From 4486960e8dfadc22a4948eb5d9917ea6fbb7883d Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Mon, 22 Mar 2021 16:38:52 +0000
Subject: [PATCH 01/15] s3-assets - backport

---
 .../@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts b/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts
index 38cfe5c2d1e46..b8d78aef6f438 100644
--- a/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts
+++ b/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts
@@ -1,6 +1,6 @@
 import * as path from 'path';
 import * as iam from '@aws-cdk/aws-iam';
-import { App, BundlingDockerImage, Stack, StackProps } from '@aws-cdk/core';
+import { App, DockerImage, Stack, StackProps } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import * as assets from '../lib';
 
@@ -12,7 +12,7 @@ class TestStack extends Stack {
     const asset = new assets.Asset(this, 'BundledAsset', {
       path: path.join(__dirname, 'markdown-asset'), // /asset-input and working directory in the container
       bundling: {
-        image: BundlingDockerImage.fromAsset(path.join(__dirname, 'alpine-markdown')), // Build an image
+        image: DockerImage.fromAsset(path.join(__dirname, 'alpine-markdown')), // Build an image
         command: [
           'sh', '-c', `
             markdown index.md > /asset-output/index.html

From 8144badb70054373d080b2d8f53524be9db068e6 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Mon, 22 Mar 2021 16:52:43 +0000
Subject: [PATCH 02/15] core - backport

---
 packages/@aws-cdk/core/lib/bundling.ts | 45 +++++++++++++++++++++++++-
 1 file changed, 44 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/core/lib/bundling.ts b/packages/@aws-cdk/core/lib/bundling.ts
index e3c1458aa0ab9..a9567fe6e464e 100644
--- a/packages/@aws-cdk/core/lib/bundling.ts
+++ b/packages/@aws-cdk/core/lib/bundling.ts
@@ -146,7 +146,7 @@ export class BundlingDockerImage {
    * @param image the image name
    */
   public static fromRegistry(image: string) {
-    return new BundlingDockerImage(image);
+    return new DockerImage(image);
   }
 
   /**
@@ -278,6 +278,49 @@ export class DockerImage extends BundlingDockerImage {
   public static fromBuild(path: string, options: DockerBuildOptions = {}) {
     return BundlingDockerImage.fromAsset(path, options);
   }
+
+  /**
+   * Reference an image on DockerHub or another online registry.
+   *
+   * @param image the image name
+   */
+  public static fromRegistry(image: string) {
+    return new DockerImage(image);
+  }
+
+  /** @param image The Docker image */
+  constructor(public readonly image: string, _imageHash?: string) {
+    super(image, _imageHash);
+  }
+
+  /**
+   * Provides a stable representation of this image for JSON serialization.
+   *
+   * @return The overridden image name if set or image hash name in that order
+   */
+  public toJSON() {
+    return super.toJSON();
+  }
+
+  /**
+   * Runs a Docker image
+   */
+  public run(options: DockerRunOptions = {}) {
+    return super.run(options);
+  }
+
+  /**
+   * Copies a file or directory out of the Docker image to the local filesystem.
+   *
+   * If `outputPath` is omitted the destination path is a temporary directory.
+   *
+   * @param imagePath the path in the Docker image
+   * @param outputPath the destination path for the copy operation
+   * @returns the destination path
+   */
+  public cp(imagePath: string, outputPath?: string): string {
+    return super.cp(imagePath, outputPath);
+  }
 }
 
 /**

From a13d4af535f2a83ef9d3cb7b86c42524659917de Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Mon, 22 Mar 2021 17:00:15 +0000
Subject: [PATCH 03/15] lambda-nodejs - backport - breaking changes

---
 packages/@aws-cdk/aws-lambda-nodejs/lib/bundling.ts       | 6 +++---
 packages/@aws-cdk/aws-lambda-nodejs/lib/types.ts          | 4 ++--
 packages/@aws-cdk/aws-lambda-nodejs/test/bundling.test.ts | 6 +++---
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/packages/@aws-cdk/aws-lambda-nodejs/lib/bundling.ts b/packages/@aws-cdk/aws-lambda-nodejs/lib/bundling.ts
index 536ca1ea7646a..8d4ce3e7261d6 100644
--- a/packages/@aws-cdk/aws-lambda-nodejs/lib/bundling.ts
+++ b/packages/@aws-cdk/aws-lambda-nodejs/lib/bundling.ts
@@ -48,7 +48,7 @@ export class Bundling implements cdk.BundlingOptions {
   private static runsLocally?: boolean;
 
   // Core bundling options
-  public readonly image: cdk.BundlingDockerImage;
+  public readonly image: cdk.DockerImage;
   public readonly command: string[];
   public readonly environment?: { [key: string]: string };
   public readonly workingDirectory: string;
@@ -78,14 +78,14 @@ export class Bundling implements cdk.BundlingOptions {
     // Docker bundling
     const shouldBuildImage = props.forceDockerBundling || !Bundling.runsLocally;
     this.image = shouldBuildImage
-      ? props.dockerImage ?? cdk.BundlingDockerImage.fromAsset(path.join(__dirname, '../lib'), {
+      ? props.dockerImage ?? cdk.DockerImage.fromBuild(path.join(__dirname, '../lib'), {
         buildArgs: {
           ...props.buildArgs ?? {},
           IMAGE: props.runtime.bundlingDockerImage.image,
           ESBUILD_VERSION: props.esbuildVersion ?? ESBUILD_VERSION,
         },
       })
-      : cdk.BundlingDockerImage.fromRegistry('dummy'); // Do not build if we don't need to
+      : cdk.DockerImage.fromRegistry('dummy'); // Do not build if we don't need to
 
     const bundlingCommand = this.createBundlingCommand(cdk.AssetStaging.BUNDLING_INPUT_DIR, cdk.AssetStaging.BUNDLING_OUTPUT_DIR);
     this.command = ['bash', '-c', bundlingCommand];
diff --git a/packages/@aws-cdk/aws-lambda-nodejs/lib/types.ts b/packages/@aws-cdk/aws-lambda-nodejs/lib/types.ts
index 537523abb4f3b..6752d8ca725a1 100644
--- a/packages/@aws-cdk/aws-lambda-nodejs/lib/types.ts
+++ b/packages/@aws-cdk/aws-lambda-nodejs/lib/types.ts
@@ -1,4 +1,4 @@
-import { BundlingDockerImage } from '@aws-cdk/core';
+import { DockerImage } from '@aws-cdk/core';
 
 /**
  * Bundling options
@@ -200,7 +200,7 @@ export interface BundlingOptions {
    *
    * @default - use the Docker image provided by @aws-cdk/aws-lambda-nodejs
    */
-  readonly dockerImage?: BundlingDockerImage;
+  readonly dockerImage?: DockerImage;
 
   /**
    * Command hooks
diff --git a/packages/@aws-cdk/aws-lambda-nodejs/test/bundling.test.ts b/packages/@aws-cdk/aws-lambda-nodejs/test/bundling.test.ts
index e6c32c496b2ff..f6c373831526c 100644
--- a/packages/@aws-cdk/aws-lambda-nodejs/test/bundling.test.ts
+++ b/packages/@aws-cdk/aws-lambda-nodejs/test/bundling.test.ts
@@ -2,7 +2,7 @@ import * as child_process from 'child_process';
 import * as os from 'os';
 import * as path from 'path';
 import { Code, Runtime } from '@aws-cdk/aws-lambda';
-import { AssetHashType, BundlingDockerImage } from '@aws-cdk/core';
+import { AssetHashType, DockerImage } from '@aws-cdk/core';
 import { version as delayVersion } from 'delay/package.json';
 import { Bundling } from '../lib/bundling';
 import { LogLevel } from '../lib/types';
@@ -11,7 +11,7 @@ import * as util from '../lib/util';
 jest.mock('@aws-cdk/aws-lambda');
 
 // Mock BundlingDockerImage.fromAsset() to avoid building the image
-let fromAssetMock = jest.spyOn(BundlingDockerImage, 'fromAsset');
+let fromAssetMock = jest.spyOn(DockerImage, 'fromBuild');
 let getEsBuildVersionMock = jest.spyOn(util, 'getEsBuildVersion');
 beforeEach(() => {
   jest.clearAllMocks();
@@ -290,7 +290,7 @@ test('Custom bundling docker image', () => {
     entry,
     depsLockFilePath,
     runtime: Runtime.NODEJS_12_X,
-    dockerImage: BundlingDockerImage.fromRegistry('my-custom-image'),
+    dockerImage: DockerImage.fromRegistry('my-custom-image'),
     forceDockerBundling: true,
   });
 

From 883163c277462df9cd5cbccd0340f3bb0f5a7c3e Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Mon, 22 Mar 2021 17:09:28 +0000
Subject: [PATCH 04/15] lambda-python - backport

---
 packages/@aws-cdk/aws-lambda-python/lib/bundling.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-lambda-python/lib/bundling.ts b/packages/@aws-cdk/aws-lambda-python/lib/bundling.ts
index a4446611d9a9d..5a3228a78fef7 100644
--- a/packages/@aws-cdk/aws-lambda-python/lib/bundling.ts
+++ b/packages/@aws-cdk/aws-lambda-python/lib/bundling.ts
@@ -98,7 +98,7 @@ export function bundle(options: BundlingOptions): lambda.Code {
   // copy Dockerfile to workdir
   fs.copyFileSync(path.join(__dirname, dockerfile), path.join(stagedir, dockerfile));
 
-  const image = cdk.BundlingDockerImage.fromAsset(stagedir, {
+  const image = cdk.DockerImage.fromBuild(stagedir, {
     buildArgs: {
       IMAGE: runtime.bundlingDockerImage.image,
     },

From c3c831f1606dc413acedfd35e819c1b06d2f6a45 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Mon, 22 Mar 2021 17:16:48 +0000
Subject: [PATCH 05/15] lambda

---
 packages/@aws-cdk/aws-lambda/lib/runtime.ts                   | 4 ++--
 .../@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/aws-lambda/lib/runtime.ts b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
index 0f26813b8c4a9..bb24fbba9eeae 100644
--- a/packages/@aws-cdk/aws-lambda/lib/runtime.ts
+++ b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
@@ -1,4 +1,4 @@
-import { BundlingDockerImage } from '@aws-cdk/core';
+import { BundlingDockerImage, DockerImage } from '@aws-cdk/core';
 
 export interface LambdaRuntimeProps {
   /**
@@ -218,7 +218,7 @@ export class Runtime {
     this.supportsInlineCode = !!props.supportsInlineCode;
     this.family = family;
     const imageName = props.bundlingDockerImage ?? `amazon/aws-sam-cli-build-image-${name}`;
-    this.bundlingDockerImage = BundlingDockerImage.fromRegistry(imageName);
+    this.bundlingDockerImage = DockerImage.fromRegistry(imageName);
     this.supportsCodeGuruProfiling = props.supportsCodeGuruProfiling ?? false;
 
     Runtime.ALL.push(this);
diff --git a/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts b/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts
index b8d78aef6f438..a62554bab726a 100644
--- a/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts
+++ b/packages/@aws-cdk/aws-s3-assets/test/integ.assets.bundling.lit.ts
@@ -12,7 +12,7 @@ class TestStack extends Stack {
     const asset = new assets.Asset(this, 'BundledAsset', {
       path: path.join(__dirname, 'markdown-asset'), // /asset-input and working directory in the container
       bundling: {
-        image: DockerImage.fromAsset(path.join(__dirname, 'alpine-markdown')), // Build an image
+        image: DockerImage.fromBuild(path.join(__dirname, 'alpine-markdown')), // Build an image
         command: [
           'sh', '-c', `
             markdown index.md > /asset-output/index.html

From b7f556cedfec9d099347230b207817246322c412 Mon Sep 17 00:00:00 2001
From: Robert Djurasaj <robertd@users.noreply.github.com>
Date: Mon, 22 Mar 2021 11:23:29 -0600
Subject: [PATCH 06/15] fix(apigatewayv2): error while configuring ANY as an
 allowed method in CORS (#13313)

API gateway expects `*` to represent `ANY` HTTP method. `HttpMethod` enum doesn't
have a value for that, thus causing errors when passing  `HttpMethod` 's `ANY` option.

This commit introduces `CorsHttpMethod` enum which has a proper `ANY` mapping to `*`.

Closes #13280.
Closes #13643.

BREAKING CHANGE: The type of `allowMethods` property under `corsPreflight`
section is changed from `HttpMethod` to `CorsHttpMethod`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-apigatewayv2/README.md  |  2 +-
 .../@aws-cdk/aws-apigatewayv2/lib/http/api.ts | 24 ++++++++++++++++++-
 .../aws-apigatewayv2/lib/http/route.ts        |  2 +-
 .../aws-apigatewayv2/test/http/api.test.ts    |  5 ++--
 4 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/packages/@aws-cdk/aws-apigatewayv2/README.md b/packages/@aws-cdk/aws-apigatewayv2/README.md
index 7a71fc00491a1..0d4d7849fd8df 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/README.md
+++ b/packages/@aws-cdk/aws-apigatewayv2/README.md
@@ -133,7 +133,7 @@ The `corsPreflight` option lets you specify a CORS configuration for an API.
 new HttpApi(stack, 'HttpProxyApi', {
   corsPreflight: {
     allowHeaders: ['Authorization'],
-    allowMethods: [HttpMethod.GET, HttpMethod.HEAD, HttpMethod.OPTIONS, HttpMethod.POST],
+    allowMethods: [CorsHttpMethod.GET, CorsHttpMethod.HEAD, CorsHttpMethod.OPTIONS, CorsHttpMethod.POST],
     allowOrigins: ['*'],
     maxAge: Duration.days(10),
   },
diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts
index 24d250dfd6eda..9675a7654a712 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts
@@ -99,6 +99,28 @@ export interface HttpApiProps {
   readonly defaultAuthorizationScopes?: string[];
 }
 
+/**
+ * Supported CORS HTTP methods
+ */
+export enum CorsHttpMethod{
+  /** HTTP ANY */
+  ANY = '*',
+  /** HTTP DELETE */
+  DELETE = 'DELETE',
+  /** HTTP GET */
+  GET = 'GET',
+  /** HTTP HEAD */
+  HEAD = 'HEAD',
+  /** HTTP OPTIONS */
+  OPTIONS = 'OPTIONS',
+  /** HTTP PATCH */
+  PATCH = 'PATCH',
+  /** HTTP POST */
+  POST = 'POST',
+  /** HTTP PUT */
+  PUT = 'PUT',
+}
+
 /**
  * Options for the CORS Configuration
  */
@@ -119,7 +141,7 @@ export interface CorsPreflightOptions {
    * Represents a collection of allowed HTTP methods.
    * @default - No Methods are allowed.
    */
-  readonly allowMethods?: HttpMethod[];
+  readonly allowMethods?: CorsHttpMethod[];
 
   /**
    * Represents a collection of allowed origins.
diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts
index c3ef630abbbb5..2252630930c27 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts
@@ -61,7 +61,7 @@ export class HttpRouteKey {
     if (path !== '/' && (!path.startsWith('/') || path.endsWith('/'))) {
       throw new Error('path must always start with a "/" and not end with a "/"');
     }
-    return new HttpRouteKey(`${method ?? 'ANY'} ${path}`, path);
+    return new HttpRouteKey(`${method ?? HttpMethod.ANY} ${path}`, path);
   }
 
   /**
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/http/api.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/http/api.test.ts
index 348d8dec9aeb4..72495a3bfde3f 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/test/http/api.test.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/test/http/api.test.ts
@@ -4,6 +4,7 @@ import { Metric } from '@aws-cdk/aws-cloudwatch';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import { Duration, Stack } from '@aws-cdk/core';
 import {
+  CorsHttpMethod,
   HttpApi, HttpAuthorizer, HttpAuthorizerType, HttpIntegrationType, HttpMethod, HttpRouteAuthorizerBindOptions, HttpRouteAuthorizerConfig,
   HttpRouteIntegrationBindOptions, HttpRouteIntegrationConfig, IHttpRouteAuthorizer, IHttpRouteIntegration, HttpNoneAuthorizer, PayloadFormatVersion,
 } from '../../lib';
@@ -106,7 +107,7 @@ describe('HttpApi', () => {
       new HttpApi(stack, 'HttpApi', {
         corsPreflight: {
           allowHeaders: ['Authorization'],
-          allowMethods: [HttpMethod.GET, HttpMethod.HEAD, HttpMethod.OPTIONS, HttpMethod.POST],
+          allowMethods: [CorsHttpMethod.GET, CorsHttpMethod.HEAD, CorsHttpMethod.OPTIONS, CorsHttpMethod.POST, CorsHttpMethod.ANY],
           allowOrigins: ['*'],
           maxAge: Duration.seconds(36400),
         },
@@ -115,7 +116,7 @@ describe('HttpApi', () => {
       expect(stack).toHaveResource('AWS::ApiGatewayV2::Api', {
         CorsConfiguration: {
           AllowHeaders: ['Authorization'],
-          AllowMethods: ['GET', 'HEAD', 'OPTIONS', 'POST'],
+          AllowMethods: ['GET', 'HEAD', 'OPTIONS', 'POST', '*'],
           AllowOrigins: ['*'],
           MaxAge: 36400,
         },

From 2c82c1dcd7561118eb413b6455b3bf553fb69428 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Mon, 22 Mar 2021 18:06:42 +0000
Subject: [PATCH 07/15] docs(cognito): minor clarifications (#13732)

Minor clarification in the docs.

closes #12932
closes #12931
closes #12930


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-cognito/README.md               | 8 ++++----
 packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/@aws-cdk/aws-cognito/README.md b/packages/@aws-cdk/aws-cognito/README.md
index d3f90ff026b36..0582fbdec0f2a 100644
--- a/packages/@aws-cdk/aws-cognito/README.md
+++ b/packages/@aws-cdk/aws-cognito/README.md
@@ -87,9 +87,9 @@ new cognito.UserPool(this, 'myuserpool', {
   selfSignUpEnabled: true,
   userVerification: {
     emailSubject: 'Verify your email for our awesome app!',
-    emailBody: 'Hello {username}, Thanks for signing up to our awesome app! Your verification code is {####}',
+    emailBody: 'Thanks for signing up to our awesome app! Your verification code is {####}',
     emailStyle: cognito.VerificationEmailStyle.CODE,
-    smsMessage: 'Hello {username}, Thanks for signing up to our awesome app! Your verification code is {####}',
+    smsMessage: 'Thanks for signing up to our awesome app! Your verification code is {####}',
   }
 });
 ```
@@ -345,7 +345,7 @@ on the construct, as so -
 const authChallengeFn = new lambda.Function(this, 'authChallengeFn', {
   runtime: lambda.Runtime.NODEJS_12_X,
   handler: 'index.handler',
-  code: lambda.Code.fromInline('auth challenge'),
+  code: lambda.Code.fromAsset(/* path to lambda asset */),
 });
 
 const userpool = new cognito.UserPool(this, 'myuserpool', {
@@ -359,7 +359,7 @@ const userpool = new cognito.UserPool(this, 'myuserpool', {
 userpool.addTrigger(cognito.UserPoolOperation.USER_MIGRATION, new lambda.Function(this, 'userMigrationFn', {
     runtime: lambda.Runtime.NODEJS_12_X,
   handler: 'index.handler',
-  code: lambda.Code.fromInline('user migration'),
+  code: lambda.Code.fromAsset(/* path to lambda asset */),
 }));
 ```
 
diff --git a/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts b/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
index 866c11015ecfd..d1f89f188c667 100644
--- a/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
+++ b/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
@@ -232,7 +232,7 @@ export interface UserPoolClientOptions {
   readonly disableOAuth?: boolean;
 
   /**
-   * OAuth settings for this to client to interact with the app.
+   * OAuth settings for this client to interact with the app.
    * An error is thrown when this is specified and `disableOAuth` is set.
    * @default - see defaults in `OAuthSettings`. meaningless if `disableOAuth` is set.
    */

From 4d634821d205e0f1167eb5c8d9c6966a14a11906 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Mon, 22 Mar 2021 18:49:42 +0000
Subject: [PATCH 08/15] fix(events,applicationautoscaling): specifying a
 schedule rate in seconds results in an error (#13689)

A previous change - b1449a17 - introduced a validation that should have
been applied only when Duration is specified as a token. Instead, it was
applied for non token values as well.

Adjusting the validation so it only applies to when the duration is a
token.

fixes #13566


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../aws-applicationautoscaling/lib/schedule.ts     |  8 ++++----
 .../aws-applicationautoscaling/test/test.cron.ts   | 12 +++++++++---
 packages/@aws-cdk/aws-events/lib/schedule.ts       |  8 ++++----
 packages/@aws-cdk/aws-events/test/test.rule.ts     |  4 ++--
 packages/@aws-cdk/aws-events/test/test.schedule.ts | 14 ++++++++++++++
 5 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/packages/@aws-cdk/aws-applicationautoscaling/lib/schedule.ts b/packages/@aws-cdk/aws-applicationautoscaling/lib/schedule.ts
index cdeb00be9a426..3bd74c1e4f681 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/lib/schedule.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/lib/schedule.ts
@@ -17,11 +17,11 @@ export abstract class Schedule {
    * Construct a schedule from an interval and a time unit
    */
   public static rate(duration: Duration): Schedule {
-    const validDurationUnit = ['minute', 'minutes', 'hour', 'hours', 'day', 'days'];
-    if (!validDurationUnit.includes(duration.unitLabel())) {
-      throw new Error("Allowed unit for scheduling is: 'minute', 'minutes', 'hour', 'hours', 'day' or 'days'");
-    }
     if (duration.isUnresolved()) {
+      const validDurationUnit = ['minute', 'minutes', 'hour', 'hours', 'day', 'days'];
+      if (!validDurationUnit.includes(duration.unitLabel())) {
+        throw new Error("Allowed units for scheduling are: 'minute', 'minutes', 'hour', 'hours', 'day' or 'days'");
+      }
       return new LiteralSchedule(`rate(${duration.formatTokenToNumber()})`);
     }
     if (duration.toSeconds() === 0) {
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts b/packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts
index ca0fb69812b10..324b2f8243c97 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts
@@ -20,10 +20,16 @@ export = {
     test.done();
   },
 
-  'rate must not be in seconds'(test: Test) {
+  'rate can be in seconds'(test: Test) {
+    const duration = appscaling.Schedule.rate(Duration.seconds(120));
+    test.equal('rate(2 minutes)', duration.expressionString);
+    test.done();
+  },
+
+  'rate must not be in seconds when specified as a token'(test: Test) {
     test.throws(() => {
-      appscaling.Schedule.rate(Duration.seconds(1));
-    }, /Allowed unit for scheduling is: 'minute', 'minutes', 'hour', 'hours', 'day' or 'days'/);
+      appscaling.Schedule.rate(Duration.seconds(Lazy.number({ produce: () => 5 })));
+    }, /Allowed units for scheduling/);
     test.done();
   },
 
diff --git a/packages/@aws-cdk/aws-events/lib/schedule.ts b/packages/@aws-cdk/aws-events/lib/schedule.ts
index c12afde30aa01..a3fcbaf399283 100644
--- a/packages/@aws-cdk/aws-events/lib/schedule.ts
+++ b/packages/@aws-cdk/aws-events/lib/schedule.ts
@@ -17,11 +17,11 @@ export abstract class Schedule {
    * Construct a schedule from an interval and a time unit
    */
   public static rate(duration: Duration): Schedule {
-    const validDurationUnit = ['minute', 'minutes', 'hour', 'hours', 'day', 'days'];
-    if (validDurationUnit.indexOf(duration.unitLabel()) === -1) {
-      throw new Error('Allowed unit for scheduling is: \'minute\', \'minutes\', \'hour\', \'hours\', \'day\', \'days\'');
-    }
     if (duration.isUnresolved()) {
+      const validDurationUnit = ['minute', 'minutes', 'hour', 'hours', 'day', 'days'];
+      if (validDurationUnit.indexOf(duration.unitLabel()) === -1) {
+        throw new Error("Allowed units for scheduling are: 'minute', 'minutes', 'hour', 'hours', 'day', 'days'");
+      }
       return new LiteralSchedule(`rate(${duration.formatTokenToNumber()})`);
     }
     if (duration.toSeconds() === 0) {
diff --git a/packages/@aws-cdk/aws-events/test/test.rule.ts b/packages/@aws-cdk/aws-events/test/test.rule.ts
index 72fe340242924..23fe7e2a2ce3e 100644
--- a/packages/@aws-cdk/aws-events/test/test.rule.ts
+++ b/packages/@aws-cdk/aws-events/test/test.rule.ts
@@ -70,7 +70,7 @@ export = {
 
   'Seconds is not an allowed value for Schedule rate'(test: Test) {
     const lazyDuration = cdk.Duration.seconds(cdk.Lazy.number({ produce: () => 5 }));
-    test.throws(() => Schedule.rate(lazyDuration), /Allowed unit for scheduling is: 'minute', 'minutes', 'hour', 'hours', 'day', 'days'/);
+    test.throws(() => Schedule.rate(lazyDuration), /Allowed units for scheduling/i);
     test.done();
   },
 
@@ -78,7 +78,7 @@ export = {
     const lazyDuration = cdk.Duration.millis(cdk.Lazy.number({ produce: () => 5 }));
 
     // THEN
-    test.throws(() => Schedule.rate(lazyDuration), /Allowed unit for scheduling is: 'minute', 'minutes', 'hour', 'hours', 'day', 'days'/);
+    test.throws(() => Schedule.rate(lazyDuration), /Allowed units for scheduling/i);
     test.done();
   },
 
diff --git a/packages/@aws-cdk/aws-events/test/test.schedule.ts b/packages/@aws-cdk/aws-events/test/test.schedule.ts
index e9c24a51c92b2..2d9728e743202 100644
--- a/packages/@aws-cdk/aws-events/test/test.schedule.ts
+++ b/packages/@aws-cdk/aws-events/test/test.schedule.ts
@@ -80,4 +80,18 @@ export = {
         .expressionString);
     test.done();
   },
+
+  'rate can be in seconds'(test: Test) {
+    test.equal('rate(2 minutes)',
+      events.Schedule.rate(Duration.seconds(120))
+        .expressionString);
+    test.done();
+  },
+
+  'rate must not be in seconds when specified as a token'(test: Test) {
+    test.throws(() => {
+      events.Schedule.rate(Duration.seconds(Lazy.number({ produce: () => 5 })));
+    }, /Allowed units for scheduling/);
+    test.done();
+  },
 };

From 0c28aff97d71cf1aea9b2b60c4a4555f34556fe2 Mon Sep 17 00:00:00 2001
From: Benura Abeywardena <43112139+BLasan@users.noreply.github.com>
Date: Tue, 23 Mar 2021 02:36:58 +0530
Subject: [PATCH 09/15] fix(codepipeline-actions): BitBucketAction fails with
 S3 "Access denied" error (#13637)

Previously access control lists for putObject was not called.
This had led in getting access denied issue when trying to upload
objects into the s3 bucket

fixes #13557


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../lib/bitbucket/source-action.ts            |  1 +
 .../bitbucket/bitbucket-source-action.test.ts | 34 +++++++++++++++++--
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/bitbucket/source-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/bitbucket/source-action.ts
index 085ff15e9f162..bdaca541dbf05 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/bitbucket/source-action.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/bitbucket/source-action.ts
@@ -117,6 +117,7 @@ export class BitBucketSourceAction extends Action {
 
     // the action needs to write the output to the pipeline bucket
     options.bucket.grantReadWrite(options.role);
+    options.bucket.grantPutAcl(options.role);
 
     // if codeBuildCloneOutput is true,
     // save the connectionArn in the Artifact instance
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts
index eccbb53970d33..ef5a06305bd56 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts
@@ -1,4 +1,4 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert';
+import { arrayWith, expect, haveResourceLike, objectLike } from '@aws-cdk/assert';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import { Stack } from '@aws-cdk/core';
@@ -82,7 +82,37 @@ nodeunitShim({
 
     test.done();
   },
-
+  'grant s3 putObjectACL to the following CodeBuild Project'(test: Test) {
+    const stack = new Stack();
+    createBitBucketAndCodeBuildPipeline(stack, {
+      codeBuildCloneOutput: true,
+    });
+    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      'PolicyDocument': {
+        'Statement': arrayWith(
+          objectLike({
+            'Action': 's3:PutObjectAcl',
+            'Effect': 'Allow',
+            'Resource': {
+              'Fn::Join': [
+                '',
+                [
+                  {
+                    'Fn::GetAtt': [
+                      'PipelineArtifactsBucket22248F97',
+                      'Arn',
+                    ],
+                  },
+                  '/*',
+                ],
+              ],
+            },
+          }),
+        ),
+      },
+    }));
+    test.done();
+  },
   'setting triggerOnPush=false reflects in the configuration'(test: Test) {
     const stack = new Stack();
 

From ff129583cb3a2c4079de06f042ae55ee26931a46 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 23 Mar 2021 10:17:11 +0000
Subject: [PATCH 10/15] ecr-assets

---
 .../aws-ecr-assets/lib/image-asset.ts         | 28 ++++++---
 .../aws-ecr-assets/test/image-asset.test.ts   | 62 +++++++++----------
 2 files changed, 52 insertions(+), 38 deletions(-)

diff --git a/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts b/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
index 26a3a40f35335..6c25da37f1419 100644
--- a/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
+++ b/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
@@ -1,11 +1,13 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import * as assets from '@aws-cdk/assets';
 import * as ecr from '@aws-cdk/aws-ecr';
 import { Annotations, FeatureFlags, IgnoreMode, Stack, Token } from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';
 import { Construct } from 'constructs';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line
+import { FingerprintOptions, IAsset, Staging } from '@aws-cdk/assets';
 // keep this import separate from other imports to reduce chance for merge conflicts with v2-main
 // eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct as CoreConstruct } from '@aws-cdk/core';
@@ -13,7 +15,7 @@ import { Construct as CoreConstruct } from '@aws-cdk/core';
 /**
  * Options for DockerImageAsset
  */
-export interface DockerImageAssetOptions extends assets.FingerprintOptions {
+export interface DockerImageAssetOptions extends FingerprintOptions {
   /**
    * ECR repository name
    *
@@ -69,7 +71,7 @@ export interface DockerImageAssetProps extends DockerImageAssetOptions {
  *
  * The image will be created in build time and uploaded to an ECR repository.
  */
-export class DockerImageAsset extends CoreConstruct implements assets.IAsset {
+export class DockerImageAsset extends CoreConstruct implements IAsset {
   /**
    * The full URI of the image (including a tag). Use this reference to pull
    * the asset.
@@ -81,8 +83,20 @@ export class DockerImageAsset extends CoreConstruct implements assets.IAsset {
    */
   public repository: ecr.IRepository;
 
+  /**
+   * A hash of the source of this asset, which is available at construction time. As this is a plain
+   * string, it can be used in construct IDs in order to enforce creation of a new resource when
+   * the content hash has changed.
+   */
   public readonly sourceHash: string;
 
+  /**
+   * A hash of this asset, which is available at construction time. As this is a plain string, it
+   * can be used in construct IDs in order to enforce creation of a new resource when the content
+   * hash has changed.
+   */
+  public readonly assetHash: string;
+
   constructor(scope: Construct, id: string, props: DockerImageAssetProps) {
     super(scope, id);
 
@@ -141,7 +155,7 @@ export class DockerImageAsset extends CoreConstruct implements assets.IAsset {
     // deletion of the ECR repository the app used).
     extraHash.version = '1.21.0';
 
-    const staging = new assets.Staging(this, 'Staging', {
+    const staging = new Staging(this, 'Staging', {
       ...props,
       exclude,
       ignoreMode,
@@ -151,7 +165,8 @@ export class DockerImageAsset extends CoreConstruct implements assets.IAsset {
         : JSON.stringify(extraHash),
     });
 
-    this.sourceHash = staging.sourceHash;
+    this.sourceHash = staging.assetHash;
+    this.assetHash = staging.assetHash;
 
     const stack = Stack.of(this);
     const location = stack.synthesizer.addDockerImageAsset({
@@ -159,8 +174,7 @@ export class DockerImageAsset extends CoreConstruct implements assets.IAsset {
       dockerBuildArgs: props.buildArgs,
       dockerBuildTarget: props.target,
       dockerFile: props.file,
-      repositoryName: props.repositoryName,
-      sourceHash: staging.sourceHash,
+      sourceHash: staging.assetHash,
     });
 
     this.repository = ecr.Repository.fromRepositoryName(this, 'Repository', location.repositoryName);
diff --git a/packages/@aws-cdk/aws-ecr-assets/test/image-asset.test.ts b/packages/@aws-cdk/aws-ecr-assets/test/image-asset.test.ts
index 17fd37be2e234..45b5a1cf0d6de 100644
--- a/packages/@aws-cdk/aws-ecr-assets/test/image-asset.test.ts
+++ b/packages/@aws-cdk/aws-ecr-assets/test/image-asset.test.ts
@@ -192,8 +192,8 @@ describe('image asset', () => {
 
     const session = app.synth();
 
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'Dockerfile'))).toBeDefined();
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'index.py'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'Dockerfile'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'index.py'))).toBeDefined();
 
   });
 
@@ -214,16 +214,16 @@ describe('image asset', () => {
     const session = app.synth();
 
     // Only the files exempted above should be included.
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, '.dockerignore'))).toBeDefined();
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'Dockerfile'))).toBeDefined();
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'index.py'))).toBeDefined();
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'foobar.txt'))).toBeDefined();
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'subdirectory'))).toBeDefined();
-    expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'subdirectory', 'baz.txt'))).toBeDefined();
-    expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'node_modules'))).toBeDefined();
-    expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'node_modules', 'one'))).toBeDefined();
-    expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'node_modules', 'some_dep'))).toBeDefined();
-    expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'node_modules', 'some_dep', 'file'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, '.dockerignore'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'Dockerfile'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'index.py'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'foobar.txt'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'subdirectory'))).toBeDefined();
+    expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'subdirectory', 'baz.txt'))).toBeDefined();
+    expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'node_modules'))).toBeDefined();
+    expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'node_modules', 'one'))).toBeDefined();
+    expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'node_modules', 'some_dep'))).toBeDefined();
+    expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'node_modules', 'some_dep', 'file'))).toBeDefined();
 
 
   });
@@ -283,13 +283,13 @@ describe('image asset', () => {
     const asset6 = new DockerImageAsset(stack, 'Asset6', { directory, extraHash: 'random-extra' });
     const asset7 = new DockerImageAsset(stack, 'Asset7', { directory, repositoryName: 'foo' });
 
-    expect(asset1.sourceHash).toEqual('ab01ecd4419f59e1ec0ac9e57a60dbb653be68a29af0223fa8cb24b4b747bc73');
-    expect(asset2.sourceHash).toEqual('7fb12f6148098e3f5c56c788a865d2af689125ead403b795fe6a262ec34384b3');
-    expect(asset3.sourceHash).toEqual('fc3b6d802ba198ba2ee55079dbef27682bcd1288d5849eb5bbd5cd69038359b3');
-    expect(asset4.sourceHash).toEqual('30439ea6dfeb4ddfd9175097286895c78393ef52a78c68f92db08abc4513cad6');
-    expect(asset5.sourceHash).toEqual('5775170880e26ba31799745241b90d4340c674bb3b1c01d758e416ee3f1c386f');
-    expect(asset6.sourceHash).toEqual('ba82fd351a4d3e3f5c5d948b9948e7e829badc3da90f97e00bb7724afbeacfd4');
-    expect(asset7.sourceHash).toEqual('26ec194928431cab6ec5af24ea9f01af2cf7b20e361128b07b2a7405d2951f95');
+    expect(asset1.assetHash).toEqual('ab01ecd4419f59e1ec0ac9e57a60dbb653be68a29af0223fa8cb24b4b747bc73');
+    expect(asset2.assetHash).toEqual('7fb12f6148098e3f5c56c788a865d2af689125ead403b795fe6a262ec34384b3');
+    expect(asset3.assetHash).toEqual('fc3b6d802ba198ba2ee55079dbef27682bcd1288d5849eb5bbd5cd69038359b3');
+    expect(asset4.assetHash).toEqual('30439ea6dfeb4ddfd9175097286895c78393ef52a78c68f92db08abc4513cad6');
+    expect(asset5.assetHash).toEqual('5775170880e26ba31799745241b90d4340c674bb3b1c01d758e416ee3f1c386f');
+    expect(asset6.assetHash).toEqual('ba82fd351a4d3e3f5c5d948b9948e7e829badc3da90f97e00bb7724afbeacfd4');
+    expect(asset7.assetHash).toEqual('26ec194928431cab6ec5af24ea9f01af2cf7b20e361128b07b2a7405d2951f95');
 
   });
 });
@@ -304,12 +304,12 @@ function testDockerDirectoryIsStagedWithoutFilesSpecifiedInDockerignore(app: App
   const session = app.synth();
 
   // .dockerignore itself should be included in output to be processed during docker build
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, '.dockerignore'))).toBeDefined();
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'Dockerfile'))).toBeDefined();
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'index.py'))).toBeDefined();
-  expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'foobar.txt'))).toBeDefined();
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'subdirectory'))).toBeDefined();
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'subdirectory', 'baz.txt'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, '.dockerignore'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'Dockerfile'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'index.py'))).toBeDefined();
+  expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'foobar.txt'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'subdirectory'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'subdirectory', 'baz.txt'))).toBeDefined();
 
 
 }
@@ -324,12 +324,12 @@ function testDockerDirectoryIsStagedWithoutFilesSpecifiedInExcludeOption(app: Ap
 
   const session = app.synth();
 
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, '.dockerignore'))).toBeDefined();
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'Dockerfile'))).toBeDefined();
-  expect(fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'index.py'))).toBeDefined();
-  expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'foobar.txt'))).toBeDefined();
-  expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'subdirectory'))).toBeDefined();
-  expect(!fs.existsSync(path.join(session.directory, `asset.${image.sourceHash}`, 'subdirectory', 'baz.txt'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, '.dockerignore'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'Dockerfile'))).toBeDefined();
+  expect(fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'index.py'))).toBeDefined();
+  expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'foobar.txt'))).toBeDefined();
+  expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'subdirectory'))).toBeDefined();
+  expect(!fs.existsSync(path.join(session.directory, `asset.${image.assetHash}`, 'subdirectory', 'baz.txt'))).toBeDefined();
 
 
 }

From 588360c4daa409a5aa86169466332e68b85cd7f1 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 23 Mar 2021 10:17:59 +0000
Subject: [PATCH 11/15] events-targets

---
 packages/@aws-cdk/aws-events-targets/lib/event-bus.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-events-targets/lib/event-bus.ts b/packages/@aws-cdk/aws-events-targets/lib/event-bus.ts
index 1d07261a8eace..8237b8cdd7993 100644
--- a/packages/@aws-cdk/aws-events-targets/lib/event-bus.ts
+++ b/packages/@aws-cdk/aws-events-targets/lib/event-bus.ts
@@ -24,13 +24,12 @@ export class EventBus implements events.IRuleTarget {
     this.role = props.role;
   }
 
-  bind(rule: events.IRule, id?: string): events.RuleTargetConfig {
+  bind(rule: events.IRule, _id?: string): events.RuleTargetConfig {
     if (this.role) {
       this.role.addToPrincipalPolicy(this.putEventStatement());
     }
     const role = this.role ?? singletonEventRole(rule, [this.putEventStatement()]);
     return {
-      id: id ?? '',
       arn: this.eventBus.eventBusArn,
       role,
     };

From 540be20b6ec7a7cb05c45610aa4d1d33e1033223 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 23 Mar 2021 10:19:33 +0000
Subject: [PATCH 12/15] s3-assets

---
 packages/@aws-cdk/aws-s3-assets/lib/asset.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-s3-assets/lib/asset.ts b/packages/@aws-cdk/aws-s3-assets/lib/asset.ts
index 510834a61c634..aa99ab67e40a3 100644
--- a/packages/@aws-cdk/aws-s3-assets/lib/asset.ts
+++ b/packages/@aws-cdk/aws-s3-assets/lib/asset.ts
@@ -1,5 +1,4 @@
 import * as path from 'path';
-import * as assets from '@aws-cdk/assets';
 import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
 import * as s3 from '@aws-cdk/aws-s3';
@@ -8,11 +7,14 @@ import * as cxapi from '@aws-cdk/cx-api';
 import { Construct } from 'constructs';
 import { toSymlinkFollow } from './compat';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { CopyOptions } from '@aws-cdk/assets';
 // keep this import separate from other imports to reduce chance for merge conflicts with v2-main
 // eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct as CoreConstruct } from '@aws-cdk/core';
 
-export interface AssetOptions extends assets.CopyOptions, cdk.AssetOptions {
+export interface AssetOptions extends CopyOptions, cdk.AssetOptions {
   /**
    * A list of principals that should be able to read this asset from S3.
    * You can use `asset.grantRead(principal)` to grant read permissions later.

From 28a1144716dd6cf6fa1024ad8e013c0a372f0aff Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 23 Mar 2021 10:22:39 +0000
Subject: [PATCH 13/15] s3

---
 packages/@aws-cdk/aws-s3/lib/bucket.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-s3/lib/bucket.ts b/packages/@aws-cdk/aws-s3/lib/bucket.ts
index ef1cda8a32f1b..bfaa85206ae86 100644
--- a/packages/@aws-cdk/aws-s3/lib/bucket.ts
+++ b/packages/@aws-cdk/aws-s3/lib/bucket.ts
@@ -1829,7 +1829,7 @@ export class Bucket extends BucketBase {
   private enableAutoDeleteObjects() {
     const provider = CustomResourceProvider.getOrCreateProvider(this, AUTO_DELETE_OBJECTS_RESOURCE_TYPE, {
       codeDirectory: path.join(__dirname, 'auto-delete-objects-handler'),
-      runtime: CustomResourceProviderRuntime.NODEJS_12,
+      runtime: CustomResourceProviderRuntime.NODEJS_12_X,
       description: `Lambda function for auto-deleting objects in ${this.bucketName} S3 bucket.`,
     });
 

From 6192659ce9207b40fcf3870f035b29de21dfc6dc Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 23 Mar 2021 10:22:43 +0000
Subject: [PATCH 14/15] cx-api

---
 packages/@aws-cdk/cx-api/lib/cloud-assembly.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/cx-api/lib/cloud-assembly.ts b/packages/@aws-cdk/cx-api/lib/cloud-assembly.ts
index 53fafe3d37049..08d8fcbcfbbc0 100644
--- a/packages/@aws-cdk/cx-api/lib/cloud-assembly.ts
+++ b/packages/@aws-cdk/cx-api/lib/cloud-assembly.ts
@@ -49,7 +49,7 @@ export class CloudAssembly {
   constructor(directory: string) {
     this.directory = directory;
 
-    this.manifest = cxschema.Manifest.load(path.join(directory, MANIFEST_FILE));
+    this.manifest = cxschema.Manifest.loadAssemblyManifest(path.join(directory, MANIFEST_FILE));
     this.version = this.manifest.version;
     this.artifacts = this.renderArtifacts();
     this.runtime = this.manifest.runtime || { libraries: { } };
@@ -303,7 +303,7 @@ export class CloudAssemblyBuilder {
     manifest = filterUndefined(manifest);
 
     const manifestFilePath = path.join(this.outdir, MANIFEST_FILE);
-    cxschema.Manifest.save(manifest, manifestFilePath);
+    cxschema.Manifest.saveAssemblyManifest(manifest, manifestFilePath);
 
     // "backwards compatibility": in order for the old CLI to tell the user they
     // need a new version, we'll emit the legacy manifest with only "version".

From 90eaf8340a39ba76b915e8fd901691cd170794a5 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 23 Mar 2021 10:27:43 +0000
Subject: [PATCH 15/15] ecr-assets

---
 packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts b/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
index 6c25da37f1419..8f99d5081f514 100644
--- a/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
+++ b/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
@@ -87,6 +87,7 @@ export class DockerImageAsset extends CoreConstruct implements IAsset {
    * A hash of the source of this asset, which is available at construction time. As this is a plain
    * string, it can be used in construct IDs in order to enforce creation of a new resource when
    * the content hash has changed.
+   * @deprecated use assetHash
    */
   public readonly sourceHash: string;