feat: update L1 CloudFormation resource definitions (#36082)

Updates the L1 CloudFormation resource definitions with the latest changes from `@aws-cdk/aws-service-spec`

**L1 CloudFormation resource definition changes:**
```
├[~] service aws-apigateway
│ └ resources
│    ├[~]  resource AWS::ApiGateway::DomainName
│    │  └ properties
│    │     └[+] EndpointAccessMode: string
│    ├[~]  resource AWS::ApiGateway::DomainNameV2
│    │  └ properties
│    │     └[+] EndpointAccessMode: string
│    ├[~]  resource AWS::ApiGateway::Method
│    │  └ types
│    │     └[~] type Integration
│    │       └ properties
│    │          └[+] IntegrationTarget: string
│    └[~]  resource AWS::ApiGateway::RestApi
│       └ properties
│          └[+] EndpointAccessMode: string
├[~] service aws-aps
│ └ resources
│    └[~]  resource AWS::APS::Scraper
│       └ types
│          ├[~] type Source
│          │ └ properties
│          │    ├ EksConfiguration: - EksConfiguration (required)
│          │    │                   + EksConfiguration
│          │    └[+] VpcConfiguration: VpcConfiguration
│          └[+]  type VpcConfiguration
│             ├      documentation: Configuration for VPC metrics source
│             │      name: VpcConfiguration
│             └ properties
│                ├ SecurityGroupIds: Array<string> (required)
│                └ SubnetIds: Array<string> (required)
├[~] service aws-batch
│ └ resources
│    └[~]  resource AWS::Batch::ComputeEnvironment
│       └ types
│          └[~] type Ec2ConfigurationObject
│            └ properties
│               └ ImageType: (documentation changed)
├[~] service aws-bedrockagentcore
│ └ resources
│    └[~]  resource AWS::BedrockAgentCore::GatewayTarget
│       ├ attributes
│       │  └[+] LastSynchronizedAt: string
│       └ types
│          ├[+]  type McpServerTargetConfiguration
│          │  ├      name: McpServerTargetConfiguration
│          │  └ properties
│          │     └ Endpoint: string (required)
│          └[~] type McpTargetConfiguration
│            └ properties
│               └[+] McpServer: McpServerTargetConfiguration
├[~] service aws-connectcampaignsv2
│ └ resources
│    └[~]  resource AWS::ConnectCampaignsV2::Campaign
│       └ types
│          └[~] type TelephonyOutboundMode
│            └ properties
│               └ PreviewConfig: (documentation changed)
├[~] service aws-controltower
│ └ resources
│    └[~]  resource AWS::ControlTower::LandingZone
│       └ properties
│          └[+] RemediationTypes: Array<string>
├[~] service aws-directoryservice
│ └ resources
│    └[~]  resource AWS::DirectoryService::MicrosoftAD
│       └      - arnTemplate: arn:${Partition}:ds:${Region}:${Account}:${DirectoryId}
│              + arnTemplate: arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId}
├[~] service aws-dsql
│ └ resources
│    └[~]  resource AWS::DSQL::Cluster
│       ├ properties
│       │  └[+] PolicyDocument: string
│       └ attributes
│          └[+] PolicyVersion: string
├[~] service aws-dynamodb
│ └ resources
│    └[~]  resource AWS::DynamoDB::GlobalTable
│       └ types
│          └[~] type ReplicaStreamSpecification
│            └ properties
│               └ ResourcePolicy: - ResourcePolicy
│                                 + ResourcePolicy (required)
├[~] service aws-ec2
│ └ resources
│    └[~]  resource AWS::EC2::IPAMScope
│       ├ properties
│       │  └[+] ExternalAuthorityConfiguration: IpamScopeExternalAuthorityConfiguration
│       └ types
│          └[+]  type IpamScopeExternalAuthorityConfiguration
│             ├      documentation: The configuration that links an Amazon VPC IPAM scope to an external authority system. It specifies the type of external system and the external resource identifier that identifies your account or instance in that system.
│             │      In IPAM, an external authority is a third-party IP address management system that provides CIDR blocks when you provision address space for top-level IPAM pools. This allows you to use your existing IP management system to control which address ranges are allocated to AWS while using Amazon VPC IPAM to manage subnets within those ranges.
│             │      name: IpamScopeExternalAuthorityConfiguration
│             └ properties
│                ├ IpamScopeExternalAuthorityType: string (required)
│                └ ExternalResourceIdentifier: string (required)
├[~] service aws-elasticloadbalancingv2
│ └ resources
│    ├[~]  resource AWS::ElasticLoadBalancingV2::Listener
│    │  └ types
│    │     ├[~] type Action
│    │     │ └ properties
│    │     │    └[+] JwtValidationConfig: JwtValidationConfig
│    │     ├[+]  type JwtValidationActionAdditionalClaim
│    │     │  ├      name: JwtValidationActionAdditionalClaim
│    │     │  └ properties
│    │     │     ├ Format: string (required)
│    │     │     ├ Values: Array<string> (required)
│    │     │     └ Name: string (required)
│    │     └[+]  type JwtValidationConfig
│    │        ├      name: JwtValidationConfig
│    │        └ properties
│    │           ├ JwksEndpoint: string (required)
│    │           ├ Issuer: string (required)
│    │           └ AdditionalClaims: Array<JwtValidationActionAdditionalClaim>
│    ├[~]  resource AWS::ElasticLoadBalancingV2::ListenerRule
│    │  └ types
│    │     ├[~] type Action
│    │     │ └ properties
│    │     │    └[+] JwtValidationConfig: JwtValidationConfig
│    │     ├[+]  type JwtValidationActionAdditionalClaim
│    │     │  ├      name: JwtValidationActionAdditionalClaim
│    │     │  └ properties
│    │     │     ├ Format: string (required)
│    │     │     ├ Name: string (required)
│    │     │     └ Values: Array<string> (required)
│    │     └[+]  type JwtValidationConfig
│    │        ├      name: JwtValidationConfig
│    │        └ properties
│    │           ├ JwksEndpoint: string (required)
│    │           ├ Issuer: string (required)
│    │           └ AdditionalClaims: Array<JwtValidationActionAdditionalClaim>
│    └[~]  resource AWS::ElasticLoadBalancingV2::TargetGroup
│       └ types
│          └[~] type TargetDescription
│            └ properties
│               └[+] QuicServerId: string
├[~] service aws-glue
│ └ resources
│    └[+]  resource AWS::Glue::IdentityCenterConfiguration
│       ├      name: IdentityCenterConfiguration
│       │      cloudFormationType: AWS::Glue::IdentityCenterConfiguration
│       │      documentation: Resource Type definition for AWS::Glue::IdentityCenterConfiguration
│       ├ properties
│       │  ├ InstanceArn: string (required, immutable)
│       │  ├ Scopes: Array<string>
│       │  └ UserBackgroundSessionsEnabled: boolean
│       └ attributes
│          ├ ApplicationArn: string
│          └ AccountId: string
├[~] service aws-iotwireless
│ └ resources
│    └[~]  resource AWS::IoTWireless::WirelessDeviceImportTask
│       └      - arnTemplate: arn:${Partition}:iotwireless:${Region}:${Account}:WirelessDeviceImportTask/${WirelessDeviceImportTaskId}
│              + arnTemplate: arn:${Partition}:iotwireless:${Region}:${Account}:ImportTask/${ImportTaskId}
├[~] service aws-kinesis
│ └ resources
│    └[~]  resource AWS::Kinesis::Stream
│       ├ properties
│       │  └[+] WarmThroughputMiBps: integer
│       ├ attributes
│       │  └[+] WarmThroughputObject: WarmThroughputObject
│       └ types
│          └[+]  type WarmThroughputObject
│             ├      documentation: Represents the warm throughput configuration on the stream. This is only present for On-Demand Kinesis Data Streams in accounts that have `MinimumThroughputBillingCommitment` enabled.
│             │      name: WarmThroughputObject
│             └ properties
│                ├ TargetMiBps: integer
│                └ CurrentMiBps: integer
├[~] service aws-kms
│ └ resources
│    └[~]  resource AWS::KMS::Key
│       └ properties
│          └ KeySpec: (documentation changed)
├[~] service aws-mediaconnect
│ └ resources
│    ├[~]  resource AWS::MediaConnect::Flow
│    │  └ types
│    │     ├[+]  type FlowTransitEncryption
│    │     │  ├      documentation: The configuration that defines how content is encrypted during transit between the MediaConnect router and a MediaConnect flow.
│    │     │  │      name: FlowTransitEncryption
│    │     │  └ properties
│    │     │     ├ EncryptionKeyType: string
│    │     │     └ EncryptionKeyConfiguration: FlowTransitEncryptionKeyConfiguration (required)
│    │     ├[+]  type FlowTransitEncryptionKeyConfiguration
│    │     │  ├      name: FlowTransitEncryptionKeyConfiguration
│    │     │  └ properties
│    │     │     ├ SecretsManager: SecretsManagerEncryptionKeyConfiguration
│    │     │     └ Automatic: json
│    │     ├[+]  type SecretsManagerEncryptionKeyConfiguration
│    │     │  ├      documentation: The configuration settings for transit encryption of a flow source using AWS Secrets Manager, including the secret ARN and role ARN.
│    │     │  │      name: SecretsManagerEncryptionKeyConfiguration
│    │     │  └ properties
│    │     │     ├ SecretArn: string (required)
│    │     │     └ RoleArn: string (required)
│    │     └[~] type Source
│    │       └ properties
│    │          ├[+] RouterIntegrationState: string
│    │          └[+] RouterIntegrationTransitDecryption: FlowTransitEncryption
│    ├[~]  resource AWS::MediaConnect::FlowOutput
│    │  ├ properties
│    │  │  ├[+] RouterIntegrationState: string
│    │  │  └[+] RouterIntegrationTransitEncryption: FlowTransitEncryption
│    │  └ types
│    │     ├[+]  type FlowTransitEncryption
│    │     │  ├      documentation: The configuration that defines how content is encrypted during transit between the MediaConnect router and a MediaConnect flow.
│    │     │  │      name: FlowTransitEncryption
│    │     │  └ properties
│    │     │     ├ EncryptionKeyType: string
│    │     │     └ EncryptionKeyConfiguration: FlowTransitEncryptionKeyConfiguration (required)
│    │     ├[+]  type FlowTransitEncryptionKeyConfiguration
│    │     │  ├      name: FlowTransitEncryptionKeyConfiguration
│    │     │  └ properties
│    │     │     ├ SecretsManager: SecretsManagerEncryptionKeyConfiguration
│    │     │     └ Automatic: json
│    │     └[+]  type SecretsManagerEncryptionKeyConfiguration
│    │        ├      documentation: The configuration settings for transit encryption of a flow output using AWS Secrets Manager, including the secret ARN and role ARN.
│    │        │      name: SecretsManagerEncryptionKeyConfiguration
│    │        └ properties
│    │           ├ SecretArn: string (required)
│    │           └ RoleArn: string (required)
│    └[+]  resource AWS::MediaConnect::RouterNetworkInterface
│       ├      name: RouterNetworkInterface
│       │      cloudFormationType: AWS::MediaConnect::RouterNetworkInterface
│       │      documentation: Represents a router network interface in AWS Elemental MediaConnect that is used to define a network boundary for router resources
│       │      tagInformation: {"tagPropertyName":"Tags","variant":"standard"}
│       ├ properties
│       │  ├ Configuration: RouterNetworkInterfaceConfiguration (required)
│       │  ├ Name: string (required)
│       │  ├ RegionName: string (immutable)
│       │  └ Tags: Array<tag>
│       ├ attributes
│       │  ├ Arn: string
│       │  ├ AssociatedInputCount: integer
│       │  ├ AssociatedOutputCount: integer
│       │  ├ CreatedAt: string
│       │  ├ Id: string
│       │  ├ NetworkInterfaceType: string
│       │  ├ State: string
│       │  └ UpdatedAt: string
│       └ types
│          ├ type PublicRouterNetworkInterfaceConfiguration
│          │ ├      documentation: The configuration settings for a public router network interface, including the list of allowed CIDR blocks.
│          │ │      name: PublicRouterNetworkInterfaceConfiguration
│          │ └ properties
│          │    └ AllowRules: Array<PublicRouterNetworkInterfaceRule> (required)
│          ├ type PublicRouterNetworkInterfaceRule
│          │ ├      documentation: A rule that allows a specific CIDR block to access the public router network interface.
│          │ │      name: PublicRouterNetworkInterfaceRule
│          │ └ properties
│          │    └ Cidr: string (required)
│          ├ type RouterNetworkInterfaceConfiguration
│          │ ├      name: RouterNetworkInterfaceConfiguration
│          │ └ properties
│          │    ├ Public: PublicRouterNetworkInterfaceConfiguration
│          │    └ Vpc: VpcRouterNetworkInterfaceConfiguration
│          └ type VpcRouterNetworkInterfaceConfiguration
│            ├      documentation: The configuration settings for a router network interface within a VPC, including the security group IDs and subnet ID.
│            │      name: VpcRouterNetworkInterfaceConfiguration
│            └ properties
│               ├ SecurityGroupIds: Array<string> (required)
│               └ SubnetId: string (required)
├[~] service aws-msk
│ └ resources
│    └[~]  resource AWS::MSK::Cluster
│       ├ properties
│       │  └[+] Rebalancing: Rebalancing
│       ├ attributes
│       │  └[+] CurrentVersion: string
│       └ types
│          └[+]  type Rebalancing
│             ├      name: Rebalancing
│             └ properties
│                └ Status: string (required)
├[~] service aws-pinpoint
│ └ resources
│    ├[~]  resource AWS::Pinpoint::EmailTemplate
│    │  └      - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/EMAIL
│    │         + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/SMS
│    ├[~]  resource AWS::Pinpoint::InAppTemplate
│    │  └      - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/EMAIL
│    │         + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/SMS
│    └[~]  resource AWS::Pinpoint::PushTemplate
│       └      - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH
│              + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/SMS
├[~] service aws-ram
│ └ resources
│    └[~]  resource AWS::RAM::Permission
│       └      - arnTemplate: arn:${Partition}:ram::${Account}:permission/${ResourcePath}
│              + arnTemplate: arn:${Partition}:ram:${Region}:${Account}:permission/${ResourcePath}
├[~] service aws-rekognition
│ └ resources
│    └[~]  resource AWS::Rekognition::Project
│       ├      - tagInformation: undefined
│       │      + tagInformation: {"tagPropertyName":"Tags","variant":"standard"}
│       └ properties
│          └[+] Tags: Array<tag>
├[~] service aws-rtbfabric
│ └ resources
│    └[+]  resource AWS::RTBFabric::InboundExternalLink
│       ├      name: InboundExternalLink
│       │      cloudFormationType: AWS::RTBFabric::InboundExternalLink
│       │      documentation: Resource Type definition for AWS::RTBFabric::InboundExternalLink Resource Type
│       │      tagInformation: {"tagPropertyName":"Tags","variant":"standard"}
│       ├ properties
│       │  ├ Tags: Array<tag>
│       │  ├ GatewayId: string (required)
│       │  ├ LinkAttributes: LinkAttributes
│       │  └ LinkLogSettings: LinkLogSettings (required)
│       ├ attributes
│       │  ├ LinkId: string
│       │  ├ Arn: string
│       │  ├ LinkStatus: string
│       │  ├ CreatedTimestamp: string
│       │  └ UpdatedTimestamp: string
│       └ types
│          ├ type ApplicationLogs
│          │ ├      name: ApplicationLogs
│          │ └ properties
│          │    └ LinkApplicationLogSampling: LinkApplicationLogSampling (required)
│          ├ type LinkApplicationLogSampling
│          │ ├      name: LinkApplicationLogSampling
│          │ └ properties
│          │    ├ ErrorLog: number (required)
│          │    └ FilterLog: number (required)
│          ├ type LinkAttributes
│          │ ├      name: LinkAttributes
│          │ └ properties
│          │    ├ ResponderErrorMasking: Array<ResponderErrorMaskingForHttpCode>
│          │    └ CustomerProvidedId: string
│          ├ type LinkLogSettings
│          │ ├      name: LinkLogSettings
│          │ └ properties
│          │    └ ApplicationLogs: ApplicationLogs (required)
│          └ type ResponderErrorMaskingForHttpCode
│            ├      name: ResponderErrorMaskingForHttpCode
│            └ properties
│               ├ HttpCode: string (required)
│               ├ Action: string (required)
│               ├ LoggingTypes: Array<string> (required)
│               └ ResponseLoggingPercentage: number
└[~] service aws-s3tables
  └ resources
     └[~]  resource AWS::S3Tables::TableBucket
        ├ properties
        │  └[+] MetricsConfiguration: MetricsConfiguration
        └ types
           └[+]  type MetricsConfiguration
              ├      documentation: Settings governing the Metric configuration for the table bucket.
              │      name: MetricsConfiguration
              └ properties
                 └ Status: string (default="Disabled")
```
**CHANGES TO L1 RESOURCES:** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

  - **aws-dynamodb**: AWS::DynamoDB::GlobalTable: ResourcePolicy property is now required.

Author: aws-cdk-automation

packages/aws-cdk-lib/package.json

@@ -132,7 +132,7 @@
   },
   "devDependencies": {
     "@aws-cdk/lambda-layer-kubectl-v31": "^2.1.0",
-    "@aws-cdk/aws-service-spec": "^0.1.115",
+    "@aws-cdk/aws-service-spec": "^0.1.116",
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/custom-resource-handlers": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",

tools/@aws-cdk/spec2cdk/package.json

@@ -31,9 +31,9 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-cdk/aws-service-spec": "^0.1.115",
+    "@aws-cdk/aws-service-spec": "^0.1.116",
     "@aws-cdk/service-spec-importers": "^0.0.93",
-    "@aws-cdk/service-spec-types": "^0.0.181",
+    "@aws-cdk/service-spec-types": "^0.0.182",
     "@cdklabs/tskb": "^0.0.3",
     "@cdklabs/typewriter": "^0.0.10",
     "camelcase": "^6",

yarn.lock

@@ -66,12 +66,12 @@
     "@aws-cdk/service-spec-types" "^0.0.164"
     "@cdklabs/tskb" "^0.0.3"
 
-"@aws-cdk/aws-service-spec@^0.1.115":
-  version "0.1.115"
-  resolved "https://registry.npmjs.org/@aws-cdk/aws-service-spec/-/aws-service-spec-0.1.115.tgz#9d419d4e8c4ba9fffc9e9f7f45c55eeb1d19c676"
-  integrity sha512-NWrQNMqnocOgK1L5B43PQurxyJBS8xnPCEtHCneMXYI9l3jvARZw7/LjgXkkb0g/F4secRJMExEuHYr2qSBxwQ==
+"@aws-cdk/aws-service-spec@^0.1.116":
+  version "0.1.116"
+  resolved "https://registry.npmjs.org/@aws-cdk/aws-service-spec/-/aws-service-spec-0.1.116.tgz#05d314b7a4e845e180031af20ab2c59b35944966"
+  integrity sha512-L3rfWG2dqRi7/hM2QbFEfmGo/c35/bii31QG7Paco94laX7Tvhw6vhFfhYYC09gq6BUy8tKXgoQhmBMipBlO8A==
   dependencies:
-    "@aws-cdk/service-spec-types" "^0.0.181"
+    "@aws-cdk/service-spec-types" "^0.0.182"
     "@cdklabs/tskb" "^0.0.3"
 
 "@aws-cdk/cloud-assembly-schema@^48.6.0":
@@ -157,10 +157,10 @@
   dependencies:
     "@cdklabs/tskb" "^0.0.3"
 
-"@aws-cdk/service-spec-types@^0.0.181":
-  version "0.0.181"
-  resolved "https://registry.npmjs.org/@aws-cdk/service-spec-types/-/service-spec-types-0.0.181.tgz#3c3e7defa8c084441d7453780d26edd9d3b993d9"
-  integrity sha512-HULC75yEwKFyN3sQJtuWZF4WIhS5A/4ijnWaPMp5j1qbJaT714QFBvdy/B5q2cxSEtbUPvbpjMIYdqp21kx/cQ==
+"@aws-cdk/service-spec-types@^0.0.182":
+  version "0.0.182"
+  resolved "https://registry.npmjs.org/@aws-cdk/service-spec-types/-/service-spec-types-0.0.182.tgz#8faa1e97a80d56bed93367b7c7df9b24ffaa8c4b"
+  integrity sha512-CFNIUUz0h8eK79UHJdyaU1EWlUyXa1E1O4WJ9UmjF2IQS9mEOOReqEzuinH9zwZY8aqwEE9cTsFeAqDbKckMbw==
   dependencies:
     "@cdklabs/tskb" "^0.0.3"