Merge branch 'master' into feat_16246

Author: mergify[bot]

package.json

@@ -16,15 +16,15 @@
   },
   "devDependencies": {
     "@yarnpkg/lockfile": "^1.1.0",
-    "cdk-generate-synthetic-examples": "^0.1.5",
+    "cdk-generate-synthetic-examples": "^0.1.6",
     "conventional-changelog-cli": "^2.2.2",
     "fs-extra": "^9.1.0",
     "graceful-fs": "^4.2.9",
     "jest-junit": "^13.0.0",
-    "jsii-diff": "^1.53.0",
-    "jsii-pacmak": "^1.53.0",
-    "jsii-reflect": "^1.53.0",
-    "jsii-rosetta": "^1.53.0",
+    "jsii-diff": "^1.54.0",
+    "jsii-pacmak": "^1.54.0",
+    "jsii-reflect": "^1.54.0",
+    "jsii-rosetta": "^1.54.0",
     "lerna": "^4.0.0",
     "patch-package": "^6.4.7",
     "standard-version": "^9.3.2",

packages/@aws-cdk/app-delivery/package.json

@@ -73,7 +73,7 @@
     "@aws-cdk/cdk-integ-tools": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
     "@types/jest": "^27.4.0",
-    "fast-check": "^2.21.0",
+    "fast-check": "^2.22.0",
     "jest": "^27.5.1"
   },
   "repository": {

packages/@aws-cdk/assertions/lib/private/cyclic.ts

@@ -70,11 +70,16 @@ function findExpressionDependencies(obj: any): Set<string> {
       } else if (keys.length === 1 && keys[0] === 'Fn::Sub') {
         const argument = x[keys[0]];
         const pattern = Array.isArray(argument) ? argument[0] : argument;
-        for (const logId of logicalIdsInSubString(pattern)) {
-          ret.add(logId);
+
+        // pattern should always be a string, but we've encountered some cases in which
+        // it isn't. Better safeguard.
+        if (typeof pattern === 'string') {
+          for (const logId of logicalIdsInSubString(pattern)) {
+            ret.add(logId);
+          }
         }
         const contextDict = Array.isArray(argument) ? argument[1] : undefined;
-        if (contextDict) {
+        if (contextDict && typeof contextDict === 'object') {
           Object.values(contextDict).forEach(recurse);
         }
       } else {

packages/@aws-cdk/assertions/lib/private/messages.ts

@@ -10,7 +10,6 @@ export function findMessage(messages: Messages, constructPath: string, props: an
     return {};
   }
 
-  Object.values(result.matches).forEach((m) => handleTrace(m));
   return result.matches;
 }
 

packages/@aws-cdk/assertions/test/annotations.test.ts

@@ -7,13 +7,12 @@ describe('Messages', () => {
   let annotations: _Annotations;
   beforeAll(() => {
     stack = new Stack();
-    const foo = new CfnResource(stack, 'Foo', {
+    new CfnResource(stack, 'Foo', {
       type: 'Foo::Bar',
       properties: {
         Fred: 'Thud',
       },
     });
-    foo.node.setContext('disable-stack-trace', false);
 
     new CfnResource(stack, 'Bar', {
       type: 'Foo::Bar',
@@ -61,11 +60,6 @@ describe('Messages', () => {
       const result = annotations.findError('*', 'no message looks like this');
       expect(result.length).toEqual(0);
     });
-
-    test('trace is redacted', () => {
-      const result = annotations.findError('/Default/Foo', Match.anyValue());
-      expect(result[0].entry.trace).toEqual('redacted');
-    });
   });
 
   describe('hasWarning', () => {
@@ -165,15 +159,7 @@ describe('Multiple Messages on the Resource', () => {
     const result2 = annotations.findError('/Default/Bar', Match.stringLikeRegexp('error:.*'));
     expect(result2.length).toEqual(2);
     const result3 = annotations.findWarning('/Default/Bar', 'warning: Foo::Bar is deprecated');
-    expect(result3).toEqual([{
-      level: 'warning',
-      entry: {
-        type: 'aws:cdk:warning',
-        data: 'warning: Foo::Bar is deprecated',
-        trace: 'redacted',
-      },
-      id: '/Default/Bar',
-    }]);
+    expect(result3[0].entry.data).toEqual('warning: Foo::Bar is deprecated');
   });
 });
 class MyAspect implements IAspect {

packages/@aws-cdk/aws-applicationautoscaling/package.json

@@ -84,7 +84,7 @@
     "@aws-cdk/cfn2ts": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
     "@types/jest": "^27.4.0",
-    "fast-check": "^2.21.0",
+    "fast-check": "^2.22.0",
     "jest": "^27.5.1"
   },
   "dependencies": {

packages/@aws-cdk/aws-autoscaling-common/package.json

@@ -75,7 +75,7 @@
     "@aws-cdk/cdk-integ-tools": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
     "@types/jest": "^27.4.0",
-    "fast-check": "^2.21.0",
+    "fast-check": "^2.22.0",
     "jest": "^27.5.1"
   },
   "dependencies": {

packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/private/singleton-policy.ts

@@ -32,7 +32,7 @@ export class SingletonPolicy extends Construct implements iam.IGrantable {
   private statements: { [key: string]: iam.PolicyStatement } = {};
 
   private constructor(private readonly role: iam.IRole) {
-    super(role as unknown as cdk.Construct, SingletonPolicy.UUID);
+    super(role as unknown as Construct, SingletonPolicy.UUID);
     this.grantPrincipal = role;
   }
 

packages/@aws-cdk/aws-ecs/README.md

@@ -427,6 +427,7 @@ const newContainer = taskDefinition.addContainer('container', {
   secrets: { // Retrieved from AWS Secrets Manager or AWS Systems Manager Parameter Store at container start-up.
     SECRET: ecs.Secret.fromSecretsManager(secret),
     DB_PASSWORD: ecs.Secret.fromSecretsManager(dbSecret, 'password'), // Reference a specific JSON field, (requires platform version 1.4.0 or later for Fargate tasks)
+    API_KEY: ecs.Secret.fromSecretsManagerVersion(secret, { versionId: '12345' }, 'apiKey'), // Reference a specific version of the secret by its version id or version stage (requires platform version 1.4.0 or later for Fargate tasks)
     PARAMETER: ecs.Secret.fromSsmParameter(parameter),
   },
 });

packages/@aws-cdk/aws-ecs/lib/container-definition.ts

@@ -14,6 +14,24 @@ import { LogDriver, LogDriverConfig } from './log-drivers/log-driver';
 // eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct as CoreConstruct } from '@aws-cdk/core';
 
+/**
+ * Specify the secret's version id or version stage
+ */
+export interface SecretVersionInfo {
+  /**
+   * version id of the secret
+   *
+   * @default - use default version id
+   */
+  readonly versionId?: string;
+  /**
+   * version stage of the secret
+   *
+   * @default - use default version stage
+   */
+  readonly versionStage?: string;
+}
+
 /**
  * A secret environment variable.
  */
@@ -47,6 +65,25 @@ export abstract class Secret {
     };
   }
 
+  /**
+   * Creates a environment variable value from a secret stored in AWS Secrets
+   * Manager.
+   *
+   * @param secret the secret stored in AWS Secrets Manager
+   * @param versionInfo the version information to reference the secret
+   * @param field the name of the field with the value that you want to set as
+   * the environment variable value. Only values in JSON format are supported.
+   * If you do not specify a JSON field, then the full content of the secret is
+   * used.
+   */
+  public static fromSecretsManagerVersion(secret: secretsmanager.ISecret, versionInfo: SecretVersionInfo, field?: string): Secret {
+    return {
+      arn: `${secret.secretArn}:${field ?? ''}:${versionInfo.versionStage ?? ''}:${versionInfo.versionId ?? ''}`,
+      hasField: !!field,
+      grantRead: grantee => secret.grantRead(grantee),
+    };
+  }
+
   /**
    * The ARN of the secret
    */