diff --git a/package.json b/package.json
index eb23cd4c49436..3ea3b84700a2b 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,7 @@
     "@types/node": "18.11.19",
     "@types/prettier": "2.6.0",
     "@yarnpkg/lockfile": "^1.1.0",
-    "cdk-generate-synthetic-examples": "^0.1.287",
+    "cdk-generate-synthetic-examples": "^0.1.291",
     "conventional-changelog-cli": "^2.2.2",
     "fs-extra": "^9.1.0",
     "graceful-fs": "^4.2.11",
diff --git a/packages/aws-cdk-lib/aws-apigateway/README.md b/packages/aws-cdk-lib/aws-apigateway/README.md
index 3008ba27848b3..68634e9f3528a 100644
--- a/packages/aws-cdk-lib/aws-apigateway/README.md
+++ b/packages/aws-cdk-lib/aws-apigateway/README.md
@@ -63,9 +63,11 @@ book.addMethod('DELETE');
 To give an IAM User or Role permission to invoke a method, use `grantExecute`:
 
 ```ts
-declare user: iam.User;
-const books = api.root.addResource('books');
-books.grantExecute(user);
+declare const api: apigateway.RestApi;
+declare const user: iam.User;
+
+const method = api.root.addResource('books').addMethod('GET');
+method.grantExecute(user);
 ```
 
 ## AWS Lambda-backed APIs
diff --git a/packages/aws-cdk-lib/aws-appmesh/README.md b/packages/aws-cdk-lib/aws-appmesh/README.md
index fb1eefa3d4536..78cb0154c2c72 100644
--- a/packages/aws-cdk-lib/aws-appmesh/README.md
+++ b/packages/aws-cdk-lib/aws-appmesh/README.md
@@ -233,7 +233,7 @@ const node = new appmesh.VirtualNode(this, 'node', {
 
 By using a key-value pair indexed signature, you can specify json key pairs to customize the log entry pattern. You can also use text format as below. You can only specify one of these 2 formats.
 
-```ts
+```text
   accessLog: appmesh.AccessLog.fromFilePath('/dev/stdout', appmesh.LoggingFormat.fromText('test_pattern')),
 ```
 
diff --git a/packages/aws-cdk-lib/aws-appsync/README.md b/packages/aws-cdk-lib/aws-appsync/README.md
index 4b14d3a147096..bd67a20ec5e65 100644
--- a/packages/aws-cdk-lib/aws-appsync/README.md
+++ b/packages/aws-cdk-lib/aws-appsync/README.md
@@ -220,8 +220,8 @@ const httpDs = api.addHttpDataSource(
     authorizationConfig: {
       signingRegion: 'us-east-1',
       signingServiceName: 'states',
-    }
-  }
+    },
+  },
 );
 
 httpDs.createResolver('MutationCallStepFunctionResolver', {
@@ -302,12 +302,14 @@ events. More information can be found
 CDK stack file `app-stack.ts`:
 
 ```ts
-const api = new appsync.GraphqlApi(stack, 'EventBridgeApi', {
+import * as events from 'aws-cdk-lib/aws-events';
+
+const api = new appsync.GraphqlApi(this, 'EventBridgeApi', {
   name: 'EventBridgeApi',
   schema: appsync.SchemaFile.fromAsset(path.join(__dirname, 'appsync.eventbridge.graphql')),
 });
 
-const bus = new events.EventBus(stack, 'DestinationEventBus', {});
+const bus = new events.EventBus(this, 'DestinationEventBus', {});
 
 const dataSource = api.addEventBridgeDataSource('NoneDS', bus);
 
@@ -468,15 +470,15 @@ sources and resolvers, an `apiId` is sufficient.
 By default all AppSync GraphQL APIs are public and can be accessed from the internet. 
 For customers that want to limit access to be from their VPC, the optional API `visibility` property can be set to `Visibility.PRIVATE` 
 at creation time. To explicitly create a public API, the `visibility` property should be set to `Visibility.GLOBAL`. 
-If visbility is not set, the service will default to `GLOBAL`.
+If visibility is not set, the service will default to `GLOBAL`.
 
 CDK stack file `app-stack.ts`:
 
 ```ts
-const api = new appsync.GraphqlApi(stack, 'api', {
+const api = new appsync.GraphqlApi(this, 'api', {
   name: 'MyPrivateAPI',
   schema: appsync.SchemaFile.fromAsset(path.join(__dirname, 'appsync.schema.graphql')),
-  visbility: appsync.Visibility.PRIVATE,
+  visibility: appsync.Visibility.PRIVATE,
 });
 ```
 
diff --git a/packages/aws-cdk-lib/aws-codepipeline-actions/README.md b/packages/aws-cdk-lib/aws-codepipeline-actions/README.md
index e5a2b9976c60f..4ec898d87b14d 100644
--- a/packages/aws-cdk-lib/aws-codepipeline-actions/README.md
+++ b/packages/aws-cdk-lib/aws-codepipeline-actions/README.md
@@ -857,9 +857,11 @@ Here's an example:
 To use an S3 Bucket as a deployment target in CodePipeline:
 
 ```ts
+import * as kms from 'aws-cdk-lib/aws-kms';
+
 const sourceOutput = new codepipeline.Artifact();
 const targetBucket = new s3.Bucket(this, 'MyBucket');
-const key: kms.IKey = new kms.Key(stack, 'EnvVarEncryptKey', {
+const key: kms.IKey = new kms.Key(this, 'EnvVarEncryptKey', {
   description: 'sample key',
 });
 
diff --git a/packages/aws-cdk-lib/aws-ec2/README.md b/packages/aws-cdk-lib/aws-ec2/README.md
index a3d30c5c64a25..50a9ed93d6372 100644
--- a/packages/aws-cdk-lib/aws-ec2/README.md
+++ b/packages/aws-cdk-lib/aws-ec2/README.md
@@ -1862,8 +1862,6 @@ an instance. For information on Launch Templates please see the
 The following demonstrates how to create a launch template with an Amazon Machine Image, security group, and an instance profile.
 
 ```ts
-import * as iam from 'aws-cdk-lib/aws-iam';
-
 declare const vpc: ec2.Vpc;
 
 const role = new iam.Role(this, 'Role', {
@@ -1897,14 +1895,16 @@ new ec2.LaunchTemplate(this, 'LaunchTemplate', {
 And the following demonstrates how to add one or more security groups to launch template.
 
 ```ts
-const sg1 = new ec2.SecurityGroup(stack, 'sg1', {
+declare const vpc: ec2.Vpc;
+
+const sg1 = new ec2.SecurityGroup(this, 'sg1', {
   vpc: vpc,
 });
-const sg2 = new ec2.SecurityGroup(stack, 'sg2', {
+const sg2 = new ec2.SecurityGroup(this, 'sg2', {
   vpc: vpc,
 });
 
-const launchTemplate = new ec2.LaunchTemplate(stack, 'LaunchTemplate', {
+const launchTemplate = new ec2.LaunchTemplate(this, 'LaunchTemplate', {
   machineImage: ec2.MachineImage.latestAmazonLinux2022(),
   securityGroup: sg1,
 });
@@ -1915,8 +1915,8 @@ launchTemplate.addSecurityGroup(sg2);
 To use [AWS Systems Manager parameters instead of AMI IDs](https://docs.aws.amazon.com/autoscaling/ec2/userguide/using-systems-manager-parameters.html) in launch templates and resolve the AMI IDs at instance launch time:
 
 ```ts
-const launchTemplate = new ec2.LaunchTemplate(stack, 'LaunchTemplate', {
-  machineImage: ec2.MachineImage.resolveSsmParameterAtLaunch('parameterName');
+const launchTemplate = new ec2.LaunchTemplate(this, 'LaunchTemplate', {
+  machineImage: ec2.MachineImage.resolveSsmParameterAtLaunch('parameterName'),
 });
 ```
 
diff --git a/packages/aws-cdk-lib/aws-ec2/lib/launch-template.ts b/packages/aws-cdk-lib/aws-ec2/lib/launch-template.ts
index 2721cf61412b6..e30ba479f34bf 100644
--- a/packages/aws-cdk-lib/aws-ec2/lib/launch-template.ts
+++ b/packages/aws-cdk-lib/aws-ec2/lib/launch-template.ts
@@ -245,15 +245,14 @@ export interface LaunchTemplateProps {
   /**
    * An IAM role to associate with the instance profile that is used by instances.
    *
-   * The role must be assumable by the service principal `ec2.amazonaws.com`:
+   * The role must be assumable by the service principal `ec2.amazonaws.com`.
+   * Note: You can provide an instanceProfile or a role, but not both.
    *
    * @example
    * const role = new iam.Role(this, 'MyRole', {
    *   assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com')
    * });
    *
-   * Note: You can provide an instanceProfile or a role, but not both.
-   *
    * @default - No new role is created.
    */
   readonly role?: iam.IRole;
diff --git a/packages/aws-cdk-lib/aws-ecr/README.md b/packages/aws-cdk-lib/aws-ecr/README.md
index e88a076d94bc2..288b91f214fe1 100644
--- a/packages/aws-cdk-lib/aws-ecr/README.md
+++ b/packages/aws-cdk-lib/aws-ecr/README.md
@@ -1,6 +1,5 @@
 # Amazon ECR Construct Library
 
-
 This package contains constructs for working with Amazon Elastic Container Registry.
 
 ## Repositories
@@ -14,7 +13,10 @@ const repository = new ecr.Repository(this, 'Repository');
 
 ## Image scanning
 
-Amazon ECR image scanning helps in identifying software vulnerabilities in your container images. You can manually scan container images stored in Amazon ECR, or you can configure your repositories to scan images when you push them to a repository. To create a new repository to scan on push, simply enable `imageScanOnPush` in the properties
+Amazon ECR image scanning helps in identifying software vulnerabilities in your container images.
+You can manually scan container images stored in Amazon ECR, or you can configure your repositories
+to scan images when you push them to a repository. To create a new repository to scan on push, simply
+enable `imageScanOnPush` in the properties.
 
 ```ts
 const repository = new ecr.Repository(this, 'Repo', {
@@ -76,6 +78,8 @@ The grantPush method grants the specified IAM entity (the grantee) permission to
 Here is an example of granting a user push permissions:
 
 ```ts
+declare const repository: ecr.Repository;
+
 const role = new iam.Role(this, 'Role', {
   assumedBy: new iam.ServicePrincipal('codebuild.amazonaws.com'),
 });
@@ -91,6 +95,8 @@ The grantPull method grants the specified IAM entity (the grantee) permission to
 - 'ecr:GetAuthorizationToken'
 
 ```ts
+declare const repository: ecr.Repository;
+
 const role = new iam.Role(this, 'Role', {
   assumedBy: new iam.ServicePrincipal('codebuild.amazonaws.com'),
 });
@@ -103,6 +109,8 @@ The grantPullPush method grants the specified IAM entity (the grantee) permissio
 Here is an example of granting a user both pull and push permissions:
 
 ```ts
+declare const repository: ecr.Repository;
+
 const role = new iam.Role(this, 'Role', {
   assumedBy: new iam.ServicePrincipal('codebuild.amazonaws.com'),
 });
diff --git a/packages/aws-cdk-lib/aws-ecs/README.md b/packages/aws-cdk-lib/aws-ecs/README.md
index ac10f5c8d9dc6..c050947d2c93e 100644
--- a/packages/aws-cdk-lib/aws-ecs/README.md
+++ b/packages/aws-cdk-lib/aws-ecs/README.md
@@ -631,15 +631,17 @@ changes the status of the primary deployment to COMPLETED.
 
 ```ts
 import * as cw from 'aws-cdk-lib/aws-cloudwatch';
+
 declare const cluster: ecs.Cluster;
 declare const taskDefinition: ecs.TaskDefinition;
-declare const elbAlarm: cloudwatch.Alarm; 
+declare const elbAlarm: cw.Alarm;
+
 const service = new ecs.FargateService(this, 'Service', {
   cluster,
   taskDefinition,
   deploymentAlarms: {
-    alarms: [elbAlarm.alarmName]
-    behavior: AlarmBehavior.ROLLBACK_ON_ALARM,
+    alarmNames: [elbAlarm.alarmName],
+    behavior: ecs.AlarmBehavior.ROLLBACK_ON_ALARM,
   },
 });
 
@@ -651,8 +653,11 @@ new cw.Alarm(this, 'CPUAlarm', {
   evaluationPeriods: 2,
   threshold: 80,
 });
-service.enableDeploymentAlarms([cpuAlarmName], AlarmBehavior.FAIL_ON_ALARM);
+service.enableDeploymentAlarms([cpuAlarmName], {
+  behavior: ecs.AlarmBehavior.FAIL_ON_ALARM,
+});
 ```
+
 > Note: Deployment alarms are only available when `deploymentController` is set
 > to `DeploymentControllerType.ECS`, which is the default.
 
@@ -685,8 +690,10 @@ there are two options to avoid the circular dependency.
 Option 1, defining a physical name for the alarm:
 ```ts
 import * as cw from 'aws-cdk-lib/aws-cloudwatch';
+
 declare const cluster: ecs.Cluster;
 declare const taskDefinition: ecs.TaskDefinition;
+
 const service = new ecs.FargateService(this, 'Service', {
   cluster,
   taskDefinition,
@@ -701,13 +708,16 @@ const myAlarm = new cw.Alarm(this, 'CPUAlarm', {
 });
 
 // Using `myAlarm.alarmName` here will cause a circular dependency
-service.enableDeploymentAlarms([cpuAlarmName], AlarmBehavior.FAIL_ON_ALARM);
+service.enableDeploymentAlarms([cpuAlarmName], {
+  behavior: ecs.AlarmBehavior.FAIL_ON_ALARM,
+});
 ```
 
 Option 2, defining a physical name for the service:
+
 ```ts
-import * as cdk from 'aws-cdk-lib'
 import * as cw from 'aws-cdk-lib/aws-cloudwatch';
+
 declare const cluster: ecs.Cluster;
 declare const taskDefinition: ecs.TaskDefinition;
 const serviceName = 'MyFargateService';
@@ -717,25 +727,27 @@ const service = new ecs.FargateService(this, 'Service', {
   taskDefinition,
 });
 
-const cpuMetric = new cw.Metric(
-  metricName: 'CPUUtilization'
-  namespace: 'AWS/ECS'
-  period: cdk.Duration.minutes(5),
+const cpuMetric = new cw.Metric({
+  metricName: 'CPUUtilization',
+  namespace: 'AWS/ECS',
+  period: Duration.minutes(5),
   statistic: 'Average',
   dimensionsMap: {
     ClusterName: cluster.clusterName,
     // Using `service.serviceName` here will cause a circular dependency
     ServiceName: serviceName,
   },
-);
+});
 const myAlarm = new cw.Alarm(this, 'CPUAlarm', {
-  alarmName: cpuAlarmName,
+  alarmName: 'cpuAlarmName',
   metric: cpuMetric,
   evaluationPeriods: 2,
   threshold: 80,
 });
 
-service.enableDeploymentAlarms([myAlarm.alarmName], AlarmBehavior.FAIL_ON_ALARM);
+service.enableDeploymentAlarms([myAlarm.alarmName], {
+  behavior: ecs.AlarmBehavior.FAIL_ON_ALARM,
+});
 ```
 
 This issue only applies if the metrics to alarm on are emitted by the service
diff --git a/packages/aws-cdk-lib/aws-eks/README.md b/packages/aws-cdk-lib/aws-eks/README.md
index d8bff843d4667..9aa98935a79af 100644
--- a/packages/aws-cdk-lib/aws-eks/README.md
+++ b/packages/aws-cdk-lib/aws-eks/README.md
@@ -654,6 +654,12 @@ You can optionally choose to configure your cluster to use IPv6 using the [`ipFa
 ```ts
 declare const vpc: ec2.Vpc;
 
+function associateSubnetWithV6Cidr(vpc: ec2.Vpc, count: number, subnet: ec2.ISubnet) {
+  const cfnSubnet = subnet.node.defaultChild as ec2.CfnSubnet;
+  cfnSubnet.ipv6CidrBlock = Fn.select(count, Fn.cidr(Fn.select(0, vpc.vpcIpv6CidrBlocks), 256, (128 - 64).toString()));
+  cfnSubnet.assignIpv6AddressOnCreation = true;
+}
+
 // make an ipv6 cidr
 const ipv6cidr = new ec2.CfnVPCCidrBlock(this, 'CIDR6', {
   vpcId: vpc.vpcId,
@@ -662,20 +668,20 @@ const ipv6cidr = new ec2.CfnVPCCidrBlock(this, 'CIDR6', {
 
 // connect the ipv6 cidr to all vpc subnets
 let subnetcount = 0;
-let subnets = [...vpc.publicSubnets, ...vpc.privateSubnets];
-for ( let subnet of subnets) {
+const subnets = vpc.publicSubnets.concat(vpc.privateSubnets);
+for (let subnet of subnets) {
   // Wait for the ipv6 cidr to complete
   subnet.node.addDependency(ipv6cidr);
-  this._associate_subnet_with_v6_cidr(subnetcount, subnet);
-  subnetcount++;
+  associateSubnetWithV6Cidr(vpc, subnetcount, subnet);
+  subnetcount = subnetcount + 1;
 }
 
 const cluster = new eks.Cluster(this, 'hello-eks', {
+  version: eks.KubernetesVersion.V1_27,
   vpc: vpc,
   ipFamily: eks.IpFamily.IP_V6,
-  vpcSubnets: [{ subnets: [...vpc.publicSubnets] }],
+  vpcSubnets: [{ subnets: vpc.publicSubnets }],
 });
-
 ```
 
 ### Kubectl Support
diff --git a/packages/aws-cdk-lib/aws-events-targets/README.md b/packages/aws-cdk-lib/aws-events-targets/README.md
index 085245218edf3..8675ddca64151 100644
--- a/packages/aws-cdk-lib/aws-events-targets/README.md
+++ b/packages/aws-cdk-lib/aws-events-targets/README.md
@@ -365,26 +365,27 @@ can use the `tags` array. Both of these fields can be used together or separatel
 to set tags on the triggered task.
 
 ```ts
-import * as ecs from "aws-cdk-lib/aws-ecs"
-declare const cluster: ecs.ICluster
-declare const taskDefinition: ecs.TaskDefinition
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+
+declare const cluster: ecs.ICluster;
+declare const taskDefinition: ecs.TaskDefinition;
 
 const rule = new events.Rule(this, 'Rule', {
   schedule: events.Schedule.rate(cdk.Duration.hours(1)),
 });
 
 rule.addTarget(
-  new targets.EcsTask( {
-      cluster: cluster,
-      taskDefinition: taskDefinition,
-      propagateTags: ecs.PropagatedTagSource.TASK_DEFINITION,
-      tags: [
-        {
-          key: 'my-tag',
-          value: 'my-tag-value',
-        },
-      ],
-    })
+  new targets.EcsTask({
+    cluster: cluster,
+    taskDefinition: taskDefinition,
+    propagateTags: ecs.PropagatedTagSource.TASK_DEFINITION,
+    tags: [
+      {
+        key: 'my-tag',
+        value: 'my-tag-value',
+      },
+    ],
+  }),
 );
 ```
 
@@ -395,9 +396,11 @@ If you want to detach the public IP address from the task, you have to set the f
 You can specify the flag `true` only when the launch type is set to FARGATE.
 
 ```ts
-import * as ecs from "aws-cdk-lib/aws-ecs"
-declare const cluster: ecs.ICluster
-declare const taskDefinition: ecs.TaskDefinition
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+
+declare const cluster: ecs.ICluster;
+declare const taskDefinition: ecs.TaskDefinition;
 
 const rule = new events.Rule(this, 'Rule', {
   schedule: events.Schedule.rate(cdk.Duration.hours(1)),
@@ -411,7 +414,6 @@ rule.addTarget(
     subnetSelection: { subnetType: ec2.SubnetType.PUBLIC },
   }),
 );
-declare const rule: events.Rule
 ```
 
 ### enable Amazon ECS Exec for ECS Task
@@ -419,9 +421,10 @@ declare const rule: events.Rule
 If you use Amazon ECS Exec, you can run commands in or get a shell to a container running on an Amazon EC2 instance or on AWS Fargate.
 
 ```ts
-import * as ecs from "aws-cdk-lib/aws-ecs"
-declare const cluster: ecs.ICluster
-declare const taskDefinition: ecs.TaskDefinition
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+
+declare const cluster: ecs.ICluster;
+declare const taskDefinition: ecs.TaskDefinition;
 
 const rule = new events.Rule(this, 'Rule', {
   schedule: events.Schedule.rate(cdk.Duration.hours(1)),
diff --git a/packages/aws-cdk-lib/aws-iam/README.md b/packages/aws-cdk-lib/aws-iam/README.md
index b6079aa8c3b54..f65db55f9f482 100644
--- a/packages/aws-cdk-lib/aws-iam/README.md
+++ b/packages/aws-cdk-lib/aws-iam/README.md
@@ -382,28 +382,28 @@ const policyDocument = {
       "Sid": "FirstStatement",
       "Effect": "Allow",
       "Action": ["iam:ChangePassword"],
-      "Resource": "*"
+      "Resource": ["*"],
     },
     {
       "Sid": "SecondStatement",
       "Effect": "Allow",
-      "Action": "s3:ListAllMyBuckets",
-      "Resource": "*"
+      "Action": ["s3:ListAllMyBuckets"],
+      "Resource": ["*"],
     },
     {
       "Sid": "ThirdStatement",
       "Effect": "Allow",
       "Action": [
         "s3:List*",
-        "s3:Get*"
+        "s3:Get*",
       ],
       "Resource": [
         "arn:aws:s3:::confidential-data",
-        "arn:aws:s3:::confidential-data/*"
+        "arn:aws:s3:::confidential-data/*",
       ],
-      "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
-    }
-  ]
+      "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}},
+    },
+  ],
 };
 
 const customPolicyDocument = iam.PolicyDocument.fromJson(policyDocument);
@@ -785,7 +785,7 @@ const role = new iam.Role(this, 'Role', {
   assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
 });
 
-const instanceProfile = iam.InstanceProfile.fromInstanceAttributes(this, 'ImportedInstanceProfile', {
+const instanceProfile = iam.InstanceProfile.fromInstanceProfileAttributes(this, 'ImportedInstanceProfile', {
   instanceProfileArn: 'arn:aws:iam::account-id:instance-profile/MyInstanceProfile',
   role,
 });
@@ -794,8 +794,8 @@ const instanceProfile = iam.InstanceProfile.fromInstanceAttributes(this, 'Import
 ## Features
 
 * Policy name uniqueness is enforced. If two policies by the same name are attached to the same
-    principal, the attachment will fail.
+  principal, the attachment will fail.
 * Policy names are not required - the CDK logical ID will be used and ensured to be unique.
 * Policies are validated during synthesis to ensure that they have actions, and that policies
-    attached to IAM principals specify relevant resources, while policies attached to resources
-    specify which IAM principals they apply to.
+  attached to IAM principals specify relevant resources, while policies attached to resources
+  specify which IAM principals they apply to.
diff --git a/packages/aws-cdk-lib/aws-lambda/README.md b/packages/aws-cdk-lib/aws-lambda/README.md
index c3eaefbfe74da..3c5ed908b91c0 100644
--- a/packages/aws-cdk-lib/aws-lambda/README.md
+++ b/packages/aws-cdk-lib/aws-lambda/README.md
@@ -591,15 +591,15 @@ Lambda functions can be configured to use the Parameters and Secrets Extension.
 import * as sm from 'aws-cdk-lib/aws-secretsmanager';
 import * as ssm from 'aws-cdk-lib/aws-ssm';
 
-const secret = new sm.Secret(stack, 'Secret');
-const parameter = new ssm.StringParameter(stack, 'Parameter', {
+const secret = new sm.Secret(this, 'Secret');
+const parameter = new ssm.StringParameter(this, 'Parameter', {
   parameterName: 'mySsmParameterName',
   stringValue: 'mySsmParameterValue',
 });
 
 const paramsAndSecrets = lambda.ParamsAndSecretsLayerVersion.fromVersion(lambda.ParamsAndSecretsVersions.V1_0_103, {
   cacheSize: 500,
-  logLevel: lamabda.ParamsAndSecretsLogLevel.DEBUG,
+  logLevel: lambda.ParamsAndSecretsLogLevel.DEBUG,
 });
 
 const lambdaFunction = new lambda.Function(this, 'MyFunction', {
@@ -620,8 +620,8 @@ If the version of Parameters and Secrets Extension is not yet available in the C
 import * as sm from 'aws-cdk-lib/aws-secretsmanager';
 import * as ssm from 'aws-cdk-lib/aws-ssm';
 
-const secret = new sm.Secret(stack, 'Secret');
-const parameter = new ssm.StringParameter(stack, 'Parameter', {
+const secret = new sm.Secret(this, 'Secret');
+const parameter = new ssm.StringParameter(this, 'Parameter', {
   parameterName: 'mySsmParameterName',
   stringValue: 'mySsmParameterValue',
 });
@@ -640,7 +640,7 @@ const lambdaFunction = new lambda.Function(this, 'MyFunction', {
 });
 
 secret.grantRead(lambdaFunction);
-parameters.grantRead(lambdaFunction);
+parameter.grantRead(lambdaFunction);
 ```
 
 ## Event Rule Target
diff --git a/packages/aws-cdk-lib/aws-logs/README.md b/packages/aws-cdk-lib/aws-logs/README.md
index 2b5283f287ab1..3f89ae6084e97 100644
--- a/packages/aws-cdk-lib/aws-logs/README.md
+++ b/packages/aws-cdk-lib/aws-logs/README.md
@@ -108,6 +108,7 @@ below) and supply the intended destination:
 
 ```ts
 import * as destinations from 'aws-cdk-lib/aws-logs-destinations';
+
 declare const fn: lambda.Function;
 declare const logGroup: logs.LogGroup;
 
@@ -349,31 +350,30 @@ Each policy may consist of a log group, S3 bucket, and/or Firehose delivery stre
 Example:
 
 ```ts
-import { Bucket } from '@aws-cdk/aws-s3';
-import { LogGroup } from '@aws-cdk/logs';
-import * as kinesisfirehose from '@aws-cdk/aws-kinesisfirehose';
-
+import * as kinesisfirehose from '@aws-cdk/aws-kinesisfirehose-alpha';
+import * as destinations from '@aws-cdk/aws-kinesisfirehose-destinations-alpha';
 
-const logGroupDestination = new LogGroup(this, 'LogGroupLambdaAudit', {
+const logGroupDestination = new logs.LogGroup(this, 'LogGroupLambdaAudit', {
   logGroupName: 'auditDestinationForCDK',
 });
 
-const s3Destination = new Bucket(this, 'audit-bucket-id');
+const bucket = new s3.Bucket(this, 'audit-bucket');
+const s3Destination = new destinations.S3Bucket(bucket);
 
-const deliveryStream = new firehose.DeliveryStream(this, 'Delivery Stream', {
+const deliveryStream = new kinesisfirehose.DeliveryStream(this, 'Delivery Stream', {
   destinations: [s3Destination],
 });
 
-const dataProtectionPolicy = new DataProtectionPolicy({
+const dataProtectionPolicy = new logs.DataProtectionPolicy({
   name: 'data protection policy',
   description: 'policy description',
-  identifiers: [DataIdentifier.DRIVERSLICENSE_US, new DataIdentifier('EmailAddress')],
+  identifiers: [logs.DataIdentifier.DRIVERSLICENSE_US, new logs.DataIdentifier('EmailAddress')],
   logGroupAuditDestination: logGroupDestination,
-  s3BucketAuditDestination: s3Destination,
-  deliveryStreamAuditDestination: deliveryStream.deliveryStreamName,
+  s3BucketAuditDestination: bucket,
+  deliveryStreamNameAuditDestination: deliveryStream.deliveryStreamName,
 });
 
-new LogGroup(this, 'LogGroupLambda', {
+new logs.LogGroup(this, 'LogGroupLambda', {
   logGroupName: 'cdkIntegLogGroup',
   dataProtectionPolicy: dataProtectionPolicy,
 });
diff --git a/packages/aws-cdk-lib/aws-osis/README.md b/packages/aws-cdk-lib/aws-osis/README.md
index a029115ea92cb..f111362a4b76f 100644
--- a/packages/aws-cdk-lib/aws-osis/README.md
+++ b/packages/aws-cdk-lib/aws-osis/README.md
@@ -16,7 +16,7 @@
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ```ts nofixture
-import * as osis from '@aws-cdk/aws-osis';
+import * as osis from 'aws-cdk-lib/aws-osis';
 ```
 
 <!--BEGIN CFNONLY DISCLAIMER-->
diff --git a/packages/aws-cdk-lib/aws-rds/README.md b/packages/aws-cdk-lib/aws-rds/README.md
index 1ed797a8a5683..1768cad3c9914 100644
--- a/packages/aws-cdk-lib/aws-rds/README.md
+++ b/packages/aws-cdk-lib/aws-rds/README.md
@@ -21,10 +21,12 @@ const cluster = new rds.DatabaseCluster(this, 'Database', {
   engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_2_08_1 }),
   credentials: rds.Credentials.fromGeneratedSecret('clusteradmin'), // Optional - will default to 'admin' username and generated password
   writer: rds.ClusterInstance.provisioned('writer', {
+    publiclyAccessible: false,
+  }),
   readers: [
     rds.ClusterInstance.provisioned('reader1', { promotionTier: 1 }),
     rds.ClusterInstance.serverlessV2('reader2'),
-  ]
+  ],
   vpcSubnets: {
     subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
   },
@@ -38,7 +40,7 @@ To adopt Aurora I/O-Optimized. Speicify `DBClusterStorageType.AURORA_IOPT1` on t
 declare const vpc: ec2.Vpc;
 const cluster = new rds.DatabaseCluster(this, 'Database', {
   engine: rds.DatabaseClusterEngine.auroraPostgres({ version: rds.AuroraPostgresEngineVersion.VER_15_2 }),
-  credentials: rds.Credentials.fromUsername('adminuser', { password: cdk.SecretValue.unsafePlainText('7959866cacc02c2d243ecfe177464fe6') }),
+  credentials: rds.Credentials.fromUsername('adminuser', { password: SecretValue.unsafePlainText('7959866cacc02c2d243ecfe177464fe6') }),
   instanceProps: {
     instanceType: ec2.InstanceType.of(ec2.InstanceClass.X2G, ec2.InstanceSize.XLARGE),
     vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
@@ -92,7 +94,9 @@ new rds.DatabaseClusterFromSnapshot(this, 'Database', {
 
 Database cluster instances may be updated in bulk or on a rolling basis.
 
-An update to all instances in a cluster may cause significant downtime. To reduce the downtime, set the `instanceUpdateBehavior` property in `DatabaseClusterBaseProps` to `InstanceUpdateBehavior.ROLLING`. This adds a dependency between each instance so the update is performed on only one instance at a time.
+An update to all instances in a cluster may cause significant downtime. To reduce the downtime, set the
+`instanceUpdateBehavior` property in `DatabaseClusterBaseProps` to `InstanceUpdateBehavior.ROLLING`.
+This adds a dependency between each instance so the update is performed on only one instance at a time.
 
 Use `InstanceUpdateBehavior.BULK` to update all instances at once.
 
@@ -100,10 +104,10 @@ Use `InstanceUpdateBehavior.BULK` to update all instances at once.
 declare const vpc: ec2.Vpc;
 const cluster = new rds.DatabaseCluster(this, 'Database', {
   engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_3_01_0 }),
-  writer: rds.ClusterInstance.provisioned({
+  writer: rds.ClusterInstance.provisioned('Instance', {
     instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.SMALL),
   }),
-  readers [rds.ClusterInstance.provisioned('reader')],
+  readers: [rds.ClusterInstance.provisioned('reader')],
   instanceUpdateBehaviour: rds.InstanceUpdateBehaviour.ROLLING, // Optional - defaults to rds.InstanceUpdateBehaviour.BULK
   vpc,
 });
@@ -127,7 +131,7 @@ const cluster = new rds.DatabaseCluster(this, 'Database', {
   writer: rds.ClusterInstance.provisioned('writer'),
   readers: [
     rds.ClusterInstance.serverlessV2('reader'),
-  ]
+  ],
   vpc,
 });
 ```
@@ -150,7 +154,7 @@ const cluster = new rds.DatabaseCluster(this, 'Database', {
   writer: rds.ClusterInstance.provisioned('writer'),
   readers: [
     rds.ClusterInstance.serverlessV2('reader'),
-  ]
+  ],
   vpc,
 });
 
@@ -223,7 +227,7 @@ const cluster = new rds.DatabaseCluster(this, 'Database', {
     rds.ClusterInstance.serverlessV2('reader1', { scaleWithWriter: true }),
     // will be put in promotion tier 2 and will not scale with the writer
     rds.ClusterInstance.serverlessV2('reader2'),
-  ]
+  ],
   vpc,
 });
 ```
@@ -276,7 +280,7 @@ const cluster = new rds.DatabaseCluster(this, 'Database', {
     rds.ClusterInstance.serverlessV2('reader1', { scaleWithWriter: true }),
     // will be put in promotion tier 2 and will not scale with the writer
     rds.ClusterInstance.serverlessV2('reader2'),
-  ]
+  ],
   vpc,
 });
 ```
@@ -303,7 +307,7 @@ For example, in order to migrate from this deprecated config:
 
 ```ts
 declare const vpc: ec2.Vpc;
-const cluster = new rds.DatabaseCluster(stack, 'Database', {
+const cluster = new rds.DatabaseCluster(this, 'Database', {
   engine: rds.DatabaseClusterEngine.auroraMysql({
     version: rds.AuroraMysqlEngineVersion.VER_3_03_0,
   }),
@@ -332,18 +336,20 @@ const instanceProps = {
 };
 
 declare const vpc: ec2.Vpc;
-const cluster = new rds.DatabaseCluster(stack, 'Database', {
+const cluster = new rds.DatabaseCluster(this, 'Database', {
   engine: rds.DatabaseClusterEngine.auroraMysql({
     version: rds.AuroraMysqlEngineVersion.VER_3_03_0,
   }),
   vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
   vpc,
-  writer: ClusterInstance.provisioned('Instance1', {
-    ...instanceProps,
+  writer: rds.ClusterInstance.provisioned('Instance1', {
+    instanceType: instanceProps.instanceType,
+    isFromLegacyInstanceProps: instanceProps.isFromLegacyInstanceProps,
   }),
   readers: [
-    ClusterInstance.provisioned('Instance2', {
-      ...instanceProps,
+    rds.ClusterInstance.provisioned('Instance2', {
+      instanceType: instanceProps.instanceType,
+      isFromLegacyInstanceProps: instanceProps.isFromLegacyInstanceProps,
     }),
   ],
 });
diff --git a/packages/aws-cdk-lib/aws-rds/lib/aurora-cluster-instance.ts b/packages/aws-cdk-lib/aws-rds/lib/aurora-cluster-instance.ts
index 3b5a5ef8f2afc..6e289821cd4da 100644
--- a/packages/aws-cdk-lib/aws-rds/lib/aurora-cluster-instance.ts
+++ b/packages/aws-cdk-lib/aws-rds/lib/aurora-cluster-instance.ts
@@ -135,7 +135,7 @@ export interface ProvisionedClusterInstanceProps extends ClusterInstanceOptions
    * @example
    * // existing cluster
    * declare const vpc: ec2.Vpc;
-   * const cluster = new rds.DatabaseCluster(stack, 'Database', {
+   * const cluster = new rds.DatabaseCluster(this, 'Database', {
    *   engine: rds.DatabaseClusterEngine.auroraMysql({
    *     version: rds.AuroraMysqlEngineVersion.VER_3_03_0,
    *   }),
@@ -154,19 +154,20 @@ export interface ProvisionedClusterInstanceProps extends ClusterInstanceOptions
    *   isFromLegacyInstanceProps: true,
    * };
    *
-   * declare const vpc: ec2.Vpc;
-   * const cluster = new rds.DatabaseCluster(stack, 'Database', {
+   * const myCluster = new rds.DatabaseCluster(this, 'Database', {
    *   engine: rds.DatabaseClusterEngine.auroraMysql({
    *     version: rds.AuroraMysqlEngineVersion.VER_3_03_0,
    *   }),
    *   vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
    *   vpc,
-   *   writer: ClusterInstance.provisioned('Instance1', {
-   *     ...instanceProps,
+   *   writer: rds.ClusterInstance.provisioned('Instance1', {
+   *     instanceType: instanceProps.instanceType,
+   *     isFromLegacyInstanceProps: instanceProps.isFromLegacyInstanceProps,
    *   }),
    *   readers: [
-   *     ClusterInstance.provisioned('Instance2', {
-   *       ...instanceProps,
+   *     rds.ClusterInstance.provisioned('Instance2', {
+   *       instanceType: instanceProps.instanceType,
+   *       isFromLegacyInstanceProps: instanceProps.isFromLegacyInstanceProps,
    *     }),
    *   ],
    * });
@@ -307,7 +308,7 @@ export interface ClusterInstanceOptions {
  * @example
  *
  * declare const vpc: ec2.Vpc;
- * const cluster = new rds.DatabaseCluster(this, 'Database', {
+ * const myCluster = new rds.DatabaseCluster(this, 'Database', {
  *   engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_2_08_1 }),
  *   writer: rds.ClusterInstance.provisioned('writer', {
  *     instanceType: ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.XLARGE4),
@@ -319,7 +320,7 @@ export interface ClusterInstanceOptions {
  *     rds.ClusterInstance.serverlessV2('reader1', { scaleWithWriter: true }),
  *     // will be put in promotion tier 2 and will not scale with the writer
  *     rds.ClusterInstance.serverlessV2('reader2'),
- *   ]
+ *   ],
  *   vpc,
  * });
  */
@@ -328,7 +329,7 @@ export class ClusterInstance implements IClusterInstance {
    * Add a provisioned instance to the cluster
    *
    * @example
-   * ClusterInstance.provisioned('ClusterInstance', {
+   * rds.ClusterInstance.provisioned('ClusterInstance', {
    *   instanceType: ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.XLARGE4),
    * });
    */
@@ -343,7 +344,7 @@ export class ClusterInstance implements IClusterInstance {
    * Add a serverless v2 instance to the cluster
    *
    * @example
-   * ClusterInstance.serverlessV2('ClusterInstance', {
+   * rds.ClusterInstance.serverlessV2('ClusterInstance', {
    *   scaleWithWriter: true,
    * });
    */
diff --git a/packages/aws-cdk-lib/aws-s3-deployment/README.md b/packages/aws-cdk-lib/aws-s3-deployment/README.md
index abf4b2afa48f8..87285c17bc8fa 100644
--- a/packages/aws-cdk-lib/aws-s3-deployment/README.md
+++ b/packages/aws-cdk-lib/aws-s3-deployment/README.md
@@ -362,19 +362,20 @@ to make from placeholders in a local file which will be resolved during deployme
 is especially useful in situations like creating an API from a spec file, where users might
 want to reference other CDK resources they have created.
 
-The syntax for template variables is `{{ variable-name }}` in your local file. Then, you would 
+The syntax for template variables is `{{ variableName }}` in your local file. Then, you would 
 specify the substitutions in CDK like this:
 
 ```ts
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 
 declare const myLambdaFunction: lambda.Function;
+declare const destinationBucket: s3.Bucket;
 
 new s3deploy.DeployTimeSubstitutedFile(this, 'MyFile', {
   source: 'my-file.yaml',
   destinationBucket: destinationBucket,
   substitutions: {
-    variable-name: myLambdaFunction.functionName,
+    variableName: myLambdaFunction.functionName,
   },
 });
 ```
diff --git a/packages/aws-cdk-lib/aws-shield/README.md b/packages/aws-cdk-lib/aws-shield/README.md
index 98045de30e9b6..b9937a3f8fc90 100644
--- a/packages/aws-cdk-lib/aws-shield/README.md
+++ b/packages/aws-cdk-lib/aws-shield/README.md
@@ -16,7 +16,7 @@
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ```ts nofixture
-import * as shield from '@aws-cdk/aws-shield';
+import * as shield from 'aws-cdk-lib/aws-shield';
 ```
 
 <!--BEGIN CFNONLY DISCLAIMER-->
diff --git a/packages/aws-cdk-lib/aws-stepfunctions/README.md b/packages/aws-cdk-lib/aws-stepfunctions/README.md
index 57e6b61d47665..13f6be9b8af4a 100644
--- a/packages/aws-cdk-lib/aws-stepfunctions/README.md
+++ b/packages/aws-cdk-lib/aws-stepfunctions/README.md
@@ -98,11 +98,11 @@ history when CloudFormation deletes your state machine.
 Alternatively you can specify an existing step functions definition by providing a string or a file that contains the ASL JSON.
 
 ```ts
-new sfn.StateMachine(stack, 'StateMachineFromString', {
+new sfn.StateMachine(this, 'StateMachineFromString', {
   definitionBody: sfn.DefinitionBody.fromString('{"StartAt":"Pass","States":{"Pass":{"Type":"Pass","End":true}}}'),
 });
 
-new sfn.StateMachine(stack, 'StateMachineFromFile', {
+new sfn.StateMachine(this, 'StateMachineFromFile', {
   definitionBody: sfn.DefinitionBody.fromFile('./asl.json'),
 });
 ```
diff --git a/packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts b/packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts
index c78622ee03399..552a60d7c320e 100644
--- a/packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts
+++ b/packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts
@@ -647,8 +647,7 @@ export interface DefinitionConfig {
 }
 
 export abstract class DefinitionBody {
-
-  public static fromFile(path: string, options: s3_assets.AssetOptions): DefinitionBody {
+  public static fromFile(path: string, options?: s3_assets.AssetOptions): DefinitionBody {
     return new FileDefinitionBody(path, options);
   }
 
@@ -661,11 +660,9 @@ export abstract class DefinitionBody {
   }
 
   public abstract bind(scope: Construct, sfnPrincipal: iam.IPrincipal, sfnProps: StateMachineProps): DefinitionConfig;
-
 }
 
 export class FileDefinitionBody extends DefinitionBody {
-
   constructor(public readonly path: string, private readonly options: s3_assets.AssetOptions = {}) {
     super();
   }
@@ -682,11 +679,9 @@ export class FileDefinitionBody extends DefinitionBody {
       },
     };
   }
-
 }
 
 export class StringDefinitionBody extends DefinitionBody {
-
   constructor(public readonly body: string) {
     super();
   }
@@ -699,7 +694,6 @@ export class StringDefinitionBody extends DefinitionBody {
 }
 
 export class ChainDefinitionBody extends DefinitionBody {
-
   constructor(public readonly chainable: IChainable) {
     super();
   }
@@ -714,5 +708,4 @@ export class ChainDefinitionBody extends DefinitionBody {
       definitionString: Stack.of(scope).toJsonString(graph.toGraphJson()),
     };
   }
-
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk-lib/aws-synthetics/README.md b/packages/aws-cdk-lib/aws-synthetics/README.md
index b8914384a868c..3bb396a164eea 100644
--- a/packages/aws-cdk-lib/aws-synthetics/README.md
+++ b/packages/aws-cdk-lib/aws-synthetics/README.md
@@ -1,6 +1,5 @@
 # AWS::Synthetics Construct Library
 
-
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ```ts nofixture
diff --git a/packages/aws-cdk-lib/aws-verifiedpermissions/README.md b/packages/aws-cdk-lib/aws-verifiedpermissions/README.md
index aa170f78bf7f1..8d5ba13c3ce17 100644
--- a/packages/aws-cdk-lib/aws-verifiedpermissions/README.md
+++ b/packages/aws-cdk-lib/aws-verifiedpermissions/README.md
@@ -16,7 +16,7 @@
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ```ts nofixture
-import * as verifiedpermissions from '@aws-cdk/aws-verifiedpermissions';
+import * as verifiedpermissions from 'aws-cdk-lib/aws-verifiedpermissions';
 ```
 
 <!--BEGIN CFNONLY DISCLAIMER-->
diff --git a/packages/aws-cdk-lib/aws-wafv2/README.md b/packages/aws-cdk-lib/aws-wafv2/README.md
index 6361e71723f42..ec45be19b799b 100644
--- a/packages/aws-cdk-lib/aws-wafv2/README.md
+++ b/packages/aws-cdk-lib/aws-wafv2/README.md
@@ -1,6 +1,5 @@
 # AWS::WAFv2 Construct Library
 
-
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ```ts nofixture
diff --git a/packages/aws-cdk-lib/aws-workspaces/README.md b/packages/aws-cdk-lib/aws-workspaces/README.md
index 3eddbb58cdf37..b04900fedd712 100644
--- a/packages/aws-cdk-lib/aws-workspaces/README.md
+++ b/packages/aws-cdk-lib/aws-workspaces/README.md
@@ -1,6 +1,5 @@
 # Amazon WorkSpaces Construct Library
 
-
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ```ts nofixture
diff --git a/packages/aws-cdk-lib/aws-xray/README.md b/packages/aws-cdk-lib/aws-xray/README.md
index 743b0408c482f..aed2b2f62a31d 100644
--- a/packages/aws-cdk-lib/aws-xray/README.md
+++ b/packages/aws-cdk-lib/aws-xray/README.md
@@ -1,6 +1,5 @@
 # AWS::XRay Construct Library
 
-
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ```ts nofixture
diff --git a/packages/aws-cdk-lib/cloud-assembly-schema/lib/cloud-assembly/metadata-schema.ts b/packages/aws-cdk-lib/cloud-assembly-schema/lib/cloud-assembly/metadata-schema.ts
index 569ef31d1e8c9..ba3ab6d87cff2 100644
--- a/packages/aws-cdk-lib/cloud-assembly-schema/lib/cloud-assembly/metadata-schema.ts
+++ b/packages/aws-cdk-lib/cloud-assembly-schema/lib/cloud-assembly/metadata-schema.ts
@@ -25,6 +25,14 @@ interface BaseAssetMetadataEntry {
 
 /**
  * Metadata Entry spec for files.
+ *
+ * @example
+ * const entry = {
+ *   packaging: 'file',
+ *   s3BucketParameter: 'bucket-parameter',
+ *   s3KeyParamenter: 'key-parameter',
+ *   artifactHashParameter: 'hash-parameter',
+ * }
  */
 export interface FileAssetMetadataEntry extends BaseAssetMetadataEntry {
   /**
@@ -101,6 +109,13 @@ export interface ContainerImageAssetCacheOption {
 
 /**
  * Metadata Entry spec for container images.
+ *
+ * @example
+ * const entry = {
+ *   packaging: 'container-image',
+ *   repositoryName: 'repository-name',
+ *   imageTag: 'tag',
+ * }
  */
 export interface ContainerImageAssetMetadataEntry extends BaseAssetMetadataEntry {
   /**
diff --git a/packages/aws-cdk-lib/custom-resources/README.md b/packages/aws-cdk-lib/custom-resources/README.md
index b36075ac9199c..ff26dce218187 100644
--- a/packages/aws-cdk-lib/custom-resources/README.md
+++ b/packages/aws-cdk-lib/custom-resources/README.md
@@ -1,5 +1,6 @@
 # AWS CDK Custom Resources
 
+This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
 ## Provider Framework
 
@@ -344,7 +345,10 @@ This sample demonstrates the following concepts:
 
 #### S3Assert
 
-Checks that the textual contents of an S3 object matches a certain value. The check will be retried for 5 minutes as long as the object is not found or the value is different. See the source code for the [construct](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/custom-resources/test/provider-framework/integration-test-fixtures/s3-assert.ts) and [handler](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/custom-resources/test/provider-framework/integration-test-fixtures/s3-assert-handler/index.py).
+Checks that the textual contents of an S3 object matches a certain value. The check will be retried
+for 5 minutes as long as the object is not found or the value is different. See the source code for the
+[construct](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/custom-resources/test/provider-framework/integration-test-fixtures/s3-assert.ts)
+and [handler](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/custom-resources/test/provider-framework/integration-test-fixtures/s3-assert-handler/index.py).
 
 The following example defines an `S3Assert` resource which waits until
 `myfile.txt` in `myBucket` exists and includes the contents `foo bar`:
@@ -384,7 +388,6 @@ const myProvider = new cr.Provider(this, 'MyProvider', {
   role: myRole,
   providerFunctionName: 'the-lambda-name',   // Optional
 });
-
 ```
 
 ### Customizing Provider Function environment encryption key
@@ -393,6 +396,8 @@ Sometimes it may be useful to manually set a AWS KMS key for the Provider Functi
 be able to view, manage and audit the key usage.
 
 ```ts
+import * as kms from 'aws-cdk-lib/aws-kms';
+
 declare const onEvent: lambda.Function;
 declare const isComplete: lambda.Function;
 declare const myRole: iam.Role;
@@ -405,7 +410,6 @@ const myProvider = new cr.Provider(this, 'MyProvider', {
   role: myRole,
   providerFunctionEnvEncryption: key,   // Optional
 });
-
 ```
 
 ## Custom Resources for AWS APIs
@@ -652,13 +656,16 @@ const getParameter = new cr.AwsCustomResource(this, 'AssociateVPCWithHostedZone'
 ```ts
 import * as regionInfo from 'aws-cdk-lib/region-info';
 
+class MyFact implements regionInfo.IFact {
+  public readonly region = 'us-east-1';
+  public readonly name = regionInfo.FactName.DEFAULT_CR_NODE_VERSION;
+  public readonly value = lambda.Runtime.NODEJS_18_X.name;
+}
+
 // change custom resource default runtime
-regionInfo.Fact.register({
-  region: 'us-east-1', // your region
-  name: regionInfo.FactName.DEFAULT_CR_NODE_VERSION,
-  value: lambda.Runtime.NODEJS_18_X.name,
-}, true);
-new AwsCustomResource(this, 'GetParameter', {
+regionInfo.Fact.register(new MyFact(), true);
+
+new cr.AwsCustomResource(this, 'GetParameter', {
   resourceType: 'Custom::SSMParameter',
   onUpdate: {
     service: '@aws-sdk/client-ssm', // 'SSM' in v2
@@ -667,13 +674,9 @@ new AwsCustomResource(this, 'GetParameter', {
       Name: 'foo',
       WithDecryption: true,
     },
-    physicalResourceId: PhysicalResourceId.fromResponse('Parameter.ARN'),
+    physicalResourceId: cr.PhysicalResourceId.fromResponse('Parameter.ARN'),
   },
 });
 ```
 
 If you are using `NODEJS_18_X` or higher, you can also use the existing AWS SDK for JavaScript v2 style.
-
----
-
-This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
diff --git a/packages/aws-cdk-lib/lambda-layer-awscli/README.md b/packages/aws-cdk-lib/lambda-layer-awscli/README.md
index d58a2638958a2..66791bfd66e1c 100644
--- a/packages/aws-cdk-lib/lambda-layer-awscli/README.md
+++ b/packages/aws-cdk-lib/lambda-layer-awscli/README.md
@@ -1,7 +1,5 @@
 # AWS Lambda Layer with AWS CLI
 
-
-
 This module exports a single class called `AwsCliLayer` which is a `lambda.Layer` that bundles the AWS CLI.
 
 Any Lambda Function that uses this layer must use a Python 3.x runtime.
diff --git a/packages/aws-cdk-lib/lambda-layer-kubectl/README.md b/packages/aws-cdk-lib/lambda-layer-kubectl/README.md
index 63c6ed18d4610..9ee6680a6e28d 100644
--- a/packages/aws-cdk-lib/lambda-layer-kubectl/README.md
+++ b/packages/aws-cdk-lib/lambda-layer-kubectl/README.md
@@ -1,11 +1,9 @@
 # AWS Lambda Layer with kubectl (and helm)
 
-
 This module exports a single class called `KubectlLayer` which is a `lambda.Layer` that bundles the [`kubectl`](https://kubernetes.io/docs/reference/kubectl/kubectl/) and the [`helm`](https://helm.sh/) command line.
 
 > - Helm Version: 3.5.4
 > - Kubectl Version: 1.20.0
-> 
 
 Usage:
 
diff --git a/packages/aws-cdk-lib/lambda-layer-node-proxy-agent/README.md b/packages/aws-cdk-lib/lambda-layer-node-proxy-agent/README.md
index 7fcafaaea9075..944511e4067fa 100644
--- a/packages/aws-cdk-lib/lambda-layer-node-proxy-agent/README.md
+++ b/packages/aws-cdk-lib/lambda-layer-node-proxy-agent/README.md
@@ -1,6 +1,5 @@
 # AWS Lambda Layer with the NPM dependency proxy-agent
 
-
 This module exports a single class called `NodeProxyAgentLayer` which is a `lambda.Layer` that bundles the NPM dependency [`proxy-agent`](https://www.npmjs.com/package/proxy-agent).
 
 > - proxy-agent Version: 5.0.0
diff --git a/packages/aws-cdk-lib/package.json b/packages/aws-cdk-lib/package.json
index c0b9cc673c4ec..5cae7270b57c4 100644
--- a/packages/aws-cdk-lib/package.json
+++ b/packages/aws-cdk-lib/package.json
@@ -95,7 +95,7 @@
     "metadata": {
       "jsii": {
         "rosetta": {
-          "strict": false
+          "strict": true
         }
       }
     }
@@ -483,11 +483,12 @@
   },
   "jsiiRosetta": {
     "exampleDependencies": {
-      "@aws-cdk/lambda-layer-kubectl-v25": "^2.0.3",
+      "@aws-cdk/lambda-layer-kubectl-v27": "^2.0.0",
       "cdk8s-plus-25": "^2.7.0",
       "@aws-cdk/aws-apigatewayv2-alpha": "*",
       "@aws-cdk/aws-batch-alpha": "*",
-      "@aws-cdk/aws-kinesisfirehose-alpha": "*"
+      "@aws-cdk/aws-kinesisfirehose-alpha": "*",
+      "@aws-cdk/aws-kinesisfirehose-destinations-alpha": "*"
     }
   },
   "awslint": {
diff --git a/packages/aws-cdk-lib/rosetta/aws_ecs/default.ts-fixture b/packages/aws-cdk-lib/rosetta/aws_ecs/default.ts-fixture
index 09d0cdb164a1b..473ccf7252fdf 100644
--- a/packages/aws-cdk-lib/rosetta/aws_ecs/default.ts-fixture
+++ b/packages/aws-cdk-lib/rosetta/aws_ecs/default.ts-fixture
@@ -1,21 +1,21 @@
 // Fixture with packages imported, but nothing else
 import { Construct } from 'constructs';
-import { SecretValue, Stack, Size } from 'aws-cdk-lib';
-import autoscaling = require('aws-cdk-lib/aws-autoscaling');
-import cloudmap = require('aws-cdk-lib/aws-servicediscovery');
-import ecs = require('aws-cdk-lib/aws-ecs');
-import ec2 = require('aws-cdk-lib/aws-ec2');
-import elb = require('aws-cdk-lib/aws-elasticloadbalancing');
-import elbv2 = require('aws-cdk-lib/aws-elasticloadbalancingv2');
-import events = require('aws-cdk-lib/aws-events');
-import kms = require('aws-cdk-lib/aws-kms');
-import logs = require('aws-cdk-lib/aws-logs');
-import s3 = require('aws-cdk-lib/aws-s3');
-import secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
-import ssm = require('aws-cdk-lib/aws-ssm');
-import targets = require('aws-cdk-lib/aws-events-targets');
-import iam = require('aws-cdk-lib/aws-iam');
-import path = require('path');
+import { SecretValue, Stack, Size, Duration } from 'aws-cdk-lib';
+import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
+import * as cloudmap from 'aws-cdk-lib/aws-servicediscovery';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as elb from 'aws-cdk-lib/aws-elasticloadbalancing';
+import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import * as events from 'aws-cdk-lib/aws-events';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+import * as targets from 'aws-cdk-lib/aws-events-targets';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as path from 'path';
 
 class Fixture extends Stack {
   constructor(scope: Construct, id: string) {
diff --git a/packages/aws-cdk-lib/rosetta/aws_logs/default.ts-fixture b/packages/aws-cdk-lib/rosetta/aws_logs/default.ts-fixture
index 3c2c490434a31..40d2f7649a57b 100644
--- a/packages/aws-cdk-lib/rosetta/aws_logs/default.ts-fixture
+++ b/packages/aws-cdk-lib/rosetta/aws_logs/default.ts-fixture
@@ -3,6 +3,7 @@ import { Construct } from 'constructs';
 import { Stack } from 'aws-cdk-lib';
 import * as logs from 'aws-cdk-lib/aws-logs';
 import * as iam from 'aws-cdk-lib/aws-iam';
+import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 
diff --git a/scripts/run-rosetta.sh b/scripts/run-rosetta.sh
index 4383f6b52d345..f5c8ba77f2ea5 100755
--- a/scripts/run-rosetta.sh
+++ b/scripts/run-rosetta.sh
@@ -73,7 +73,7 @@ time $ROSETTA extract \
 
 if $infuse; then
     echo "💎 Generating synthetic examples for the remainder" >&2
-    time npx cdk-generate-synthetic-examples@^0.1.260 \
+    time npx cdk-generate-synthetic-examples@^0.1.291 \
         $(cat $jsii_pkgs_file)
 
     time $ROSETTA extract \
diff --git a/yarn.lock b/yarn.lock
index c12430264b1f8..9335e02a8687c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4982,10 +4982,10 @@ case@1.6.3, case@^1.6.3:
   resolved "https://registry.npmjs.org/case/-/case-1.6.3.tgz#0a4386e3e9825351ca2e6216c60467ff5f1ea1c9"
   integrity sha512-mzDSXIPaFwVDvZAHqZ9VlbyF4yyXRuX6IvB06WvPYkqJVO24kX1PPhv9bfpKNFZyxYFmmgo03HUiD8iklmJYRQ==
 
-cdk-generate-synthetic-examples@^0.1.287:
-  version "0.1.287"
-  resolved "https://registry.npmjs.org/cdk-generate-synthetic-examples/-/cdk-generate-synthetic-examples-0.1.287.tgz#6ea883857e3afe6164c1a45c9a95dad554447aa0"
-  integrity sha512-fUfqPzq4bMhPhzG6LZhTIGvjUIg7AB6MPuIo334Pr0tILahWS1LrF/pXmmKN4leysu7vgGGxJrXOfIKTWMB6iQ==
+cdk-generate-synthetic-examples@^0.1.291:
+  version "0.1.291"
+  resolved "https://registry.npmjs.org/cdk-generate-synthetic-examples/-/cdk-generate-synthetic-examples-0.1.291.tgz#67660f4c620ee4a994abb142e4d385086e248bc9"
+  integrity sha512-pixtUlwPWE0URquqviOC/f06ATcetf5EfgE5UP44cmNlZRp1+qqm+U9yeHvc/QfJhyBd3aTXVtuHYs4AuBWB5g==
   dependencies:
     "@jsii/spec" "^1.84.0"
     fs-extra "^10.1.0"