resources.
 
-#### Generic Permissions
+### Generic Permissions
 
 Alternatively, you can use more generic `grant` functions to accomplish the same usage.
 
@@ -386,7 +386,7 @@ api.grantMutation(role, 'updateExample');
 api.grant(role, appsync.IamResource.ofType('Mutation', 'updateExample'), 'appsync:GraphQL');
 ```
 
-### Pipeline Resolvers and AppSync Functions
+## Pipeline Resolvers and AppSync Functions
 
 AppSync Functions are local functions that perform certain operations onto a
 backend data source. Developers can compose operations (Functions) and execute
@@ -418,7 +418,7 @@ const pipelineResolver = new appsync.Resolver(stack, 'pipeline', {
 
 Learn more about Pipeline Resolvers and AppSync Functions [here](https://docs.aws.amazon.com/appsync/latest/devguide/pipeline-resolvers.html).
 
-### Code-First Schema
+## Code-First Schema
 
 CDK offers the ability to generate your schema in a code-first approach.
 A code-first approach offers a developer workflow with:
@@ -429,7 +429,7 @@ A code-first approach offers a developer workflow with:
 
 The code-first approach allows for **dynamic** schema generation. You can generate your schema based on variables and templates to reduce code duplication.
 
-#### Code-First Example
+### Code-First Example
 
 To showcase the code-first approach. Let's try to model the following schema segment.
 
@@ -545,7 +545,7 @@ create the base Object Type (i.e. Film) and from there we can generate its respe
 
 Check out a more in-depth example [here](https://github.com/BryanPan342/starwars-code-first).
 
-#### GraphQL Types
+## GraphQL Types
 
 One of the benefits of GraphQL is its strongly typed nature. We define the
 types within an object, query, mutation, interface, etc. as **GraphQL Types**.
@@ -562,7 +562,7 @@ More concretely, GraphQL Types are simply the types appended to variables.
 Referencing the object type `Demo` in the previous example, the GraphQL Types
 is `String!` and is applied to both the names `id` and `version`.
 
-#### Directives
+### Directives
 
 `Directives` are attached to a field or type and affect the execution of queries,
 mutations, and types. With AppSync, we use `Directives` to configure authorization.
@@ -577,12 +577,12 @@ through `Cognito User Pools`
 
 To learn more about authorization and directives, read these docs [here](https://docs.aws.amazon.com/appsync/latest/devguide/security.html).
 
-#### Field and Resolvable Fields
+### Field and Resolvable Fields
 
 While `GraphqlType` is a base implementation for GraphQL fields, we have abstractions
 on top of `GraphqlType` that provide finer grain support.
 
-#### Field
+### Field
 
 `Field` extends `GraphqlType` and will allow you to define arguments. [**Interface Types**](#Interface-Types) are not resolvable and this class will allow you to define arguments,
 but not its resolvers.
@@ -609,7 +609,7 @@ const type = new appsync.InterfaceType('Node', {
 });
 ```
 
-#### Resolvable Fields
+### Resolvable Fields
 
 `ResolvableField` extends `Field` and will allow you to define arguments and its resolvers.
 [**Object Types**](#Object-Types) can have fields that resolve and perform operations on
@@ -671,7 +671,7 @@ const query = new appsync.ObjectType('Query', {
 
 Learn more about fields and resolvers [here](https://docs.aws.amazon.com/appsync/latest/devguide/resolver-mapping-template-reference-overview.html).
 
-#### Intermediate Types
+### Intermediate Types
 
 Intermediate Types are defined by Graphql Types and Fields. They have a set of defined
 fields, where each field corresponds to another type in the system. Intermediate
@@ -703,7 +703,7 @@ const node = new appsync.InterfaceType('Node', {
 
 To learn more about **Interface Types**, read the docs [here](https://graphql.org/learn/schema/#interfaces).
 
-##### Object Types
+#### Object Types
 
 **Object Types** are types that you declare. For example, in the [code-first example](#code-first-example)
 the `demo` variable is an **Object Type**. **Object Types** are defined by
@@ -775,7 +775,7 @@ You can create Object Types in three ways:
 
 To learn more about **Object Types**, read the docs [here](https://graphql.org/learn/schema/#object-types-and-fields).
 
-### Enum Types
+#### Enum Types
 
 **Enum Types** are a special type of Intermediate Type. They restrict a particular
 set of allowed values for other Intermediate Types.
@@ -832,7 +832,7 @@ api.addType(review);
 
 To learn more about **Input Types**, read the docs [here](https://graphql.org/learn/schema/#input-types).
 
-### Union Types
+#### Union Types
 
 **Union Types** are a special type of Intermediate Type. They are similar to
 Interface Types, but they cannot specify any common fields between types.
@@ -860,7 +860,7 @@ api.addType(search);
 
 To learn more about **Union Types**, read the docs [here](https://graphql.org/learn/schema/#union-types).
 
-#### Query
+### Query
 
 Every schema requires a top level Query type. By default, the schema will look
 for the `Object Type` named `Query`. The top level `Query` is the **only** exposed
@@ -883,7 +883,7 @@ api.addQuery('allFilms', new appsync.ResolvableField({
 
 To learn more about top level operations, check out the docs [here](https://docs.aws.amazon.com/appsync/latest/devguide/graphql-overview.html).
 
-#### Mutation
+### Mutation
 
 Every schema **can** have a top level Mutation type. By default, the schema will look
 for the `ObjectType` named `Mutation`. The top level `Mutation` Type is the only exposed
@@ -906,7 +906,7 @@ api.addMutation('addFilm', new appsync.ResolvableField({
 
 To learn more about top level operations, check out the docs [here](https://docs.aws.amazon.com/appsync/latest/devguide/graphql-overview.html).
 
-#### Subscription
+### Subscription
 
 Every schema **can** have a top level Subscription type. The top level `Subscription` Type
 is the only exposed type that users can access to invoke a response to a mutation. `Subscriptions`

packages/@aws-cdk/aws-certificatemanager/jest.config.js

@@ -1,2 +1,2 @@
-const baseConfig = require('../../../tools/cdk-build-tools/config/jest.config');
+const baseConfig = require('cdk-build-tools/config/jest.config');
 module.exports = baseConfig;

packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/package.json

@@ -29,7 +29,7 @@
   "devDependencies": {
     "aws-sdk": "^2.596.0",
     "aws-sdk-mock": "^5.1.0",
-    "eslint": "^7.23.0",
+    "eslint": "^7.24.0",
     "eslint-config-standard": "^14.1.1",
     "eslint-plugin-import": "^2.22.1",
     "eslint-plugin-node": "^11.1.0",

packages/@aws-cdk/aws-cloudformation/package.json

@@ -72,7 +72,7 @@
     "@aws-cdk/aws-sns-subscriptions": "0.0.0",
     "@aws-cdk/aws-sqs": "0.0.0",
     "@aws-cdk/aws-ssm": "0.0.0",
-    "@types/aws-lambda": "^8.10.73",
+    "@types/aws-lambda": "^8.10.75",
     "@types/nodeunit": "^0.0.31",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",

packages/@aws-cdk/aws-cloudfront/lib/distribution.ts

@@ -279,6 +279,12 @@ export class Distribution extends Resource implements IDistribution {
     this.certificate = props.certificate;
     this.errorResponses = props.errorResponses ?? [];
 
+    // Comments have an undocumented limit of 128 characters
+    const trimmedComment =
+      props.comment && props.comment.length > 128
+        ? `${props.comment.substr(0, 128 - 3)}...`
+        : props.comment;
+
     const distribution = new CfnDistribution(this, 'Resource', {
       distributionConfig: {
         enabled: props.enabled ?? true,
@@ -287,7 +293,7 @@ export class Distribution extends Resource implements IDistribution {
         defaultCacheBehavior: this.defaultBehavior._renderBehavior(),
         aliases: props.domainNames,
         cacheBehaviors: Lazy.any({ produce: () => this.renderCacheBehaviors() }),
-        comment: props.comment,
+        comment: trimmedComment,
         customErrorResponses: this.renderErrorResponses(),
         defaultRootObject: props.defaultRootObject,
         httpVersion: props.httpVersion ?? HttpVersion.HTTP2,

packages/@aws-cdk/aws-cloudfront/lib/geo-restriction.ts

@@ -4,27 +4,43 @@
 export class GeoRestriction {
 
   /**
-   * Whitelist specific countries which you want CloudFront to distribute your content.
+   * Allow specific countries which you want CloudFront to distribute your content.
    *
    * @param locations Two-letter, uppercase country code for a country
-   * that you want to whitelist. Include one element for each country.
+   * that you want to allow. Include one element for each country.
    * See ISO 3166-1-alpha-2 code on the *International Organization for Standardization* website
    */
-  public static whitelist(...locations: string[]) {
+  public static allowlist(...locations: string[]) {
     return new GeoRestriction('whitelist', GeoRestriction.validateLocations(locations));
   }
 
   /**
-   * Blacklist specific countries which you don't want CloudFront to distribute your content.
+   * Deny specific countries which you don't want CloudFront to distribute your content.
    *
    * @param locations Two-letter, uppercase country code for a country
-   * that you want to blacklist. Include one element for each country.
+   * that you want to deny. Include one element for each country.
    * See ISO 3166-1-alpha-2 code on the *International Organization for Standardization* website
    */
-  public static blacklist(...locations: string[]) {
+  public static denylist(...locations: string[]) {
     return new GeoRestriction('blacklist', GeoRestriction.validateLocations(locations));
   }
 
+  /**
+   * DEPRECATED
+   * @deprecated use `allowlist`
+   */
+  public static whitelist(...locations: string[]) {
+    return GeoRestriction.allowlist(...locations);
+  }
+
+  /**
+   * DEPRECATED
+   * @deprecated use `denylist`
+   */
+  public static blacklist(...locations: string[]) {
+    return GeoRestriction.denylist(...locations);
+  }
+
   private static LOCATION_REGEX = /^[A-Z]{2}$/;
 
   private static validateLocations(locations: string[]) {
@@ -43,9 +59,9 @@ export class GeoRestriction {
   /**
    * Creates an instance of GeoRestriction for internal use
    *
-   * @param restrictionType Specifies the restriction type to impose (whitelist or blacklist)
+   * @param restrictionType Specifies the restriction type to impose
    * @param locations Two-letter, uppercase country code for a country
-   * that you want to whitelist/blacklist. Include one element for each country.
+   * that you want to allow/deny. Include one element for each country.
    * See ISO 3166-1-alpha-2 code on the *International Organization for Standardization* website
    */
   private constructor(readonly restrictionType: 'whitelist' | 'blacklist', readonly locations: string[]) {}

packages/@aws-cdk/aws-cloudfront/lib/origin-access-identity.ts

@@ -115,7 +115,7 @@ export class OriginAccessIdentity extends OriginAccessIdentityBase implements IO
     // physical id - OAI name
     this.originAccessIdentityName = this.getResourceNameAttribute(this.resource.ref);
 
-    // Canonical user to whitelist in S3 Bucket Policy
+    // Canonical user to grant access to in the S3 Bucket Policy
     this.cloudFrontOriginAccessIdentityS3CanonicalUserId = this.resource.attrS3CanonicalUserId;
     // The principal for must be either the canonical user or a special ARN
     // with the CloudFront Origin Access Id (see `arn()` method). For