chore(release): 1.48.0 (#8831)

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/bump/1.48.0/CHANGELOG.md)

.github/ISSUE_TEMPLATE/bug.md

@@ -1,7 +1,7 @@
 ---
 name: "\U0001F41B Bug Report"
 about: Report a bug
-title: "(module): "
+title: "[module] "
 labels: bug, needs-triage
 ---
 

.github/ISSUE_TEMPLATE/doc.md

@@ -1,7 +1,7 @@
 ---
 name: "📕 Documentation Issue"
 about: Issue in the reference documentation or developer guide
-title: "(module): "
+title: "[module] "
 labels: feature-request, documentation, needs-triage
 ---
 

.github/ISSUE_TEMPLATE/feature-request.md

@@ -1,7 +1,7 @@
 ---
 name: "\U0001F680 Feature Request"
 about: Request a new feature
-title: "(module): "
+title: "[module] "
 labels: feature-request, needs-triage
 ---
 

.github/ISSUE_TEMPLATE/general-issues.md

@@ -1,7 +1,7 @@
 ---
 name: "\U00002753 General Issue"
 about: Create a new issue
-title: "(module): "
+title: "[module] "
 labels: needs-triage
 ---
 

.gitignore

@@ -35,3 +35,6 @@ cdk.out/
 
 # Yarn error log
 yarn-error.log
+
+# Parcel default cache directory
+.parcel-cache

CHANGELOG.md

@@ -2,6 +2,52 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.48.0](https://github.com/aws/aws-cdk/compare/v1.47.1...v1.48.0) (2020-07-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* **stepfunctions-tasks:** `containerName` is not supported as an override anymore and has been replaced by `containerDefinition`
+* **stepfunctions-tasks:** `EvaluateExpression` is now a construct representing a task state rather than an embedded property called `task`
+* **backup:** existing vaults that use a generated name will be replaced but
+existing recovery points won't be lost. The default vault removal policy is
+`RETAIN` and if it was set to `DESTROY` the deployment will fail because
+vault with recovery points cannot be deleted.
+
+### Features
+
+* **autoscaling:** bring your own security group ([3698f47](https://github.com/aws/aws-cdk/commit/3698f47bad970be6f3765e4f145d64f59ded4276))
+* **aws-cloudwatch:** add comparison operators ([#8812](https://github.com/aws/aws-cdk/issues/8812)) ([7003a09](https://github.com/aws/aws-cdk/commit/7003a09c4cc5390c4b1c125e79d50cf7ba2c9723)), closes [#8808](https://github.com/aws/aws-cdk/issues/8808)
+* **cfn-include:** add support for YAML templates ([#8746](https://github.com/aws/aws-cdk/issues/8746)) ([293a937](https://github.com/aws/aws-cdk/commit/293a937a6c24681319ae7ca210ffdd0b2ba7d88a)), closes [#8745](https://github.com/aws/aws-cdk/issues/8745)
+* **cfnspec:** cloudformation spec v16.0.0 ([#8807](https://github.com/aws/aws-cdk/issues/8807)) ([4ce27f4](https://github.com/aws/aws-cdk/commit/4ce27f4195c70bd9e365ec0e0df5c0ede863bc8a))
+* **cli:** support multiple verbosity levels ([#8749](https://github.com/aws/aws-cdk/issues/8749)) ([fa4196b](https://github.com/aws/aws-cdk/commit/fa4196b11a4b843af1401cbcfd3fe075986ec5c0))
+* **ec2:** `Volume` construct ([#8219](https://github.com/aws/aws-cdk/issues/8219)) ([7490dee](https://github.com/aws/aws-cdk/commit/7490deef3390f024dede3da8b95bcec6140ce1be))
+* **ec2:** add 6xlarge InstanceSize ([#8701](https://github.com/aws/aws-cdk/issues/8701)) ([4917c04](https://github.com/aws/aws-cdk/commit/4917c04a23852608c4c697bff02a1085fdfd4b8c))
+* **ec2:** natGateways=0 disables private subnets ([#8817](https://github.com/aws/aws-cdk/issues/8817)) ([7f432ff](https://github.com/aws/aws-cdk/commit/7f432ffd2c4755bd0976c1777021dad4c7cf2e26)), closes [#4814](https://github.com/aws/aws-cdk/issues/4814)
+* **efs:** Filesystem.addAccessPoint() ([#8737](https://github.com/aws/aws-cdk/issues/8737)) ([127547a](https://github.com/aws/aws-cdk/commit/127547a8d64c25fef7c330abee06fd890354afec))
+* **lambda-nodejs:** external and install modules ([#8681](https://github.com/aws/aws-cdk/issues/8681)) ([401594e](https://github.com/aws/aws-cdk/commit/401594ea6cd1c9dc7c4f62ffeee95a720a0ec337)), closes [#6323](https://github.com/aws/aws-cdk/issues/6323) [#7912](https://github.com/aws/aws-cdk/issues/7912)
+* **secretsmanager:** add grantUpdate method ([#8600](https://github.com/aws/aws-cdk/issues/8600)) ([4e72d1e](https://github.com/aws/aws-cdk/commit/4e72d1e9f00ff464c9e645fe55f9178e30ad44df)), closes [#8491](https://github.com/aws/aws-cdk/issues/8491)
+* **stepfunctions:** class for working with Json paths to retrieve state machine data and context ([#8647](https://github.com/aws/aws-cdk/issues/8647)) ([67978a1](https://github.com/aws/aws-cdk/commit/67978a1cc92c9e7bea389e533b893efedd204c66))
+* **stepfunctions-tasks:** evaluate expression as a task construct ([#8555](https://github.com/aws/aws-cdk/issues/8555)) ([83fd2ae](https://github.com/aws/aws-cdk/commit/83fd2aee6389d03cfe69260b996d7d09398bbf99))
+* **stepfunctions-tasks:** task construct to call `RunJob` on ECS ([#8451](https://github.com/aws/aws-cdk/issues/8451)) ([13deb26](https://github.com/aws/aws-cdk/commit/13deb266f030a28890b5672a0c12b658d253f57e)), closes [#8610](https://github.com/aws/aws-cdk/issues/8610)
+
+
+### Bug Fixes
+
+* **apigateway:** error defining lambda integration on imported RestApi ([#8785](https://github.com/aws/aws-cdk/issues/8785)) ([05aaf42](https://github.com/aws/aws-cdk/commit/05aaf422e71e12ea6ec91ea26bfbce81ebfea7f4)), closes [#8679](https://github.com/aws/aws-cdk/issues/8679)
+* **backup:** correctly validate Vault name ([#8689](https://github.com/aws/aws-cdk/issues/8689)) ([07b330c](https://github.com/aws/aws-cdk/commit/07b330cf39be2a98fbee93915f07c2c34136e105))
+* **backup:** vault name may exceed 50 characters ([#8653](https://github.com/aws/aws-cdk/issues/8653)) ([d09c121](https://github.com/aws/aws-cdk/commit/d09c121e84c0c106f25a129066b0990fb237b841)), closes [#8627](https://github.com/aws/aws-cdk/issues/8627)
+* **batch:** Invalid spot fleet service role ([#8325](https://github.com/aws/aws-cdk/issues/8325)) ([034bc35](https://github.com/aws/aws-cdk/commit/034bc354ace24965cd091f423b8f2ef91f487a7a)), closes [#6706](https://github.com/aws/aws-cdk/issues/6706)
+* **cli:** post install warnings are not clearly visible when running cdk init ([#8723](https://github.com/aws/aws-cdk/issues/8723)) ([2662db3](https://github.com/aws/aws-cdk/commit/2662db3218387a6264b37190c231e3b0006eb6b6)), closes [#8720](https://github.com/aws/aws-cdk/issues/8720)
+* **cli:** unable to use "legacy" bootstrap with --public-access-block-configuration=false ([#8755](https://github.com/aws/aws-cdk/issues/8755)) ([88f8e1e](https://github.com/aws/aws-cdk/commit/88f8e1e9475c66114796dd2840c67a3f4e11f57f)), closes [#8728](https://github.com/aws/aws-cdk/issues/8728)
+* **cognito:** cannot add multiple route53 targets to the same user pool domain ([#8622](https://github.com/aws/aws-cdk/issues/8622)) ([32b54a5](https://github.com/aws/aws-cdk/commit/32b54a504357922e55ac98850a8e4acc9a0349f5)), closes [#8603](https://github.com/aws/aws-cdk/issues/8603)
+* **core:** bundling directory access permission is too restrictive ([#8767](https://github.com/aws/aws-cdk/issues/8767)) ([1842168](https://github.com/aws/aws-cdk/commit/18421686c4109deb018cc77429ec6deefb7d5689)), closes [#8757](https://github.com/aws/aws-cdk/issues/8757)
+* **eks:** Helm chart timeout expects duration ([#8773](https://github.com/aws/aws-cdk/issues/8773)) ([d1c2ef2](https://github.com/aws/aws-cdk/commit/d1c2ef2fc8a845446c956e5e1eb32745f1810ee9)), closes [#8718](https://github.com/aws/aws-cdk/issues/8718)
+* **elbv2:** Add missing accounts to ELBv2 Log Delivery. ([#8715](https://github.com/aws/aws-cdk/issues/8715)) ([8914899](https://github.com/aws/aws-cdk/commit/8914899aafcaa28d8b7ca2d2901f86b016179b50))
+* **rewrite:** script ignores list of files ([#8777](https://github.com/aws/aws-cdk/issues/8777)) ([bb514c1](https://github.com/aws/aws-cdk/commit/bb514c1eb1098ccbe5cee4d7570d11bc8d9155c3))
+* **route53-targets:** A/AAAA Alias Record to ELB cannot resolve IPv6 addresses ([#8747](https://github.com/aws/aws-cdk/issues/8747)) ([87e2651](https://github.com/aws/aws-cdk/commit/87e265114590d8fcc69e18b42d777b8ca201307c)), closes [#6271](https://github.com/aws/aws-cdk/issues/6271)
+* **s3-notifications:** broken permissions query in `LambdaDestination` ([#8741](https://github.com/aws/aws-cdk/issues/8741)) ([10bd8e4](https://github.com/aws/aws-cdk/commit/10bd8e49709330624eee5f2c2662dee11e19e130)), closes [#8538](https://github.com/aws/aws-cdk/issues/8538)
+
 ## [1.47.1](https://github.com/aws/aws-cdk/compare/v1.47.0...v1.47.1) (2020-06-30)
 
 ### Bug Fixes

build.sh

@@ -31,7 +31,7 @@ export NODE_OPTIONS="--max-old-space-size=4096 ${NODE_OPTIONS:-}"
 
 echo "============================================================================================="
 echo "installing..."
-yarn install --frozen-lockfile
+yarn install --frozen-lockfile --network-timeout 1000000
 
 fail() {
   echo "❌  Last command failed. Scroll up to see errors in log (search for '!!!!!!!!')."

lerna.json

@@ -10,5 +10,5 @@
     "tools/*"
   ],
   "rejectCycles": "true",
-  "version": "1.47.1"
+  "version": "1.48.0"
 }

package.json

@@ -52,6 +52,8 @@
       "@aws-cdk/aws-codepipeline-actions/case/**",
       "@aws-cdk/aws-ecr-assets/minimatch",
       "@aws-cdk/aws-ecr-assets/minimatch/**",
+      "@aws-cdk/aws-eks/yaml",
+      "@aws-cdk/aws-eks/yaml/**",
       "@aws-cdk/aws-lambda-nodejs/parcel-bundler",
       "@aws-cdk/aws-lambda-nodejs/parcel-bundler/**",
       "@aws-cdk/cloud-assembly-schema/jsonschema",

packages/@aws-cdk/assert/package.json

@@ -21,7 +21,7 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@types/jest": "^26.0.0",
+    "@types/jest": "^26.0.3",
     "cdk-build-tools": "0.0.0",
     "jest": "^25.5.4",
     "pkglint": "0.0.0",

packages/@aws-cdk/aws-apigateway/lib/integrations/lambda.ts

@@ -56,7 +56,7 @@ export class LambdaIntegration extends AwsIntegration {
     super.bind(method);
     const principal = new iam.ServicePrincipal('apigateway.amazonaws.com');
 
-    const desc = `${method.restApi.node.uniqueId}.${method.httpMethod}.${method.resource.path.replace(/\//g, '.')}`;
+    const desc = `${method.api.node.uniqueId}.${method.httpMethod}.${method.resource.path.replace(/\//g, '.')}`;
 
     this.handler.addPermission(`ApiPermission.${desc}`, {
       principal,

packages/@aws-cdk/aws-apigateway/lib/method.ts

@@ -237,27 +237,22 @@ export class Method extends Resource {
    *   arn:aws:execute-api:{region}:{account}:{restApiId}/{stage}/{method}/{path}
    *
    * NOTE: {stage} will refer to the `restApi.deploymentStage`, which will
-   * automatically set if auto-deploy is enabled.
+   * automatically set if auto-deploy is enabled, or can be explicitly assigned.
+   * When not configured, {stage} will be set to '*', as a shorthand for 'all stages'.
    *
    * @attribute
    */
   public get methodArn(): string {
-    if (!this.restApi.deploymentStage) {
-      throw new Error(
-        `Unable to determine ARN for method "${this.node.id}" since there is no stage associated with this API.\n` +
-        'Either use the `deploy` prop or explicitly assign `deploymentStage` on the RestApi');
-    }
-
-    const stage = this.restApi.deploymentStage.stageName.toString();
-    return this.restApi.arnForExecuteApi(this.httpMethod, pathForArn(this.resource.path), stage);
+    const stage = this.api.deploymentStage?.stageName;
+    return this.api.arnForExecuteApi(this.httpMethod, pathForArn(this.resource.path), stage);
   }
 
   /**
    * Returns an execute-api ARN for this method's "test-invoke-stage" stage.
    * This stage is used by the AWS Console UI when testing the method.
    */
   public get testMethodArn(): string {
-    return this.restApi.arnForExecuteApi(this.httpMethod, pathForArn(this.resource.path), 'test-invoke-stage');
+    return this.api.arnForExecuteApi(this.httpMethod, pathForArn(this.resource.path), 'test-invoke-stage');
   }
 
   private renderIntegration(integration?: Integration): CfnMethod.IntegrationProperty {

packages/@aws-cdk/aws-apigateway/lib/restapi.ts

@@ -38,6 +38,11 @@ export interface IRestApi extends IResourceBase {
    */
   readonly latestDeployment?: Deployment;
 
+  /**
+   * API Gateway stage that points to the latest deployment (if defined).
+   */
+  deploymentStage: Stage;
+
   /**
    * Represents the root resource ("/") of this API. Use it to define the API model:
    *
@@ -46,6 +51,17 @@ export interface IRestApi extends IResourceBase {
    *
    */
   readonly root: IResource;
+
+  /**
+   * Gets the "execute-api" ARN
+   * @returns The "execute-api" ARN.
+   * @default "*" returns the execute API ARN for all methods/resources in
+   * this API.
+   * @param method The method (default `*`)
+   * @param path The resource path. Must start with '/' (default `*`)
+   * @param stage The stage (default `*`)
+   */
+  arnForExecuteApi(method?: string, path?: string, stage?: string): string;
 }
 
 /**
@@ -324,15 +340,6 @@ export abstract class RestApiBase extends Resource implements IRestApi {
     return new UsagePlan(this, id, props);
   }
 
-  /**
-   * Gets the "execute-api" ARN
-   * @returns The "execute-api" ARN.
-   * @default "*" returns the execute API ARN for all methods/resources in
-   * this API.
-   * @param method The method (default `*`)
-   * @param path The resource path. Must start with '/' (default `*`)
-   * @param stage The stage (default `*`)
-   */
   public arnForExecuteApi(method: string = '*', path: string = '/*', stage: string = '*') {
     if (!path.startsWith('/')) {
       throw new Error(`"path" must begin with a "/": '${path}'`);
@@ -496,7 +503,7 @@ export class RestApi extends RestApiBase {
    * Import an existing RestApi.
    */
   public static fromRestApiId(scope: Construct, id: string, restApiId: string): IRestApi {
-    class Import extends Resource implements IRestApi {
+    class Import extends RestApiBase {
       public readonly restApiId = restApiId;
 
       public get root(): IResource {

packages/@aws-cdk/aws-apigateway/test/test.lambda.ts

@@ -191,4 +191,28 @@ export = {
 
     test.done();
   },
+
+  'works for imported RestApi'(test: Test) {
+    const stack = new cdk.Stack();
+    const api = apigateway.RestApi.fromRestApiAttributes(stack, 'RestApi', {
+      restApiId: 'imported-rest-api-id',
+      rootResourceId: 'imported-root-resource-id',
+    });
+
+    const handler = new lambda.Function(stack, 'MyFunc', {
+      runtime: lambda.Runtime.NODEJS_10_X,
+      handler: 'index.handler',
+      code: lambda.Code.fromInline('loo'),
+    });
+
+    api.root.addMethod('ANY', new apigateway.LambdaIntegration(handler));
+
+    expect(stack).to(haveResource('AWS::ApiGateway::Method', {
+      RestApiId: 'imported-rest-api-id',
+      ResourceId: 'imported-root-resource-id',
+      HttpMethod: 'ANY',
+    }));
+
+    test.done();
+  },
 };

packages/@aws-cdk/aws-apigateway/test/test.method.ts

@@ -207,15 +207,31 @@ export = {
     test.done();
   },
 
-  '"methodArn" fails if the API does not have a deployment stage'(test: Test) {
+  '"methodArn" returns an arn with "*" as its stage when deploymentStage is not set'(test: Test) {
     // GIVEN
     const stack = new cdk.Stack();
     const api = new apigw.RestApi(stack, 'test-api', { deploy: false });
+
+    // WHEN
     const method = new apigw.Method(stack, 'my-method', { httpMethod: 'POST', resource: api.root });
 
-    // WHEN + THEN
-    test.throws(() => method.methodArn,
-      /Unable to determine ARN for method "my-method" since there is no stage associated with this API./);
+    // THEN
+    test.deepEqual(stack.resolve(method.methodArn), {
+      'Fn::Join': [
+        '',
+        [
+          'arn:',
+          { Ref: 'AWS::Partition' },
+          ':execute-api:',
+          { Ref: 'AWS::Region' },
+          ':',
+          { Ref: 'AWS::AccountId' },
+          ':',
+          { Ref: 'testapiD6451F70' },
+          '/*/POST/',
+        ],
+      ],
+    });
 
     test.done();
   },

packages/@aws-cdk/aws-appsync/README.md

@@ -65,7 +65,7 @@ export class ApiStack extends Stack {
   constructor(scope: Construct, id: string) {
     super(scope, id);
 
-    const userPool = new UserPool(this, 'UserPool'{
+    const userPool = new UserPool(this, 'UserPool', {
       userPoolName: 'myPool',
     });
 

packages/@aws-cdk/aws-autoscaling/README.md

@@ -29,9 +29,20 @@ new autoscaling.AutoScalingGroup(this, 'ASG', {
 });
 ```
 
-> NOTE: AutoScalingGroup has an property called `allowAllOutbound` (allowing the instances to contact the
-> internet) which is set to `true` by default. Be sure to set this to `false`  if you don't want
-> your instances to be able to start arbitrary connections.
+NOTE: AutoScalingGroup has an property called `allowAllOutbound` (allowing the instances to contact the
+internet) which is set to `true` by default. Be sure to set this to `false`  if you don't want
+your instances to be able to start arbitrary connections. Alternatively, you can specify an existing security
+group to attach to the instances that are launched, rather than have the group create a new one.
+
+```ts
+const mySecurityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {...});
+new autoscaling.AutoScalingGroup(this, 'ASG', {
+  vpc,
+  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+  machineImage: new ec2.AmazonLinuxImage(),
+  securityGroup: mySecurityGroup,
+});
+```
 
 ### Machine Images (AMIs)
 

packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts

@@ -255,6 +255,13 @@ export interface AutoScalingGroupProps extends CommonAutoScalingGroupProps {
    */
   readonly machineImage: ec2.IMachineImage;
 
+  /**
+   * Security group to launch the instances in.
+   *
+   * @default - A SecurityGroup will be created if none is specified.
+   */
+  readonly securityGroup?: ec2.ISecurityGroup;
+
   /**
    * Specific UserData to use
    *
@@ -475,7 +482,7 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
   constructor(scope: Construct, id: string, props: AutoScalingGroupProps) {
     super(scope, id);
 
-    this.securityGroup = new ec2.SecurityGroup(this, 'InstanceSecurityGroup', {
+    this.securityGroup = props.securityGroup || new ec2.SecurityGroup(this, 'InstanceSecurityGroup', {
       vpc: props.vpc,
       allowAllOutbound: props.allowAllOutbound !== false,
     });

packages/@aws-cdk/aws-autoscaling/test/test.auto-scaling-group.ts

@@ -658,6 +658,28 @@ export = {
     test.done();
   },
 
+  'an existing security group can be specified instead of auto-created'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = mockVpc(stack);
+    const securityGroup = ec2.SecurityGroup.fromSecurityGroupId(stack, 'MySG', 'most-secure');
+
+    // WHEN
+    new autoscaling.AutoScalingGroup(stack, 'MyASG', {
+      vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.MICRO),
+      machineImage: new ec2.AmazonLinuxImage(),
+      securityGroup,
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+      SecurityGroups: ['most-secure'],
+    },
+    ));
+    test.done();
+  },
+
   'an existing role can be specified instead of auto-created'(test: Test) {
     // GIVEN
     const stack = new cdk.Stack();

packages/@aws-cdk/aws-backup/README.md

@@ -6,6 +6,10 @@
 
 > All classes with the `Cfn` prefix in this module ([CFN Resources](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib)) are always stable and safe to use.
 
+![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)
+
+> The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.
+
 ---
 <!--END STABILITY BANNER-->