Merge branch 'main' into feat-validate-cloud-front-waf-region

packages/@aws-cdk/aws-servicecatalogappregistry-alpha/lib/application-associator.ts

@@ -50,7 +50,7 @@ export class ApplicationAssociator extends Construct {
     this.associateCrossAccountStacks = targetBindResult.associateCrossAccountStacks;
     cdk.Aspects.of(scope).add(new CheckedStageStackAssociator(this, {
       associateCrossAccountStacks: this.associateCrossAccountStacks,
-    }));
+    }), { priority: cdk.AspectPriority.MUTATING });
   }
 
   /**
@@ -61,7 +61,7 @@ export class ApplicationAssociator extends Construct {
     this.associatedStages.add(stage);
     cdk.Aspects.of(stage).add(new CheckedStageStackAssociator(this, {
       associateCrossAccountStacks: this.associateCrossAccountStacks,
-    }));
+    }), { priority: cdk.AspectPriority.MUTATING });
     return stage;
   }
 

packages/@aws-cdk/integ-tests-alpha/lib/assertions/http-call.ts

@@ -1,4 +1,4 @@
-import { Aspects, CfnOutput, CustomResource, Lazy, Token } from 'aws-cdk-lib';
+import { AspectPriority, Aspects, CfnOutput, CustomResource, Lazy, Token } from 'aws-cdk-lib';
 import { Construct, IConstruct } from 'constructs';
 import { ApiCallBase, IApiCall } from './api-call-base';
 import { ExpectedResult } from './common';
@@ -51,7 +51,7 @@ export class HttpApiCall extends ApiCallBase {
           }
         }
       },
-    });
+    }, { priority: AspectPriority.MUTATING });
   }
 
   public assertAtPath(_path: string, _expected: ExpectedResult): IApiCall {

packages/@aws-cdk/integ-tests-alpha/lib/assertions/sdk.ts

@@ -1,4 +1,4 @@
-import { ArnFormat, CfnResource, CustomResource, Lazy, Stack, Aspects, CfnOutput } from 'aws-cdk-lib/core';
+import { ArnFormat, CfnResource, CustomResource, Lazy, Stack, Aspects, CfnOutput, AspectPriority } from 'aws-cdk-lib/core';
 import { Construct, IConstruct } from 'constructs';
 import { ApiCallBase, IApiCall } from './api-call-base';
 import { ExpectedResult } from './common';
@@ -125,7 +125,7 @@ export class AwsApiCall extends ApiCallBase {
           }
         }
       },
-    });
+    }, { priority: AspectPriority.MUTATING });
   }
 
   public assertAtPath(path: string, expected: ExpectedResult): IApiCall {
@@ -281,6 +281,6 @@ export class LambdaInvokeFunction extends AwsApiCall {
           })]);
         }
       },
-    });
+    }, { priority: AspectPriority.MUTATING });
   }
 }

packages/aws-cdk-lib/assertions/lib/matcher.ts

@@ -182,7 +182,6 @@ export class MatchResult {
    */
   public toHumanStrings(): string[] {
     const failures = new Array<MatchFailure>();
-    debugger;
     recurse(this, []);
 
     return failures.map(r => {

packages/aws-cdk-lib/aws-autoscaling/lib/auto-scaling-group.ts

@@ -17,6 +17,7 @@ import * as iam from '../../aws-iam';
 import * as sns from '../../aws-sns';
 import {
   Annotations,
+  AspectPriority,
   Aspects,
   Aws,
   CfnAutoScalingRollingUpdate, CfnCreationPolicy, CfnUpdatePolicy,
@@ -1573,7 +1574,7 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
     this.spotPrice = props.spotPrice;
 
     if (props.requireImdsv2) {
-      Aspects.of(this).add(new AutoScalingGroupRequireImdsv2Aspect());
+      Aspects.of(this).add(new AutoScalingGroupRequireImdsv2Aspect(), { priority: AspectPriority.MUTATING });
     }
 
     this.node.addValidation({ validate: () => this.validateTargetGroup() });

packages/aws-cdk-lib/aws-backup/lib/selection.ts

@@ -4,7 +4,7 @@ import { BackupableResourcesCollector } from './backupable-resources-collector';
 import { IBackupPlan } from './plan';
 import { BackupResource, TagOperation } from './resource';
 import * as iam from '../../aws-iam';
-import { Lazy, Resource, Aspects } from '../../core';
+import { Lazy, Resource, Aspects, AspectPriority } from '../../core';
 
 /**
  * Options for a BackupSelection
@@ -140,7 +140,7 @@ export class BackupSelection extends Resource implements iam.IGrantable {
     }
 
     if (resource.construct) {
-      Aspects.of(resource.construct).add(this.backupableResourcesCollector);
+      Aspects.of(resource.construct).add(this.backupableResourcesCollector, { priority: AspectPriority.MUTATING });
       // Cannot push `this.backupableResourcesCollector.resources` to
       // `this.resources` here because it has not been evaluated yet.
       // Will be concatenated to `this.resources` in a `Lazy.list`

packages/aws-cdk-lib/aws-ec2/lib/instance.ts

@@ -15,7 +15,7 @@ import { UserData } from './user-data';
 import { BlockDevice } from './volume';
 import { IVpc, Subnet, SubnetSelection } from './vpc';
 import * as iam from '../../aws-iam';
-import { Annotations, Aspects, Duration, FeatureFlags, Fn, IResource, Lazy, Resource, Stack, Tags, Token } from '../../core';
+import { Annotations, AspectPriority, Aspects, Duration, FeatureFlags, Fn, IResource, Lazy, Resource, Stack, Tags, Token } from '../../core';
 import { md5hash } from '../../core/lib/helpers-internal';
 import * as cxapi from '../../cx-api';
 
@@ -669,7 +669,7 @@ export class Instance extends Resource implements IInstance {
     }));
 
     if (props.requireImdsv2) {
-      Aspects.of(this).add(new InstanceRequireImdsv2Aspect());
+      Aspects.of(this).add(new InstanceRequireImdsv2Aspect(), { priority: AspectPriority.MUTATING });
     }
   }
 

packages/aws-cdk-lib/aws-ecs/lib/cluster.ts

@@ -13,7 +13,7 @@ import { IKey } from '../../aws-kms';
 import * as logs from '../../aws-logs';
 import * as s3 from '../../aws-s3';
 import * as cloudmap from '../../aws-servicediscovery';
-import { Aws, Duration, IResource, Resource, Stack, Aspects, ArnFormat, IAspect, Token, Names } from '../../core';
+import { Aws, Duration, IResource, Resource, Stack, Aspects, ArnFormat, IAspect, Token, Names, AspectPriority } from '../../core';
 
 const CLUSTER_SYMBOL = Symbol.for('@aws-cdk/aws-ecs/lib/cluster.Cluster');
 
@@ -282,7 +282,7 @@ export class Cluster extends Resource implements ICluster {
     // since it's harmless, but we'd prefer not to add unexpected new
     // resources to the stack which could surprise users working with
     // brown-field CDK apps and stacks.
-    Aspects.of(this).add(new MaybeCreateCapacityProviderAssociations(this, id));
+    Aspects.of(this).add(new MaybeCreateCapacityProviderAssociations(this, id), { priority: AspectPriority.MUTATING });
   }
 
   /**

packages/aws-cdk-lib/aws-iam/lib/permissions-boundary.ts

@@ -1,7 +1,7 @@
 import { IConstruct } from 'constructs';
 import { CfnRole, CfnUser } from './iam.generated';
 import { IManagedPolicy } from './managed-policy';
-import { Aspects, CfnResource } from '../../core';
+import { AspectPriority, Aspects, CfnResource } from '../../core';
 
 /**
  * Modify the Permissions Boundaries of Users and Roles in a construct tree
@@ -40,7 +40,7 @@ export class PermissionsBoundary {
           node.addPropertyOverride('PermissionsBoundary', boundaryPolicy.managedPolicyArn);
         }
       },
-    });
+    }, { priority: AspectPriority.MUTATING });
   }
 
   /**
@@ -56,6 +56,6 @@ export class PermissionsBoundary {
           node.addPropertyDeletionOverride('PermissionsBoundary');
         }
       },
-    });
+    }, { priority: AspectPriority.MUTATING });
   }
 }

packages/aws-cdk-lib/aws-iam/lib/role.ts

@@ -13,7 +13,7 @@ import { ImportedRole } from './private/imported-role';
 import { MutatingPolicyDocumentAdapter } from './private/policydoc-adapter';
 import { PrecreatedRole } from './private/precreated-role';
 import { AttachedPolicies, UniqueStringSet } from './private/util';
-import { ArnFormat, Duration, Resource, Stack, Token, TokenComparison, Aspects, Annotations, RemovalPolicy } from '../../core';
+import { ArnFormat, Duration, Resource, Stack, Token, TokenComparison, Aspects, Annotations, RemovalPolicy, AspectPriority } from '../../core';
 import { getCustomizeRolesConfig, getPrecreatedRoleConfig, CUSTOMIZE_ROLES_CONTEXT_KEY, CustomizeRoleConfig } from '../../core/lib/helpers-internal';
 
 const MAX_INLINE_SIZE = 10000;
@@ -493,7 +493,7 @@ export class Role extends Resource implements IRole {
             this.splitLargePolicy();
           }
         },
-      });
+      }, { priority: AspectPriority.MUTATING });
     }
 
     this.policyFragment = new ArnPrincipal(this.roleArn).policyFragment;

packages/aws-cdk-lib/aws-servicecatalog/lib/portfolio.ts

@@ -366,7 +366,7 @@ export class Portfolio extends PortfolioBase {
           (c as Portfolio).addBucketPermissionsToSharedAccounts();
         };
       },
-    });
+    }, { priority: cdk.AspectPriority.MUTATING });
   }
 
   protected generateUniqueHash(value: string): string {

packages/aws-cdk-lib/cloudformation-include/test/test-templates/non-existent-policy-attribute.json

@@ -0,0 +1,17 @@
+{
+  "Resources": {
+    "ASG": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "5"
+      },
+      "CreationPolicy": {
+        "NonExistentResourceAttribute": "Bucket1"
+      },
+      "UpdatePolicy": {
+        "NonExistentResourceAttribute": "Bucket1"
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/valid-templates.test.ts

@@ -707,6 +707,13 @@ describe('CDK Include', () => {
     );
   });
 
+  test('preserves unknown policy attributes', () => {
+    const cfnTemplate = includeTestTemplate(stack, 'non-existent-policy-attribute.json');
+    Template.fromStack(stack).templateMatches(
+      loadTestFileToJsObject('non-existent-policy-attribute.json'),
+    );
+  });
+
   test("correctly handles referencing the ingested template's resources across Stacks", () => {
     // for cross-stack sharing to work, we need an App
     const app = new core.App();