…executeBatchBuild: true` (#12181)

If the `executeBatchBuild` prop is added to trigger a batch build, we also need to switch the IAM permissions to the ones which allow triggering a batch build. This does that.

This should probably have been part of #11741

This adds a `startBatchBuild` option to the code build source, to trigger a batch build. The cloudformation property isn't in the official docs yet but is mentioned [here](aws-cloudformation/cloudformation-coverage-roadmap#621 (comment)).

Closes #11663

…ables (#12150)

If you use a Secret in an environment variable of the default type
`BuildEnvironmentVariableType.PLAINTEXT`,
it will be visible in plain text in the AWS Console.
Add validation that checks for this common mistake,
along with a flag that allows you to opt out of it.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

closes #12202


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…the image from public ECR (#12141)

close #12134 

update `aws-node-termination-handler` version to `0.13.2`
```ts
this._spotInterruptHandler = this.addHelmChart('spot-interrupt-handler', {
        chart: 'aws-node-termination-handler',
        version: '0.13.2',
        repository: 'https://aws.github.io/eks-charts',
        namespace: 'kube-system',
        values: {
          'nodeSelector.lifecycle': LifecycleLabel.SPOT,
        },
      });
```

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Use the custom resource provider from core to delete objects in the
bucket. A bucket policy gives the correct permissions to the provider's
Lambda function role.

Credits to @Chriscbr for starting the work on this.

Closes #3297
Closes #9751


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…2239)

See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html#cfn-attributes-updatepolicy-upgradeelasticsearchdomain

Closes [#12210](#12210)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…#12070)

Bundling sets the working directory to `cdk.AssetStaging.BUNDLING_INPUT_DIR`
but we want to force `npx` to always use the globally installed
`esbuild` and not a version available in the mounted volume.

Closes #12007


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Closes #12093


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Closes: #10133

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Bumps [esbuild](https://github.com/evanw/esbuild) from 0.8.20 to 0.8.27.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/master/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.8.20...v0.8.27)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

…om kms key fails to deploy (#11699)

The problem was that we were missing the necessary kms permissions for the custom resource that applies the access policies.

Fixes #11412

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

closes #12266

This change adds support for `AuroraPostgresEngineVersion` version 11.9 used for db.r6g instance types Aurora.

https://aws.amazon.com/about-aws/whats-new/2020/12/introducing-amazon-aurora-r6g-instance-types-powered-by-aws-graviton-2-processors-in-preview/

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This workaround was discussed in this issue: #6243 (comment)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*