Merge branch 'master' into eks

README.md

@@ -79,17 +79,17 @@ For a detailed walkthrough, see the [tutorial](https://docs.aws.amazon.com/cdk/l
 Install or update the [AWS CDK CLI] from npm (requires [Node.js ≥ 14.15.0](https://nodejs.org/download/release/latest-v14.x/)). We recommend using a version in [Active LTS](https://nodejs.org/en/about/releases/)
 
 ```console
-$ npm i -g aws-cdk
+npm i -g aws-cdk
 ```
 
 (See [Manual Installation](./MANUAL_INSTALLATION.md) for installing the CDK from a signed .zip file).
 
 Initialize a project:
 
 ```console
-$ mkdir hello-cdk
-$ cd hello-cdk
-$ cdk init sample-app --language=typescript
+mkdir hello-cdk
+cd hello-cdk
+cdk init sample-app --language=typescript
 ```
 
 This creates a sample project looking like this:
@@ -113,7 +113,7 @@ export class HelloCdkStack extends cdk.Stack {
 Deploy this to your account:
 
 ```console
-$ cdk deploy
+cdk deploy
 ```
 
 Use the `cdk` command-line toolkit to interact with your project:

packages/@aws-cdk/aws-appsync/README.md

@@ -252,7 +252,7 @@ import * as opensearch from '@aws-cdk/aws-opensearchservice';
 
 const user = new iam.User(this, 'User');
 const domain = new opensearch.Domain(this, 'Domain', {
-  version: opensearch.EngineVersion.OPENSEARCH_1_1,
+  version: opensearch.EngineVersion.OPENSEARCH_1_2,
   removalPolicy: RemovalPolicy.DESTROY,
   fineGrainedAccessControl: { masterUserArn: user.userArn },
   encryptionAtRest: { enabled: true },

packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.expected.json

@@ -39,7 +39,7 @@
         "EncryptionAtRestOptions": {
           "Enabled": true
         },
-        "EngineVersion": "OpenSearch_1.1",
+        "EngineVersion": "OpenSearch_1.2",
         "LogPublishingOptions": {},
         "NodeToNodeEncryptionOptions": {
           "Enabled": true

packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.ts

@@ -8,7 +8,7 @@ const app = new cdk.App();
 const stack = new cdk.Stack(app, 'appsync-opensearch');
 const user = new User(stack, 'User');
 const domain = new opensearch.Domain(stack, 'Domain', {
-  version: opensearch.EngineVersion.OPENSEARCH_1_1,
+  version: opensearch.EngineVersion.OPENSEARCH_1_2,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
   fineGrainedAccessControl: {
     masterUserArn: user.userArn,

packages/@aws-cdk/aws-dynamodb/lib/table.ts

@@ -1183,7 +1183,7 @@ export class Table extends TableBase {
       attributeDefinitions: this.attributeDefinitions,
       globalSecondaryIndexes: Lazy.any({ produce: () => this.globalSecondaryIndexes }, { omitEmptyArray: true }),
       localSecondaryIndexes: Lazy.any({ produce: () => this.localSecondaryIndexes }, { omitEmptyArray: true }),
-      pointInTimeRecoverySpecification: props.pointInTimeRecovery ? { pointInTimeRecoveryEnabled: props.pointInTimeRecovery } : undefined,
+      pointInTimeRecoverySpecification: props.pointInTimeRecovery != null ? { pointInTimeRecoveryEnabled: props.pointInTimeRecovery } : undefined,
       billingMode: this.billingMode === BillingMode.PAY_PER_REQUEST ? this.billingMode : undefined,
       provisionedThroughput: this.billingMode === BillingMode.PAY_PER_REQUEST ? undefined : {
         readCapacityUnits: props.readCapacity || 5,

packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts

@@ -413,7 +413,7 @@ export abstract class ApplicationLoadBalancedServiceBase extends CoreConstruct {
     }
     this.cluster = props.cluster || this.getDefaultCluster(this, props.vpc);
 
-    if (props.desiredCount !== undefined && props.desiredCount < 1) {
+    if (props.desiredCount !== undefined && !cdk.Token.isUnresolved(props.desiredCount) && props.desiredCount < 1) {
       throw new Error('You must specify a desiredCount greater than 0');
     }
 

packages/@aws-cdk/aws-ecs-patterns/test/fargate/load-balanced-fargate-service.test.ts

@@ -1047,3 +1047,29 @@ test('test Network load balanced service with docker labels defined', () => {
     ],
   });
 });
+
+test('Passing in token for desiredCount will not throw error', () => {
+  // GIVEN
+  const stack = new cdk.Stack();
+  const vpc = new ec2.Vpc(stack, 'VPC');
+  const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
+  const param = new cdk.CfnParameter(stack, 'prammm', {
+    type: 'Number',
+    default: 1,
+  });
+
+  // WHEN
+  const service = new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'Service', {
+    cluster,
+    taskImageOptions: {
+      image: ecs.ContainerImage.fromRegistry('/aws/aws-example-app'),
+      dockerLabels: { label1: 'labelValue1', label2: 'labelValue2' },
+    },
+    desiredCount: param.valueAsNumber,
+  });
+
+  // THEN
+  expect(() => {
+    service.internalDesiredCount;
+  }).toBeTruthy;
+});

packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts

@@ -1,4 +1,4 @@
-import { Tokenization } from '@aws-cdk/core';
+import { Tokenization, Token } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { ImportedTaskDefinition } from '../base/_imported-task-definition';
 import {
@@ -140,7 +140,8 @@ export class FargateTaskDefinition extends TaskDefinition implements IFargateTas
       networkMode: NetworkMode.AWS_VPC,
     });
 
-    if (props.ephemeralStorageGiB && (props.ephemeralStorageGiB < 21 || props.ephemeralStorageGiB > 200)) {
+    // eslint-disable-next-line max-len
+    if (props.ephemeralStorageGiB && !Token.isUnresolved(props.ephemeralStorageGiB) && (props.ephemeralStorageGiB < 21 || props.ephemeralStorageGiB > 200)) {
       throw new Error('Ephemeral storage size must be between 21GiB and 200GiB');
     }
 

packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts

@@ -251,6 +251,25 @@ describe('fargate task definition', () => {
         'Add the \'taskRole\' in ImportedTaskDefinitionProps to instantiate ImportedTaskDefinition');
     });
 
+    test('Passing in token for ephemeral storage will not throw error', () => {
+      // GIVEN
+      const stack = new cdk.Stack();
+
+      // WHEN
+      const param = new cdk.CfnParameter(stack, 'prammm', {
+        type: 'Number',
+        default: 1,
+      });
+
+      const taskDefinition = new ecs.FargateTaskDefinition(stack, 'FargateTaskDef', {
+        ephemeralStorageGiB: param.valueAsNumber,
+      });
+
+      // THEN
+      expect(() => {
+        taskDefinition.ephemeralStorageGiB;
+      }).toBeTruthy;
+    });
 
     test('runtime testing for windows container', () => {
       // GIVEN

packages/@aws-cdk/aws-iam/lib/private/merge-statements.ts

@@ -18,26 +18,33 @@ import { StatementSchema, normalizeStatement, IamValue } from './postprocess-pol
 export function mergeStatements(statements: StatementSchema[]): StatementSchema[] {
   const compStatements = statements.map(makeComparable);
 
-  let i = 0;
-  while (i < compStatements.length) {
-    let didMerge = false;
-
-    for (let j = i + 1; j < compStatements.length; j++) {
-      const merged = tryMerge(compStatements[i], compStatements[j]);
-      if (merged) {
-        compStatements[i] = merged;
-        compStatements.splice(j, 1);
-        didMerge = true;
-        break;
+  // Keep trying until nothing changes anymore
+  while (onePass()) { /* again */ }
+  return compStatements.map(renderComparable);
+
+  // Do one optimization pass, return 'true' if we merged anything
+  function onePass() {
+    let ret = false;
+    let i = 0;
+    while (i < compStatements.length) {
+      let didMerge = false;
+
+      for (let j = i + 1; j < compStatements.length; j++) {
+        const merged = tryMerge(compStatements[i], compStatements[j]);
+        if (merged) {
+          compStatements[i] = merged;
+          compStatements.splice(j, 1);
+          ret = didMerge = true;
+          break;
+        }
       }
-    }
 
-    if (!didMerge) {
-      i++;
+      if (!didMerge) {
+        i++;
+      }
     }
+    return ret;
   }
-
-  return compStatements.map(renderComparable);
 }
 
 /**

packages/@aws-cdk/aws-iam/test/merge-statements.test.ts

@@ -441,6 +441,36 @@ test('fail merging typed and untyped principals', () => {
   ]);
 });
 
+test('keep merging even if it requires multiple passes', () => {
+  // [A, R1], [B, R1], [A, R2], [B, R2]
+  // -> [{A, B}, R1], [{A, B], R2]
+  // -> [{A, B}, {R1, R2}]
+  assertMerged([
+    new iam.PolicyStatement({
+      actions: ['service:A'],
+      resources: ['R1'],
+    }),
+    new iam.PolicyStatement({
+      actions: ['service:B'],
+      resources: ['R1'],
+    }),
+    new iam.PolicyStatement({
+      actions: ['service:A'],
+      resources: ['R2'],
+    }),
+    new iam.PolicyStatement({
+      actions: ['service:B'],
+      resources: ['R2'],
+    }),
+  ], [
+    {
+      Effect: 'Allow',
+      Action: ['service:A', 'service:B'],
+      Resource: ['R1', 'R2'],
+    },
+  ]);
+});
+
 function assertNoMerge(statements: iam.PolicyStatement[]) {
   const app = new App();
   const stack = new Stack(app, 'Stack');

packages/@aws-cdk/aws-opensearchservice/lib/version.ts

@@ -65,6 +65,9 @@ export class EngineVersion {
   /** AWS OpenSearch 1.1 */
   public static readonly OPENSEARCH_1_1 = EngineVersion.openSearch('1.1');
 
+  /** AWS OpenSearch 1.2 */
+  public static readonly OPENSEARCH_1_2 = EngineVersion.openSearch('1.2');
+
   /**
    * Custom ElasticSearch version
    * @param version custom version number

packages/@aws-cdk/aws-rds/test/integ.instance.lit.expected.json

@@ -19,11 +19,11 @@
     "VPCPublicSubnet1SubnetB4246D30": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.0.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1a",
+        "CidrBlock": "10.0.0.0/18",
         "MapPublicIpOnLaunch": true,
         "Tags": [
           {
@@ -116,11 +116,11 @@
     "VPCPublicSubnet2Subnet74179F39": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.64.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1b",
+        "CidrBlock": "10.0.64.0/18",
         "MapPublicIpOnLaunch": true,
         "Tags": [
           {
@@ -213,11 +213,11 @@
     "VPCPrivateSubnet1Subnet8BCA10E0": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.128.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1a",
+        "CidrBlock": "10.0.128.0/18",
         "MapPublicIpOnLaunch": false,
         "Tags": [
           {
@@ -275,11 +275,11 @@
     "VPCPrivateSubnet2SubnetCFCDAA7A": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.192.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1b",
+        "CidrBlock": "10.0.192.0/18",
         "MapPublicIpOnLaunch": false,
         "Tags": [
           {
@@ -628,7 +628,7 @@
       "Properties": {
         "DBInstanceClass": "db.t3.medium",
         "AllocatedStorage": "100",
-        "AutoMinorVersionUpgrade": false,
+        "AutoMinorVersionUpgrade": true,
         "BackupRetentionPeriod": 7,
         "CopyTagsToSnapshot": true,
         "DBName": "ORCL",
@@ -696,8 +696,8 @@
           }
         ]
       },
-      "UpdateReplacePolicy": "Snapshot",
-      "DeletionPolicy": "Snapshot"
+      "UpdateReplacePolicy": "Delete",
+      "DeletionPolicy": "Delete"
     },
     "InstanceLogRetentiontrace487771C8": {
       "Type": "Custom::LogRetention",

packages/@aws-cdk/aws-rds/test/integ.instance.lit.ts

@@ -5,6 +5,7 @@ import * as targets from '@aws-cdk/aws-events-targets';
 import * as lambda from '@aws-cdk/aws-lambda';
 import * as logs from '@aws-cdk/aws-logs';
 import * as cdk from '@aws-cdk/core';
+import { RemovalPolicy } from '@aws-cdk/core';
 import * as rds from '../lib';
 
 const app = new cdk.App();
@@ -63,9 +64,10 @@ class DatabaseInstanceStack extends cdk.Stack {
         'listener',
       ],
       cloudwatchLogsRetention: logs.RetentionDays.ONE_MONTH,
-      autoMinorVersionUpgrade: false,
+      autoMinorVersionUpgrade: true, // required to be true if LOCATOR is used in the option group
       optionGroup,
       parameterGroup,
+      removalPolicy: RemovalPolicy.DESTROY,
     });
 
     // Allow connections on default port from any IPV4