diff --git a/README.md b/README.md
index 7349b1909d6b1..ddf9cce9d3997 100644
--- a/README.md
+++ b/README.md
@@ -79,7 +79,7 @@ For a detailed walkthrough, see the [tutorial](https://docs.aws.amazon.com/cdk/l
 Install or update the [AWS CDK CLI] from npm (requires [Node.js ≥ 14.15.0](https://nodejs.org/download/release/latest-v14.x/)). We recommend using a version in [Active LTS](https://nodejs.org/en/about/releases/)
 
 ```console
-$ npm i -g aws-cdk
+npm i -g aws-cdk
 ```
 
 (See [Manual Installation](./MANUAL_INSTALLATION.md) for installing the CDK from a signed .zip file).
@@ -87,9 +87,9 @@ $ npm i -g aws-cdk
 Initialize a project:
 
 ```console
-$ mkdir hello-cdk
-$ cd hello-cdk
-$ cdk init sample-app --language=typescript
+mkdir hello-cdk
+cd hello-cdk
+cdk init sample-app --language=typescript
 ```
 
 This creates a sample project looking like this:
@@ -113,7 +113,7 @@ export class HelloCdkStack extends cdk.Stack {
 Deploy this to your account:
 
 ```console
-$ cdk deploy
+cdk deploy
 ```
 
 Use the `cdk` command-line toolkit to interact with your project:
diff --git a/packages/@aws-cdk/aws-appsync/README.md b/packages/@aws-cdk/aws-appsync/README.md
index 721fa10390784..d7a54f9887cc7 100644
--- a/packages/@aws-cdk/aws-appsync/README.md
+++ b/packages/@aws-cdk/aws-appsync/README.md
@@ -252,7 +252,7 @@ import * as opensearch from '@aws-cdk/aws-opensearchservice';
 
 const user = new iam.User(this, 'User');
 const domain = new opensearch.Domain(this, 'Domain', {
-  version: opensearch.EngineVersion.OPENSEARCH_1_1,
+  version: opensearch.EngineVersion.OPENSEARCH_1_2,
   removalPolicy: RemovalPolicy.DESTROY,
   fineGrainedAccessControl: { masterUserArn: user.userArn },
   encryptionAtRest: { enabled: true },
diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.expected.json b/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.expected.json
index 1977b2d346896..803b2f0226d72 100644
--- a/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.expected.json
+++ b/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.expected.json
@@ -39,7 +39,7 @@
         "EncryptionAtRestOptions": {
           "Enabled": true
         },
-        "EngineVersion": "OpenSearch_1.1",
+        "EngineVersion": "OpenSearch_1.2",
         "LogPublishingOptions": {},
         "NodeToNodeEncryptionOptions": {
           "Enabled": true
diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.ts b/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.ts
index e055bfe15c83b..cb96dee17e90f 100644
--- a/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.ts
+++ b/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.ts
@@ -8,7 +8,7 @@ const app = new cdk.App();
 const stack = new cdk.Stack(app, 'appsync-opensearch');
 const user = new User(stack, 'User');
 const domain = new opensearch.Domain(stack, 'Domain', {
-  version: opensearch.EngineVersion.OPENSEARCH_1_1,
+  version: opensearch.EngineVersion.OPENSEARCH_1_2,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
   fineGrainedAccessControl: {
     masterUserArn: user.userArn,
diff --git a/packages/@aws-cdk/aws-dynamodb/lib/table.ts b/packages/@aws-cdk/aws-dynamodb/lib/table.ts
index 00dca8dbe31e3..e3745e4b84687 100644
--- a/packages/@aws-cdk/aws-dynamodb/lib/table.ts
+++ b/packages/@aws-cdk/aws-dynamodb/lib/table.ts
@@ -1183,7 +1183,7 @@ export class Table extends TableBase {
       attributeDefinitions: this.attributeDefinitions,
       globalSecondaryIndexes: Lazy.any({ produce: () => this.globalSecondaryIndexes }, { omitEmptyArray: true }),
       localSecondaryIndexes: Lazy.any({ produce: () => this.localSecondaryIndexes }, { omitEmptyArray: true }),
-      pointInTimeRecoverySpecification: props.pointInTimeRecovery ? { pointInTimeRecoveryEnabled: props.pointInTimeRecovery } : undefined,
+      pointInTimeRecoverySpecification: props.pointInTimeRecovery != null ? { pointInTimeRecoveryEnabled: props.pointInTimeRecovery } : undefined,
       billingMode: this.billingMode === BillingMode.PAY_PER_REQUEST ? this.billingMode : undefined,
       provisionedThroughput: this.billingMode === BillingMode.PAY_PER_REQUEST ? undefined : {
         readCapacityUnits: props.readCapacity || 5,
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
index b4c41ed5aa990..755683a62787e 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
@@ -413,7 +413,7 @@ export abstract class ApplicationLoadBalancedServiceBase extends CoreConstruct {
     }
     this.cluster = props.cluster || this.getDefaultCluster(this, props.vpc);
 
-    if (props.desiredCount !== undefined && props.desiredCount < 1) {
+    if (props.desiredCount !== undefined && !cdk.Token.isUnresolved(props.desiredCount) && props.desiredCount < 1) {
       throw new Error('You must specify a desiredCount greater than 0');
     }
 
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/load-balanced-fargate-service.test.ts b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/load-balanced-fargate-service.test.ts
index 70763a1bc2277..a00b676894c83 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/load-balanced-fargate-service.test.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/load-balanced-fargate-service.test.ts
@@ -1047,3 +1047,29 @@ test('test Network load balanced service with docker labels defined', () => {
     ],
   });
 });
+
+test('Passing in token for desiredCount will not throw error', () => {
+  // GIVEN
+  const stack = new cdk.Stack();
+  const vpc = new ec2.Vpc(stack, 'VPC');
+  const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
+  const param = new cdk.CfnParameter(stack, 'prammm', {
+    type: 'Number',
+    default: 1,
+  });
+
+  // WHEN
+  const service = new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'Service', {
+    cluster,
+    taskImageOptions: {
+      image: ecs.ContainerImage.fromRegistry('/aws/aws-example-app'),
+      dockerLabels: { label1: 'labelValue1', label2: 'labelValue2' },
+    },
+    desiredCount: param.valueAsNumber,
+  });
+
+  // THEN
+  expect(() => {
+    service.internalDesiredCount;
+  }).toBeTruthy;
+});
diff --git a/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts b/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts
index a1e957ed7a21c..c4e0831fbb4f7 100644
--- a/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts
@@ -1,4 +1,4 @@
-import { Tokenization } from '@aws-cdk/core';
+import { Tokenization, Token } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { ImportedTaskDefinition } from '../base/_imported-task-definition';
 import {
@@ -140,7 +140,8 @@ export class FargateTaskDefinition extends TaskDefinition implements IFargateTas
       networkMode: NetworkMode.AWS_VPC,
     });
 
-    if (props.ephemeralStorageGiB && (props.ephemeralStorageGiB < 21 || props.ephemeralStorageGiB > 200)) {
+    // eslint-disable-next-line max-len
+    if (props.ephemeralStorageGiB && !Token.isUnresolved(props.ephemeralStorageGiB) && (props.ephemeralStorageGiB < 21 || props.ephemeralStorageGiB > 200)) {
       throw new Error('Ephemeral storage size must be between 21GiB and 200GiB');
     }
 
diff --git a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
index e0b7afca3389f..e2eb71d53ceee 100644
--- a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
@@ -251,6 +251,25 @@ describe('fargate task definition', () => {
         'Add the \'taskRole\' in ImportedTaskDefinitionProps to instantiate ImportedTaskDefinition');
     });
 
+    test('Passing in token for ephemeral storage will not throw error', () => {
+      // GIVEN
+      const stack = new cdk.Stack();
+
+      // WHEN
+      const param = new cdk.CfnParameter(stack, 'prammm', {
+        type: 'Number',
+        default: 1,
+      });
+
+      const taskDefinition = new ecs.FargateTaskDefinition(stack, 'FargateTaskDef', {
+        ephemeralStorageGiB: param.valueAsNumber,
+      });
+
+      // THEN
+      expect(() => {
+        taskDefinition.ephemeralStorageGiB;
+      }).toBeTruthy;
+    });
 
     test('runtime testing for windows container', () => {
       // GIVEN
diff --git a/packages/@aws-cdk/aws-iam/lib/private/merge-statements.ts b/packages/@aws-cdk/aws-iam/lib/private/merge-statements.ts
index f7ef33b1ea026..c79ecd6a8a814 100644
--- a/packages/@aws-cdk/aws-iam/lib/private/merge-statements.ts
+++ b/packages/@aws-cdk/aws-iam/lib/private/merge-statements.ts
@@ -18,26 +18,33 @@ import { StatementSchema, normalizeStatement, IamValue } from './postprocess-pol
 export function mergeStatements(statements: StatementSchema[]): StatementSchema[] {
   const compStatements = statements.map(makeComparable);
 
-  let i = 0;
-  while (i < compStatements.length) {
-    let didMerge = false;
-
-    for (let j = i + 1; j < compStatements.length; j++) {
-      const merged = tryMerge(compStatements[i], compStatements[j]);
-      if (merged) {
-        compStatements[i] = merged;
-        compStatements.splice(j, 1);
-        didMerge = true;
-        break;
+  // Keep trying until nothing changes anymore
+  while (onePass()) { /* again */ }
+  return compStatements.map(renderComparable);
+
+  // Do one optimization pass, return 'true' if we merged anything
+  function onePass() {
+    let ret = false;
+    let i = 0;
+    while (i < compStatements.length) {
+      let didMerge = false;
+
+      for (let j = i + 1; j < compStatements.length; j++) {
+        const merged = tryMerge(compStatements[i], compStatements[j]);
+        if (merged) {
+          compStatements[i] = merged;
+          compStatements.splice(j, 1);
+          ret = didMerge = true;
+          break;
+        }
       }
-    }
 
-    if (!didMerge) {
-      i++;
+      if (!didMerge) {
+        i++;
+      }
     }
+    return ret;
   }
-
-  return compStatements.map(renderComparable);
 }
 
 /**
diff --git a/packages/@aws-cdk/aws-iam/test/merge-statements.test.ts b/packages/@aws-cdk/aws-iam/test/merge-statements.test.ts
index f3114955ecd61..061db0e134d02 100644
--- a/packages/@aws-cdk/aws-iam/test/merge-statements.test.ts
+++ b/packages/@aws-cdk/aws-iam/test/merge-statements.test.ts
@@ -441,6 +441,36 @@ test('fail merging typed and untyped principals', () => {
   ]);
 });
 
+test('keep merging even if it requires multiple passes', () => {
+  // [A, R1], [B, R1], [A, R2], [B, R2]
+  // -> [{A, B}, R1], [{A, B], R2]
+  // -> [{A, B}, {R1, R2}]
+  assertMerged([
+    new iam.PolicyStatement({
+      actions: ['service:A'],
+      resources: ['R1'],
+    }),
+    new iam.PolicyStatement({
+      actions: ['service:B'],
+      resources: ['R1'],
+    }),
+    new iam.PolicyStatement({
+      actions: ['service:A'],
+      resources: ['R2'],
+    }),
+    new iam.PolicyStatement({
+      actions: ['service:B'],
+      resources: ['R2'],
+    }),
+  ], [
+    {
+      Effect: 'Allow',
+      Action: ['service:A', 'service:B'],
+      Resource: ['R1', 'R2'],
+    },
+  ]);
+});
+
 function assertNoMerge(statements: iam.PolicyStatement[]) {
   const app = new App();
   const stack = new Stack(app, 'Stack');
diff --git a/packages/@aws-cdk/aws-opensearchservice/lib/version.ts b/packages/@aws-cdk/aws-opensearchservice/lib/version.ts
index 119b7844502dc..b989ac4867b72 100644
--- a/packages/@aws-cdk/aws-opensearchservice/lib/version.ts
+++ b/packages/@aws-cdk/aws-opensearchservice/lib/version.ts
@@ -65,6 +65,9 @@ export class EngineVersion {
   /** AWS OpenSearch 1.1 */
   public static readonly OPENSEARCH_1_1 = EngineVersion.openSearch('1.1');
 
+  /** AWS OpenSearch 1.2 */
+  public static readonly OPENSEARCH_1_2 = EngineVersion.openSearch('1.2');
+
   /**
    * Custom ElasticSearch version
    * @param version custom version number
diff --git a/packages/@aws-cdk/aws-rds/test/integ.instance.lit.expected.json b/packages/@aws-cdk/aws-rds/test/integ.instance.lit.expected.json
index 36c5fdc654df2..ccded802da6f0 100644
--- a/packages/@aws-cdk/aws-rds/test/integ.instance.lit.expected.json
+++ b/packages/@aws-cdk/aws-rds/test/integ.instance.lit.expected.json
@@ -19,11 +19,11 @@
     "VPCPublicSubnet1SubnetB4246D30": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.0.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1a",
+        "CidrBlock": "10.0.0.0/18",
         "MapPublicIpOnLaunch": true,
         "Tags": [
           {
@@ -116,11 +116,11 @@
     "VPCPublicSubnet2Subnet74179F39": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.64.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1b",
+        "CidrBlock": "10.0.64.0/18",
         "MapPublicIpOnLaunch": true,
         "Tags": [
           {
@@ -213,11 +213,11 @@
     "VPCPrivateSubnet1Subnet8BCA10E0": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.128.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1a",
+        "CidrBlock": "10.0.128.0/18",
         "MapPublicIpOnLaunch": false,
         "Tags": [
           {
@@ -275,11 +275,11 @@
     "VPCPrivateSubnet2SubnetCFCDAA7A": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.192.0/18",
         "VpcId": {
           "Ref": "VPCB9E5F0B4"
         },
         "AvailabilityZone": "test-region-1b",
+        "CidrBlock": "10.0.192.0/18",
         "MapPublicIpOnLaunch": false,
         "Tags": [
           {
@@ -628,7 +628,7 @@
       "Properties": {
         "DBInstanceClass": "db.t3.medium",
         "AllocatedStorage": "100",
-        "AutoMinorVersionUpgrade": false,
+        "AutoMinorVersionUpgrade": true,
         "BackupRetentionPeriod": 7,
         "CopyTagsToSnapshot": true,
         "DBName": "ORCL",
@@ -696,8 +696,8 @@
           }
         ]
       },
-      "UpdateReplacePolicy": "Snapshot",
-      "DeletionPolicy": "Snapshot"
+      "UpdateReplacePolicy": "Delete",
+      "DeletionPolicy": "Delete"
     },
     "InstanceLogRetentiontrace487771C8": {
       "Type": "Custom::LogRetention",
diff --git a/packages/@aws-cdk/aws-rds/test/integ.instance.lit.ts b/packages/@aws-cdk/aws-rds/test/integ.instance.lit.ts
index 3e869950a0a46..7154c05b8970b 100644
--- a/packages/@aws-cdk/aws-rds/test/integ.instance.lit.ts
+++ b/packages/@aws-cdk/aws-rds/test/integ.instance.lit.ts
@@ -5,6 +5,7 @@ import * as targets from '@aws-cdk/aws-events-targets';
 import * as lambda from '@aws-cdk/aws-lambda';
 import * as logs from '@aws-cdk/aws-logs';
 import * as cdk from '@aws-cdk/core';
+import { RemovalPolicy } from '@aws-cdk/core';
 import * as rds from '../lib';
 
 const app = new cdk.App();
@@ -63,9 +64,10 @@ class DatabaseInstanceStack extends cdk.Stack {
         'listener',
       ],
       cloudwatchLogsRetention: logs.RetentionDays.ONE_MONTH,
-      autoMinorVersionUpgrade: false,
+      autoMinorVersionUpgrade: true, // required to be true if LOCATOR is used in the option group
       optionGroup,
       parameterGroup,
+      removalPolicy: RemovalPolicy.DESTROY,
     });
 
     // Allow connections on default port from any IPV4
diff --git a/packages/@aws-cdk/aws-rds/test/integ.proxy.expected.json b/packages/@aws-cdk/aws-rds/test/integ.proxy.expected.json
index a8eff4138bc50..465915d69d202 100644
--- a/packages/@aws-cdk/aws-rds/test/integ.proxy.expected.json
+++ b/packages/@aws-cdk/aws-rds/test/integ.proxy.expected.json
@@ -18,11 +18,11 @@
     "vpcPublicSubnet1Subnet2E65531E": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.0.0/18",
         "VpcId": {
           "Ref": "vpcA2121C38"
         },
         "AvailabilityZone": "test-region-1a",
+        "CidrBlock": "10.0.0.0/18",
         "MapPublicIpOnLaunch": true,
         "Tags": [
           {
@@ -115,11 +115,11 @@
     "vpcPublicSubnet2Subnet009B674F": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.64.0/18",
         "VpcId": {
           "Ref": "vpcA2121C38"
         },
         "AvailabilityZone": "test-region-1b",
+        "CidrBlock": "10.0.64.0/18",
         "MapPublicIpOnLaunch": true,
         "Tags": [
           {
@@ -212,11 +212,11 @@
     "vpcPrivateSubnet1Subnet934893E8": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.128.0/18",
         "VpcId": {
           "Ref": "vpcA2121C38"
         },
         "AvailabilityZone": "test-region-1a",
+        "CidrBlock": "10.0.128.0/18",
         "MapPublicIpOnLaunch": false,
         "Tags": [
           {
@@ -274,11 +274,11 @@
     "vpcPrivateSubnet2Subnet7031C2BA": {
       "Type": "AWS::EC2::Subnet",
       "Properties": {
-        "CidrBlock": "10.0.192.0/18",
         "VpcId": {
           "Ref": "vpcA2121C38"
         },
         "AvailabilityZone": "test-region-1b",
+        "CidrBlock": "10.0.192.0/18",
         "MapPublicIpOnLaunch": false,
         "Tags": [
           {
@@ -462,7 +462,7 @@
           "Ref": "dbInstanceSubnetGroupD062EC9E"
         },
         "Engine": "postgres",
-        "EngineVersion": "11.5",
+        "EngineVersion": "11.15",
         "MasterUsername": {
           "Fn::Join": [
             "",
@@ -497,8 +497,8 @@
           }
         ]
       },
-      "UpdateReplacePolicy": "Snapshot",
-      "DeletionPolicy": "Snapshot"
+      "UpdateReplacePolicy": "Delete",
+      "DeletionPolicy": "Delete"
     },
     "dbProxyIAMRole662F3AB8": {
       "Type": "AWS::IAM::Role",
diff --git a/packages/@aws-cdk/aws-rds/test/integ.proxy.ts b/packages/@aws-cdk/aws-rds/test/integ.proxy.ts
index e59ead63f3590..0b67735f5c4e5 100644
--- a/packages/@aws-cdk/aws-rds/test/integ.proxy.ts
+++ b/packages/@aws-cdk/aws-rds/test/integ.proxy.ts
@@ -1,5 +1,6 @@
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as cdk from '@aws-cdk/core';
+import { RemovalPolicy } from '@aws-cdk/core';
 import * as rds from '../lib';
 
 const app = new cdk.App();
@@ -9,13 +10,14 @@ const vpc = new ec2.Vpc(stack, 'vpc', { maxAzs: 2 });
 
 const dbInstance = new rds.DatabaseInstance(stack, 'dbInstance', {
   engine: rds.DatabaseInstanceEngine.postgres({
-    version: rds.PostgresEngineVersion.VER_11_5,
+    version: rds.PostgresEngineVersion.VER_11_15,
   }),
   instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MEDIUM),
   credentials: rds.Credentials.fromUsername('master', {
     excludeCharacters: '"@/\\',
   }),
   vpc,
+  removalPolicy: RemovalPolicy.DESTROY,
 });
 
 new rds.DatabaseProxy(stack, 'dbProxy', {
diff --git a/packages/@aws-cdk/aws-sqs/lib/policy.ts b/packages/@aws-cdk/aws-sqs/lib/policy.ts
index 5b79fc9af4e5a..5aeccf8b7be13 100644
--- a/packages/@aws-cdk/aws-sqs/lib/policy.ts
+++ b/packages/@aws-cdk/aws-sqs/lib/policy.ts
@@ -34,20 +34,23 @@ export class QueuePolicy extends Resource {
    */
   public readonly document = new PolicyDocument();
 
-  /**
-   * Not currently supported by AWS CloudFormation.
-   * @attribute
-   */
-  public readonly queuePolicyId: string;
-
   constructor(scope: Construct, id: string, props: QueuePolicyProps) {
     super(scope, id);
 
-    const resource = new CfnQueuePolicy(this, 'Resource', {
+    new CfnQueuePolicy(this, 'Resource', {
       policyDocument: this.document,
       queues: props.queues.map(q => q.queueUrl),
     });
+  }
 
-    this.queuePolicyId = resource.attrId;
+  /**
+   * Not currently supported by AWS CloudFormation.
+   *
+   * This attribute temporarily existed in CloudFormation, and then was removed again.
+   *
+   * @attribute
+   */
+  public get queuePolicyId(): string {
+    throw new Error('QueuePolicy.queuePolicyId has been removed from CloudFormation');
   }
 }
diff --git a/packages/@aws-cdk/cfnspec/CHANGELOG.md b/packages/@aws-cdk/cfnspec/CHANGELOG.md
index b747e37831ee9..5993c4069c6e1 100644
--- a/packages/@aws-cdk/cfnspec/CHANGELOG.md
+++ b/packages/@aws-cdk/cfnspec/CHANGELOG.md
@@ -1,3 +1,70 @@
+# CloudFormation Resource Specification v65.0.0
+
+## New Resource Types
+
+
+## Removed Resource Types
+
+* AWS::Events::Endpoint
+
+## Attribute Changes
+
+* AWS::SQS::QueuePolicy Documentation (__changed__)
+  * Old: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html
+  * New: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-policy.html
+* AWS::SQS::QueuePolicy Id (__deleted__)
+* AWS::SageMaker::Domain SecurityGroupIdForDomainBoundary (__added__)
+
+## Property Changes
+
+* AWS::ECS::Service PlacementConstraints.UpdateType (__changed__)
+  * Old: Immutable
+  * New: Mutable
+* AWS::ECS::Service PlacementStrategies.UpdateType (__changed__)
+  * Old: Immutable
+  * New: Mutable
+* AWS::SQS::QueuePolicy PolicyDocument.Documentation (__changed__)
+  * Old: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html#cfn-sqs-queuepolicy-policydocument
+  * New: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-policy.html#cfn-sqs-queuepolicy-policydoc
+* AWS::SQS::QueuePolicy Queues.Documentation (__changed__)
+  * Old: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html#cfn-sqs-queuepolicy-queues
+  * New: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-policy.html#cfn-sqs-queuepolicy-queues
+* AWS::SageMaker::Domain AppSecurityGroupManagement (__added__)
+* AWS::SageMaker::Domain DomainSettings (__added__)
+
+## Property Type Changes
+
+* AWS::SageMaker::Domain.DomainSettings (__added__)
+* AWS::SageMaker::Domain.RStudioServerProAppSettings (__added__)
+* AWS::SageMaker::Domain.RStudioServerProDomainSettings (__added__)
+* AWS::SageMaker::UserProfile.RStudioServerProAppSettings (__added__)
+* AWS::DMS::Endpoint.KafkaSettings IncludePartitionValue (__added__)
+* AWS::DMS::Endpoint.KafkaSettings MessageFormat (__added__)
+* AWS::DMS::Endpoint.KafkaSettings MessageMaxBytes (__added__)
+* AWS::DMS::Endpoint.KinesisSettings IncludePartitionValue (__added__)
+* AWS::DMS::Endpoint.MySqlSettings AfterConnectScript (__added__)
+* AWS::DMS::Endpoint.MySqlSettings CleanSourceMetadataOnMismatch (__added__)
+* AWS::DMS::Endpoint.MySqlSettings EventsPollInterval (__added__)
+* AWS::DMS::Endpoint.MySqlSettings MaxFileSize (__added__)
+* AWS::DMS::Endpoint.MySqlSettings ParallelLoadThreads (__added__)
+* AWS::DMS::Endpoint.MySqlSettings ServerTimezone (__added__)
+* AWS::DMS::Endpoint.MySqlSettings TargetDbType (__added__)
+* AWS::ECS::Service.PlacementConstraint Expression.UpdateType (__changed__)
+  * Old: Immutable
+  * New: Mutable
+* AWS::ECS::Service.PlacementConstraint Type.UpdateType (__changed__)
+  * Old: Immutable
+  * New: Mutable
+* AWS::ECS::Service.PlacementStrategy Field.UpdateType (__changed__)
+  * Old: Immutable
+  * New: Mutable
+* AWS::ECS::Service.PlacementStrategy Type.UpdateType (__changed__)
+  * Old: Immutable
+  * New: Mutable
+* AWS::SageMaker::Domain.UserSettings RStudioServerProAppSettings (__added__)
+* AWS::SageMaker::UserProfile.UserSettings RStudioServerProAppSettings (__added__)
+
+
 # CloudFormation Resource Specification v63.0.0
 
 ## New Resource Types
diff --git a/packages/@aws-cdk/cfnspec/cfn.version b/packages/@aws-cdk/cfnspec/cfn.version
index 4996915d8b08d..4acff0a40e2b4 100644
--- a/packages/@aws-cdk/cfnspec/cfn.version
+++ b/packages/@aws-cdk/cfnspec/cfn.version
@@ -1 +1 @@
-63.0.0
+65.0.0
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ACMPCA.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ACMPCA.json
index b033bc7ae6183..31a291819a349 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ACMPCA.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ACMPCA.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ACMPCA::Certificate.ApiPassthrough": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-acmpca-certificate-apipassthrough.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_APS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_APS.json
index 345e00a8170ae..6e69e21b0c5c9 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_APS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_APS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::APS::RuleGroupsNamespace": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AccessAnalyzer.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AccessAnalyzer.json
index 4a2e025992e5c..8e69d543f98eb 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AccessAnalyzer.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AccessAnalyzer.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AccessAnalyzer::Analyzer.ArchiveRule": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-accessanalyzer-analyzer-archiverule.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmazonMQ.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmazonMQ.json
index 64ffdeeb2af10..19371db216bbb 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmazonMQ.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmazonMQ.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AmazonMQ::Broker.ConfigurationId": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amazonmq-broker-configurationid.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Amplify.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Amplify.json
index a3caf1c4afa24..557e569da1752 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Amplify.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Amplify.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Amplify::App.AutoBranchCreationConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amplify-app-autobranchcreationconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmplifyUIBuilder.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmplifyUIBuilder.json
index 085ee4d064cdb..74187e57987fe 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmplifyUIBuilder.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AmplifyUIBuilder.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AmplifyUIBuilder::Component.ActionParameters": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-amplifyuibuilder-component-actionparameters.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGateway.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGateway.json
index 0962d73bcc4f4..f64aa8e45b43c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGateway.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGateway.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ApiGateway::ApiKey.StageKey": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-apikey-stagekey.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGatewayV2.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGatewayV2.json
index 03680b804b33d..8b8886c633861 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGatewayV2.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApiGatewayV2.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ApiGatewayV2::Api.BodyS3Location": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigatewayv2-api-bodys3location.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppConfig.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppConfig.json
index 0848c0a8cd190..efb60e0aa53b2 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppConfig.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppConfig.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AppConfig::Application.Tags": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appconfig-application-tags.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppFlow.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppFlow.json
index f616702f3dc44..c51e19f377162 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppFlow.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppFlow.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AppFlow::ConnectorProfile.AmplitudeConnectorProfileCredentials": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appflow-connectorprofile-amplitudeconnectorprofilecredentials.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppIntegrations.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppIntegrations.json
index c6bac0940c593..0e6c19dba37d2 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppIntegrations.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppIntegrations.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AppIntegrations::DataIntegration.ScheduleConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appintegrations-dataintegration-scheduleconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppMesh.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppMesh.json
index d43ea6e409a90..6cc82c83c6703 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppMesh.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppMesh.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AppMesh::GatewayRoute.GatewayRouteHostnameMatch": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appmesh-gatewayroute-gatewayroutehostnamematch.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppRunner.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppRunner.json
index 2f1d30240179b..988e4e8bd4968 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppRunner.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppRunner.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AppRunner::Service.AuthenticationConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apprunner-service-authenticationconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppStream.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppStream.json
index 886285a698840..d61d6b7f95655 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppStream.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppStream.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AppStream::AppBlock.S3Location": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appstream-appblock-s3location.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppSync.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppSync.json
index b38c0e11bd5d0..29a48ad2c496c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppSync.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AppSync.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AppSync::DataSource.AuthorizationConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appsync-datasource-authorizationconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationAutoScaling.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationAutoScaling.json
index b6fccca5e211d..3b9216ab0c990 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationAutoScaling.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationAutoScaling.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ApplicationAutoScaling::ScalableTarget.ScalableTargetAction": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalabletarget-scalabletargetaction.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationInsights.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationInsights.json
index a0ed3e7418a38..ae1c226ddf36e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationInsights.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ApplicationInsights.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ApplicationInsights::Application.Alarm": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationinsights-application-alarm.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Athena.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Athena.json
index 54a739440eeaf..8f8877dd7a814 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Athena.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Athena.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Athena::WorkGroup.EncryptionConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-encryptionconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AuditManager.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AuditManager.json
index 09adfc3c0473d..be2772514210d 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AuditManager.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AuditManager.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AuditManager::Assessment.AWSAccount": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-auditmanager-assessment-awsaccount.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScaling.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScaling.json
index a5629d1accfed..a9da22e23f77f 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScaling.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScaling.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AutoScaling::AutoScalingGroup.AcceleratorCountRequest": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-autoscaling-autoscalinggroup-acceleratorcountrequest.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScalingPlans.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScalingPlans.json
index 2113a1a253f68..744f026f3c875 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScalingPlans.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_AutoScalingPlans.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::AutoScalingPlans::ScalingPlan.ApplicationSource": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-autoscalingplans-scalingplan-applicationsource.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Backup.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Backup.json
index 1a3c5cee08c69..7984ab5bf19dc 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Backup.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Backup.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Backup::BackupPlan.AdvancedBackupSettingResourceType": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-backup-backupplan-advancedbackupsettingresourcetype.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Batch.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Batch.json
index 19c02020dfdf3..a3fd4fecec863 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Batch.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Batch.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Batch::ComputeEnvironment.ComputeResources": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-computeenvironment-computeresources.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_BillingConductor.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_BillingConductor.json
index 22a1229f7eb8c..f19f101132301 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_BillingConductor.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_BillingConductor.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::BillingConductor::BillingGroup.AccountGrouping": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-billingconductor-billinggroup-accountgrouping.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Budgets.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Budgets.json
index 57935026a5a7e..f49628168aab5 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Budgets.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Budgets.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Budgets::Budget.BudgetData": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-budgets-budget-budgetdata.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CE.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CE.json
index d9d758a25a11e..63c91c8e96922 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CE.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CE.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CE::AnomalySubscription.Subscriber": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ce-anomalysubscription-subscriber.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CUR.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CUR.json
index 6abcca3fffaf0..3ae4d1801a9d9 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CUR.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CUR.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::CUR::ReportDefinition": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cassandra.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cassandra.json
index 060778c079167..c0fb87068d5d8 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cassandra.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cassandra.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Cassandra::Table.BillingMode": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cassandra-table-billingmode.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CertificateManager.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CertificateManager.json
index 580a19dafcc72..998c3fb6a7ff1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CertificateManager.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CertificateManager.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CertificateManager::Account.ExpiryEventsConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-certificatemanager-account-expiryeventsconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Chatbot.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Chatbot.json
index cb050366b77ba..0967bf8ae4916 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Chatbot.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Chatbot.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::Chatbot::SlackChannelConfiguration": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cloud9.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cloud9.json
index f2542d84f5997..1317a2389436e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cloud9.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cloud9.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Cloud9::EnvironmentEC2.Repository": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloud9-environmentec2-repository.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFormation.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFormation.json
index 3a263b19ca4c9..658c86a481cb5 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFormation.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFormation.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CloudFormation::HookVersion.LoggingConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-hookversion-loggingconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFront.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFront.json
index e5dbe282db52a..cda050e48c840 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFront.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudFront.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CloudFront::CachePolicy.CachePolicyConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudTrail.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudTrail.json
index 290fa810dba1e..ca208c959033e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudTrail.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudTrail.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CloudTrail::Trail.DataResource": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-trail-dataresource.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudWatch.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudWatch.json
index 77fe5a7862b53..83a6dbbd0286e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudWatch.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CloudWatch.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CloudWatch::Alarm.Dimension": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cw-dimension.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeArtifact.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeArtifact.json
index a4ea7e6eb337d..fad8c8c7ce35b 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeArtifact.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeArtifact.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::CodeArtifact::Domain": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeBuild.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeBuild.json
index 556961ac79d6f..9462011a5ecc9 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeBuild.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeBuild.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CodeBuild::Project.Artifacts": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codebuild-project-artifacts.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeCommit.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeCommit.json
index 8260e1947a89b..72268b920aa79 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeCommit.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeCommit.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CodeCommit::Repository.Code": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codecommit-repository-code.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeDeploy.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeDeploy.json
index 76d77ff7ab364..3816307559d88 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeDeploy.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeDeploy.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CodeDeploy::DeploymentConfig.MinimumHealthyHosts": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codedeploy-deploymentconfig-minimumhealthyhosts.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruProfiler.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruProfiler.json
index 5e171d55ae49e..271cd277d1157 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruProfiler.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruProfiler.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CodeGuruProfiler::ProfilingGroup.Channel": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codeguruprofiler-profilinggroup-channel.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruReviewer.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruReviewer.json
index 338d30d5a3e03..679838864533c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruReviewer.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeGuruReviewer.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::CodeGuruReviewer::RepositoryAssociation": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodePipeline.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodePipeline.json
index b417227ce6cbf..719cc8cbf3035 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodePipeline.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodePipeline.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CodePipeline::CustomActionType.ArtifactDetails": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codepipeline-customactiontype-artifactdetails.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStar.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStar.json
index 48ba7f64eb956..a3354f9cb49d0 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStar.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStar.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CodeStar::GitHubRepository.Code": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codestar-githubrepository-code.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarConnections.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarConnections.json
index dfcf29f736b11..6b17cf76c4957 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarConnections.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarConnections.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::CodeStarConnections::Connection": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarNotifications.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarNotifications.json
index 80e10035b9dab..a62bb5bd618ff 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarNotifications.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CodeStarNotifications.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CodeStarNotifications::NotificationRule.Target": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codestarnotifications-notificationrule-target.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cognito.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cognito.json
index 62334d481c916..274645a0faec8 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cognito.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Cognito.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Cognito::IdentityPool.CognitoIdentityProvider": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-identitypool-cognitoidentityprovider.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Config.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Config.json
index 52c9f9df4421d..e66aa2d3468c7 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Config.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Config.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Config::ConfigRule.Scope": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-scope.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Connect.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Connect.json
index be0595e15612c..a3d23a9e074e5 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Connect.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Connect.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Connect::HoursOfOperation.HoursOfOperationConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-connect-hoursofoperation-hoursofoperationconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CustomerProfiles.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CustomerProfiles.json
index 8fc5346ffe95d..80f847af74abc 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CustomerProfiles.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_CustomerProfiles.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::CustomerProfiles::Integration.ConnectorOperator": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-customerprofiles-integration-connectoroperator.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DAX.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DAX.json
index 20fe6cb4a5550..ea1c00b14561a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DAX.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DAX.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DAX::Cluster.SSESpecification": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dax-cluster-ssespecification.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DLM.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DLM.json
index be0b30b14966b..87c06843423b1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DLM.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DLM.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DLM::LifecyclePolicy.Action": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dlm-lifecyclepolicy-action.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DMS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DMS.json
index 298afcbdcf139..ff6cb9276d253 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DMS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DMS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DMS::Endpoint.DocDbSettings": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-docdbsettings.html",
@@ -179,6 +179,12 @@
           "Required": false,
           "UpdateType": "Mutable"
         },
+        "IncludePartitionValue": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-kafkasettings.html#cfn-dms-endpoint-kafkasettings-includepartitionvalue",
+          "PrimitiveType": "Boolean",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
         "IncludeTableAlterOperations": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-kafkasettings.html#cfn-dms-endpoint-kafkasettings-includetablealteroperations",
           "PrimitiveType": "Boolean",
@@ -191,6 +197,18 @@
           "Required": false,
           "UpdateType": "Mutable"
         },
+        "MessageFormat": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-kafkasettings.html#cfn-dms-endpoint-kafkasettings-messageformat",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "MessageMaxBytes": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-kafkasettings.html#cfn-dms-endpoint-kafkasettings-messagemaxbytes",
+          "PrimitiveType": "Integer",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
         "NoHexPrefix": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-kafkasettings.html#cfn-dms-endpoint-kafkasettings-nohexprefix",
           "PrimitiveType": "Boolean",
@@ -268,6 +286,12 @@
           "Required": false,
           "UpdateType": "Mutable"
         },
+        "IncludePartitionValue": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-kinesissettings.html#cfn-dms-endpoint-kinesissettings-includepartitionvalue",
+          "PrimitiveType": "Boolean",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
         "IncludeTableAlterOperations": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-kinesissettings.html#cfn-dms-endpoint-kinesissettings-includetablealteroperations",
           "PrimitiveType": "Boolean",
@@ -415,6 +439,36 @@
     "AWS::DMS::Endpoint.MySqlSettings": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html",
       "Properties": {
+        "AfterConnectScript": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-afterconnectscript",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "CleanSourceMetadataOnMismatch": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-cleansourcemetadataonmismatch",
+          "PrimitiveType": "Boolean",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "EventsPollInterval": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-eventspollinterval",
+          "PrimitiveType": "Integer",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "MaxFileSize": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-maxfilesize",
+          "PrimitiveType": "Integer",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "ParallelLoadThreads": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-parallelloadthreads",
+          "PrimitiveType": "Integer",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
         "SecretsManagerAccessRoleArn": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-secretsmanageraccessrolearn",
           "PrimitiveType": "String",
@@ -426,6 +480,18 @@
           "PrimitiveType": "String",
           "Required": false,
           "UpdateType": "Mutable"
+        },
+        "ServerTimezone": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-servertimezone",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "TargetDbType": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dms-endpoint-mysqlsettings.html#cfn-dms-endpoint-mysqlsettings-targetdbtype",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
         }
       }
     },
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataBrew.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataBrew.json
index 1c021687aca13..a560e126ec48f 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataBrew.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataBrew.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DataBrew::Dataset.CsvOptions": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-databrew-dataset-csvoptions.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataPipeline.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataPipeline.json
index 19c4f56205b74..64977ff5f85ca 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataPipeline.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataPipeline.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DataPipeline::Pipeline.Field": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-datapipeline-pipeline-pipelineobjects-fields.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataSync.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataSync.json
index 3f386f46b470f..616ef1f812aca 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataSync.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DataSync.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DataSync::LocationEFS.Ec2Config": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-datasync-locationefs-ec2config.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Detective.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Detective.json
index 56faa21c1f5ff..4a0cfa99fd393 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Detective.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Detective.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::Detective::Graph": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DevOpsGuru.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DevOpsGuru.json
index b04e08d8b5059..36ae1cdb432ca 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DevOpsGuru.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DevOpsGuru.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DevOpsGuru::NotificationChannel.NotificationChannelConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-devopsguru-notificationchannel-notificationchannelconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DirectoryService.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DirectoryService.json
index c2309f8f4123f..f1b85143d78fd 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DirectoryService.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DirectoryService.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DirectoryService::MicrosoftAD.VpcSettings": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-directoryservice-microsoftad-vpcsettings.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DocDB.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DocDB.json
index abc912f5069d8..6d90d7c6c57d1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DocDB.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DocDB.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::DocDB::DBCluster": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DynamoDB.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DynamoDB.json
index c882966d612f2..3e1443f5c9b00 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DynamoDB.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_DynamoDB.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::DynamoDB::GlobalTable.AttributeDefinition": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-globaltable-attributedefinition.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EC2.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EC2.json
index 19a3690b1dd86..709bee378bf52 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EC2.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EC2.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::EC2::CapacityReservation.TagSpecification": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-capacityreservation-tagspecification.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECR.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECR.json
index d114ab2f2e0c9..d1f9fd3d4d0a0 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECR.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECR.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ECR::ReplicationConfiguration.ReplicationConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecr-replicationconfiguration-replicationconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECS.json
index a81c9475fea5e..08b57e4b39f1d 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ECS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ECS::CapacityProvider.AutoScalingGroupProvider": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-capacityprovider-autoscalinggroupprovider.html",
@@ -337,13 +337,13 @@
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-service-placementconstraint.html#cfn-ecs-service-placementconstraint-expression",
           "PrimitiveType": "String",
           "Required": false,
-          "UpdateType": "Immutable"
+          "UpdateType": "Mutable"
         },
         "Type": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-service-placementconstraint.html#cfn-ecs-service-placementconstraint-type",
           "PrimitiveType": "String",
           "Required": true,
-          "UpdateType": "Immutable"
+          "UpdateType": "Mutable"
         }
       }
     },
@@ -354,13 +354,13 @@
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-service-placementstrategy.html#cfn-ecs-service-placementstrategy-field",
           "PrimitiveType": "String",
           "Required": false,
-          "UpdateType": "Immutable"
+          "UpdateType": "Mutable"
         },
         "Type": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-service-placementstrategy.html#cfn-ecs-service-placementstrategy-type",
           "PrimitiveType": "String",
           "Required": true,
-          "UpdateType": "Immutable"
+          "UpdateType": "Mutable"
         }
       }
     },
@@ -1603,14 +1603,14 @@
           "ItemType": "PlacementConstraint",
           "Required": false,
           "Type": "List",
-          "UpdateType": "Immutable"
+          "UpdateType": "Mutable"
         },
         "PlacementStrategies": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html#cfn-ecs-service-placementstrategies",
           "ItemType": "PlacementStrategy",
           "Required": false,
           "Type": "List",
-          "UpdateType": "Immutable"
+          "UpdateType": "Mutable"
         },
         "PlatformVersion": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html#cfn-ecs-service-platformversion",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EFS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EFS.json
index 6bc4e1afe0bb9..bba85ff5c3bfb 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EFS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EFS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::EFS::AccessPoint.AccessPointTag": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-efs-accesspoint-accesspointtag.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EKS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EKS.json
index dbc2097adfc33..c873bddb7c055 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EKS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EKS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::EKS::Cluster.ClusterLogging": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-eks-cluster-clusterlogging.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMR.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMR.json
index 42cff4d5e283b..bcad3f358f03f 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMR.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMR.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::EMR::Cluster.Application": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticmapreduce-cluster-application.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMRContainers.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMRContainers.json
index 77c008b27de65..3abad19275971 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMRContainers.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EMRContainers.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::EMRContainers::VirtualCluster.ContainerInfo": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-emrcontainers-virtualcluster-containerinfo.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElastiCache.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElastiCache.json
index 7929087d41af9..3efbceca22c1a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElastiCache.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElastiCache.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ElastiCache::CacheCluster.CloudWatchLogsDestinationDetails": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticache-cachecluster-cloudwatchlogsdestinationdetails.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticBeanstalk.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticBeanstalk.json
index 079e26a29c9a4..3892b2fab02c4 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticBeanstalk.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticBeanstalk.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ElasticBeanstalk::Application.ApplicationResourceLifecycleConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticbeanstalk-application-applicationresourcelifecycleconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancing.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancing.json
index 810a4710cd6e7..26e4988bc418b 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancing.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancing.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ElasticLoadBalancing::LoadBalancer.AccessLoggingPolicy": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-elb-accessloggingpolicy.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancingV2.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancingV2.json
index 78b47b93a29b1..f273244dea180 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancingV2.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ElasticLoadBalancingV2.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ElasticLoadBalancingV2::Listener.Action": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticloadbalancingv2-listener-action.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Elasticsearch.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Elasticsearch.json
index 429e5004fdc1f..89ab08a27ffb8 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Elasticsearch.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Elasticsearch.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Elasticsearch::Domain.AdvancedSecurityOptionsInput": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticsearch-domain-advancedsecurityoptionsinput.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EventSchemas.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EventSchemas.json
index c87162e72349c..0b254979b40ad 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EventSchemas.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_EventSchemas.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::EventSchemas::Discoverer.TagsEntry": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-eventschemas-discoverer-tagsentry.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Events.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Events.json
index f51270d548153..a79d3477a59fe 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Events.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Events.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Events::Connection.ApiKeyAuthParameters": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-connection-apikeyauthparameters.html",
@@ -159,78 +159,6 @@
         }
       }
     },
-    "AWS::Events::Endpoint.EndpointEventBus": {
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-endpointeventbus.html",
-      "Properties": {
-        "EventBusArn": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-endpointeventbus.html#cfn-events-endpoint-endpointeventbus-eventbusarn",
-          "PrimitiveType": "String",
-          "Required": true,
-          "UpdateType": "Mutable"
-        }
-      }
-    },
-    "AWS::Events::Endpoint.FailoverConfig": {
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-failoverconfig.html",
-      "Properties": {
-        "Primary": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-failoverconfig.html#cfn-events-endpoint-failoverconfig-primary",
-          "Required": true,
-          "Type": "Primary",
-          "UpdateType": "Mutable"
-        },
-        "Secondary": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-failoverconfig.html#cfn-events-endpoint-failoverconfig-secondary",
-          "Required": true,
-          "Type": "Secondary",
-          "UpdateType": "Mutable"
-        }
-      }
-    },
-    "AWS::Events::Endpoint.Primary": {
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-primary.html",
-      "Properties": {
-        "HealthCheck": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-primary.html#cfn-events-endpoint-primary-healthcheck",
-          "PrimitiveType": "String",
-          "Required": true,
-          "UpdateType": "Mutable"
-        }
-      }
-    },
-    "AWS::Events::Endpoint.ReplicationConfig": {
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-replicationconfig.html",
-      "Properties": {
-        "State": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-replicationconfig.html#cfn-events-endpoint-replicationconfig-state",
-          "PrimitiveType": "String",
-          "Required": true,
-          "UpdateType": "Mutable"
-        }
-      }
-    },
-    "AWS::Events::Endpoint.RoutingConfig": {
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-routingconfig.html",
-      "Properties": {
-        "FailoverConfig": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-routingconfig.html#cfn-events-endpoint-routingconfig-failoverconfig",
-          "Required": true,
-          "Type": "FailoverConfig",
-          "UpdateType": "Mutable"
-        }
-      }
-    },
-    "AWS::Events::Endpoint.Secondary": {
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-secondary.html",
-      "Properties": {
-        "Route": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-endpoint-secondary.html#cfn-events-endpoint-secondary-route",
-          "PrimitiveType": "String",
-          "Required": true,
-          "UpdateType": "Mutable"
-        }
-      }
-    },
     "AWS::Events::EventBus.TagEntry": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-eventbus-tagentry.html",
       "Properties": {
@@ -961,65 +889,6 @@
         }
       }
     },
-    "AWS::Events::Endpoint": {
-      "Attributes": {
-        "Arn": {
-          "PrimitiveType": "String"
-        },
-        "EndpointId": {
-          "PrimitiveType": "String"
-        },
-        "EndpointUrl": {
-          "PrimitiveType": "String"
-        },
-        "State": {
-          "PrimitiveType": "String"
-        },
-        "StateReason": {
-          "PrimitiveType": "String"
-        }
-      },
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-endpoint.html",
-      "Properties": {
-        "Description": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-endpoint.html#cfn-events-endpoint-description",
-          "PrimitiveType": "String",
-          "Required": false,
-          "UpdateType": "Mutable"
-        },
-        "EventBuses": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-endpoint.html#cfn-events-endpoint-eventbuses",
-          "ItemType": "EndpointEventBus",
-          "Required": true,
-          "Type": "List",
-          "UpdateType": "Mutable"
-        },
-        "Name": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-endpoint.html#cfn-events-endpoint-name",
-          "PrimitiveType": "String",
-          "Required": true,
-          "UpdateType": "Immutable"
-        },
-        "ReplicationConfig": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-endpoint.html#cfn-events-endpoint-replicationconfig",
-          "Required": false,
-          "Type": "ReplicationConfig",
-          "UpdateType": "Mutable"
-        },
-        "RoleArn": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-endpoint.html#cfn-events-endpoint-rolearn",
-          "PrimitiveType": "String",
-          "Required": false,
-          "UpdateType": "Mutable"
-        },
-        "RoutingConfig": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-endpoint.html#cfn-events-endpoint-routingconfig",
-          "Required": true,
-          "Type": "RoutingConfig",
-          "UpdateType": "Mutable"
-        }
-      }
-    },
     "AWS::Events::EventBus": {
       "Attributes": {
         "Arn": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Evidently.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Evidently.json
index c2fdca3ab9cb9..c3739861f7f4b 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Evidently.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Evidently.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Evidently::Experiment.MetricGoalObject": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-evidently-experiment-metricgoalobject.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FIS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FIS.json
index bf9ce1ae522fa..2a3401f2eaab2 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FIS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FIS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::FIS::ExperimentTemplate.ExperimentTemplateAction": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fis-experimenttemplate-experimenttemplateaction.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FMS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FMS.json
index 3114630804a11..d5207e4678790 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FMS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FMS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::FMS::Policy.IEMap": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fms-policy-iemap.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FSx.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FSx.json
index bde338ca7a8e4..bf141d918adcd 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FSx.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FSx.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::FSx::FileSystem.AuditLogConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-auditlogconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FinSpace.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FinSpace.json
index a2f269fd8fce0..86880cc94fc99 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FinSpace.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FinSpace.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::FinSpace::Environment.FederationParameters": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-finspace-environment-federationparameters.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Forecast.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Forecast.json
index 31407eaf099ba..9709f838af4ab 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Forecast.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Forecast.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::Forecast::Dataset": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FraudDetector.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FraudDetector.json
index 6f4d2104133d2..b1b4f999a8f8c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FraudDetector.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_FraudDetector.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::FraudDetector::Detector.EntityType": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-frauddetector-detector-entitytype.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GameLift.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GameLift.json
index 504ff43141e69..b7561a98e604c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GameLift.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GameLift.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::GameLift::Alias.RoutingStrategy": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-gamelift-alias-routingstrategy.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GlobalAccelerator.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GlobalAccelerator.json
index 1fb823c95b44d..0a8a12315910a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GlobalAccelerator.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GlobalAccelerator.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::GlobalAccelerator::EndpointGroup.EndpointConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-globalaccelerator-endpointgroup-endpointconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Glue.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Glue.json
index 103dea2806424..c92366799ca6f 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Glue.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Glue.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Glue::Classifier.CsvClassifier": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-glue-classifier-csvclassifier.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Greengrass.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Greengrass.json
index 303af9b2c092f..6367efa5cac07 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Greengrass.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Greengrass.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Greengrass::ConnectorDefinition.Connector": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-greengrass-connectordefinition-connector.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GreengrassV2.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GreengrassV2.json
index 313fffb330f30..2321c3c73723b 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GreengrassV2.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GreengrassV2.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::GreengrassV2::ComponentVersion.ComponentDependencyRequirement": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-greengrassv2-componentversion-componentdependencyrequirement.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GroundStation.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GroundStation.json
index b4c0926ac8d28..e1074519290b8 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GroundStation.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GroundStation.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::GroundStation::Config.AntennaDownlinkConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-groundstation-config-antennadownlinkconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GuardDuty.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GuardDuty.json
index d74c32954160a..756a0faff9a28 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GuardDuty.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_GuardDuty.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::GuardDuty::Detector.CFNDataSourceConfigurations": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-guardduty-detector-cfndatasourceconfigurations.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_HealthLake.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_HealthLake.json
index c072c6f19428c..4a3a5cb3b66f4 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_HealthLake.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_HealthLake.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::HealthLake::FHIRDatastore.KmsEncryptionConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-healthlake-fhirdatastore-kmsencryptionconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IAM.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IAM.json
index 354c362069643..f08ee66a0e5d2 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IAM.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IAM.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IAM::Group.Policy": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-policy.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IVS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IVS.json
index 0e0404faad6cd..2112cfcccdd1a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IVS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IVS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IVS::RecordingConfiguration.DestinationConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ivs-recordingconfiguration-destinationconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ImageBuilder.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ImageBuilder.json
index bccb786b6df38..e101857fd1382 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ImageBuilder.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ImageBuilder.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ImageBuilder::ContainerRecipe.ComponentConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-imagebuilder-containerrecipe-componentconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Inspector.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Inspector.json
index 526c74df8789a..a06ff4cf1de0a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Inspector.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Inspector.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::Inspector::AssessmentTarget": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_InspectorV2.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_InspectorV2.json
index 6a3b91d0479e1..5f3eea2e5bf8a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_InspectorV2.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_InspectorV2.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::InspectorV2::Filter.DateFilter": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-inspectorv2-filter-datefilter.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json
index f93d27fbed810..f05f51e09ccc5 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IoT::AccountAuditConfiguration.AuditCheckConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iot-accountauditconfiguration-auditcheckconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT1Click.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT1Click.json
index 4c1f5388369e8..e81eb24a10880 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT1Click.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT1Click.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IoT1Click::Project.DeviceTemplate": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iot1click-project-devicetemplate.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTAnalytics.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTAnalytics.json
index 3341cd450c829..06392c8d15228 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTAnalytics.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTAnalytics.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IoTAnalytics::Channel.ChannelStorage": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotanalytics-channel-channelstorage.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTCoreDeviceAdvisor.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTCoreDeviceAdvisor.json
index 6fc630923689e..322b806dc2332 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTCoreDeviceAdvisor.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTCoreDeviceAdvisor.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::IoTCoreDeviceAdvisor::SuiteDefinition": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTEvents.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTEvents.json
index a21d0122e65d7..d053b8811e968 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTEvents.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTEvents.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IoTEvents::AlarmModel.AcknowledgeFlow": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotevents-alarmmodel-acknowledgeflow.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTFleetHub.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTFleetHub.json
index 43a2f1661cd3a..6f12fda293e65 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTFleetHub.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTFleetHub.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::IoTFleetHub::Application": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTSiteWise.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTSiteWise.json
index 7917bba0188ce..e0170b9b6e124 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTSiteWise.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTSiteWise.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IoTSiteWise::AccessPolicy.AccessPolicyIdentity": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotsitewise-accesspolicy-accesspolicyidentity.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTThingsGraph.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTThingsGraph.json
index 4e265da545b49..fc6cc4ef74ee0 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTThingsGraph.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTThingsGraph.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IoTThingsGraph::FlowTemplate.DefinitionDocument": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotthingsgraph-flowtemplate-definitiondocument.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTWireless.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTWireless.json
index 92180804b90e1..2d914b2d402e4 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTWireless.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoTWireless.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::IoTWireless::DeviceProfile.LoRaWANDeviceProfile": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iotwireless-deviceprofile-lorawandeviceprofile.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KMS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KMS.json
index eb47b0525e215..d06b5196495c6 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KMS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KMS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::KMS::Alias": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KafkaConnect.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KafkaConnect.json
index bdcf318e037bb..068f42cc1c15d 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KafkaConnect.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KafkaConnect.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::KafkaConnect::Connector.ApacheKafkaCluster": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-kafkaconnect-connector-apachekafkacluster.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kendra.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kendra.json
index 7c678c0d37222..048245cb5e16c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kendra.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kendra.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Kendra::DataSource.AccessControlListConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-kendra-datasource-accesscontrollistconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kinesis.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kinesis.json
index 7da4b0e7bea92..3d4bcc50f28ad 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kinesis.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Kinesis.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Kinesis::Stream.StreamEncryption": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-kinesis-stream-streamencryption.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalytics.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalytics.json
index 5fbe33a6c048d..879036a701bb1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalytics.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalytics.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::KinesisAnalytics::Application.CSVMappingParameters": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-kinesisanalytics-application-csvmappingparameters.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalyticsV2.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalyticsV2.json
index 3e03c8937df85..1ff96a9d04186 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalyticsV2.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisAnalyticsV2.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::KinesisAnalyticsV2::Application.ApplicationCodeConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-kinesisanalyticsv2-application-applicationcodeconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisFirehose.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisFirehose.json
index 1f44ffbf8162f..c00db83b3de67 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisFirehose.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisFirehose.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::KinesisFirehose::DeliveryStream.AmazonopensearchserviceBufferingHints": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-kinesisfirehose-deliverystream-amazonopensearchservicebufferinghints.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisVideo.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisVideo.json
index 4a01a19f8eb75..a65286545d35a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisVideo.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_KinesisVideo.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::KinesisVideo::SignalingChannel": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LakeFormation.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LakeFormation.json
index 40ef79a1ec3d0..0d273aad78230 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LakeFormation.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LakeFormation.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::LakeFormation::DataLakeSettings.Admins": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lakeformation-datalakesettings-admins.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lambda.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lambda.json
index 3d60299491470..ae495ce6d1f95 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lambda.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lambda.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Lambda::Alias.AliasRoutingConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-alias-aliasroutingconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lex.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lex.json
index 664a5f51321d8..ec077e524ca06 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lex.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lex.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Lex::Bot.AdvancedRecognitionSetting": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lex-bot-advancedrecognitionsetting.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LicenseManager.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LicenseManager.json
index a1ebf4db44f2a..6780cb0164e9a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LicenseManager.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LicenseManager.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::LicenseManager::License.BorrowConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-licensemanager-license-borrowconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lightsail.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lightsail.json
index 086864a1dbe4f..08602fb1f9d02 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lightsail.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Lightsail.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Lightsail::Bucket.AccessRules": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lightsail-bucket-accessrules.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Location.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Location.json
index 3584abb3172a2..132b2a5a76c19 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Location.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Location.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Location::Map.MapConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-location-map-mapconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Logs.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Logs.json
index d492b6ea7bc13..019ee43b9259e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Logs.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Logs.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Logs::MetricFilter.MetricTransformation": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-logs-metricfilter-metrictransformation.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutEquipment.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutEquipment.json
index f1fd159c0be37..91d509bc29b51 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutEquipment.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutEquipment.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::LookoutEquipment::InferenceScheduler": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutMetrics.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutMetrics.json
index fea526a260b61..c5dd728b0282c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutMetrics.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutMetrics.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::LookoutMetrics::Alert.Action": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lookoutmetrics-alert-action.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutVision.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutVision.json
index c6239947a243b..b841ea62893a5 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutVision.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_LookoutVision.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::LookoutVision::Project": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MSK.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MSK.json
index e752678307182..6334ba4ebd85d 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MSK.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MSK.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MSK::Cluster.BrokerLogs": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-msk-cluster-brokerlogs.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MWAA.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MWAA.json
index ec0cf8b9eedf4..40f81113b56fe 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MWAA.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MWAA.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MWAA::Environment.LoggingConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-mwaa-environment-loggingconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Macie.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Macie.json
index c302ffdf0f991..1f020780832ff 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Macie.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Macie.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Macie::FindingsFilter.Criterion": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-macie-findingsfilter-criterion.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ManagedBlockchain.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ManagedBlockchain.json
index 36bbecfb18aba..7788065aaa8ce 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ManagedBlockchain.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ManagedBlockchain.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ManagedBlockchain::Member.ApprovalThresholdPolicy": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-managedblockchain-member-approvalthresholdpolicy.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConnect.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConnect.json
index 8fb07f58b6cbc..268e659bbb1fa 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConnect.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConnect.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MediaConnect::Flow.Encryption": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-mediaconnect-flow-encryption.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConvert.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConvert.json
index c992a2fed6a85..ca108de7d4e11 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConvert.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaConvert.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MediaConvert::JobTemplate.AccelerationSettings": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-mediaconvert-jobtemplate-accelerationsettings.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaLive.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaLive.json
index 6251324e4c202..07f160f2aff60 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaLive.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaLive.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MediaLive::Channel.AacSettings": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-medialive-channel-aacsettings.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaPackage.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaPackage.json
index 8972d36294f2c..d35d3353607b5 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaPackage.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaPackage.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MediaPackage::Asset.EgressEndpoint": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-mediapackage-asset-egressendpoint.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaStore.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaStore.json
index ed4a94cae2725..fd99cc83dc129 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaStore.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MediaStore.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MediaStore::Container.CorsRule": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-mediastore-container-corsrule.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MemoryDB.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MemoryDB.json
index 13b95fb51a74d..2f3279c691bc9 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MemoryDB.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_MemoryDB.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::MemoryDB::Cluster.Endpoint": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-memorydb-cluster-endpoint.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Neptune.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Neptune.json
index 7c6a1d0520a58..fe10967b8fb1b 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Neptune.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Neptune.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Neptune::DBCluster.DBClusterRole": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-neptune-dbcluster-dbclusterrole.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkFirewall.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkFirewall.json
index f24c88ad6e2e8..87f491f339fe1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkFirewall.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkFirewall.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::NetworkFirewall::Firewall.SubnetMapping": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewall-subnetmapping.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkManager.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkManager.json
index cd3dbd142e6b5..786dd74fd6e20 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkManager.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NetworkManager.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::NetworkManager::Device.Location": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkmanager-device-location.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NimbleStudio.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NimbleStudio.json
index c6e8bcc66a01a..bb59347e6d93a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NimbleStudio.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_NimbleStudio.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::NimbleStudio::LaunchProfile.StreamConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-nimblestudio-launchprofile-streamconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpenSearchService.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpenSearchService.json
index a04f0464ae6e1..cb38bc35b25fb 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpenSearchService.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpenSearchService.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::OpenSearchService::Domain.AdvancedSecurityOptionsInput": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorks.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorks.json
index c172679b67252..adfa529eeb3ad 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorks.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorks.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::OpsWorks::App.DataSource": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opsworks-app-datasource.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorksCM.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorksCM.json
index 5bfd159e99cf4..ea11efc3556a1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorksCM.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_OpsWorksCM.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::OpsWorksCM::Server.EngineAttribute": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opsworkscm-server-engineattribute.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Panorama.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Panorama.json
index b17d636387579..225719b641e00 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Panorama.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Panorama.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Panorama::ApplicationInstance.ManifestOverridesPayload": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-panorama-applicationinstance-manifestoverridespayload.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Personalize.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Personalize.json
index fd7699d1c49fe..bf02ac3460e4e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Personalize.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Personalize.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Personalize::Dataset.DatasetImportJob": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-personalize-dataset-datasetimportjob.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Pinpoint.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Pinpoint.json
index 2ff8175ae159c..11a6d2484e887 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Pinpoint.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Pinpoint.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Pinpoint::ApplicationSettings.CampaignHook": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-pinpoint-applicationsettings-campaignhook.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_PinpointEmail.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_PinpointEmail.json
index 11537b9ef643c..45c488cfa70a8 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_PinpointEmail.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_PinpointEmail.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::PinpointEmail::ConfigurationSet.DeliveryOptions": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-pinpointemail-configurationset-deliveryoptions.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QLDB.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QLDB.json
index f055e8550286b..11c8c31b3e6be 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QLDB.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QLDB.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::QLDB::Stream.KinesisConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-qldb-stream-kinesisconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QuickSight.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QuickSight.json
index 5ff8bd9db3b61..d5113b88299c9 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QuickSight.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_QuickSight.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::QuickSight::Analysis.AnalysisError": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-quicksight-analysis-analysiserror.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RAM.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RAM.json
index ad098ca364943..bf254c6c3ac7e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RAM.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RAM.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::RAM::ResourceShare": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RDS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RDS.json
index 3e5565aa69860..d34c706f590c1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RDS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RDS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::RDS::DBCluster.DBClusterRole": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-dbclusterrole.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RUM.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RUM.json
index 16c86ef08f9f3..77b5056c84279 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RUM.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RUM.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::RUM::AppMonitor.AppMonitorConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rum-appmonitor-appmonitorconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Redshift.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Redshift.json
index 08491323f4be4..ec5d4cb8d6a7d 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Redshift.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Redshift.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Redshift::Cluster.Endpoint": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-redshift-cluster-endpoint.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RefactorSpaces.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RefactorSpaces.json
index 01d28a1638f77..0241c3e136c64 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RefactorSpaces.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RefactorSpaces.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::RefactorSpaces::Application.ApiGatewayProxyInput": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-refactorspaces-application-apigatewayproxyinput.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Rekognition.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Rekognition.json
index 1d2268c7072ad..b7af9ddf4da75 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Rekognition.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Rekognition.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::Rekognition::Collection": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResilienceHub.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResilienceHub.json
index a8a47d0390652..5d746cd1d2e5a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResilienceHub.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResilienceHub.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ResilienceHub::App.PhysicalResourceId": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resiliencehub-app-physicalresourceid.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResourceGroups.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResourceGroups.json
index 40f0b1d29c7e9..32ea2da90078c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResourceGroups.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ResourceGroups.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ResourceGroups::Group.ConfigurationItem": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resourcegroups-group-configurationitem.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RoboMaker.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RoboMaker.json
index 9bd3b351c6e0a..ae657003d96c8 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RoboMaker.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_RoboMaker.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::RoboMaker::RobotApplication.RobotSoftwareSuite": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-robomaker-robotapplication-robotsoftwaresuite.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53.json
index bba4894b5b5a7..539ce2b47cf06 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Route53::HealthCheck.HealthCheckTag": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-healthcheck-healthchecktag.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryControl.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryControl.json
index b1b6dc8f19b3d..ba6f7179d0fd9 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryControl.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryControl.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Route53RecoveryControl::Cluster.ClusterEndpoint": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53recoverycontrol-cluster-clusterendpoint.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryReadiness.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryReadiness.json
index f4db3f1155c53..c3d989e6ef5dd 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryReadiness.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53RecoveryReadiness.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Route53RecoveryReadiness::ResourceSet.DNSTargetResource": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53recoveryreadiness-resourceset-dnstargetresource.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53Resolver.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53Resolver.json
index 7fc0859d7b610..a7387022ac7a2 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53Resolver.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Route53Resolver.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Route53Resolver::FirewallRuleGroup.FirewallRule": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53resolver-firewallrulegroup-firewallrule.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3.json
index 9c6216514c986..e02d59ddd160a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::S3::AccessPoint.PublicAccessBlockConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-accesspoint-publicaccessblockconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3ObjectLambda.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3ObjectLambda.json
index 598a53984ff44..89b0cf0a806f8 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3ObjectLambda.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3ObjectLambda.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::S3ObjectLambda::AccessPoint.ObjectLambdaConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3objectlambda-accesspoint-objectlambdaconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3Outposts.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3Outposts.json
index b5b81fd7b844a..710e765160180 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3Outposts.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_S3Outposts.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::S3Outposts::AccessPoint.VpcConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3outposts-accesspoint-vpcconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SDB.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SDB.json
index f736c01eba889..3e1c1cb5f14cd 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SDB.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SDB.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::SDB::Domain": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SES.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SES.json
index 11485a3c40645..b7f876672425b 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SES.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SES.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SES::ConfigurationSetEventDestination.CloudWatchDestination": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ses-configurationseteventdestination-cloudwatchdestination.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SNS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SNS.json
index 346294b79b0b2..d18230fc7d027 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SNS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SNS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SNS::Topic.Subscription": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sns-subscription.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SQS.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SQS.json
index 37bfe22adf62b..03ed3429b558b 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SQS.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SQS.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::SQS::Queue": {
@@ -111,21 +111,16 @@
       }
     },
     "AWS::SQS::QueuePolicy": {
-      "Attributes": {
-        "Id": {
-          "PrimitiveType": "String"
-        }
-      },
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html",
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-policy.html",
       "Properties": {
         "PolicyDocument": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html#cfn-sqs-queuepolicy-policydocument",
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-policy.html#cfn-sqs-queuepolicy-policydoc",
           "PrimitiveType": "Json",
           "Required": true,
           "UpdateType": "Mutable"
         },
         "Queues": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html#cfn-sqs-queuepolicy-queues",
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-policy.html#cfn-sqs-queuepolicy-queues",
           "DuplicatesAllowed": true,
           "PrimitiveItemType": "String",
           "Required": true,
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSM.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSM.json
index c6bcb086e45c9..86116ba415876 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSM.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSM.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SSM::Association.InstanceAssociationOutputLocation": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-association-instanceassociationoutputlocation.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMContacts.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMContacts.json
index 0e0e62fb99d58..dd05422752be1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMContacts.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMContacts.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SSMContacts::Contact.ChannelTargetInfo": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssmcontacts-contact-channeltargetinfo.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMIncidents.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMIncidents.json
index 505d09e85fc06..a374edbe7f28c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMIncidents.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSMIncidents.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SSMIncidents::ReplicationSet.RegionConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssmincidents-replicationset-regionconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSO.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSO.json
index 6837aad28c38e..1f6d774fae724 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSO.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SSO.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SSO::InstanceAccessControlAttributeConfiguration.AccessControlAttribute": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sso-instanceaccesscontrolattributeconfiguration-accesscontrolattribute.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SageMaker.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SageMaker.json
index 331cd9acb2863..b5153d8bd618a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SageMaker.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SageMaker.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SageMaker::App.ResourceSpec": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-app-resourcespec.html",
@@ -442,6 +442,25 @@
         }
       }
     },
+    "AWS::SageMaker::Domain.DomainSettings": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-domainsettings.html",
+      "Properties": {
+        "RStudioServerProDomainSettings": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-domainsettings.html#cfn-sagemaker-domain-domainsettings-rstudioserverprodomainsettings",
+          "Required": false,
+          "Type": "RStudioServerProDomainSettings",
+          "UpdateType": "Mutable"
+        },
+        "SecurityGroupIds": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-domainsettings.html#cfn-sagemaker-domain-domainsettings-securitygroupids",
+          "DuplicatesAllowed": true,
+          "PrimitiveItemType": "String",
+          "Required": false,
+          "Type": "List",
+          "UpdateType": "Immutable"
+        }
+      }
+    },
     "AWS::SageMaker::Domain.JupyterServerAppSettings": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-jupyterserverappsettings.html",
       "Properties": {
@@ -472,6 +491,52 @@
         }
       }
     },
+    "AWS::SageMaker::Domain.RStudioServerProAppSettings": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverproappsettings.html",
+      "Properties": {
+        "AccessStatus": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverproappsettings.html#cfn-sagemaker-domain-rstudioserverproappsettings-accessstatus",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "UserGroup": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverproappsettings.html#cfn-sagemaker-domain-rstudioserverproappsettings-usergroup",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        }
+      }
+    },
+    "AWS::SageMaker::Domain.RStudioServerProDomainSettings": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverprodomainsettings.html",
+      "Properties": {
+        "DefaultResourceSpec": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverprodomainsettings.html#cfn-sagemaker-domain-rstudioserverprodomainsettings-defaultresourcespec",
+          "Required": false,
+          "Type": "ResourceSpec",
+          "UpdateType": "Immutable"
+        },
+        "DomainExecutionRoleArn": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverprodomainsettings.html#cfn-sagemaker-domain-rstudioserverprodomainsettings-domainexecutionrolearn",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Immutable"
+        },
+        "RStudioConnectUrl": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverprodomainsettings.html#cfn-sagemaker-domain-rstudioserverprodomainsettings-rstudioconnecturl",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "RStudioPackageManagerUrl": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-rstudioserverprodomainsettings.html#cfn-sagemaker-domain-rstudioserverprodomainsettings-rstudiopackagemanagerurl",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        }
+      }
+    },
     "AWS::SageMaker::Domain.ResourceSpec": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-resourcespec.html",
       "Properties": {
@@ -539,6 +604,12 @@
           "Type": "KernelGatewayAppSettings",
           "UpdateType": "Mutable"
         },
+        "RStudioServerProAppSettings": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-usersettings.html#cfn-sagemaker-domain-usersettings-rstudioserverproappsettings",
+          "Required": false,
+          "Type": "RStudioServerProAppSettings",
+          "UpdateType": "Mutable"
+        },
         "SecurityGroups": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-domain-usersettings.html#cfn-sagemaker-domain-usersettings-securitygroups",
           "DuplicatesAllowed": true,
@@ -2358,6 +2429,23 @@
         }
       }
     },
+    "AWS::SageMaker::UserProfile.RStudioServerProAppSettings": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-userprofile-rstudioserverproappsettings.html",
+      "Properties": {
+        "AccessStatus": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-userprofile-rstudioserverproappsettings.html#cfn-sagemaker-userprofile-rstudioserverproappsettings-accessstatus",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "UserGroup": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-userprofile-rstudioserverproappsettings.html#cfn-sagemaker-userprofile-rstudioserverproappsettings-usergroup",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        }
+      }
+    },
     "AWS::SageMaker::UserProfile.ResourceSpec": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-userprofile-resourcespec.html",
       "Properties": {
@@ -2425,6 +2513,12 @@
           "Type": "KernelGatewayAppSettings",
           "UpdateType": "Mutable"
         },
+        "RStudioServerProAppSettings": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-userprofile-usersettings.html#cfn-sagemaker-userprofile-usersettings-rstudioserverproappsettings",
+          "Required": false,
+          "Type": "RStudioServerProAppSettings",
+          "UpdateType": "Mutable"
+        },
         "SecurityGroups": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sagemaker-userprofile-usersettings.html#cfn-sagemaker-userprofile-usersettings-securitygroups",
           "DuplicatesAllowed": true,
@@ -2740,6 +2834,9 @@
         "HomeEfsFileSystemId": {
           "PrimitiveType": "String"
         },
+        "SecurityGroupIdForDomainBoundary": {
+          "PrimitiveType": "String"
+        },
         "SingleSignOnManagedApplicationInstanceId": {
           "PrimitiveType": "String"
         },
@@ -2755,6 +2852,12 @@
           "Required": false,
           "UpdateType": "Immutable"
         },
+        "AppSecurityGroupManagement": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sagemaker-domain.html#cfn-sagemaker-domain-appsecuritygroupmanagement",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
         "AuthMode": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sagemaker-domain.html#cfn-sagemaker-domain-authmode",
           "PrimitiveType": "String",
@@ -2773,6 +2876,12 @@
           "Required": true,
           "UpdateType": "Immutable"
         },
+        "DomainSettings": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sagemaker-domain.html#cfn-sagemaker-domain-domainsettings",
+          "Required": false,
+          "Type": "DomainSettings",
+          "UpdateType": "Mutable"
+        },
         "KmsKeyId": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sagemaker-domain.html#cfn-sagemaker-domain-kmskeyid",
           "PrimitiveType": "String",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecretsManager.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecretsManager.json
index 3acb7de28a8ab..c518822a0d6ca 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecretsManager.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecretsManager.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::SecretsManager::RotationSchedule.HostedRotationLambda": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecurityHub.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecurityHub.json
index c5d08691cb55d..ffd6469afa82e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecurityHub.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_SecurityHub.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::SecurityHub::Hub": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalog.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalog.json
index 87b22c85c9b20..e6981019f167c 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalog.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalog.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ServiceCatalog::CloudFormationProduct.ProvisioningArtifactProperties": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-servicecatalog-cloudformationproduct-provisioningartifactproperties.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalogAppRegistry.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalogAppRegistry.json
index a4b35183b7de0..3394fdcbdc43f 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalogAppRegistry.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceCatalogAppRegistry.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {},
   "ResourceTypes": {
     "AWS::ServiceCatalogAppRegistry::Application": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceDiscovery.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceDiscovery.json
index 25810a304d5d2..6703a55412649 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceDiscovery.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_ServiceDiscovery.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::ServiceDiscovery::PrivateDnsNamespace.PrivateDnsPropertiesMutable": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-servicediscovery-privatednsnamespace-privatednspropertiesmutable.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Signer.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Signer.json
index 15817ea33defb..064c7a1000b64 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Signer.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Signer.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Signer::SigningProfile.SignatureValidityPeriod": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-signer-signingprofile-signaturevalidityperiod.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_StepFunctions.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_StepFunctions.json
index 8b4cfa88e044b..568e76f18bb3e 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_StepFunctions.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_StepFunctions.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::StepFunctions::Activity.TagsEntry": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-stepfunctions-activity-tagsentry.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Synthetics.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Synthetics.json
index fd02447e5fcaf..1913280df82ed 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Synthetics.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Synthetics.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Synthetics::Canary.ArtifactConfig": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-synthetics-canary-artifactconfig.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Timestream.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Timestream.json
index 37849fc955a30..525740ac94c23 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Timestream.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Timestream.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Timestream::ScheduledQuery.DimensionMapping": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-timestream-scheduledquery-dimensionmapping.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Transfer.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Transfer.json
index dc59a76ec3e7d..0e78fa72cad74 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Transfer.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Transfer.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Transfer::Server.EndpointDetails": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-transfer-server-endpointdetails.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAF.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAF.json
index 3bd386347ef8b..03b2d809585aa 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAF.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAF.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::WAF::ByteMatchSet.ByteMatchTuple": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-waf-bytematchset-bytematchtuples.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFRegional.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFRegional.json
index a6031abce2eaa..0ee74e285b8dc 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFRegional.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFRegional.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::WAFRegional::ByteMatchSet.ByteMatchTuple": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafregional-bytematchset-bytematchtuple.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFv2.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFv2.json
index 29b6f9963fd31..15c980e2dd7a9 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFv2.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WAFv2.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::WAFv2::LoggingConfiguration.FieldToMatch": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-loggingconfiguration-fieldtomatch.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Wisdom.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Wisdom.json
index 9ed69407430c7..4f970e00b68cf 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Wisdom.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_Wisdom.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::Wisdom::Assistant.ServerSideEncryptionConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wisdom-assistant-serversideencryptionconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WorkSpaces.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WorkSpaces.json
index 3bc6ca3937803..f090b864ac3fd 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WorkSpaces.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_WorkSpaces.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::WorkSpaces::ConnectionAlias.ConnectionAliasAssociation": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-workspaces-connectionalias-connectionaliasassociation.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_XRay.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_XRay.json
index 35b013ec61299..86833dc185fef 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_XRay.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_XRay.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "AWS::XRay::Group.InsightsConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-xray-group-insightsconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Alexa_ASK.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Alexa_ASK.json
index 49a1ec4aa4f8d..640471a91baca 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Alexa_ASK.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Alexa_ASK.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "Alexa::ASK::Skill.AuthenticationConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ask-skill-authenticationconfiguration.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Tag.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Tag.json
index 3486a9e1ca841..70ecedfc02b9a 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Tag.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_Tag.json
@@ -1,5 +1,5 @@
 {
-  "$version": "63.0.0",
+  "$version": "65.0.0",
   "PropertyTypes": {
     "Tag": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/001_Version.json b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/001_Version.json
index 2cccd3695c2e4..5c69a88216bc1 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/001_Version.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/001_Version.json
@@ -1,3 +1,3 @@
 {
-  "ResourceSpecificationVersion": "63.0.0"
+  "ResourceSpecificationVersion": "65.0.0"
 }
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/index.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/index.ts
index 50c2dc35a5eab..5fd6eb6ceda07 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/lib/index.ts
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/index.ts
@@ -1,3 +1,4 @@
 export * from './cloud-assembly';
 export * from './assets';
 export * from './manifest';
+export * from './integ-tests';
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/common.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/common.ts
new file mode 100644
index 0000000000000..01ab969b63098
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/common.ts
@@ -0,0 +1,202 @@
+/**
+ * In what scenarios should the CLI ask for approval
+ */
+export enum RequireApproval {
+  /**
+   * Never ask for approval
+   */
+  NEVER = 'never',
+
+  /**
+   * Prompt for approval for any type  of change to the stack
+   */
+  ANYCHANGE = 'any-change',
+
+  /**
+   * Only prompt for approval if there are security related changes
+   */
+  BROADENING = 'broadening'
+}
+
+/**
+ * Default CDK CLI options that apply to all commands
+ */
+export interface DefaultCdkOptions {
+  /**
+   * List of stacks to deploy
+   *
+   * Requried if `all` is not set
+   *
+   * @default - []
+   */
+  readonly stacks?: string[];
+
+  /**
+   * Deploy all stacks
+   *
+   * Requried if `stacks` is not set
+   *
+   * @default - false
+   */
+  readonly all?: boolean;
+
+  /**
+   * command-line for executing your app or a cloud assembly directory
+   * e.g. "node bin/my-app.js"
+   * or
+   * "cdk.out"
+   *
+   * @default - read from cdk.json
+   */
+  readonly app?: string;
+
+
+  /**
+   * Role to pass to CloudFormation for deployment
+   *
+   * @default - use the bootstrap cfn-exec role
+   */
+  readonly roleArn?: string;
+
+  /**
+   * Additional context
+   *
+   * @default - no additional context
+   */
+  readonly context?: { [name: string]: string };
+
+  /**
+   * Print trace for stack warnings
+   *
+   * @default false
+   */
+  readonly trace?: boolean;
+
+  /**
+   * Do not construct stacks with warnings
+   *
+   * @default false
+   */
+  readonly strict?: boolean;
+
+  /**
+   * Perform context lookups.
+   *
+   * Synthesis fails if this is disabled and context lookups need
+   * to be performed
+   *
+   * @default true
+   */
+  readonly lookups?: boolean;
+
+  /**
+    * Ignores synthesis errors, which will likely produce an invalid output
+   *
+   * @default false
+   */
+  readonly ignoreErrors?: boolean;
+
+  /**
+   * Use JSON output instead of YAML when templates are printed
+   * to STDOUT
+   *
+   * @default false
+   */
+  readonly json?: boolean;
+
+  /**
+   * show debug logs
+   *
+   * @default false
+   */
+  readonly verbose?: boolean;
+
+  /**
+   * enable emission of additional debugging information, such as creation stack
+   * traces of tokens
+   *
+   * @default false
+   */
+  readonly debug?: boolean;
+
+  /**
+   * Use the indicated AWS profile as the default environment
+   *
+   * @default - no profile is used
+   */
+  readonly profile?: string;
+
+  /**
+   * Use the indicated proxy. Will read from
+   * HTTPS_PROXY environment if specified
+   *
+   * @default - no proxy
+   */
+  readonly proxy?: string;
+
+  /**
+   * Path to CA certificate to use when validating HTTPS
+   * requests.
+   *
+   * @default - read from AWS_CA_BUNDLE environment variable
+   */
+  readonly caBundlePath?: string;
+
+  /**
+   * Force trying to fetch EC2 instance credentials
+   *
+   * @default - guess EC2 instance status
+   */
+  readonly ec2Creds?: boolean;
+
+  /**
+   * Include "AWS::CDK::Metadata" resource in synthesized templates
+   *
+   * @default true
+   */
+  readonly versionReporting?: boolean;
+
+  /**
+   * Include "aws:cdk:path" CloudFormation metadata for each resource
+   *
+   * @default true
+   */
+  readonly pathMetadata?: boolean;
+
+  /**
+   * Include "aws:asset:*" CloudFormation metadata for resources that use assets
+   *
+   * @default true
+   */
+  readonly assetMetadata?: boolean;
+
+  /**
+   * Copy assets to the output directory
+   *
+   * Needed for local debugging the source files with SAM CLI
+   *
+   * @default false
+   */
+  readonly staging?: boolean;
+
+  /**
+   * Emits the synthesized cloud assembly into a directory
+   *
+   * @default cdk.out
+   */
+  readonly output?: string;
+
+  /**
+   * Show relevant notices
+   *
+   * @default true
+   */
+  readonly notices?: boolean;
+
+  /**
+   * Show colors and other style from console output
+   *
+   * @default true
+   */
+  readonly color?: boolean;
+}
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/deploy.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/deploy.ts
new file mode 100644
index 0000000000000..09a20c610f12d
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/deploy.ts
@@ -0,0 +1,97 @@
+import { DefaultCdkOptions, RequireApproval } from './common';
+
+/**
+ * Options to use with cdk deploy
+ */
+export interface DeployOptions extends DefaultCdkOptions {
+  /**
+   * Only perform action on the given stack
+   *
+   * @default false
+   */
+  readonly exclusively?: boolean;
+
+  /**
+   * Name of the toolkit stack to use/deploy
+   *
+   * @default CDKToolkit
+   */
+  readonly toolkitStackName?: string;
+
+  /**
+   * Reuse the assets with the given asset IDs
+   *
+   * @default - do not reuse assets
+   */
+  readonly reuseAssets?: string[];
+
+  /**
+   * Optional name to use for the CloudFormation change set.
+   * If not provided, a name will be generated automatically.
+   *
+   * @default - auto generate a name
+   */
+  readonly changeSetName?: string;
+
+  /**
+   * Always deploy, even if templates are identical.
+   * @default false
+   */
+  readonly force?: boolean;
+
+  /**
+   * Rollback failed deployments
+   *
+   * @default true
+   */
+  readonly rollback?: boolean;
+
+  /**
+   * ARNs of SNS topics that CloudFormation will notify with stack related events
+   *
+   * @default - no notifications
+   */
+  readonly notificationArns?: string[];
+
+  /**
+   * What kind of security changes require approval
+   *
+   * @default RequireApproval.Never
+   */
+  readonly requireApproval?: RequireApproval;
+
+  /**
+   * Whether to execute the ChangeSet
+   * Not providing `execute` parameter will result in execution of ChangeSet
+   * @default true
+   */
+  readonly execute?: boolean;
+
+  /**
+   * Additional parameters for CloudFormation at deploy time
+   * @default {}
+   */
+  readonly parameters?: { [name: string]: string };
+
+  /**
+   * Use previous values for unspecified parameters
+   *
+   * If not set, all parameters must be specified for every deployment.
+   *
+   * @default true
+   */
+  readonly usePreviousParameters?: boolean;
+
+  /**
+   * Path to file where stack outputs will be written after a successful deploy as JSON
+   * @default - Outputs are not written to any file
+   */
+  readonly outputsFile?: string;
+
+  /**
+   * Whether we are on a CI system
+   *
+   * @default false
+   */
+  readonly ci?: boolean;
+}
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/destroy.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/destroy.ts
new file mode 100644
index 0000000000000..9dfe8f267c6db
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/destroy.ts
@@ -0,0 +1,20 @@
+import { DefaultCdkOptions } from './common';
+
+/**
+ * Options to use with cdk destroy
+ */
+export interface DestroyOptions extends DefaultCdkOptions {
+  /**
+   * Do not ask for permission before destroying stacks
+   *
+   * @default false
+   */
+  readonly force?: boolean;
+
+  /**
+   * Only destroy the given stack
+   *
+   * @default false
+   */
+  readonly exclusively?: boolean;
+}
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/index.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/index.ts
new file mode 100644
index 0000000000000..528980446938b
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/commands/index.ts
@@ -0,0 +1,3 @@
+export * from './common';
+export * from './deploy';
+export * from './destroy';
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/index.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/index.ts
new file mode 100644
index 0000000000000..5a08e62a47958
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/index.ts
@@ -0,0 +1,3 @@
+export * from './schema';
+export * from './commands';
+export * from './test-case';
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/schema.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/schema.ts
new file mode 100644
index 0000000000000..4eccc8a6422b4
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/schema.ts
@@ -0,0 +1,26 @@
+import { TestCase } from './test-case';
+/**
+ * Definitions for the integration testing manifest
+ */
+export interface IntegManifest {
+  /**
+   * Version of the manifest
+   */
+  readonly version: string;
+
+  /**
+   * Enable lookups for this test. If lookups are enabled
+   * then `stackUpdateWorkflow` must be set to false.
+   * Lookups should only be enabled when you are explicitely testing
+   * lookups.
+   *
+   * @default false
+   */
+  readonly enableLookups?: boolean;
+
+  /**
+   * test cases
+   */
+  readonly testCases: { [testName: string]: TestCase };
+}
+
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/test-case.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/test-case.ts
new file mode 100644
index 0000000000000..6d3ecc05c626e
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/integ-tests/test-case.ts
@@ -0,0 +1,186 @@
+import { DeployOptions, DestroyOptions } from './commands';
+
+/**
+ * Represents an integration test test case
+ */
+export interface TestCase {
+  /**
+   * Stacks that should be tested as part of this test case
+   * The stackNames will be passed as args to the cdk commands
+   * so dependent stacks will be automatically deployed unless
+   * `exclusively` is passed
+   */
+  readonly stacks: string[];
+
+  /**
+   * Run update workflow on this test case
+   * This should only be set to false to test scenarios
+   * that are not possible to test as part of the update workflow
+   *
+   * @default true
+   */
+  readonly stackUpdateWorkflow?: boolean;
+
+  /**
+   * Additional options to use for each CDK command
+   *
+   * @default - runner default options
+   */
+  readonly cdkCommandOptions?: CdkCommands;
+
+  /**
+   * Additional commands to run at predefined points in the test workflow
+   *
+   * e.g. { postDeploy: ['yarn', 'test'] }
+   *
+   * @default - no hooks
+   */
+  readonly hooks?: Hooks;
+
+  /**
+   * Whether or not to include asset hashes in the diff
+   * Asset hashes can introduces a lot of unneccessary noise into tests,
+   * but there are some cases where asset hashes _should_ be included. For example
+   * any tests involving custom resources or bundling
+   *
+   * @default false
+   */
+  readonly diffAssets?: boolean;
+
+  /**
+   * List of CloudFormation resource types in this stack that can
+   * be destroyed as part of an update without failing the test.
+   *
+   * This list should only include resources that for this specific
+   * integration test we are sure will not cause errors or an outage if
+   * destroyed. For example, maybe we know that a new resource will be created
+   * first before the old resource is destroyed which prevents any outage.
+   *
+   * e.g. ['AWS::IAM::Role']
+   *
+   * @default - do not allow destruction of any resources on update
+   */
+  readonly allowDestroy?: string[];
+
+  /**
+   * Limit deployment to these regions
+   *
+   * @default - can run in any region
+   */
+  readonly regions?: string[];
+}
+
+/**
+ * Commands to run at predefined points during the
+ * integration test workflow
+ */
+export interface Hooks {
+  /**
+   * Commands to run prior to deploying the cdk stacks
+   * in the integration test
+   *
+   * @default - no commands
+   */
+  readonly preDeploy?: string[];
+
+  /**
+   * Commands to run prior after deploying the cdk stacks
+   * in the integration test
+   *
+   * @default - no commands
+   */
+  readonly postDeploy?: string[];
+
+  /**
+   * Commands to run prior to destroying the cdk stacks
+   * in the integration test
+   *
+   * @default - no commands
+   */
+  readonly preDestroy?: string[];
+
+  /**
+   * Commands to run after destroying the cdk stacks
+   * in the integration test
+   *
+   * @default - no commands
+   */
+  readonly postDestroy?: string[];
+}
+
+/**
+ * Represents a cdk command
+ * i.e. `synth`, `deploy`, & `destroy`
+ */
+export interface CdkCommand {
+  /**
+   * Whether or not to run this command as part of the workflow
+   * This can be used if you only want to test some of the workflow
+   * for example enable `synth` and disable `deploy` & `destroy` in order
+   * to limit the test to synthesis
+   *
+   * @default true
+   */
+  readonly enabled?: boolean;
+
+  /**
+   * If the runner should expect this command to fail
+   *
+   * @default false
+   */
+  readonly expectError?: boolean;
+
+  /**
+   * This can be used in combination with `expectedError`
+   * to validate that a specific message is returned.
+   *
+   * @default - do not validate message
+   */
+  readonly expectedMessage?: string;
+}
+
+/**
+ * Represents a cdk deploy command
+ */
+export interface DeployCommand extends CdkCommand {
+  /**
+   * Additional arguments to pass to the command
+   * This can be used to test specific CLI functionality
+   *
+   * @default - only default args are used
+   */
+  readonly args?: DeployOptions;
+}
+
+/**
+ * Represents a cdk destroy command
+ */
+export interface DestroyCommand extends CdkCommand {
+  /**
+   * Additional arguments to pass to the command
+   * This can be used to test specific CLI functionality
+   *
+   * @default - only default args are used
+   */
+  readonly args?: DestroyOptions;
+}
+
+/**
+ * Options for specific cdk commands that are run
+ * as part of the integration test workflow
+ */
+export interface CdkCommands {
+  /**
+   * Options to for the cdk deploy command
+   *
+   * @default - default deploy options
+   */
+  readonly deploy?: DeployCommand;
+
+  /**
+   * Options to for the cdk destroy command
+   *
+   * @default - default destroy options
+   */
+  readonly destroy?: DestroyCommand;
+}
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/manifest.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/manifest.ts
index d2ceb45685678..62f7894a54dd3 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/lib/manifest.ts
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/manifest.ts
@@ -3,6 +3,7 @@ import * as jsonschema from 'jsonschema';
 import * as semver from 'semver';
 import * as assets from './assets';
 import * as assembly from './cloud-assembly';
+import * as integ from './integ-tests';
 
 /* eslint-disable @typescript-eslint/no-var-requires */
 /* eslint-disable @typescript-eslint/no-require-imports */
@@ -21,6 +22,8 @@ const ASSEMBLY_SCHEMA = require('../schema/cloud-assembly.schema.json');
  */
 const SCHEMA_VERSION = require('../schema/cloud-assembly.version.json').version;
 
+const INTEG_SCHEMA = require('../schema/integ.schema.json');
+
 /**
  * Options for the loadManifest operation
  */
@@ -89,6 +92,25 @@ export class Manifest {
     return this.loadManifest(filePath, ASSETS_SCHEMA);
   }
 
+  /**
+   * Validates and saves the integ manifest to file.
+   *
+   * @param manifest - manifest.
+   * @param filePath - output file path.
+   */
+  public static saveIntegManifest(manifest: integ.IntegManifest, filePath: string) {
+    Manifest.saveManifest(manifest, filePath, INTEG_SCHEMA);
+  }
+
+  /**
+   * Load and validates the integ manifest from file.
+   *
+   * @param filePath - path to the manifest file.
+   */
+  public static loadIntegManifest(filePath: string): integ.IntegManifest {
+    return this.loadManifest(filePath, INTEG_SCHEMA);
+  }
+
   /**
    * Fetch the current schema version number.
    */
@@ -251,4 +273,4 @@ function noUndefined<A extends object>(xs: A): A {
 
 function stripEnumErrors(errors: jsonschema.ValidationError[]) {
   return errors.filter(e => typeof e.schema ==='string' || !('enum' in e.schema));
-}
\ No newline at end of file
+}
diff --git a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json
index ae7a33e962d0b..90bef2e09ad39 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json
+++ b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json
@@ -1 +1 @@
-{"version":"16.0.0"}
+{"version":"17.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/cloud-assembly-schema/schema/integ.schema.json b/packages/@aws-cdk/cloud-assembly-schema/schema/integ.schema.json
new file mode 100644
index 0000000000000..676c1bdab91dd
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/schema/integ.schema.json
@@ -0,0 +1,474 @@
+{
+    "$ref": "#/definitions/IntegManifest",
+    "definitions": {
+        "IntegManifest": {
+            "description": "Definitions for the integration testing manifest",
+            "type": "object",
+            "properties": {
+                "version": {
+                    "description": "Version of the manifest",
+                    "type": "string"
+                },
+                "enableLookups": {
+                    "description": "Enable lookups for this test. If lookups are enabled\nthen `stackUpdateWorkflow` must be set to false.\nLookups should only be enabled when you are explicitely testing\nlookups.",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "testCases": {
+                    "description": "test cases",
+                    "type": "object",
+                    "additionalProperties": {
+                        "$ref": "#/definitions/TestCase"
+                    }
+                }
+            },
+            "required": [
+                "testCases",
+                "version"
+            ]
+        },
+        "TestCase": {
+            "description": "Represents an integration test test case",
+            "type": "object",
+            "properties": {
+                "stacks": {
+                    "description": "Stacks that should be tested as part of this test case\nThe stackNames will be passed as args to the cdk commands\nso dependent stacks will be automatically deployed unless\n`exclusively` is passed",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "stackUpdateWorkflow": {
+                    "description": "Run update workflow on this test case\nThis should only be set to false to test scenarios\nthat are not possible to test as part of the update workflow (Default true)",
+                    "type": "boolean"
+                },
+                "cdkCommandOptions": {
+                    "description": "Additional options to use for each CDK command (Default - runner default options)",
+                    "$ref": "#/definitions/CdkCommands"
+                },
+                "hooks": {
+                    "description": "Additional commands to run at predefined points in the test workflow\n\ne.g. { postDeploy: ['yarn', 'test'] } (Default - no hooks)",
+                    "$ref": "#/definitions/Hooks"
+                },
+                "diffAssets": {
+                    "description": "Whether or not to include asset hashes in the diff\nAsset hashes can introduces a lot of unneccessary noise into tests,\nbut there are some cases where asset hashes _should_ be included. For example\nany tests involving custom resources or bundling",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "allowDestroy": {
+                    "description": "List of CloudFormation resource types in this stack that can\nbe destroyed as part of an update without failing the test.\n\nThis list should only include resources that for this specific\nintegration test we are sure will not cause errors or an outage if\ndestroyed. For example, maybe we know that a new resource will be created\nfirst before the old resource is destroyed which prevents any outage.\n\ne.g. ['AWS::IAM::Role'] (Default - do not allow destruction of any resources on update)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "regions": {
+                    "description": "Limit deployment to these regions (Default - can run in any region)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            },
+            "required": [
+                "stacks"
+            ]
+        },
+        "CdkCommands": {
+            "description": "Options for specific cdk commands that are run\nas part of the integration test workflow",
+            "type": "object",
+            "properties": {
+                "deploy": {
+                    "description": "Options to for the cdk deploy command (Default - default deploy options)",
+                    "$ref": "#/definitions/DeployCommand"
+                },
+                "destroy": {
+                    "description": "Options to for the cdk destroy command (Default - default destroy options)",
+                    "$ref": "#/definitions/DestroyCommand"
+                }
+            }
+        },
+        "DeployCommand": {
+            "description": "Represents a cdk deploy command",
+            "type": "object",
+            "properties": {
+                "args": {
+                    "description": "Additional arguments to pass to the command\nThis can be used to test specific CLI functionality (Default - only default args are used)",
+                    "$ref": "#/definitions/DeployOptions"
+                },
+                "enabled": {
+                    "description": "Whether or not to run this command as part of the workflow\nThis can be used if you only want to test some of the workflow\nfor example enable `synth` and disable `deploy` & `destroy` in order\nto limit the test to synthesis (Default true)",
+                    "type": "boolean"
+                },
+                "expectError": {
+                    "description": "If the runner should expect this command to fail",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "expectedMessage": {
+                    "description": "This can be used in combination with `expectedError`\nto validate that a specific message is returned. (Default - do not validate message)",
+                    "type": "string"
+                }
+            }
+        },
+        "DeployOptions": {
+            "description": "Options to use with cdk deploy",
+            "type": "object",
+            "properties": {
+                "exclusively": {
+                    "description": "Only perform action on the given stack",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "toolkitStackName": {
+                    "description": "Name of the toolkit stack to use/deploy (Default CDKToolkit)",
+                    "type": "string"
+                },
+                "reuseAssets": {
+                    "description": "Reuse the assets with the given asset IDs (Default - do not reuse assets)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "changeSetName": {
+                    "description": "Optional name to use for the CloudFormation change set.\nIf not provided, a name will be generated automatically. (Default - auto generate a name)",
+                    "type": "string"
+                },
+                "force": {
+                    "description": "Always deploy, even if templates are identical.",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "rollback": {
+                    "description": "Rollback failed deployments (Default true)",
+                    "type": "boolean"
+                },
+                "notificationArns": {
+                    "description": "ARNs of SNS topics that CloudFormation will notify with stack related events (Default - no notifications)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "requireApproval": {
+                    "description": "What kind of security changes require approval (Default RequireApproval.Never)",
+                    "enum": [
+                        "any-change",
+                        "broadening",
+                        "never"
+                    ],
+                    "type": "string"
+                },
+                "execute": {
+                    "description": "Whether to execute the ChangeSet\nNot providing `execute` parameter will result in execution of ChangeSet (Default true)",
+                    "type": "boolean"
+                },
+                "parameters": {
+                    "description": "Additional parameters for CloudFormation at deploy time (Default [object Object])",
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    }
+                },
+                "usePreviousParameters": {
+                    "description": "Use previous values for unspecified parameters\n\nIf not set, all parameters must be specified for every deployment. (Default true)",
+                    "type": "boolean"
+                },
+                "outputsFile": {
+                    "description": "Path to file where stack outputs will be written after a successful deploy as JSON (Default - Outputs are not written to any file)",
+                    "type": "string"
+                },
+                "ci": {
+                    "description": "Whether we are on a CI system",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "stacks": {
+                    "description": "List of stacks to deploy\n\nRequried if `all` is not set (Default - [])",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "all": {
+                    "description": "Deploy all stacks\n\nRequried if `stacks` is not set (Default - false)",
+                    "type": "boolean"
+                },
+                "app": {
+                    "description": "command-line for executing your app or a cloud assembly directory\ne.g. \"node bin/my-app.js\"\nor\n\"cdk.out\" (Default - read from cdk.json)",
+                    "type": "string"
+                },
+                "roleArn": {
+                    "description": "Role to pass to CloudFormation for deployment (Default - use the bootstrap cfn-exec role)",
+                    "type": "string"
+                },
+                "context": {
+                    "description": "Additional context (Default - no additional context)",
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    }
+                },
+                "trace": {
+                    "description": "Print trace for stack warnings",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "strict": {
+                    "description": "Do not construct stacks with warnings",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "lookups": {
+                    "description": "Perform context lookups.\n\nSynthesis fails if this is disabled and context lookups need\nto be performed (Default true)",
+                    "type": "boolean"
+                },
+                "ignoreErrors": {
+                    "description": "Ignores synthesis errors, which will likely produce an invalid output",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "json": {
+                    "description": "Use JSON output instead of YAML when templates are printed\nto STDOUT",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "verbose": {
+                    "description": "show debug logs",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "debug": {
+                    "description": "enable emission of additional debugging information, such as creation stack\ntraces of tokens",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "profile": {
+                    "description": "Use the indicated AWS profile as the default environment (Default - no profile is used)",
+                    "type": "string"
+                },
+                "proxy": {
+                    "description": "Use the indicated proxy. Will read from\nHTTPS_PROXY environment if specified (Default - no proxy)",
+                    "type": "string"
+                },
+                "caBundlePath": {
+                    "description": "Path to CA certificate to use when validating HTTPS\nrequests. (Default - read from AWS_CA_BUNDLE environment variable)",
+                    "type": "string"
+                },
+                "ec2Creds": {
+                    "description": "Force trying to fetch EC2 instance credentials (Default - guess EC2 instance status)",
+                    "type": "boolean"
+                },
+                "versionReporting": {
+                    "description": "Include \"AWS::CDK::Metadata\" resource in synthesized templates (Default true)",
+                    "type": "boolean"
+                },
+                "pathMetadata": {
+                    "description": "Include \"aws:cdk:path\" CloudFormation metadata for each resource (Default true)",
+                    "type": "boolean"
+                },
+                "assetMetadata": {
+                    "description": "Include \"aws:asset:*\" CloudFormation metadata for resources that use assets (Default true)",
+                    "type": "boolean"
+                },
+                "staging": {
+                    "description": "Copy assets to the output directory\n\nNeeded for local debugging the source files with SAM CLI",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "output": {
+                    "description": "Emits the synthesized cloud assembly into a directory (Default cdk.out)",
+                    "type": "string"
+                },
+                "notices": {
+                    "description": "Show relevant notices (Default true)",
+                    "type": "boolean"
+                },
+                "color": {
+                    "description": "Show colors and other style from console output (Default true)",
+                    "type": "boolean"
+                }
+            }
+        },
+        "DestroyCommand": {
+            "description": "Represents a cdk destroy command",
+            "type": "object",
+            "properties": {
+                "args": {
+                    "description": "Additional arguments to pass to the command\nThis can be used to test specific CLI functionality (Default - only default args are used)",
+                    "$ref": "#/definitions/DestroyOptions"
+                },
+                "enabled": {
+                    "description": "Whether or not to run this command as part of the workflow\nThis can be used if you only want to test some of the workflow\nfor example enable `synth` and disable `deploy` & `destroy` in order\nto limit the test to synthesis (Default true)",
+                    "type": "boolean"
+                },
+                "expectError": {
+                    "description": "If the runner should expect this command to fail",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "expectedMessage": {
+                    "description": "This can be used in combination with `expectedError`\nto validate that a specific message is returned. (Default - do not validate message)",
+                    "type": "string"
+                }
+            }
+        },
+        "DestroyOptions": {
+            "description": "Options to use with cdk destroy",
+            "type": "object",
+            "properties": {
+                "force": {
+                    "description": "Do not ask for permission before destroying stacks",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "exclusively": {
+                    "description": "Only destroy the given stack",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "stacks": {
+                    "description": "List of stacks to deploy\n\nRequried if `all` is not set (Default - [])",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "all": {
+                    "description": "Deploy all stacks\n\nRequried if `stacks` is not set (Default - false)",
+                    "type": "boolean"
+                },
+                "app": {
+                    "description": "command-line for executing your app or a cloud assembly directory\ne.g. \"node bin/my-app.js\"\nor\n\"cdk.out\" (Default - read from cdk.json)",
+                    "type": "string"
+                },
+                "roleArn": {
+                    "description": "Role to pass to CloudFormation for deployment (Default - use the bootstrap cfn-exec role)",
+                    "type": "string"
+                },
+                "context": {
+                    "description": "Additional context (Default - no additional context)",
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    }
+                },
+                "trace": {
+                    "description": "Print trace for stack warnings",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "strict": {
+                    "description": "Do not construct stacks with warnings",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "lookups": {
+                    "description": "Perform context lookups.\n\nSynthesis fails if this is disabled and context lookups need\nto be performed (Default true)",
+                    "type": "boolean"
+                },
+                "ignoreErrors": {
+                    "description": "Ignores synthesis errors, which will likely produce an invalid output",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "json": {
+                    "description": "Use JSON output instead of YAML when templates are printed\nto STDOUT",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "verbose": {
+                    "description": "show debug logs",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "debug": {
+                    "description": "enable emission of additional debugging information, such as creation stack\ntraces of tokens",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "profile": {
+                    "description": "Use the indicated AWS profile as the default environment (Default - no profile is used)",
+                    "type": "string"
+                },
+                "proxy": {
+                    "description": "Use the indicated proxy. Will read from\nHTTPS_PROXY environment if specified (Default - no proxy)",
+                    "type": "string"
+                },
+                "caBundlePath": {
+                    "description": "Path to CA certificate to use when validating HTTPS\nrequests. (Default - read from AWS_CA_BUNDLE environment variable)",
+                    "type": "string"
+                },
+                "ec2Creds": {
+                    "description": "Force trying to fetch EC2 instance credentials (Default - guess EC2 instance status)",
+                    "type": "boolean"
+                },
+                "versionReporting": {
+                    "description": "Include \"AWS::CDK::Metadata\" resource in synthesized templates (Default true)",
+                    "type": "boolean"
+                },
+                "pathMetadata": {
+                    "description": "Include \"aws:cdk:path\" CloudFormation metadata for each resource (Default true)",
+                    "type": "boolean"
+                },
+                "assetMetadata": {
+                    "description": "Include \"aws:asset:*\" CloudFormation metadata for resources that use assets (Default true)",
+                    "type": "boolean"
+                },
+                "staging": {
+                    "description": "Copy assets to the output directory\n\nNeeded for local debugging the source files with SAM CLI",
+                    "default": false,
+                    "type": "boolean"
+                },
+                "output": {
+                    "description": "Emits the synthesized cloud assembly into a directory (Default cdk.out)",
+                    "type": "string"
+                },
+                "notices": {
+                    "description": "Show relevant notices (Default true)",
+                    "type": "boolean"
+                },
+                "color": {
+                    "description": "Show colors and other style from console output (Default true)",
+                    "type": "boolean"
+                }
+            }
+        },
+        "Hooks": {
+            "description": "Commands to run at predefined points during the\nintegration test workflow",
+            "type": "object",
+            "properties": {
+                "preDeploy": {
+                    "description": "Commands to run prior to deploying the cdk stacks\nin the integration test (Default - no commands)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "postDeploy": {
+                    "description": "Commands to run prior after deploying the cdk stacks\nin the integration test (Default - no commands)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "preDestroy": {
+                    "description": "Commands to run prior to destroying the cdk stacks\nin the integration test (Default - no commands)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "postDestroy": {
+                    "description": "Commands to run after destroying the cdk stacks\nin the integration test (Default - no commands)",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            }
+        }
+    },
+    "$schema": "http://json-schema.org/draft-07/schema#"
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/cloud-assembly-schema/scripts/update-schema.ts b/packages/@aws-cdk/cloud-assembly-schema/scripts/update-schema.ts
index e92083d34b0a6..13a410cd4a36f 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/scripts/update-schema.ts
+++ b/packages/@aws-cdk/cloud-assembly-schema/scripts/update-schema.ts
@@ -17,6 +17,7 @@ const SCHEMA_DIR = path.resolve(__dirname, '../schema');
 const SCHEMA_DEFINITIONS: { [schemaName: string]: { rootTypeName: string } } = {
   'assets': { rootTypeName: 'AssetManifest' },
   'cloud-assembly': { rootTypeName: 'AssemblyManifest' },
+  'integ': { rootTypeName: 'IntegManifest' },
 };
 
 export const SCHEMAS = Object.keys(SCHEMA_DEFINITIONS);
diff --git a/packages/@aws-cdk/cloud-assembly-schema/test/integ-tests.test.ts b/packages/@aws-cdk/cloud-assembly-schema/test/integ-tests.test.ts
new file mode 100644
index 0000000000000..3baefc89d750f
--- /dev/null
+++ b/packages/@aws-cdk/cloud-assembly-schema/test/integ-tests.test.ts
@@ -0,0 +1,137 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { Manifest } from '../lib';
+
+describe('Integration test', () => {
+  test('valid input', () => {
+    expect(() => {
+      validate({
+        version: Manifest.version(),
+        testCases: {
+          testCase1: {
+            stacks: ['stack1', 'stack2'],
+            stackUpdateWorkflow: true,
+            cdkCommandOptions: {
+              deploy: {
+                enabled: true,
+                expectError: false,
+                expectedMessage: 'some message',
+                args: {
+                  exclusively: true,
+                  toolkitStackName: 'Stack',
+                  reuseAssets: ['asset1', 'asset2'],
+                  changeSetName: 'changeset',
+                  force: true,
+                  rollback: false,
+                  notificationArns: ['arn1', 'arn2'],
+                  execute: true,
+                  parameters: {
+                    'MYPARAM': 'Value',
+                    'Stack1:OtherParam': 'OtherValue',
+                  },
+                  usePreviousParameters: true,
+                  outputsFile: 'outputs.json',
+                  ci: true,
+                  requireApproval: 'never',
+                  app: 'node bin/my-app.js',
+                  roleArn: 'roleArn',
+                  context: {
+                    KEY: 'value',
+                  },
+                  trace: true,
+                  strict: true,
+                  lookups: true,
+                  ignoreErrors: true,
+                  json: true,
+                  verbose: true,
+                  debug: true,
+                  profile: 'profile',
+                  proxy: 'https://proxy',
+                  caBundlePath: 'path/to/bundle',
+                  ec2Creds: true,
+                  versionReporting: false,
+                  pathMetadata: false,
+                  assetMetadata: true,
+                  staging: false,
+                  output: true,
+                  notices: true,
+                  color: false,
+                },
+              },
+              synth: {
+                enabled: true,
+                expectError: false,
+                expectedMessage: 'some message',
+                args: {
+                  quiet: true,
+                  exclusively: true,
+                  validation: true,
+                },
+              },
+              destroy: {
+                enabled: true,
+                expectError: false,
+                expectedMessage: 'some message',
+                args: {
+                  force: true,
+                  exclusively: true,
+                },
+              },
+            },
+            hooks: {
+              preDeploy: ['yarn test'],
+              postDeploy: ['some other command'],
+              preDestroy: ['command1', 'command2'],
+              postDestroy: ['command3', 'command4'],
+            },
+            diffAssets: true,
+            allowDestroy: ['AWS::IAM::Role'],
+            region: ['us-east-1', 'us-east-2'],
+          },
+        },
+      });
+    });
+  });
+
+  test('invalid input', () => {
+    expect(() => {
+      validate({
+        version: Manifest.version(),
+        testCases: {
+          stacks: true,
+        },
+      });
+    }).toThrow(/instance\.testCases\.stacks is not of a type\(s\) object/);
+  });
+
+  test('without command options', () => {
+    expect(() => {
+      validate({
+        version: Manifest.version(),
+        testCases: {
+          testCase1: {
+            stacks: ['stack1', 'stack2'],
+            stackUpdateWorkflow: true,
+            hooks: {
+              preDeploy: ['yarn test'],
+            },
+            diffAssets: true,
+          },
+        },
+      });
+    });
+  });
+});
+
+function validate(manifest: any) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'integ.test.'));
+  const filePath = path.join(dir, 'manifest.json');
+  fs.writeFileSync(filePath, JSON.stringify(manifest, undefined, 2));
+  try {
+    Manifest.loadIntegManifest(filePath);
+  } finally {
+    fs.unlinkSync(filePath);
+    fs.rmdirSync(dir);
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/.eslintrc.js b/packages/@aws-cdk/integ-runner/.eslintrc.js
new file mode 100644
index 0000000000000..2658ee8727166
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/.eslintrc.js
@@ -0,0 +1,3 @@
+const baseConfig = require('@aws-cdk/cdk-build-tools/config/eslintrc');
+baseConfig.parserOptions.project = __dirname + '/tsconfig.json';
+module.exports = baseConfig;
diff --git a/packages/@aws-cdk/integ-runner/.gitignore b/packages/@aws-cdk/integ-runner/.gitignore
new file mode 100644
index 0000000000000..d24092a6feda2
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/.gitignore
@@ -0,0 +1,28 @@
+*.js
+*.js.map
+*.d.ts
+!lib/init-templates/**/javascript/**/*
+node_modules
+dist
+
+# Generated by generate.sh
+build-info.json
+
+.LAST_BUILD
+.nyc_output
+coverage
+nyc.config.js
+.LAST_PACKAGE
+*.snk
+
+!test/integ/run-wrappers/dist
+!test/integ/cli/**/*
+assets.json
+npm-shrinkwrap.json
+!.eslintrc.js
+!jest.config.js
+
+junit.xml
+
+# Ignore this symlink, we recreate it at test time
+test/test-archive-follow/data/linked
diff --git a/packages/@aws-cdk/integ-runner/.npmignore b/packages/@aws-cdk/integ-runner/.npmignore
new file mode 100644
index 0000000000000..45b8808bdd7ac
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/.npmignore
@@ -0,0 +1,30 @@
+# Don't include original .ts files when doing `npm pack`
+*.ts
+!*.template.ts
+!*.d.ts
+coverage
+.nyc_output
+*.tgz
+
+dist
+.LAST_PACKAGE
+.LAST_BUILD
+*.snk
+
+!lib/init-templates/*/*/tsconfig.json
+!test/integ/cli/**/*.js
+!test/integ/run-wrappers/dist
+
+*.tsbuildinfo
+
+tsconfig.json
+
+# init templates include default tsconfig.json files which we need
+!lib/init-templates/**/tsconfig.json
+.eslintrc.js
+jest.config.js
+
+# exclude cdk artifacts
+**/cdk.out
+junit.xml
+test/
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/LICENSE b/packages/@aws-cdk/integ-runner/LICENSE
new file mode 100644
index 0000000000000..82ad00bb02d0b
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2018-2022 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/packages/@aws-cdk/integ-runner/NOTICE b/packages/@aws-cdk/integ-runner/NOTICE
new file mode 100644
index 0000000000000..1b7adbb891265
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/NOTICE
@@ -0,0 +1,2 @@
+AWS Cloud Development Kit (AWS CDK)
+Copyright 2018-2022 Amazon.com, Inc. or its affiliates. All Rights Reserved.
diff --git a/packages/@aws-cdk/integ-runner/README.md b/packages/@aws-cdk/integ-runner/README.md
new file mode 100644
index 0000000000000..e67a64282a42b
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/README.md
@@ -0,0 +1,161 @@
+# integ-runner
+
+<!--BEGIN STABILITY BANNER-->
+
+---
+
+![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)
+
+> The APIs of higher level constructs in this module are experimental and under active development.
+> They are subject to non-backward compatible changes or removal in any future version. These are
+> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
+> announced in the release notes. This means that while you may use them, you may need to update
+> your source code when upgrading to a newer version of this package.
+
+---
+
+<!--END STABILITY BANNER-->
+
+
+## Overview
+
+
+## Usage
+
+- Run all integration tests in `test` directory
+
+```bash
+integ-runner [ARGS] [TEST...]
+```
+
+This will look for all files that match the naming convention of `/integ.*.ts$/`. Each of these files will be expected
+to be a self contained CDK app. The runner will execute the following for each file (app):
+
+1. Check if a snapshot file exists (i.e. `/integ.*.expected.snapshot$/`)
+2. If the snapshot does not exist
+	2a. Synth the integ app which will produce the `integ.json` file
+3. Read the `integ.json` file which contains instructions on what the runner should do.
+4. Execute instructions
+
+### Options
+
+- `--update-on-failed` (default=false)
+  Rerun integration tests if snapshot fails
+- `--clean` (default=`true`)
+  Destroy stacks after deploy (use `--no-clean` for debugging)
+- `--verbose` (default=`false`)
+  verbose logging
+- `--parallel` (default=`false`)
+  Run tests in parallel across default regions
+- `--parallel-regions`
+  List of regions to run tests in. If this is provided then all tests will
+  be run in parallel across these regions
+- `--directory` (default=`test`)
+  Search for integration tests recursively from this starting directory
+- `--force` (default=`false`)
+  Rerun integration test even if the test passes
+- `--file`
+  Read the list of tests from this file
+
+Example:
+
+```bash
+integ-runner --update --parallel --parallel-regions us-east-1 --parallel-regions us-east-2 --parallel-regions us-west-2 --directory ./
+```
+
+This will search for integration tests recursively from the current directory and then execute them in parallel across `us-east-1`, `us-east-2`, & `us-west-2`.
+
+### integ.json schema
+
+See [@aws-cdk/cloud-assembly-schema/lib/integ-tests/schema.ts](../cloud-assembly-schema/lib/integ-tests/schema.ts)
+
+### defining an integration test
+
+In most cases an integration test will be an instance of a stack
+
+```ts
+import { Function, FunctionOptions } from '../lib';
+
+interface MyIntegTestProps extends StackOptions {
+  functionProps?: FunctionOptions;
+}
+class MyIntegTest extends Stack {
+  constructor(scope: Construct, id: string, props: MyIntegTestProps) {
+    super(scope, id, props);
+	
+	new Function(this, 'Handler', {
+	  runtime: Runtime.NODEJS_12_X,
+	  handler: 'index.handler',
+	  code: Code.fromAsset(path.join(__dirname, 'lambda-handler')),
+	  ...props.functionProps,
+	});
+  }
+}
+```
+
+You would then use the `IntegTest` construct to create your test cases
+
+```ts
+new IntegTeset(app, 'ArmTest', {
+  stacks: [
+    new MyIntegTest(app, 'Stack1', {
+	  functionProps: {
+	    architecture: lambda.Architecture.ARM_64,
+	  },
+	}),
+  ],
+  diffAssets: true,
+  update: true,
+  cdkCommandOptions: {
+    deploy: {
+	  args: {
+	    requireApproval: RequireApproval.NEVER,
+		json: true,
+	  },
+	},
+	destroy: {
+	  args: {
+	    force: true,
+	  },
+	},
+  },
+});
+
+new IntegTeset(app, 'AmdTest', {
+  stacks: [
+    new MyIntegTest(app, 'Stack2', {
+	  functionProps: {
+	    architecture: lambda.Architecture.X86_64,
+	  },
+	}),
+  ],
+});
+```
+
+This will synthesize an `integ.json` file with the following contents
+
+```json
+{
+  "ArmTest": {
+    "stacks": ["Stack1"],
+	"diffAssets": true,
+	"update": true,
+	"cdkCommands": {
+	  "deploy": {
+	    "args": {
+		  "requireApproval": "never",
+		  "json": true
+		}
+	  },
+	  "destroy": {
+	    "args": {
+		  "force": true
+		}
+	  }
+	}
+  },
+  "AmdTest": {
+    "stacks": ["Stack2"]
+  }
+}
+```
diff --git a/packages/@aws-cdk/integ-runner/THIRD_PARTY_LICENSES b/packages/@aws-cdk/integ-runner/THIRD_PARTY_LICENSES
new file mode 100644
index 0000000000000..72508e4743434
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/THIRD_PARTY_LICENSES
@@ -0,0 +1,902 @@
+The @aws-cdk/integ-runner package includes the following third-party software/licensing:
+
+** ajv@8.11.0 - https://www.npmjs.com/package/ajv/v/8.11.0 | MIT
+The MIT License (MIT)
+
+Copyright (c) 2015-2021 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+
+----------------
+
+** ansi-regex@5.0.1 - https://www.npmjs.com/package/ansi-regex/v/5.0.1 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** ansi-styles@4.3.0 - https://www.npmjs.com/package/ansi-styles/v/4.3.0 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** astral-regex@2.0.0 - https://www.npmjs.com/package/astral-regex/v/2.0.0 | MIT
+MIT License
+
+Copyright (c) Kevin Mårtensson <kevinmartensson@gmail.com> (github.com/kevva)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** at-least-node@1.0.0 - https://www.npmjs.com/package/at-least-node/v/1.0.0 | ISC
+The ISC License
+Copyright (c) 2020 Ryan Zimmerman <opensrc@ryanzim.com>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+----------------
+
+** chalk@4.1.2 - https://www.npmjs.com/package/chalk/v/4.1.2 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** cliui@7.0.4 - https://www.npmjs.com/package/cliui/v/7.0.4 | ISC
+Copyright (c) 2015, Contributors
+
+Permission to use, copy, modify, and/or distribute this software
+for any purpose with or without fee is hereby granted, provided
+that the above copyright notice and this permission notice
+appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE
+LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+----------------
+
+** color-convert@2.0.1 - https://www.npmjs.com/package/color-convert/v/2.0.1 | MIT
+Copyright (c) 2011-2016 Heather Arthur <fayearthur@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+
+----------------
+
+** color-name@1.1.4 - https://www.npmjs.com/package/color-name/v/1.1.4 | MIT
+The MIT License (MIT)
+Copyright (c) 2015 Dmitry Ivanov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+----------------
+
+** diff@5.0.0 - https://www.npmjs.com/package/diff/v/5.0.0 | BSD-3-Clause
+Software License Agreement (BSD License)
+
+Copyright (c) 2009-2015, Kevin Decker <kpdecker@gmail.com>
+
+All rights reserved.
+
+Redistribution and use of this software in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above
+  copyright notice, this list of conditions and the
+  following disclaimer.
+
+* Redistributions in binary form must reproduce the above
+  copyright notice, this list of conditions and the
+  following disclaimer in the documentation and/or other
+  materials provided with the distribution.
+
+* Neither the name of Kevin Decker nor the names of its
+  contributors may be used to endorse or promote products
+  derived from this software without specific prior
+  written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+----------------
+
+** emoji-regex@8.0.0 - https://www.npmjs.com/package/emoji-regex/v/8.0.0 | MIT
+Copyright Mathias Bynens <https://mathiasbynens.be/>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** escalade@3.1.1 - https://www.npmjs.com/package/escalade/v/3.1.1 | MIT
+MIT License
+
+Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** fast-deep-equal@3.1.3 - https://www.npmjs.com/package/fast-deep-equal/v/3.1.3 | MIT
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+----------------
+
+** fs-extra@9.1.0 - https://www.npmjs.com/package/fs-extra/v/9.1.0 | MIT
+(The MIT License)
+
+Copyright (c) 2011-2017 JP Richardson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files
+(the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify,
+ merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
+OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** get-caller-file@2.0.5 - https://www.npmjs.com/package/get-caller-file/v/2.0.5 | ISC
+
+----------------
+
+** graceful-fs@4.2.9 - https://www.npmjs.com/package/graceful-fs/v/4.2.9 | ISC
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter, Ben Noordhuis, and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+----------------
+
+** has-flag@4.0.0 - https://www.npmjs.com/package/has-flag/v/4.0.0 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** is-fullwidth-code-point@3.0.0 - https://www.npmjs.com/package/is-fullwidth-code-point/v/3.0.0 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** jsonfile@6.1.0 - https://www.npmjs.com/package/jsonfile/v/6.1.0 | MIT
+(The MIT License)
+
+Copyright (c) 2012-2015, JP Richardson <jprichardson@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files
+(the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify,
+ merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
+OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** jsonschema@1.4.0 - https://www.npmjs.com/package/jsonschema/v/1.4.0 | MIT
+jsonschema is licensed under MIT license.
+
+Copyright (C) 2012-2015 Tom de Grunt <tom@degrunt.nl>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+----------------
+
+** lodash.truncate@4.4.2 - https://www.npmjs.com/package/lodash.truncate/v/4.4.2 | MIT
+Copyright jQuery Foundation and other contributors <https://jquery.org/>
+
+Based on Underscore.js, copyright Jeremy Ashkenas,
+DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>
+
+This software consists of voluntary contributions made by many
+individuals. For exact contribution history, see the revision history
+available at https://github.com/lodash/lodash
+
+The following license applies to all parts of this software except as
+documented below:
+
+====
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+====
+
+Copyright and related rights for sample code are waived via CC0. Sample
+code is defined as all source code displayed within the prose of the
+documentation.
+
+CC0: http://creativecommons.org/publicdomain/zero/1.0/
+
+====
+
+Files located in the node_modules and vendor directories are externally
+maintained libraries used by this software which have their own
+licenses; we recommend you read them, as their terms may differ from the
+terms above.
+
+
+----------------
+
+** lru-cache@6.0.0 - https://www.npmjs.com/package/lru-cache/v/6.0.0 | ISC
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+----------------
+
+** require-directory@2.1.1 - https://www.npmjs.com/package/require-directory/v/2.1.1 | MIT
+The MIT License (MIT)
+
+Copyright (c) 2011 Troy Goode <troygoode@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** semver@7.3.5 - https://www.npmjs.com/package/semver/v/7.3.5 | ISC
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+----------------
+
+** slice-ansi@4.0.0 - https://www.npmjs.com/package/slice-ansi/v/4.0.0 | MIT
+MIT License
+
+Copyright (c) DC <threedeecee@gmail.com>
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** string-width@4.2.3 - https://www.npmjs.com/package/string-width/v/4.2.3 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** strip-ansi@6.0.1 - https://www.npmjs.com/package/strip-ansi/v/6.0.1 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** supports-color@7.2.0 - https://www.npmjs.com/package/supports-color/v/7.2.0 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** table@6.8.0 - https://www.npmjs.com/package/table/v/6.8.0 | BSD-3-Clause
+Copyright (c) 2018, Gajus Kuizinas (http://gajus.com/)
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the Gajus Kuizinas (http://gajus.com/) nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL ANUARY BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+----------------
+
+** universalify@2.0.0 - https://www.npmjs.com/package/universalify/v/2.0.0 | MIT
+(The MIT License)
+
+Copyright (c) 2017, Ryan Zimmerman <opensrc@ryanzim.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the 'Software'), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** workerpool@6.2.0 - https://www.npmjs.com/package/workerpool/v/6.2.0 | Apache-2.0
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+----------------
+
+** wrap-ansi@7.0.0 - https://www.npmjs.com/package/wrap-ansi/v/7.0.0 | MIT
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+----------------
+
+** y18n@5.0.8 - https://www.npmjs.com/package/y18n/v/5.0.8 | ISC
+Copyright (c) 2015, Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+
+
+----------------
+
+** yallist@4.0.0 - https://www.npmjs.com/package/yallist/v/4.0.0 | ISC
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+----------------
+
+** yargs-parser@20.2.9 - https://www.npmjs.com/package/yargs-parser/v/20.2.9 | ISC
+Copyright (c) 2016, Contributors
+
+Permission to use, copy, modify, and/or distribute this software
+for any purpose with or without fee is hereby granted, provided
+that the above copyright notice and this permission notice
+appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE
+LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+----------------
+
+** yargs@16.2.0 - https://www.npmjs.com/package/yargs/v/16.2.0 | MIT
+MIT License
+
+Copyright 2010 James Halliday (mail@substack.net); Modified work Copyright 2014 Contributors (ben@npmjs.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+
+----------------
diff --git a/packages/@aws-cdk/integ-runner/bin/integ-runner b/packages/@aws-cdk/integ-runner/bin/integ-runner
new file mode 100755
index 0000000000000..20ace56b80449
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/bin/integ-runner
@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+require('./integ-runner.js');
diff --git a/packages/@aws-cdk/integ-runner/bin/integ-runner.ts b/packages/@aws-cdk/integ-runner/bin/integ-runner.ts
new file mode 100644
index 0000000000000..4f2652b107236
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/bin/integ-runner.ts
@@ -0,0 +1,3 @@
+import { cli } from '../lib';
+
+cli();
diff --git a/packages/@aws-cdk/integ-runner/jest.config.js b/packages/@aws-cdk/integ-runner/jest.config.js
new file mode 100644
index 0000000000000..d052cbb29f05d
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/jest.config.js
@@ -0,0 +1,10 @@
+const baseConfig = require('@aws-cdk/cdk-build-tools/config/jest.config');
+module.exports = {
+    ...baseConfig,
+    coverageThreshold: {
+        global: {
+            ...baseConfig.coverageThreshold.global,
+            branches: 60,
+        },
+    },
+};
diff --git a/packages/@aws-cdk/integ-runner/lib/cli.ts b/packages/@aws-cdk/integ-runner/lib/cli.ts
new file mode 100644
index 0000000000000..9174946f8da75
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/cli.ts
@@ -0,0 +1,106 @@
+// Exercise all integ stacks and if they deploy, update the expected synth files
+import * as os from 'os';
+import * as path from 'path';
+import * as workerpool from 'workerpool';
+import * as logger from './logger';
+import { IntegrationTests, IntegTestConfig } from './runner/integ-tests';
+import { runSnapshotTests, runIntegrationTests } from './workers';
+
+// https://github.com/yargs/yargs/issues/1929
+// https://github.com/evanw/esbuild/issues/1492
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const yargs = require('yargs');
+
+
+async function main() {
+  const argv = yargs
+    .usage('Usage: integ-runner [TEST...]')
+    .option('list', { type: 'boolean', default: false, desc: 'List tests instead of running them' })
+    .option('clean', { type: 'boolean', default: true, desc: 'Skips stack clean up after test is completed (use --no-clean to negate)' })
+    .option('verbose', { type: 'boolean', default: false, alias: 'v', desc: 'Verbose logs' })
+    .option('dry-run', { type: 'boolean', default: false, desc: 'do not actually deploy the stack. just update the snapshot (not recommended!)' })
+    .option('update-on-failed', { type: 'boolean', default: false, desc: 'rerun integration tests and update snapshots for failed tests.' })
+    .option('force', { type: 'boolean', default: false, desc: 'Rerun all integration tests even if tests are passing' })
+    .option('parallel', { type: 'boolean', default: false, desc: 'run integration tests in parallel' })
+    .option('parallel-regions', { type: 'array', desc: 'if --parallel is used then these regions are used to run tests in parallel', nargs: 1, default: [] })
+    .options('directory', { type: 'string', default: 'test', desc: 'starting directory to discover integration tests' })
+    .argv;
+
+  // Cap to a reasonable top-level limit to prevent thrash on machines with many, many cores.
+  const maxWorkers = parseInt(process.env.CDK_INTEG_MAX_WORKER_COUNT ?? '16');
+  const N = Math.min(maxWorkers, Math.max(1, Math.ceil(os.cpus().length / 2)));
+  const pool = workerpool.pool(path.join(__dirname, '../lib/workers/extract/index.js'), {
+    maxWorkers: N,
+  });
+
+  // list of integration tests that will be executed
+  const testsToRun: IntegTestConfig[] = [];
+  const testsFromArgs: IntegTestConfig[] = [];
+  const parallelRegions = arrayFromYargs(argv['parallel-regions']);
+  const testRegions: string[] = parallelRegions ?? ['us-east-1', 'us-east-2', 'us-west-2'];
+  const runUpdateOnFailed = argv['update-on-failed'] ?? false;
+  try {
+
+    if (argv.list) {
+      const tests = await new IntegrationTests(argv.directory).fromCliArgs();
+      process.stdout.write(tests.map(t => t.fileName).join('\n') + '\n');
+      return;
+    }
+
+    if (argv._.length === 0) {
+      testsFromArgs.push(...(await new IntegrationTests(argv.directory).fromCliArgs()));
+    } else {
+      testsFromArgs.push(...(await new IntegrationTests(argv.directory).fromCliArgs(argv._.map((x: any) => x.toString()))));
+    }
+
+    // If `--force` is not used then first validate the snapshots and gather
+    // the failed snapshot tests. If `--force` is used then we will skip snapshot
+    // tests and run integration tests for all tests
+    if (!argv.force) {
+      const failedSnapshots = await runSnapshotTests(pool, testsFromArgs);
+      testsToRun.push(...failedSnapshots);
+    } else {
+      testsToRun.push(...testsFromArgs);
+    }
+
+
+    // run integration tests if `--update-on-failed` OR `--force` is used
+    if (runUpdateOnFailed || argv.force) {
+      await runIntegrationTests({
+        pool,
+        tests: testsToRun,
+        regions: testRegions,
+        clean: argv.clean,
+        dryRun: argv['dry-run'],
+        verbose: argv.verbose,
+      });
+
+      if (argv.clean === false) {
+        logger.warning('Not cleaning up stacks since "--no-clean" was used');
+      }
+    }
+  } finally {
+    void pool.terminate();
+  }
+}
+
+/**
+ * Translate a Yargs input array to something that makes more sense in a programming language
+ * model (telling the difference between absence and an empty array)
+ *
+ * - An empty array is the default case, meaning the user didn't pass any arguments. We return
+ *   undefined.
+ * - If the user passed a single empty string, they did something like `--array=`, which we'll
+ *   take to mean they passed an empty array.
+ */
+function arrayFromYargs(xs: string[]): string[] | undefined {
+  if (xs.length === 0) { return undefined; }
+  return xs.filter(x => x !== '');
+}
+
+export function cli() {
+  main().then().catch(err => {
+    logger.error(err);
+    process.exitCode = 1;
+  });
+}
diff --git a/packages/@aws-cdk/integ-runner/lib/index.ts b/packages/@aws-cdk/integ-runner/lib/index.ts
new file mode 100644
index 0000000000000..e8523067d0351
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/index.ts
@@ -0,0 +1 @@
+export { cli } from './cli';
diff --git a/packages/@aws-cdk/integ-runner/lib/logger.ts b/packages/@aws-cdk/integ-runner/lib/logger.ts
new file mode 100644
index 0000000000000..55c7f80b24365
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/logger.ts
@@ -0,0 +1,20 @@
+import { Writable } from 'stream';
+import * as util from 'util';
+import * as chalk from 'chalk';
+
+type StyleFn = (str: string) => string;
+const { stderr } = process;
+
+const logger = (stream: Writable, styles?: StyleFn[]) => (fmt: string, ...args: any[]) => {
+  let str = util.format(fmt, ...args);
+  if (styles && styles.length) {
+    str = styles.reduce((a, style) => style(a), str);
+  }
+  stream.write(str + '\n');
+};
+
+export const print = logger(stderr);
+export const error = logger(stderr, [chalk.red]);
+export const warning = logger(stderr, [chalk.yellow]);
+export const success = logger(stderr, [chalk.green]);
+export const highlight = logger(stderr, [chalk.bold]);
diff --git a/packages/@aws-cdk/integ-runner/lib/runner/index.ts b/packages/@aws-cdk/integ-runner/lib/runner/index.ts
new file mode 100644
index 0000000000000..02b61b3dfe184
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/runner/index.ts
@@ -0,0 +1,2 @@
+export * from './runners';
+export * from './integ-tests';
diff --git a/packages/@aws-cdk/integ-runner/lib/runner/integ-tests.ts b/packages/@aws-cdk/integ-runner/lib/runner/integ-tests.ts
new file mode 100644
index 0000000000000..0fd648c31c5d1
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/runner/integ-tests.ts
@@ -0,0 +1,76 @@
+import * as path from 'path';
+import * as fs from 'fs-extra';
+
+/**
+ * Represents a single integration test
+ */
+export interface IntegTestConfig {
+  readonly directory: string;
+  readonly fileName: string;
+}
+
+/**
+ * Discover integration tests
+ */
+export class IntegrationTests {
+  constructor(private readonly directory: string) {
+  }
+
+  /**
+   * Takes an optional list of tests to look for, otherwise
+   * it will look for all tests from the directory
+   */
+  public async fromCliArgs(tests?: string[]): Promise<IntegTestConfig[]> {
+    let allTests = await this.discover();
+    const all = allTests.map(x => x.fileName);
+    let foundAll = true;
+
+    if (tests && tests.length > 0) {
+      // Pare down found tests to filter
+      allTests = allTests.filter(t => {
+        const parts = path.parse(t.fileName);
+        return (tests.includes(t.fileName) || tests.includes(parts.base));
+      });
+
+      const selectedNames = allTests.map(t => path.parse(t.fileName).base);
+      for (const unmatched of tests.filter(t => !selectedNames.includes(t))) {
+        process.stderr.write(`No such integ test: ${unmatched}\n`);
+        foundAll = false;
+      }
+    }
+
+    if (!foundAll) {
+      process.stderr.write(`Available tests: ${all.join(' ')}\n`);
+      return [];
+    }
+
+    return allTests;
+  }
+
+  private async discover(): Promise<IntegTestConfig[]> {
+    const files = await this.readTree();
+    const integs = files.filter(fileName => path.basename(fileName).startsWith('integ.') && path.basename(fileName).endsWith('.js'));
+    return this.request(integs);
+  }
+
+  private request(files: string[]): IntegTestConfig[] {
+    return files.map(fileName => { return { directory: this.directory, fileName }; });
+  }
+
+  private async readTree(): Promise<string[]> {
+    const ret = new Array<string>();
+
+    async function recurse(dir: string) {
+      const files = await fs.readdir(dir);
+      for (const file of files) {
+        const fullPath = path.join(dir, file);
+        const statf = await fs.stat(fullPath);
+        if (statf.isFile()) { ret.push(fullPath); }
+        if (statf.isDirectory()) { await recurse(path.join(fullPath)); }
+      }
+    }
+
+    await recurse(this.directory);
+    return ret;
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/lib/runner/private/canonicalize-assets.ts b/packages/@aws-cdk/integ-runner/lib/runner/private/canonicalize-assets.ts
new file mode 100644
index 0000000000000..9cee3d4742b3c
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/runner/private/canonicalize-assets.ts
@@ -0,0 +1,71 @@
+/**
+ * Reduce template to a normal form where asset references have been normalized
+ *
+ * This makes it possible to compare templates if all that's different between
+ * them is the hashes of the asset values.
+ *
+ * Currently only handles parameterized assets, but can (and should)
+ * be adapted to handle convention-mode assets as well when we start using
+ * more of those.
+ */
+export function canonicalizeTemplate(template: any): any {
+  // For the weird case where we have an array of templates...
+  if (Array.isArray(template)) {
+    return template.map(canonicalizeTemplate);
+  }
+
+  // Find assets via parameters
+  const stringSubstitutions = new Array<[RegExp, string]>();
+  const paramRe = /^AssetParameters([a-zA-Z0-9]{64})(S3Bucket|S3VersionKey|ArtifactHash)([a-zA-Z0-9]{8})$/;
+
+  const assetsSeen = new Set<string>();
+  for (const paramName of Object.keys(template?.Parameters || {})) {
+    const m = paramRe.exec(paramName);
+    if (!m) { continue; }
+    if (assetsSeen.has(m[1])) { continue; }
+
+    assetsSeen.add(m[1]);
+    const ix = assetsSeen.size;
+
+    // Full parameter reference
+    stringSubstitutions.push([
+      new RegExp(`AssetParameters${m[1]}(S3Bucket|S3VersionKey|ArtifactHash)([a-zA-Z0-9]{8})`),
+      `Asset${ix}$1`,
+    ]);
+    // Substring asset hash reference
+    stringSubstitutions.push([
+      new RegExp(`${m[1]}`),
+      `Asset${ix}Hash`,
+    ]);
+  }
+
+  // Substitute them out
+  return substitute(template);
+
+  function substitute(what: any): any {
+    if (Array.isArray(what)) {
+      return what.map(substitute);
+    }
+
+    if (typeof what === 'object' && what !== null) {
+      const ret: any = {};
+      for (const [k, v] of Object.entries(what)) {
+        ret[stringSub(k)] = substitute(v);
+      }
+      return ret;
+    }
+
+    if (typeof what === 'string') {
+      return stringSub(what);
+    }
+
+    return what;
+  }
+
+  function stringSub(x: string) {
+    for (const [re, replacement] of stringSubstitutions) {
+      x = x.replace(re, replacement);
+    }
+    return x;
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/lib/runner/private/cloud-assembly.ts b/packages/@aws-cdk/integ-runner/lib/runner/private/cloud-assembly.ts
new file mode 100644
index 0000000000000..99626ea53bdb2
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/runner/private/cloud-assembly.ts
@@ -0,0 +1,66 @@
+import * as path from 'path';
+import { AssemblyManifest, Manifest, ArtifactType, AwsCloudFormationStackProperties } from '@aws-cdk/cloud-assembly-schema';
+import * as fs from 'fs-extra';
+
+/**
+ * Reads a Cloud Assembly manifest
+ */
+export class AssemblyManifestReader {
+  public static readonly DEFAULT_FILENAME = 'manifest.json';
+
+  /**
+   * Reads a Cloud Assembly manifest from a file
+   */
+  public static fromFile(fileName: string): AssemblyManifestReader {
+    try {
+      const obj = Manifest.loadAssemblyManifest(fileName);
+      return new AssemblyManifestReader(path.dirname(fileName), obj);
+
+    } catch (e) {
+      throw new Error(`Cannot read integ manifest '${fileName}': ${e.message}`);
+    }
+  }
+
+  /**
+   * Reads a Cloud Assembly manifest from a file or a directory
+   * If the given filePath is a directory then it will look for
+   * a file within the directory with the DEFAULT_FILENAME
+   */
+  public static fromPath(filePath: string): AssemblyManifestReader {
+    let st;
+    try {
+      st = fs.statSync(filePath);
+    } catch (e) {
+      throw new Error(`Cannot read integ manifest at '${filePath}': ${e.message}`);
+    }
+    if (st.isDirectory()) {
+      return AssemblyManifestReader.fromFile(path.join(filePath, AssemblyManifestReader.DEFAULT_FILENAME));
+    }
+    return AssemblyManifestReader.fromFile(filePath);
+  }
+
+  /**
+   * The directory where the manifest was found
+   */
+  public readonly directory: string;
+
+  constructor(directory: string, private readonly manifest: AssemblyManifest) {
+    this.directory = directory;
+  }
+
+  /**
+   * Get the stacks from the manifest
+   * returns a map of artifactId to CloudFormation template
+   */
+  public get stacks(): Record<string, any> {
+    const stacks: Record<string, any> = {};
+    for (const [artifactId, artifact] of Object.entries(this.manifest.artifacts ?? {})) {
+      if (artifact.type !== ArtifactType.AWS_CLOUDFORMATION_STACK) { continue; }
+      const props = artifact.properties as AwsCloudFormationStackProperties;
+
+      const template = fs.readJSONSync(path.resolve(this.directory, props.templateFile));
+      stacks[artifactId] = template;
+    }
+    return stacks;
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/lib/runner/private/integ-manifest.ts b/packages/@aws-cdk/integ-runner/lib/runner/private/integ-manifest.ts
new file mode 100644
index 0000000000000..80b567dbb69ce
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/runner/private/integ-manifest.ts
@@ -0,0 +1,76 @@
+import * as path from 'path';
+import { IntegManifest, Manifest, TestCase } from '@aws-cdk/cloud-assembly-schema';
+import * as fs from 'fs-extra';
+
+/**
+ * Test case configuration read from the integ manifest
+ */
+export interface IntegTestConfig {
+  /**
+   * Test cases contained in this integration test
+   */
+  readonly testCases: { [testCaseName: string]: TestCase };
+
+  /**
+   * Whether to enable lookups for this test
+   *
+   * @default false
+   */
+  readonly enableLookups: boolean;
+}
+
+/**
+ * Reads an integration tests manifest
+ */
+export class IntegManifestReader {
+  public static readonly DEFAULT_FILENAME = 'integ.json';
+
+  /**
+   * Reads an integration test manifest from the specified file
+   */
+  public static fromFile(fileName: string): IntegManifestReader {
+    try {
+      const obj = Manifest.loadIntegManifest(fileName);
+      return new IntegManifestReader(path.dirname(fileName), obj);
+
+    } catch (e) {
+      throw new Error(`Cannot read integ manifest '${fileName}': ${e.message}`);
+    }
+  }
+
+  /**
+   * Reads a Integration test manifest from a file or a directory
+   * If the given filePath is a directory then it will look for
+   * a file within the directory with the DEFAULT_FILENAME
+   */
+  public static fromPath(filePath: string): IntegManifestReader {
+    let st;
+    try {
+      st = fs.statSync(filePath);
+    } catch (e) {
+      throw new Error(`Cannot read integ manifest at '${filePath}': ${e.message}`);
+    }
+    if (st.isDirectory()) {
+      return IntegManifestReader.fromFile(path.join(filePath, IntegManifestReader.DEFAULT_FILENAME));
+    }
+    return IntegManifestReader.fromFile(filePath);
+  }
+
+  /**
+   * The directory where the manifest was found
+   */
+  public readonly directory: string;
+  constructor(directory: string, private readonly manifest: IntegManifest) {
+    this.directory = directory;
+  }
+
+  /**
+   * List of integration tests in the manifest
+   */
+  public get tests(): IntegTestConfig {
+    return {
+      testCases: this.manifest.testCases,
+      enableLookups: this.manifest.enableLookups ?? false,
+    };
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/lib/runner/runners.ts b/packages/@aws-cdk/integ-runner/lib/runner/runners.ts
new file mode 100644
index 0000000000000..90327a82da7b0
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/runner/runners.ts
@@ -0,0 +1,607 @@
+import * as path from 'path';
+import { Writable, WritableOptions } from 'stream';
+import { StringDecoder, NodeStringDecoder } from 'string_decoder';
+import { TestCase, RequireApproval, DefaultCdkOptions } from '@aws-cdk/cloud-assembly-schema';
+import { diffTemplate, formatDifferences } from '@aws-cdk/cloudformation-diff';
+import { AVAILABILITY_ZONE_FALLBACK_CONTEXT_KEY, FUTURE_FLAGS, TARGET_PARTITIONS } from '@aws-cdk/cx-api';
+import { CdkCliWrapper, ICdk } from 'cdk-cli-wrapper';
+import * as fs from 'fs-extra';
+import { Diagnostic, DiagnosticReason } from '../workers/common';
+import { canonicalizeTemplate } from './private/canonicalize-assets';
+import { AssemblyManifestReader } from './private/cloud-assembly';
+import { IntegManifestReader } from './private/integ-manifest';
+
+const CDK_OUTDIR_PREFIX = 'cdk-integ.out';
+const CDK_INTEG_STACK_PRAGMA = '/// !cdk-integ';
+const PRAGMA_PREFIX = 'pragma:';
+const SET_CONTEXT_PRAGMA_PREFIX = 'pragma:set-context:';
+const VERIFY_ASSET_HASHES = 'pragma:include-assets-hashes';
+const ENABLE_LOOKUPS_PRAGMA = 'pragma:enable-lookups';
+
+/**
+ * Options for creating an integration test runner
+ */
+export interface IntegRunnerOptions {
+  /**
+   * The name of the file that contains the integration test
+   * This should be a JavaScript file
+   */
+  readonly fileName: string,
+
+  /**
+   * Additional environment variables that will be available
+   * to the CDK CLI
+   *
+   * @default - no additional environment variables
+   */
+  readonly env?: { [name: string]: string },
+
+  /**
+   * tmp cdk.out directory
+   *
+   * @default - directory will be `cdk-integ.out.${testName}`
+   */
+  readonly integOutDir?: string,
+
+  /**
+   * Instance of the CDK CLI to use
+   *
+   * @default - CdkCliWrapper
+   */
+  readonly cdk?: ICdk;
+}
+
+/**
+ * Represents an Integration test runner
+ */
+export abstract class IntegRunner {
+  /**
+   * The directory where the snapshot will be stored
+   */
+  public readonly snapshotDir: string;
+
+  /**
+   * An instance of the CDK  CLI
+   */
+  public readonly cdk: ICdk;
+
+  /**
+   * Pretty name of the test
+   */
+  public readonly testName: string;
+
+  /**
+   * The path to the integration test file
+   */
+  protected readonly sourceFilePath: string;
+
+  /**
+   * The value used in the '--app' CLI parameter
+   */
+  protected readonly cdkApp: string;
+
+  /**
+   * The path where the `cdk.context.json` file
+   * will be created
+   */
+  protected readonly cdkContextPath: string;
+
+  /**
+   * The relative path from the cwd to the snapshot directory
+   */
+  protected readonly relativeSnapshotDir: string;
+
+  /**
+   * The integration tests that this runner will execute
+   */
+  protected _tests?: { [testName: string]: TestCase };
+
+  /**
+   * The working directory that the integration tests will be
+   * executed from
+   */
+  protected readonly directory: string;
+
+  /**
+   * Default options to pass to the CDK CLI
+   */
+  protected readonly defaultArgs: DefaultCdkOptions = {
+    pathMetadata: false,
+    assetMetadata: false,
+    versionReporting: false,
+  }
+
+  private _enableLookups?: boolean;
+
+  /**
+   * The directory where the CDK will be synthed to
+   */
+  protected readonly cdkOutDir: string;
+
+  constructor(options: IntegRunnerOptions) {
+    const parsed = path.parse(options.fileName);
+    this.directory = parsed.dir;
+    this.testName = parsed.name.slice(6);
+    this.snapshotDir = path.join(this.directory, `${this.testName}.integ.snapshot`);
+    this.relativeSnapshotDir = `${this.testName}.integ.snapshot`;
+    this.sourceFilePath = path.join(this.directory, parsed.base);
+    this.cdkContextPath = path.join(this.directory, 'cdk.context.json');
+    this.cdk = options.cdk ?? new CdkCliWrapper({
+      cdkExecutable: require.resolve('aws-cdk/bin/cdk'),
+      directory: this.directory,
+      env: options.env,
+    });
+    this.cdkOutDir = options.integOutDir ?? `${CDK_OUTDIR_PREFIX}.${this.testName}`;
+    this.cdkApp = `node ${parsed.base}`;
+    if (this.hasSnapshot()) {
+      this.loadManifest();
+    }
+  }
+
+  /**
+   * Whether or not lookups are enabled for a given test case
+   */
+  protected get enableLookups(): boolean {
+    return this._enableLookups ?? false;
+  }
+
+  /**
+   * Return this list of test cases for this integration test
+   */
+  public get tests(): { [testName: string]: TestCase } | undefined {
+    return this._tests;
+  }
+
+  /**
+   * Returns true if a snapshot already exists for this test
+   */
+  public hasSnapshot(): boolean {
+    if (fs.existsSync(this.snapshotDir)) {
+      return true;
+    } else {
+      return false;
+    }
+  }
+
+  protected loadManifest(dir?: string): void {
+    try {
+      const reader = IntegManifestReader.fromPath(dir ?? this.snapshotDir);
+      this._tests = reader.tests.testCases;
+      this._enableLookups = reader.tests.enableLookups;
+    } catch (e) {
+      this._tests = this.renderTestCasesForLegacyTests();
+      this._enableLookups = this.pragmas().includes(ENABLE_LOOKUPS_PRAGMA);
+    }
+  }
+
+  protected cleanup(): void {
+    const cdkOutPath = path.join(this.directory, this.cdkOutDir);
+    if (fs.existsSync(cdkOutPath)) {
+      fs.removeSync(cdkOutPath);
+    }
+  }
+
+  protected createSnapshot(): void {
+    if (fs.existsSync(this.snapshotDir)) {
+      fs.removeSync(this.snapshotDir);
+    }
+
+    // if lookups are enabled then we need to synth again
+    // using dummy context and save that as the snapshot
+    if (this.enableLookups) {
+      this.writeContext();
+      this.cdk.synth({
+        ...this.defaultArgs,
+        all: true,
+        app: this.cdkApp,
+        output: this.relativeSnapshotDir,
+        // TODO: figure out if we need this...
+        // env: {
+        //   ...DEFAULT_SYNTH_OPTIONS.env,
+        // },
+      });
+      this.cleanupContextFile();
+    } else {
+      fs.moveSync(path.join(this.directory, this.cdkOutDir), this.snapshotDir, { overwrite: true });
+    }
+  }
+
+  /**
+   * Returns the single test stack to use.
+   *
+   * If the test has a single stack, it will be chosen. Otherwise a pragma is expected within the
+   * test file the name of the stack:
+   *
+   * @example
+   *
+   *    /// !cdk-integ <stack-name>
+   *
+   */
+  private renderTestCasesForLegacyTests(): { [testName: string]: TestCase } {
+    const tests: TestCase = {
+      stacks: [],
+    };
+    const pragma = this.readStackPragma();
+    if (pragma.length > 0) {
+      tests.stacks.push(...pragma);
+    } else {
+      const stacks = (this.cdk.list({
+        ...this.defaultArgs,
+        all: true,
+        app: this.cdkApp,
+        output: this.cdkOutDir,
+      })).split('\n');
+      if (stacks.length !== 1) {
+        throw new Error('"cdk-integ" can only operate on apps with a single stack.\n\n' +
+          '  If your app has multiple stacks, specify which stack to select by adding this to your test source:\n\n' +
+          `      ${CDK_INTEG_STACK_PRAGMA} STACK ...\n\n` +
+          `  Available stacks: ${stacks.join(' ')} (wildcards are also supported)\n`);
+      }
+      tests.stacks.push(...stacks);
+    }
+
+    return {
+      [this.testName]: tests,
+    };
+  }
+
+  /**
+   * Reads stack names from the "!cdk-integ" pragma.
+   *
+   * Every word that's NOT prefixed by "pragma:" is considered a stack name.
+   *
+   * @example
+   *
+   *    /// !cdk-integ <stack-name>
+   */
+  private readStackPragma(): string[] {
+    return (this.readIntegPragma()).filter(p => !p.startsWith(PRAGMA_PREFIX));
+  }
+
+  /**
+   * Read arbitrary cdk-integ pragma directives
+   *
+   * Reads the test source file and looks for the "!cdk-integ" pragma. If it exists, returns it's
+   * contents. This allows integ tests to supply custom command line arguments to "cdk deploy" and "cdk synth".
+   *
+   * @example
+   *
+   *    /// !cdk-integ [...]
+   */
+  private readIntegPragma(): string[] {
+    const source = fs.readFileSync(this.sourceFilePath, { encoding: 'utf-8' });
+    const pragmaLine = source.split('\n').find(x => x.startsWith(CDK_INTEG_STACK_PRAGMA + ' '));
+    if (!pragmaLine) {
+      return [];
+    }
+
+    const args = pragmaLine.substring(CDK_INTEG_STACK_PRAGMA.length).trim().split(' ');
+    if (args.length === 0) {
+      throw new Error(`Invalid syntax for cdk-integ pragma. Usage: "${CDK_INTEG_STACK_PRAGMA} [STACK] [pragma:PRAGMA] [...]"`);
+    }
+    return args;
+  }
+
+  /**
+   * Return the non-stack pragmas
+   *
+   * These are all pragmas that start with "pragma:".
+   *
+   * For backwards compatibility reasons, all pragmas that DON'T start with this
+   * string are considered to be stack names.
+   */
+  protected pragmas(): string[] {
+    return (this.readIntegPragma()).filter(p => p.startsWith(PRAGMA_PREFIX));
+  }
+
+  /**
+   * There is not currently a way to pass structured context to the CLI
+   * so to workaround this we write the context to a file
+   */
+  protected writeContext(additionalContext?: Record<string, any>): void {
+    const ctxPragmaContext: Record<string, any> = {};
+
+    // apply context from set-context pragma
+    // usage: pragma:set-context:key=value
+    const ctxPragmas = (this.pragmas()).filter(p => p.startsWith(SET_CONTEXT_PRAGMA_PREFIX));
+    for (const p of ctxPragmas) {
+      const instruction = p.substring(SET_CONTEXT_PRAGMA_PREFIX.length);
+      const [key, value] = instruction.split('=');
+      if (key == null || value == null) {
+        throw new Error(`invalid "set-context" pragma syntax. example: "pragma:set-context:@aws-cdk/core:newStyleStackSynthesis=true" got: ${p}`);
+      }
+
+      ctxPragmaContext[key] = value;
+    }
+    const context: Record<string, any> = {
+      ...DEFAULT_SYNTH_OPTIONS.context,
+      ...ctxPragmaContext,
+      ...additionalContext,
+    };
+    fs.writeFileSync(this.cdkContextPath, JSON.stringify(context, undefined, 2), { encoding: 'utf-8' });
+  }
+
+  protected cleanupContextFile() {
+    if (fs.existsSync(this.cdkContextPath)) {
+      fs.unlinkSync(this.cdkContextPath);
+    }
+  }
+}
+
+/**
+ * Options for the integration test runner
+ */
+export interface RunOptions {
+  /**
+   * The test case to execute
+   */
+  readonly testCase: TestCase;
+
+  /**
+   * Whether or not to run `cdk destroy` and cleanup the
+   * integration test stacks.
+   *
+   * Set this to false if you need to perform any validation
+   * or troubleshooting after deployment.
+   *
+   * @default true
+   */
+  readonly clean?: boolean;
+
+  /**
+   * If set to true, the integration test will not deploy
+   * anything and will simply update the snapshot.
+   *
+   * You should NOT use this method since you are essentially
+   * bypassing the integration test.
+   *
+   * @default false
+   */
+  readonly dryRun?: boolean;
+}
+
+/**
+ * An integration test runner that orchestrates executing
+ * integration tests
+ */
+export class IntegTestRunner extends IntegRunner {
+  constructor(options: IntegRunnerOptions) {
+    super(options);
+  }
+
+  /**
+   * Orchestrates running integration tests. Currently this includes
+   *
+   * 1. Deploying the integration test stacks
+   * 2. Saving the snapshot
+   * 3. Destroying the integration test stacks
+   */
+  public runIntegTestCase(options: RunOptions): void {
+    const clean = options.clean ?? true;
+    try {
+      if (!options.dryRun) {
+        this.cdk.deploy({
+          ...this.defaultArgs,
+          stacks: options.testCase.stacks,
+          requireApproval: RequireApproval.NEVER,
+          output: this.cdkOutDir,
+          app: this.cdkApp,
+          lookups: this.enableLookups,
+        });
+      } else {
+        this.cdk.synth({
+          ...this.defaultArgs,
+          stacks: options.testCase.stacks,
+          output: this.cdkOutDir,
+          app: this.cdkApp,
+          lookups: this.enableLookups,
+        });
+      }
+      this.createSnapshot();
+    } catch (e) {
+      throw e;
+    } finally {
+      if (!options.dryRun) {
+        if (clean) {
+          this.cdk.destroy({
+            ...this.defaultArgs,
+            stacks: options.testCase.stacks,
+            force: true,
+            app: this.cdkApp,
+            output: this.cdkOutDir,
+          });
+        }
+      }
+      this.cleanup();
+    }
+  }
+
+  /**
+   * Generate a snapshot if one does not exist
+   * This will synth and then load the integration test manifest
+   */
+  public generateSnapshot(): void {
+    if (this.hasSnapshot()) {
+      throw new Error(`${this.testName} already has a snapshot: ${this.snapshotDir}`);
+    }
+
+    this.cdk.synth({
+      ...this.defaultArgs,
+      all: true,
+      app: this.cdkApp,
+      output: this.cdkOutDir,
+    });
+    this.loadManifest(this.cdkOutDir);
+  }
+}
+
+/**
+ * Runner for snapshot tests. This handles orchestrating
+ * the validation of the integration test snapshots
+ */
+export class IntegSnapshotRunner extends IntegRunner {
+  constructor(options: IntegRunnerOptions) {
+    super(options);
+  }
+
+  /**
+   * Synth the integration tests and compare the templates
+   * to the existing snapshot.
+   */
+  public testSnapshot(): Diagnostic[] {
+    try {
+      // read the existing snapshot
+      const expectedStacks = this.readAssembly(this.snapshotDir);
+
+      // if lookups are enabled then write the dummy context file
+      if (this.enableLookups) {
+        this.writeContext();
+      }
+      // synth the integration test
+      this.cdk.synth({
+        ...this.defaultArgs,
+        all: true,
+        app: this.cdkApp,
+        output: this.cdkOutDir,
+        lookups: this.enableLookups,
+      });
+      const actualStacks = this.readAssembly(path.join(this.directory, this.cdkOutDir));
+
+      // diff the existing snapshot (expected) with the integration test (actual)
+      const diagnostics = this.diffAssembly(expectedStacks, actualStacks);
+      return diagnostics;
+    } catch (e) {
+      throw e;
+    } finally {
+      this.cleanupContextFile();
+      this.cleanup();
+    }
+  }
+
+  private diffAssembly(existing: Record<string, any>, actual: Record<string, any>): Diagnostic[] {
+    const verifyHashes = this.pragmas().includes(VERIFY_ASSET_HASHES);
+    const failures: Diagnostic[] = [];
+    for (const templateId of Object.keys(existing)) {
+      if (!actual.hasOwnProperty(templateId)) {
+        failures.push({
+          testName: this.testName,
+          reason: DiagnosticReason.SNAPSHOT_FAILED,
+          message: `${templateId} exists in snapshot, but not in actual`,
+        });
+      }
+    }
+
+    for (const templateId of Object.keys(actual)) {
+      if (!existing.hasOwnProperty(templateId)) {
+        failures.push({
+          testName: this.testName,
+          reason: DiagnosticReason.SNAPSHOT_FAILED,
+          message: `${templateId} does not exist in snapshot, but does in actual`,
+        });
+      } else {
+        let actualTemplate = actual[templateId];
+        let expectedTemplate = existing[templateId];
+
+        if (!verifyHashes) {
+          actualTemplate = canonicalizeTemplate(actualTemplate);
+          expectedTemplate = canonicalizeTemplate(expectedTemplate);
+        }
+        const diff = diffTemplate(expectedTemplate, actualTemplate);
+        if (!diff.isEmpty) {
+          const writable = new StringWritable({});
+          formatDifferences(writable, diff);
+          failures.push({
+            reason: DiagnosticReason.SNAPSHOT_FAILED,
+            message: writable.data,
+            testName: this.testName,
+          });
+        }
+      }
+    }
+
+    return failures;
+  }
+
+  private readAssembly(dir: string): Record<string, any> {
+    const assembly = AssemblyManifestReader.fromPath(dir);
+    const stacks = assembly.stacks;
+
+    return stacks;
+  }
+}
+
+class StringWritable extends Writable {
+  public data: string;
+  private _decoder: NodeStringDecoder;
+  constructor(options: WritableOptions) {
+    super(options);
+    this._decoder = new StringDecoder();
+    this.data = '';
+  }
+
+  _write(chunk: any, encoding: string, callback: (error?: Error | null) => void): void {
+    if (encoding === 'buffer') {
+      chunk = this._decoder.write(chunk);
+    }
+
+    this.data += chunk;
+    callback();
+  }
+
+  _final(callback: (error?: Error | null) => void): void {
+    this.data += this._decoder.end();
+    callback();
+  }
+}
+
+// Default context we run all integ tests with, so they don't depend on the
+// account of the exercising user.
+const DEFAULT_SYNTH_OPTIONS = {
+  context: {
+    [AVAILABILITY_ZONE_FALLBACK_CONTEXT_KEY]: ['test-region-1a', 'test-region-1b', 'test-region-1c'],
+    'availability-zones:account=12345678:region=test-region': ['test-region-1a', 'test-region-1b', 'test-region-1c'],
+    'ssm:account=12345678:parameterName=/aws/service/ami-amazon-linux-latest/amzn-ami-hvm-x86_64-gp2:region=test-region': 'ami-1234',
+    'ssm:account=12345678:parameterName=/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2:region=test-region': 'ami-1234',
+    'ssm:account=12345678:parameterName=/aws/service/ecs/optimized-ami/amazon-linux/recommended:region=test-region': '{"image_id": "ami-1234"}',
+    // eslint-disable-next-line max-len
+    'ami:account=12345678:filters.image-type.0=machine:filters.name.0=amzn-ami-vpc-nat-*:filters.state.0=available:owners.0=amazon:region=test-region': 'ami-1234',
+    'vpc-provider:account=12345678:filter.isDefault=true:region=test-region:returnAsymmetricSubnets=true': {
+      vpcId: 'vpc-60900905',
+      subnetGroups: [
+        {
+          type: 'Public',
+          name: 'Public',
+          subnets: [
+            {
+              subnetId: 'subnet-e19455ca',
+              availabilityZone: 'us-east-1a',
+              routeTableId: 'rtb-e19455ca',
+            },
+            {
+              subnetId: 'subnet-e0c24797',
+              availabilityZone: 'us-east-1b',
+              routeTableId: 'rtb-e0c24797',
+            },
+            {
+              subnetId: 'subnet-ccd77395',
+              availabilityZone: 'us-east-1c',
+              routeTableId: 'rtb-ccd77395',
+            },
+          ],
+        },
+      ],
+    },
+    // Enable feature flags for all integ tests
+    ...FUTURE_FLAGS,
+
+    // Restricting to these target partitions makes most service principals synthesize to
+    // `service.${URL_SUFFIX}`, which is technically *incorrect* (it's only `amazonaws.com`
+    // or `amazonaws.com.cn`, never UrlSuffix for any of the restricted regions) but it's what
+    // most existing integ tests contain, and we want to disturb as few as possible.
+    [TARGET_PARTITIONS]: ['aws', 'aws-cn'],
+  },
+  env: {
+    CDK_INTEG_ACCOUNT: '12345678',
+    CDK_INTEG_REGION: 'test-region',
+  },
+};
diff --git a/packages/@aws-cdk/integ-runner/lib/workers/common.ts b/packages/@aws-cdk/integ-runner/lib/workers/common.ts
new file mode 100644
index 0000000000000..b1bd40e6a2312
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/workers/common.ts
@@ -0,0 +1,128 @@
+import * as chalk from 'chalk';
+import * as logger from '../logger';
+import { IntegTestConfig } from '../runner/integ-tests';
+
+/**
+ * Integration test results
+ */
+export interface IntegBatchResponse {
+  failedTests: IntegTestConfig[];
+}
+
+/**
+ * Common options for running integration tests
+ */
+export interface IntegTestOptions {
+  /**
+   * A list of integration tests to run
+   * in this batch
+   */
+  readonly tests: IntegTestConfig[];
+
+  /**
+   * Whether or not to destroy the stacks at the
+   * end of the test
+   *
+   * @default true
+   */
+  readonly clean?: boolean;
+
+  /**
+   * When this is set to `true` the snapshot will
+   * be created _without_ running the integration test
+   * The resulting snapshot SHOULD NOT be checked in
+   *
+   * @default false
+   */
+  readonly dryRun?: boolean;
+
+  /**
+   * Whether to enable verbose logging
+   *
+   * @default false
+   */
+  readonly verbose?: boolean;
+}
+
+/**
+ * Represents possible reasons for a diagnostic
+ */
+export enum DiagnosticReason {
+  /**
+   * The integration test failed because there
+   * is not existing snapshot
+   */
+  NO_SNAPSHOT = 'NO_SNAPSHOT',
+
+  /**
+   * The integration test failed
+   */
+  TEST_FAILED = 'TEST_FAILED',
+
+  /**
+   * The snapshot test failed because the actual
+   * snapshot was different than the expected snapshot
+   */
+  SNAPSHOT_FAILED = 'SNAPSHOT_FAILED',
+
+  /**
+   * The snapshot test succeeded
+   */
+  SNAPSHOT_SUCCESS = 'SNAPSHOT_SUCCESS',
+
+  /**
+   * The integration test succeeded
+   */
+  TEST_SUCCESS = 'TEST_SUCCESS',
+}
+
+/**
+ * Integration test diagnostics
+ * This is used to report back the status of each test
+ */
+export interface Diagnostic {
+  /**
+   * The name of the test
+   */
+  readonly testName: string;
+
+  /**
+   * The diagnostic message
+   */
+  readonly message: string;
+
+  /**
+   * The reason for the diagnostic
+   */
+  readonly reason: DiagnosticReason;
+}
+
+export function printSummary(total: number, failed: number): void {
+  if (failed > 0) {
+    logger.print('%s:    %s %s, %s total', chalk.bold('Tests'), chalk.red(failed), chalk.red('failed'), total);
+  } else {
+    logger.print('%s:    %s %s, %s total', chalk.bold('Tests'), chalk.green(total), chalk.green('passed'), total);
+  }
+}
+
+/**
+ * Print out the results from tests
+ */
+export function printResults(diagnostic: Diagnostic): void {
+  switch (diagnostic.reason) {
+    case DiagnosticReason.SNAPSHOT_SUCCESS:
+      logger.success('  %s No Change!', diagnostic.testName);
+      break;
+    case DiagnosticReason.TEST_SUCCESS:
+      logger.success('  %s Test Succeeded!', diagnostic.testName);
+      break;
+    case DiagnosticReason.NO_SNAPSHOT:
+      logger.error('  %s - No Snapshot!', diagnostic.testName);
+      break;
+    case DiagnosticReason.SNAPSHOT_FAILED:
+      logger.error('  %s - Snapshot changed!\n%s', diagnostic.testName, diagnostic.message);
+      break;
+    case DiagnosticReason.TEST_FAILED:
+      logger.error('  %s - Failed!\n%s', diagnostic.testName, diagnostic.message);
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/lib/workers/extract/extract_worker.ts b/packages/@aws-cdk/integ-runner/lib/workers/extract/extract_worker.ts
new file mode 100644
index 0000000000000..f4991f56d1826
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/workers/extract/extract_worker.ts
@@ -0,0 +1,35 @@
+import * as workerpool from 'workerpool';
+import { IntegTestConfig } from '../../runner/integ-tests';
+import { Diagnostic, IntegBatchResponse } from '../common';
+import { singleThreadedSnapshotRunner } from '../integ-snapshot-worker';
+import { singleThreadedTestRunner, IntegTestBatchRequest } from '../integ-test-worker';
+
+/**
+ * Options for running snapshot tests
+ */
+export interface SnapshotBatchRequest {
+  readonly tests: IntegTestConfig[];
+}
+
+/**
+ * Snapshot test results
+ */
+export interface SnapshotBatchResponse {
+  diagnostics: Diagnostic[];
+  failedTests: IntegTestConfig[];
+}
+
+function integTestBatch(request: IntegTestBatchRequest): IntegBatchResponse {
+  const result = singleThreadedTestRunner(request);
+  return result;
+}
+
+function snapshotTestBatch(request: SnapshotBatchRequest): IntegBatchResponse {
+  const result = singleThreadedSnapshotRunner(request.tests);
+  return result;
+}
+
+workerpool.worker({
+  snapshotTestBatch,
+  integTestBatch,
+});
diff --git a/packages/@aws-cdk/integ-runner/lib/workers/extract/index.ts b/packages/@aws-cdk/integ-runner/lib/workers/extract/index.ts
new file mode 100644
index 0000000000000..f1a7211364650
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/workers/extract/index.ts
@@ -0,0 +1 @@
+export * from './extract_worker';
diff --git a/packages/@aws-cdk/integ-runner/lib/workers/index.ts b/packages/@aws-cdk/integ-runner/lib/workers/index.ts
new file mode 100644
index 0000000000000..f425090046137
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/workers/index.ts
@@ -0,0 +1,3 @@
+export * from './common';
+export * from './integ-test-worker';
+export * from './integ-snapshot-worker';
diff --git a/packages/@aws-cdk/integ-runner/lib/workers/integ-snapshot-worker.ts b/packages/@aws-cdk/integ-runner/lib/workers/integ-snapshot-worker.ts
new file mode 100644
index 0000000000000..3e9668ad34583
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/workers/integ-snapshot-worker.ts
@@ -0,0 +1,103 @@
+import * as workerpool from 'workerpool';
+import * as logger from '../logger';
+import { IntegTestConfig } from '../runner/integ-tests';
+import { IntegSnapshotRunner } from '../runner/runners';
+import { IntegBatchResponse, printSummary, Diagnostic, DiagnosticReason, printResults } from './common';
+
+/**
+ * Options for running snapshot tests
+ */
+export interface SnapshotBatchRequest {
+  readonly tests: IntegTestConfig[];
+}
+
+/**
+ * Snapshot test results
+ */
+export interface SnapshotBatchResponse {
+  diagnostics: Diagnostic[];
+  failedTests: IntegTestConfig[];
+}
+
+/**
+ * Split a list of snapshot tests into batches that can be run using a workerpool.
+ */
+function batchTests(tests: IntegTestConfig[]): SnapshotBatchRequest[] {
+  let batchSize = 3;
+  const ret: SnapshotBatchRequest[] = [];
+  for (let i = 0; i < tests.length; i += batchSize) {
+    ret.push({
+      tests: tests.slice(i, i + batchSize),
+    });
+  }
+  return ret;
+}
+
+/**
+ * Run Snapshot tests
+ * First batch up the tests. By default there will be 3 tests per batch.
+ * Use a workerpool to run the batches in parallel.
+ */
+export async function runSnapshotTests(pool: workerpool.WorkerPool, tests: IntegTestConfig[]): Promise<IntegTestConfig[]> {
+  const testsToRun: IntegTestConfig[] = [];
+  const requests = batchTests(tests);
+  logger.highlight('\nVerifying integration test snapshots...\n');
+
+  const responses: IntegBatchResponse[] = await Promise.all(
+    requests.map((request) => pool.exec('snapshotTestBatch', [request], {
+      on: printResults,
+    })),
+  );
+  for (const response of responses) {
+    testsToRun.push(...response.failedTests);
+  }
+
+  logger.highlight('\nSnapshot Results: \n');
+  printSummary(tests.length, testsToRun.length); return testsToRun;
+}
+
+/**
+ * Runs a single snapshot test batch request.
+ * For each integration test this will check to see
+ * if there is an existing snapshot, and if there is will
+ * check if there are any changes
+ */
+export function singleThreadedSnapshotRunner(tests: IntegTestConfig[]): IntegBatchResponse {
+  const failedTests = new Array<IntegTestConfig>();
+  for (const test of tests) {
+    const runner = new IntegSnapshotRunner({ fileName: test.fileName });
+    try {
+      if (!runner.hasSnapshot()) {
+        workerpool.workerEmit({
+          reason: DiagnosticReason.NO_SNAPSHOT,
+          testName: runner.testName,
+          message: 'No Snapshot',
+        });
+        failedTests.push(test);
+      } else {
+        const snapshotDiagnostics = runner.testSnapshot();
+        if (snapshotDiagnostics.length > 0) {
+          snapshotDiagnostics.forEach(diagnostic => printResults(diagnostic));
+          failedTests.push(test);
+        } else {
+          workerpool.workerEmit({
+            reason: DiagnosticReason.SNAPSHOT_SUCCESS,
+            testName: runner.testName,
+            message: 'Success',
+          });
+        }
+      }
+    } catch (e) {
+      failedTests.push(test);
+      workerpool.workerEmit({
+        message: e.message,
+        testName: runner.testName,
+        reason: DiagnosticReason.SNAPSHOT_FAILED,
+      });
+    }
+  }
+
+  return {
+    failedTests,
+  };
+}
diff --git a/packages/@aws-cdk/integ-runner/lib/workers/integ-test-worker.ts b/packages/@aws-cdk/integ-runner/lib/workers/integ-test-worker.ts
new file mode 100644
index 0000000000000..b02af11b46861
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/lib/workers/integ-test-worker.ts
@@ -0,0 +1,140 @@
+import * as workerpool from 'workerpool';
+import * as logger from '../logger';
+import { IntegTestConfig } from '../runner/integ-tests';
+import { IntegTestRunner } from '../runner/runners';
+import { printResults, printSummary, IntegBatchResponse, IntegTestOptions, DiagnosticReason } from './common';
+
+/**
+ * Options for an integration test batch
+ */
+export interface IntegTestBatchRequest extends IntegTestOptions {
+  /**
+   * The AWS region to run this batch in
+   */
+  readonly region: string;
+}
+
+/**
+ * Options for running all integration tests
+ */
+export interface IntegTestRunOptions extends IntegTestOptions {
+  /**
+   * The regions to run the integration tests across.
+   * This allows the runner to run integration tests in parallel
+   */
+  readonly regions: string[];
+
+  /**
+   * The workerpool to use
+   */
+  readonly pool: workerpool.WorkerPool;
+}
+
+/**
+ * Run Integration tests.
+ */
+export async function runIntegrationTests(options: IntegTestRunOptions): Promise<void> {
+  logger.highlight('\nRunning integration tests for failed tests...\n');
+  logger.print('Running in parallel across: %s', options.regions.join(', '));
+  const totalTests = options.tests.length;
+  const failedTests: IntegTestConfig[] = [];
+
+  const responses = await runIntegrationTestsInParallel(options);
+  for (const response of responses) {
+    failedTests.push(...response.failedTests);
+  }
+  logger.highlight('\nTest Results: \n');
+  printSummary(totalTests, failedTests.length);
+}
+
+/**
+ * Runs a set of integration tests in parallel across a list of AWS regions.
+ * Only a single test can be run at a time in a given region. Once a region
+ * is done running a test, the next test will be pulled from the queue
+ */
+export async function runIntegrationTestsInParallel(
+  options: IntegTestRunOptions,
+): Promise<IntegBatchResponse[]> {
+
+  const queue = options.tests;
+  const results: IntegBatchResponse[] = [];
+
+  async function runTest(region: string): Promise<void> {
+    do {
+      const test = queue.pop();
+      if (!test) break;
+      logger.highlight(`Running test ${test.fileName} in ${region}`);
+      const response: IntegBatchResponse = await options.pool.exec('integTestBatch', [{
+        region,
+        tests: [test],
+        clean: options.clean,
+        dryRun: options.dryRun,
+        verbose: options.verbose,
+      }], {
+        on: printResults,
+      });
+
+      results.push(response);
+    } while (queue.length > 0);
+  }
+
+  const workers = options.regions.map((region) => runTest(region));
+  await Promise.all(workers);
+  return results;
+}
+
+/**
+ * Runs a single integration test batch request.
+ * If the test does not have an existing snapshot,
+ * this will first generate a snapshot and then execute
+ * the integration tests.
+ *
+ * If the tests succeed it will then save the snapshot
+ */
+export function singleThreadedTestRunner(request: IntegTestBatchRequest): IntegBatchResponse {
+  const failures: IntegTestConfig[] = [];
+  for (const test of request.tests) {
+    const runner = new IntegTestRunner({
+      fileName: test.fileName,
+      env: {
+        AWS_REGION: request.region,
+      },
+    });
+    try {
+      if (!runner.hasSnapshot()) {
+        runner.generateSnapshot();
+      }
+
+      if (!runner.tests) {
+        throw new Error(`No tests defined for ${runner.testName}`);
+      }
+      for (const [testName, testCase] of Object.entries(runner.tests)) {
+        try {
+          runner.runIntegTestCase({
+            testCase: testCase,
+            clean: request.clean,
+            dryRun: request.dryRun,
+          });
+          workerpool.workerEmit({
+            reason: DiagnosticReason.TEST_SUCCESS,
+            testName: testName,
+            message: 'Success',
+          });
+        } catch (e) {
+          failures.push(test);
+          workerpool.workerEmit({
+            reason: DiagnosticReason.TEST_FAILED,
+            testName: testName,
+            message: `Integration test failed: ${e}`,
+          });
+        }
+      }
+    } catch (e) {
+      logger.error(`Errors running test cases: ${e}`);
+    }
+  }
+
+  return {
+    failedTests: failures,
+  };
+}
diff --git a/packages/@aws-cdk/integ-runner/package.json b/packages/@aws-cdk/integ-runner/package.json
new file mode 100644
index 0000000000000..20eaf0193740b
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/package.json
@@ -0,0 +1,100 @@
+{
+  "name": "@aws-cdk/integ-runner",
+  "description": "CDK Integration Testing Tool",
+  "version": "0.0.0",
+  "private": true,
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "bin": {
+    "integ-runner": "bin/integ-runner"
+  },
+  "scripts": {
+    "build": "cdk-build",
+    "lint": "cdk-lint",
+    "package": "cdk-package",
+    "awslint": "cdk-awslint",
+    "pkglint": "pkglint -f",
+    "test": "cdk-test",
+    "watch": "cdk-watch",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
+    "compat": "cdk-compat",
+    "build+extract": "yarn build",
+    "build+test+extract": "yarn build+test"
+  },
+  "cdk-package": {
+    "bundle": {
+      "entryPoints": [
+        "lib/index.js",
+        "lib/workers/extract/index.js"
+      ],
+      "externals": {
+        "dependencies": [
+          "aws-cdk"
+        ]
+      },
+      "allowedLicenses": [
+        "Apache-2.0",
+        "MIT",
+        "BSD-3-Clause",
+        "ISC",
+        "BSD-2-Clause",
+        "0BSD"
+      ],
+      "dontAttribute": "^@aws-cdk/|^cdk-assets$|^cdk-cli-wrapper$",
+      "test": "bin/integ-runner --version"
+    }
+  },
+  "author": {
+    "name": "Amazon Web Services",
+    "url": "https://aws.amazon.com",
+    "organization": true
+  },
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "@aws-cdk/cdk-build-tools": "0.0.0",
+    "@aws-cdk/pkglint": "0.0.0",
+    "@types/fs-extra": "^8.1.2",
+    "@types/jest": "^27.4.1",
+    "@types/node": "^10.17.60",
+    "@types/workerpool": "^6.1.0",
+    "@types/yargs": "^15.0.14",
+    "jest": "^27.5.1"
+  },
+  "dependencies": {
+    "@aws-cdk/cloud-assembly-schema": "0.0.0",
+    "@aws-cdk/cloudformation-diff": "0.0.0",
+    "@aws-cdk/cx-api": "0.0.0",
+    "cdk-cli-wrapper": "0.0.0",
+    "aws-cdk": "0.0.0",
+    "chalk": "^4",
+    "fs-extra": "^9.1.0",
+    "workerpool": "^6.2.0",
+    "yargs": "^16.2.0"
+  },
+  "repository": {
+    "url": "https://github.com/aws/aws-cdk.git",
+    "type": "git",
+    "directory": "packages/@aws-cdk/integ-runner"
+  },
+  "keywords": [
+    "aws",
+    "cdk"
+  ],
+  "homepage": "https://github.com/aws/aws-cdk",
+  "engines": {
+    "node": ">= 10.13.0 <13 || >=13.7.0"
+  },
+  "nozem": {
+    "ostools": [
+      "unzip",
+      "diff",
+      "rm"
+    ]
+  },
+  "stability": "experimental",
+  "maturity": "experimental",
+  "publishConfig": {
+    "tag": "latest"
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/runner/integration-tests.test.ts b/packages/@aws-cdk/integ-runner/test/runner/integration-tests.test.ts
new file mode 100644
index 0000000000000..878f5bf5d2489
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/runner/integration-tests.test.ts
@@ -0,0 +1,15 @@
+import * as path from 'path';
+import { IntegrationTests } from '../../lib/runner/integ-tests';
+
+const directory = path.join(__dirname, '../test-data');
+
+describe('IntegrationTests', () => {
+  test('from cli args', async () => {
+    const tests = new IntegrationTests(directory);
+
+    const integTests = await tests.fromCliArgs(['integ.integ-test1.js']);
+
+    expect(integTests.length).toEqual(1);
+    expect(integTests[0].fileName).toEqual(expect.stringMatching(/integ.integ-test1.js$/));
+  });
+});
diff --git a/packages/@aws-cdk/integ-runner/test/runner/runners.test.ts b/packages/@aws-cdk/integ-runner/test/runner/runners.test.ts
new file mode 100644
index 0000000000000..da6cb3aaf83ae
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/runner/runners.test.ts
@@ -0,0 +1,324 @@
+import * as path from 'path';
+import * as fs from 'fs-extra';
+import { IntegTestRunner, IntegSnapshotRunner } from '../../lib/runner/runners';
+import { DiagnosticReason } from '../../lib/workers/common';
+
+describe('IntegTest runSnapshotTests', () => {
+  let synthMock: jest.SpyInstance;
+  beforeEach(() => {
+    jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(process.stdout, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'moveSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'removeSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'writeFileSync').mockImplementation(() => { return true; });
+  });
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.resetAllMocks();
+    jest.restoreAllMocks();
+  });
+  test('with defaults no diff', () => {
+    // WHEN
+    const integTest = new IntegSnapshotRunner({
+      fileName: 'test/test-data/integ.test-with-snapshot.js',
+      integOutDir: 'test-with-snapshot.integ.snapshot',
+    });
+    synthMock = jest.spyOn(integTest.cdk, 'synth').mockImplementation();
+    integTest.testSnapshot();
+
+    // THEN
+    expect(synthMock).toHaveBeenCalledTimes(1);
+    expect(synthMock.mock.calls[0][0]).toEqual({
+      all: true,
+      app: 'node integ.test-with-snapshot.js',
+      output: 'test-with-snapshot.integ.snapshot',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      lookups: false,
+    });
+  });
+
+  test('with defaults and diff', () => {
+    // WHEN
+    const integTest = new IntegSnapshotRunner({
+      fileName: path.join(__dirname, '../test-data/integ.test-with-snapshot.js'),
+      integOutDir: 'test-with-snapshot-diff.integ.snapshot',
+    });
+    synthMock = jest.spyOn(integTest.cdk, 'synth').mockImplementation();
+    const diagnostics = integTest.testSnapshot();
+
+    // THEN
+    expect(synthMock).toHaveBeenCalledTimes(1);
+    expect(synthMock.mock.calls[0][0]).toEqual({
+      all: true,
+      app: 'node integ.test-with-snapshot.js',
+      output: 'test-with-snapshot-diff.integ.snapshot',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      lookups: false,
+    });
+    expect(diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({
+      reason: DiagnosticReason.SNAPSHOT_FAILED,
+      testName: integTest.testName,
+      message: expect.stringContaining('foobar'),
+    })]));
+  });
+
+  test('dont diff asset hashes', () => {
+    // WHEN
+    const integTest = new IntegSnapshotRunner({
+      fileName: path.join(__dirname, '../test-data/integ.test-with-snapshot-assets-diff.js'),
+      integOutDir: 'test-with-snapshot-assets.integ.snapshot',
+    });
+    synthMock = jest.spyOn(integTest.cdk, 'synth').mockImplementation();
+    expect(() => {
+      integTest.testSnapshot();
+    }).not.toThrow();
+
+    // THEN
+    expect(synthMock).toHaveBeenCalledTimes(1);
+    expect(synthMock.mock.calls[0][0]).toEqual({
+      all: true,
+      app: 'node integ.test-with-snapshot-assets-diff.js',
+      output: 'test-with-snapshot-assets.integ.snapshot',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      lookups: true,
+    });
+  });
+
+  test('diff asset hashes', () => {
+    // WHEN
+    const integTest = new IntegSnapshotRunner({
+      fileName: path.join(__dirname, '../test-data/integ.test-with-snapshot-assets.js'),
+      integOutDir: 'test-with-snapshot-assets-diff.integ.snapshot',
+    });
+    synthMock = jest.spyOn(integTest.cdk, 'synth').mockImplementation();
+    const diagnostics = integTest.testSnapshot();
+
+    // THEN
+    expect(synthMock).toHaveBeenCalledTimes(1);
+    expect(synthMock.mock.calls[0][0]).toEqual({
+      all: true,
+      app: 'node integ.test-with-snapshot-assets.js',
+      output: 'test-with-snapshot-assets-diff.integ.snapshot',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      lookups: false,
+    });
+    expect(diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({
+      reason: DiagnosticReason.SNAPSHOT_FAILED,
+      testName: integTest.testName,
+      message: expect.stringContaining('Parameters'),
+    })]));
+  });
+});
+
+describe('IntegTest runIntegTests', () => {
+  let integTest: IntegTestRunner;
+  let deployMock: jest.SpyInstance;
+  let destroyMock: jest.SpyInstance;
+  let synthMock: jest.SpyInstance;
+  let listMock: jest.SpyInstance;
+  // let stderrMock: jest.SpyInstance;
+  beforeEach(() => {
+    integTest = new IntegTestRunner({ fileName: path.join(__dirname, '../test-data/integ.integ-test1.js') });
+    deployMock = jest.spyOn(integTest.cdk, 'deploy').mockImplementation();
+    destroyMock = jest.spyOn(integTest.cdk, 'destroy').mockImplementation();
+    synthMock = jest.spyOn(integTest.cdk, 'synth').mockImplementation();
+    listMock = jest.spyOn(integTest.cdk, 'list').mockImplementation();
+    jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'moveSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'removeSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'writeFileSync').mockImplementation(() => { return true; });
+  });
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.resetAllMocks();
+    jest.restoreAllMocks();
+  });
+  test('with defaults', () => {
+    // WHEN
+    integTest.runIntegTestCase({
+      testCase: {
+        stacks: ['stack1'],
+      },
+    });
+
+    // THEN
+    expect(deployMock).toHaveBeenCalledTimes(1);
+    expect(destroyMock).toHaveBeenCalledTimes(1);
+    expect(synthMock).toHaveBeenCalledTimes(0);
+    expect(deployMock.mock.calls[0][0]).toEqual({
+      app: 'node integ.integ-test1.js',
+      requireApproval: 'never',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      lookups: false,
+      stacks: ['stack1'],
+      output: 'cdk-integ.out.integ-test1',
+    });
+    expect(destroyMock.mock.calls[0][0]).toEqual({
+      app: 'node integ.integ-test1.js',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      force: true,
+      stacks: ['stack1'],
+      output: 'cdk-integ.out.integ-test1',
+    });
+  });
+
+  test('with lookups', () => {
+    // WHEN
+    integTest = new IntegTestRunner({ fileName: path.join(__dirname, '../test-data/integ.test-with-snapshot-assets-diff.js') });
+    deployMock = jest.spyOn(integTest.cdk, 'deploy').mockImplementation();
+    destroyMock = jest.spyOn(integTest.cdk, 'destroy').mockImplementation();
+    synthMock = jest.spyOn(integTest.cdk, 'synth').mockImplementation();
+    listMock = jest.spyOn(integTest.cdk, 'list').mockImplementation();
+    integTest.runIntegTestCase({
+      testCase: {
+        stacks: ['test-stack'],
+      },
+    });
+
+    // THEN
+    expect(deployMock).toHaveBeenCalledTimes(1);
+    expect(destroyMock).toHaveBeenCalledTimes(1);
+    expect(synthMock).toHaveBeenCalledTimes(1);
+    expect(deployMock.mock.calls[0][0]).toEqual({
+      app: 'node integ.test-with-snapshot-assets-diff.js',
+      requireApproval: 'never',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      lookups: true,
+      stacks: ['test-stack'],
+      output: 'cdk-integ.out.test-with-snapshot-assets-diff',
+    });
+    expect(synthMock.mock.calls[0][0]).toEqual({
+      app: 'node integ.test-with-snapshot-assets-diff.js',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      all: true,
+      output: 'test-with-snapshot-assets-diff.integ.snapshot',
+    });
+    expect(destroyMock.mock.calls[0][0]).toEqual({
+      app: 'node integ.test-with-snapshot-assets-diff.js',
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      force: true,
+      stacks: ['test-stack'],
+      output: 'cdk-integ.out.test-with-snapshot-assets-diff',
+    });
+  });
+
+  test('no clean', () => {
+    // WHEN
+    integTest.runIntegTestCase({
+      clean: false,
+      testCase: {
+        stacks: ['stack1'],
+      },
+    });
+
+    // THEN
+    expect(deployMock).toHaveBeenCalledTimes(1);
+    expect(destroyMock).toHaveBeenCalledTimes(0);
+    expect(synthMock).toHaveBeenCalledTimes(0);
+  });
+
+  test('dryrun', () => {
+    // WHEN
+    integTest.runIntegTestCase({
+      dryRun: true,
+      testCase: {
+        stacks: ['stack1'],
+      },
+    });
+
+    // THEN
+    expect(deployMock).toHaveBeenCalledTimes(0);
+    expect(destroyMock).toHaveBeenCalledTimes(0);
+    expect(synthMock).toHaveBeenCalledTimes(1);
+  });
+
+  test('determine test stack via pragma', () => {
+    // WHEN
+    integTest.generateSnapshot();
+
+    // THEN
+    expect(integTest.tests).toEqual(expect.objectContaining({
+      'integ-test1': {
+        stacks: ['stack1'],
+      },
+    }));
+    expect(listMock).toHaveBeenCalledTimes(0);
+  });
+
+  test('generate snapshot', () => {
+    // WHEN
+    integTest.generateSnapshot();
+
+    // THEN
+    expect(synthMock).toHaveBeenCalledTimes(1);
+    expect(synthMock.mock.calls[0][0]).toEqual({
+      all: true,
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      app: 'node integ.integ-test1.js',
+      output: 'cdk-integ.out.integ-test1',
+    });
+  });
+});
+
+describe('IntegTest no pragma', () => {
+  let integTest: IntegTestRunner;
+  let synthMock: jest.SpyInstance;
+  beforeEach(() => {
+    integTest = new IntegTestRunner({ fileName: 'test/test-data/integ.integ-test2.js' });
+    jest.spyOn(integTest.cdk, 'deploy').mockImplementation();
+    jest.spyOn(integTest.cdk, 'destroy').mockImplementation();
+    synthMock = jest.spyOn(integTest.cdk, 'synth').mockImplementation();
+    jest.spyOn(integTest.cdk, 'list').mockImplementation(() => {
+      return 'stackabc';
+    });
+    jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'moveSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'removeSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'writeFileSync').mockImplementation(() => { return true; });
+  });
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.resetAllMocks();
+    jest.restoreAllMocks();
+  });
+  test('get stacks from list', async () => {
+    // WHEN
+    integTest.generateSnapshot();
+
+    // THEN
+    expect(integTest.tests).toEqual(expect.objectContaining({
+      'integ-test2': {
+        stacks: ['stackabc'],
+      },
+    }));
+    expect(synthMock).toHaveBeenCalledTimes(1);
+    expect(synthMock.mock.calls[0][0]).toEqual({
+      app: 'node integ.integ-test2.js',
+      all: true,
+      pathMetadata: false,
+      assetMetadata: false,
+      versionReporting: false,
+      output: 'cdk-integ.out.integ-test2',
+    });
+  });
+});
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/cdk.out b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/cdk.out
new file mode 100644
index 0000000000000..2efc89439fab8
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/cdk.out
@@ -0,0 +1 @@
+{"version":"18.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/manifest.json b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/manifest.json
new file mode 100644
index 0000000000000..c0da3afe14484
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/manifest.json
@@ -0,0 +1,57 @@
+{
+  "version": "17.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "test-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "test-stack.template.json",
+        "validateOnSynth": false
+      },
+      "metadata": {
+        "/test-stack/MyFunction1/ServiceRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction1ServiceRole9852B06B",
+            "trace": [
+              "new Role (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-iam/lib/role.js:50:22)",
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:82:35)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/test-stack/MyFunction1/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction12A744C2E",
+            "trace": [
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:154:26)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ]
+      },
+      "displayName": "test-stack"
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/test-stack.template.json b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/test-stack.template.json
new file mode 100644
index 0000000000000..969780cdf33e5
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/test-stack.template.json
@@ -0,0 +1,68 @@
+{
+  "Resources": {
+    "MyFunction1ServiceRole9852B06B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "MyFunction12A744C2E": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "foo"
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunction1ServiceRole9852B06B",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "nodejs14.x"
+      },
+      "DependsOn": [
+        "MyFunction1ServiceRole9852B06B"
+      ]
+    }
+  },
+  "Parameters": {
+    "AssetParametersDec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509S3BucketBF50F97C": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"Dec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    },
+    "AssetParametersDec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509S3VersionKeyF21AC8C1": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"Dec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    },
+    "AssetParametersDec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509ArtifactHash5D8C129B": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"Dec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/tree.json b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/tree.json
new file mode 100644
index 0000000000000..b664bec74b37c
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot-assets/tree.json
@@ -0,0 +1,114 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Construct",
+          "version": "0.0.0"
+        }
+      },
+      "test-stack": {
+        "id": "test-stack",
+        "path": "test-stack",
+        "children": {
+          "MyFunction1": {
+            "id": "MyFunction1",
+            "path": "test-stack/MyFunction1",
+            "children": {
+              "ServiceRole": {
+                "id": "ServiceRole",
+                "path": "test-stack/MyFunction1/ServiceRole",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "test-stack/MyFunction1/ServiceRole/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": "lambda.amazonaws.com"
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "test-stack/MyFunction1/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Lambda::Function",
+                  "aws:cdk:cloudformation:props": {
+                    "code": {
+                      "zipFile": "foo"
+                    },
+                    "role": {
+                      "Fn::GetAtt": [
+                        "MyFunction1ServiceRole9852B06B",
+                        "Arn"
+                      ]
+                    },
+                    "handler": "index.handler",
+                    "runtime": "nodejs14.x"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-lambda.CfnFunction",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-lambda.Function",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/cdk.out b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/cdk.out
new file mode 100644
index 0000000000000..2efc89439fab8
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"18.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/manifest.json b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/manifest.json
new file mode 100644
index 0000000000000..c0da3afe14484
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/manifest.json
@@ -0,0 +1,57 @@
+{
+  "version": "17.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "test-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "test-stack.template.json",
+        "validateOnSynth": false
+      },
+      "metadata": {
+        "/test-stack/MyFunction1/ServiceRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction1ServiceRole9852B06B",
+            "trace": [
+              "new Role (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-iam/lib/role.js:50:22)",
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:82:35)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/test-stack/MyFunction1/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction12A744C2E",
+            "trace": [
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:154:26)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ]
+      },
+      "displayName": "test-stack"
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/test-stack.template.json b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/test-stack.template.json
new file mode 100644
index 0000000000000..40f4c8238c04f
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/test-stack.template.json
@@ -0,0 +1,54 @@
+{
+  "Resources": {
+    "MyFunction1ServiceRole9852B06B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "MyFunction12A744C2E": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "foo"
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunction1ServiceRole9852B06B",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "nodejs14.x"
+      },
+      "DependsOn": [
+        "MyFunction1ServiceRole9852B06B"
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/tree.json b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/tree.json
new file mode 100644
index 0000000000000..b664bec74b37c
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/cdk-integ.out.test-with-snapshot/tree.json
@@ -0,0 +1,114 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Construct",
+          "version": "0.0.0"
+        }
+      },
+      "test-stack": {
+        "id": "test-stack",
+        "path": "test-stack",
+        "children": {
+          "MyFunction1": {
+            "id": "MyFunction1",
+            "path": "test-stack/MyFunction1",
+            "children": {
+              "ServiceRole": {
+                "id": "ServiceRole",
+                "path": "test-stack/MyFunction1/ServiceRole",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "test-stack/MyFunction1/ServiceRole/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": "lambda.amazonaws.com"
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "test-stack/MyFunction1/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Lambda::Function",
+                  "aws:cdk:cloudformation:props": {
+                    "code": {
+                      "zipFile": "foo"
+                    },
+                    "role": {
+                      "Fn::GetAtt": [
+                        "MyFunction1ServiceRole9852B06B",
+                        "Arn"
+                      ]
+                    },
+                    "handler": "index.handler",
+                    "runtime": "nodejs14.x"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-lambda.CfnFunction",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-lambda.Function",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/integ.integ-test1.ts b/packages/@aws-cdk/integ-runner/test/test-data/integ.integ-test1.ts
new file mode 100644
index 0000000000000..26679b49d93bc
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/integ.integ-test1.ts
@@ -0,0 +1,2 @@
+/// !cdk-integ stack1 pragma:ignore-assets
+/// !cdk-integ pragma:ignore-assets
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/integ.integ-test2.ts b/packages/@aws-cdk/integ-runner/test/test-data/integ.integ-test2.ts
new file mode 100644
index 0000000000000..bb0eb24f2756d
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/integ.integ-test2.ts
@@ -0,0 +1 @@
+/// !cdk-integ pragma:enable-lookups
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot-assets-diff.ts b/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot-assets-diff.ts
new file mode 100644
index 0000000000000..bcdc92fbcdcf2
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot-assets-diff.ts
@@ -0,0 +1 @@
+/// !cdk-integ test-stack pragma:enable-lookups
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot-assets.ts b/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot-assets.ts
new file mode 100644
index 0000000000000..ff230f9f7e58e
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot-assets.ts
@@ -0,0 +1 @@
+/// !cdk-integ test-stack pragma:include-assets-hashes
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot.ts b/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot.ts
new file mode 100644
index 0000000000000..c3548a8acffcc
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/integ.test-with-snapshot.ts
@@ -0,0 +1,2 @@
+/// !cdk-integ test-stack pragma:ignore-assets
+/// !cdk-integ pragma:ignore-assets
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/not.integ-test.ts b/packages/@aws-cdk/integ-runner/test/test-data/not.integ-test.ts
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/cdk.out b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/cdk.out
new file mode 100644
index 0000000000000..2efc89439fab8
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"18.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/manifest.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/manifest.json
new file mode 100644
index 0000000000000..c0da3afe14484
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/manifest.json
@@ -0,0 +1,57 @@
+{
+  "version": "17.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "test-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "test-stack.template.json",
+        "validateOnSynth": false
+      },
+      "metadata": {
+        "/test-stack/MyFunction1/ServiceRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction1ServiceRole9852B06B",
+            "trace": [
+              "new Role (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-iam/lib/role.js:50:22)",
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:82:35)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/test-stack/MyFunction1/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction12A744C2E",
+            "trace": [
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:154:26)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ]
+      },
+      "displayName": "test-stack"
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/test-stack.template.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/test-stack.template.json
new file mode 100644
index 0000000000000..969780cdf33e5
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/test-stack.template.json
@@ -0,0 +1,68 @@
+{
+  "Resources": {
+    "MyFunction1ServiceRole9852B06B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "MyFunction12A744C2E": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "foo"
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunction1ServiceRole9852B06B",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "nodejs14.x"
+      },
+      "DependsOn": [
+        "MyFunction1ServiceRole9852B06B"
+      ]
+    }
+  },
+  "Parameters": {
+    "AssetParametersDec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509S3BucketBF50F97C": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"Dec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    },
+    "AssetParametersDec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509S3VersionKeyF21AC8C1": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"Dec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    },
+    "AssetParametersDec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509ArtifactHash5D8C129B": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"Dec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/tree.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/tree.json
new file mode 100644
index 0000000000000..b664bec74b37c
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets-diff.integ.snapshot/tree.json
@@ -0,0 +1,114 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Construct",
+          "version": "0.0.0"
+        }
+      },
+      "test-stack": {
+        "id": "test-stack",
+        "path": "test-stack",
+        "children": {
+          "MyFunction1": {
+            "id": "MyFunction1",
+            "path": "test-stack/MyFunction1",
+            "children": {
+              "ServiceRole": {
+                "id": "ServiceRole",
+                "path": "test-stack/MyFunction1/ServiceRole",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "test-stack/MyFunction1/ServiceRole/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": "lambda.amazonaws.com"
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "test-stack/MyFunction1/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Lambda::Function",
+                  "aws:cdk:cloudformation:props": {
+                    "code": {
+                      "zipFile": "foo"
+                    },
+                    "role": {
+                      "Fn::GetAtt": [
+                        "MyFunction1ServiceRole9852B06B",
+                        "Arn"
+                      ]
+                    },
+                    "handler": "index.handler",
+                    "runtime": "nodejs14.x"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-lambda.CfnFunction",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-lambda.Function",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/cdk.out b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/cdk.out
new file mode 100644
index 0000000000000..2efc89439fab8
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"18.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/manifest.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/manifest.json
new file mode 100644
index 0000000000000..c0da3afe14484
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/manifest.json
@@ -0,0 +1,57 @@
+{
+  "version": "17.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "test-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "test-stack.template.json",
+        "validateOnSynth": false
+      },
+      "metadata": {
+        "/test-stack/MyFunction1/ServiceRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction1ServiceRole9852B06B",
+            "trace": [
+              "new Role (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-iam/lib/role.js:50:22)",
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:82:35)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/test-stack/MyFunction1/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction12A744C2E",
+            "trace": [
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:154:26)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ]
+      },
+      "displayName": "test-stack"
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/test-stack.template.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/test-stack.template.json
new file mode 100644
index 0000000000000..ed2a09b94be23
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/test-stack.template.json
@@ -0,0 +1,68 @@
+{
+  "Resources": {
+    "MyFunction1ServiceRole9852B06B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "MyFunction12A744C2E": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "foo"
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunction1ServiceRole9852B06B",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "nodejs14.x"
+      },
+      "DependsOn": [
+        "MyFunction1ServiceRole9852B06B"
+      ]
+    }
+  },
+  "Parameters": {
+    "AssetParametersfec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509S3BucketBF50F97C": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"fec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    },
+    "AssetParametersfec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509S3VersionKeyF21AC8C1": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"fec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    },
+    "AssetParametersfec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509ArtifactHash5D8C129B": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"fec1c56a3f23d9d27f58815e0c34c810cc02f431ac63a078f9b5d2aa44cc3509\""
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/tree.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/tree.json
new file mode 100644
index 0000000000000..b664bec74b37c
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-assets.integ.snapshot/tree.json
@@ -0,0 +1,114 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Construct",
+          "version": "0.0.0"
+        }
+      },
+      "test-stack": {
+        "id": "test-stack",
+        "path": "test-stack",
+        "children": {
+          "MyFunction1": {
+            "id": "MyFunction1",
+            "path": "test-stack/MyFunction1",
+            "children": {
+              "ServiceRole": {
+                "id": "ServiceRole",
+                "path": "test-stack/MyFunction1/ServiceRole",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "test-stack/MyFunction1/ServiceRole/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": "lambda.amazonaws.com"
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "test-stack/MyFunction1/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Lambda::Function",
+                  "aws:cdk:cloudformation:props": {
+                    "code": {
+                      "zipFile": "foo"
+                    },
+                    "role": {
+                      "Fn::GetAtt": [
+                        "MyFunction1ServiceRole9852B06B",
+                        "Arn"
+                      ]
+                    },
+                    "handler": "index.handler",
+                    "runtime": "nodejs14.x"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-lambda.CfnFunction",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-lambda.Function",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/cdk.out b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/cdk.out
new file mode 100644
index 0000000000000..2efc89439fab8
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"18.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/manifest.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/manifest.json
new file mode 100644
index 0000000000000..c0da3afe14484
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/manifest.json
@@ -0,0 +1,57 @@
+{
+  "version": "17.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "test-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "test-stack.template.json",
+        "validateOnSynth": false
+      },
+      "metadata": {
+        "/test-stack/MyFunction1/ServiceRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction1ServiceRole9852B06B",
+            "trace": [
+              "new Role (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-iam/lib/role.js:50:22)",
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:82:35)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/test-stack/MyFunction1/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction12A744C2E",
+            "trace": [
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:154:26)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ]
+      },
+      "displayName": "test-stack"
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/test-stack.template.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/test-stack.template.json
new file mode 100644
index 0000000000000..3d62830b46139
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/test-stack.template.json
@@ -0,0 +1,54 @@
+{
+  "Resources": {
+    "MyFunction1ServiceRole9852B06B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "MyFunction12A744C2E": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "foobar"
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunction1ServiceRole9852B06B",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "nodejs14.x"
+      },
+      "DependsOn": [
+        "MyFunction1ServiceRole9852B06B"
+      ]
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/tree.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/tree.json
new file mode 100644
index 0000000000000..b664bec74b37c
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot-diff.integ.snapshot/tree.json
@@ -0,0 +1,114 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Construct",
+          "version": "0.0.0"
+        }
+      },
+      "test-stack": {
+        "id": "test-stack",
+        "path": "test-stack",
+        "children": {
+          "MyFunction1": {
+            "id": "MyFunction1",
+            "path": "test-stack/MyFunction1",
+            "children": {
+              "ServiceRole": {
+                "id": "ServiceRole",
+                "path": "test-stack/MyFunction1/ServiceRole",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "test-stack/MyFunction1/ServiceRole/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": "lambda.amazonaws.com"
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "test-stack/MyFunction1/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Lambda::Function",
+                  "aws:cdk:cloudformation:props": {
+                    "code": {
+                      "zipFile": "foo"
+                    },
+                    "role": {
+                      "Fn::GetAtt": [
+                        "MyFunction1ServiceRole9852B06B",
+                        "Arn"
+                      ]
+                    },
+                    "handler": "index.handler",
+                    "runtime": "nodejs14.x"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-lambda.CfnFunction",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-lambda.Function",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/cdk.out b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/cdk.out
new file mode 100644
index 0000000000000..2efc89439fab8
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"18.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/manifest.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/manifest.json
new file mode 100644
index 0000000000000..c0da3afe14484
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/manifest.json
@@ -0,0 +1,57 @@
+{
+  "version": "17.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "test-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "test-stack.template.json",
+        "validateOnSynth": false
+      },
+      "metadata": {
+        "/test-stack/MyFunction1/ServiceRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction1ServiceRole9852B06B",
+            "trace": [
+              "new Role (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-iam/lib/role.js:50:22)",
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:82:35)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/test-stack/MyFunction1/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "MyFunction12A744C2E",
+            "trace": [
+              "new Function (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-lambda/lib/function.js:154:26)",
+              "new TestStack (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:10:9)",
+              "Object.<anonymous> (/home/hallcor/work/aws-cdk/integ-test-runner/packages/@aws-cdk/aws-s3objectlambda/test/integ.lambda.js:18:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ]
+      },
+      "displayName": "test-stack"
+    }
+  }
+}
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/test-stack.template.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/test-stack.template.json
new file mode 100644
index 0000000000000..40f4c8238c04f
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/test-stack.template.json
@@ -0,0 +1,54 @@
+{
+  "Resources": {
+    "MyFunction1ServiceRole9852B06B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "MyFunction12A744C2E": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "foo"
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunction1ServiceRole9852B06B",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "nodejs14.x"
+      },
+      "DependsOn": [
+        "MyFunction1ServiceRole9852B06B"
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/tree.json b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/tree.json
new file mode 100644
index 0000000000000..b664bec74b37c
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/test-data/test-with-snapshot.integ.snapshot/tree.json
@@ -0,0 +1,114 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Construct",
+          "version": "0.0.0"
+        }
+      },
+      "test-stack": {
+        "id": "test-stack",
+        "path": "test-stack",
+        "children": {
+          "MyFunction1": {
+            "id": "MyFunction1",
+            "path": "test-stack/MyFunction1",
+            "children": {
+              "ServiceRole": {
+                "id": "ServiceRole",
+                "path": "test-stack/MyFunction1/ServiceRole",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "test-stack/MyFunction1/ServiceRole/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": "lambda.amazonaws.com"
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "test-stack/MyFunction1/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Lambda::Function",
+                  "aws:cdk:cloudformation:props": {
+                    "code": {
+                      "zipFile": "foo"
+                    },
+                    "role": {
+                      "Fn::GetAtt": [
+                        "MyFunction1ServiceRole9852B06B",
+                        "Arn"
+                      ]
+                    },
+                    "handler": "index.handler",
+                    "runtime": "nodejs14.x"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-lambda.CfnFunction",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-lambda.Function",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/integ-runner/test/workers/mock-extract_worker.ts b/packages/@aws-cdk/integ-runner/test/workers/mock-extract_worker.ts
new file mode 100644
index 0000000000000..7479d229302b8
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/workers/mock-extract_worker.ts
@@ -0,0 +1,15 @@
+import * as workerpool from 'workerpool';
+import { IntegBatchResponse } from '../../lib/workers/common';
+import { IntegTestBatchRequest } from '../../lib/workers/integ-test-worker';
+
+
+function integTestBatch(request: IntegTestBatchRequest): IntegBatchResponse {
+  return {
+    failedTests: request.tests,
+  };
+}
+
+workerpool.worker({
+  integTestBatch,
+});
+
diff --git a/packages/@aws-cdk/integ-runner/test/workers/workers.test.ts b/packages/@aws-cdk/integ-runner/test/workers/workers.test.ts
new file mode 100644
index 0000000000000..26ca05a3dfe9e
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/test/workers/workers.test.ts
@@ -0,0 +1,298 @@
+import * as child_process from 'child_process';
+import * as path from 'path';
+import * as fs from 'fs-extra';
+import * as workerpool from 'workerpool';
+import { singleThreadedSnapshotRunner } from '../../lib/workers';
+import { singleThreadedTestRunner, runIntegrationTestsInParallel, runIntegrationTests } from '../../lib/workers/integ-test-worker';
+
+const directory = path.join(__dirname, '../test-data');
+describe('Snapshot tests', () => {
+  beforeEach(() => {
+    jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(process.stdout, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'moveSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'removeSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'writeFileSync').mockImplementation(() => { return true; });
+  });
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.resetAllMocks();
+    jest.restoreAllMocks();
+  });
+  test('no snapshot', () => {
+    // WHEN
+    const test = {
+      fileName: path.join(directory, 'integ.integ-test1.js'),
+      directory: directory,
+    };
+    const result = singleThreadedSnapshotRunner([test]);
+
+    // THEN
+    expect(result.failedTests.length).toEqual(1);
+    expect(result.failedTests[0]).toEqual(test);
+  });
+
+  test('has snapshot', () => {
+    // WHEN
+    jest.spyOn(child_process, 'spawnSync').mockResolvedValue;
+    const test = {
+      fileName: path.join(directory, 'integ.test-with-snapshot.js'),
+      directory: directory,
+    };
+    const result = singleThreadedSnapshotRunner([test]);
+
+    // THEN
+    expect(result.failedTests.length).toEqual(0);
+  });
+
+  test('failed snapshot', () => {
+    // WHEN
+    jest.spyOn(child_process, 'spawnSync').mockRejectedValue;
+    const test = {
+      fileName: path.join(directory, 'integ.test-with-snapshot-assets.js'),
+      directory: directory,
+    };
+    const result = singleThreadedSnapshotRunner([test]);
+
+    // THEN
+    expect(result.failedTests.length).toEqual(1);
+    expect(result.failedTests[0]).toEqual(test);
+  });
+});
+
+describe('test runner', () => {
+  beforeEach(() => {
+    jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(process.stdout, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'moveSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'removeSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'writeFileSync').mockImplementation(() => { return true; });
+  });
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.resetAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  test('no snapshot', () => {
+    // WHEN
+    const test = {
+      fileName: path.join(directory, 'integ.integ-test1.js'),
+      directory: directory,
+    };
+    const spawnSyncMock = jest.spyOn(child_process, 'spawnSync').mockImplementation();
+    singleThreadedTestRunner({
+      tests: [test],
+      region: 'us-east-1',
+    });
+
+    expect(spawnSyncMock).toHaveBeenCalledWith(
+      expect.stringMatching(/cdk/),
+      ['synth', '--app', 'node integ.integ-test1.js', '--no-version-reporting', '--no-path-metadata', '--no-asset-metadata', '--output', 'cdk-integ.out.integ-test1', '--all'],
+      expect.anything(),
+    );
+  });
+});
+
+describe('parallel worker', () => {
+  let pool: workerpool.WorkerPool;
+  let stderrMock: jest.SpyInstance;
+  beforeEach(() => {
+    pool = workerpool.pool(path.join(__dirname, './mock-extract_worker.js'));
+    jest.spyOn(child_process, 'spawnSync').mockImplementation();
+    stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(process.stdout, 'write').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'moveSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'removeSync').mockImplementation(() => { return true; });
+    jest.spyOn(fs, 'writeFileSync').mockImplementation(() => { return true; });
+  });
+  afterEach(async () => {
+    await pool.terminate();
+    jest.clearAllMocks();
+    jest.resetAllMocks();
+    jest.restoreAllMocks();
+  });
+  test('run all integration tests', async () => {
+    const tests = [
+      {
+        fileName: 'integ.test-with-snapshot.js',
+        directory,
+      },
+      {
+        fileName: 'integ.another-test-with-snapshot.js',
+        directory,
+      },
+    ];
+    await runIntegrationTests({
+      tests,
+      pool,
+      regions: ['us-east-1', 'us-east-2'],
+    });
+
+    expect(stderrMock.mock.calls[0][0]).toContain(
+      'Running integration tests for failed tests...',
+    );
+    expect(stderrMock.mock.calls[1][0]).toContain(
+      'Running in parallel across: us-east-1, us-east-2',
+    );
+    expect(stderrMock.mock.calls[3][0]).toContain(
+      'Running test integ.test-with-snapshot.js in us-east-2',
+    );
+    expect(stderrMock.mock.calls[2][0]).toContain(
+      'Running test integ.another-test-with-snapshot.js in us-east-1',
+    );
+
+  });
+  test('run tests', async () => {
+    const tests = [{
+      fileName: 'integ.test-with-snapshot.js',
+      directory,
+    }];
+    const results = await runIntegrationTestsInParallel({
+      pool,
+      tests,
+      regions: ['us-east-1'],
+    });
+
+    expect(stderrMock.mock.calls[0][0]).toContain(
+      'Running test integ.test-with-snapshot.js in us-east-1',
+    );
+    expect(results).toEqual([
+      {
+        failedTests: [{
+          fileName: 'integ.test-with-snapshot.js',
+          directory,
+        }],
+      },
+    ]);
+  });
+
+  test('run multiple tests', async () => {
+    const tests = [
+      {
+        fileName: 'integ.test-with-snapshot.js',
+        directory,
+      },
+      {
+        fileName: 'integ.another-test-with-snapshot.js',
+        directory,
+      },
+    ];
+    const results = await runIntegrationTestsInParallel({
+      tests,
+      pool,
+      regions: ['us-east-1', 'us-east-2'],
+    });
+
+    expect(stderrMock.mock.calls[1][0]).toContain(
+      'Running test integ.test-with-snapshot.js in us-east-2',
+    );
+    expect(stderrMock.mock.calls[0][0]).toContain(
+      'Running test integ.another-test-with-snapshot.js in us-east-1',
+    );
+    expect(results).toEqual(expect.arrayContaining([
+      {
+        failedTests: [
+          {
+            fileName: 'integ.test-with-snapshot.js',
+            directory,
+          },
+        ],
+      },
+      {
+        failedTests: [
+          {
+            fileName: 'integ.another-test-with-snapshot.js',
+            directory,
+          },
+        ],
+      },
+    ]));
+  });
+
+  test('more tests than regions', async () => {
+    const tests = [
+      {
+        fileName: 'integ.test-with-snapshot.js',
+        directory,
+      },
+      {
+        fileName: 'integ.another-test-with-snapshot.js',
+        directory,
+      },
+    ];
+    const results = await runIntegrationTestsInParallel({
+      tests,
+      pool,
+      regions: ['us-east-1'],
+    });
+
+    expect(stderrMock.mock.calls[1][0]).toContain(
+      'Running test integ.test-with-snapshot.js in us-east-1',
+    );
+    expect(stderrMock.mock.calls[0][0]).toContain(
+      'Running test integ.another-test-with-snapshot.js in us-east-1',
+    );
+    expect(results).toEqual([
+      {
+        failedTests: [
+          {
+            fileName: 'integ.another-test-with-snapshot.js',
+            directory,
+          },
+        ],
+      },
+      {
+        failedTests: [
+          {
+            fileName: 'integ.test-with-snapshot.js',
+            directory,
+          },
+        ],
+      },
+    ]);
+  });
+
+  test('more regions than tests', async () => {
+    const tests = [
+      {
+        fileName: 'integ.test-with-snapshot.js',
+        directory,
+      },
+      {
+        fileName: 'integ.another-test-with-snapshot.js',
+        directory,
+      },
+    ];
+    const results = await runIntegrationTestsInParallel({
+      tests,
+      pool,
+      regions: ['us-east-1', 'us-east-2', 'us-west-2'],
+    });
+
+    expect(stderrMock.mock.calls[1][0]).toContain(
+      'Running test integ.test-with-snapshot.js in us-east-2',
+    );
+    expect(stderrMock.mock.calls[0][0]).toContain(
+      'Running test integ.another-test-with-snapshot.js in us-east-1',
+    );
+    expect(results).toEqual(expect.arrayContaining([
+      {
+        failedTests: [
+          {
+            fileName: 'integ.another-test-with-snapshot.js',
+            directory,
+          },
+        ],
+      },
+      {
+        failedTests: [
+          {
+            fileName: 'integ.test-with-snapshot.js',
+            directory,
+          },
+        ],
+      },
+    ]));
+  });
+});
diff --git a/packages/@aws-cdk/integ-runner/tsconfig.json b/packages/@aws-cdk/integ-runner/tsconfig.json
new file mode 100644
index 0000000000000..04e0404f04442
--- /dev/null
+++ b/packages/@aws-cdk/integ-runner/tsconfig.json
@@ -0,0 +1,28 @@
+{
+    "compilerOptions": {
+        "target": "ES2018",
+        "module": "commonjs",
+        "lib": ["es2018", "dom"],
+        "strict": true,
+        "alwaysStrict": true,
+        "declaration": true,
+        "inlineSourceMap": true,
+        "inlineSources": true,
+        "noUnusedLocals": true,
+        "noUnusedParameters": true,
+        "noImplicitReturns": true,
+        "noFallthroughCasesInSwitch": true,
+        "resolveJsonModule": true,
+        "composite": true,
+        "incremental": true
+      },
+    "include": [
+        "**/*.ts",
+        "**/*.d.ts",
+        "lib/init-templates/*/*/add-project.hook.ts"
+    ],
+    "exclude": [
+        "lib/init-templates/*/typescript/**/*.ts"
+    ]
+}
+
diff --git a/packages/aws-cdk/README.md b/packages/aws-cdk/README.md
index f50fb6509b1f9..265f4a39f1b7c 100644
--- a/packages/aws-cdk/README.md
+++ b/packages/aws-cdk/README.md
@@ -19,6 +19,7 @@ Command                               | Description
 [`cdk synth`](#cdk-synthesize)        | Synthesize a CDK app to CloudFormation template(s)
 [`cdk diff`](#cdk-diff)               | Diff stacks against current state
 [`cdk deploy`](#cdk-deploy)           | Deploy a stack into an AWS account
+[`cdk import`](#cdk-import)           | Import existing AWS resources into a CDK stack
 [`cdk watch`](#cdk-watch)             | Watches a CDK app for deployable and hotswappable changes
 [`cdk destroy`](#cdk-destroy)         | Deletes a stack from an AWS account
 [`cdk bootstrap`](#cdk-bootstrap)     | Deploy a toolkit stack to support deploying large stacks & artifacts
@@ -450,6 +451,53 @@ $ cdk watch --no-logs
 **Note**: This command is considered experimental,
 and might have breaking changes in the future.
 
+### `cdk import`
+
+Sometimes you want to import AWS resources that were created using other means
+into a CDK stack. For some resources (like Roles, Lambda Functions, Event Rules,
+...), it's feasible to create new versions in CDK and then delete the old
+versions. For other resources, this is not possible: stateful resources like S3
+Buckets, DynamoDB tables, etc., cannot be easily deleted without impact on the
+service.
+
+`cdk import`, which uses [CloudFormation resource
+imports](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import.html),
+makes it possible to bring an existing resource under CDK/CloudFormation's
+management. See the [list of resources that can be imported here](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html).
+
+To import an existing resource to a CDK stack, follow the following steps:
+
+1. Run a `cdk diff` to make sure there are no pending changes to the CDK stack you want to
+   import resources into. The only changes allowed in an "import" operation are
+   the addition of new resources which you want to import.
+2. Add constructs for the resources you want to import to your Stack (for example,
+   for an S3 bucket, add something like `new s3.Bucket(this, 'ImportedS3Bucket', {});`).
+   **Do not add any other changes!** You must also make sure to exactly model the state
+   that the resource currently has. For the example of the Bucket, be sure to
+   include KMS keys, life cycle policies, and anything else that's relevant
+   about the bucket. If you do not, subsequent update operations may not do what
+   you expect.
+3. Run the `cdk import` - if there are multiple stacks in the CDK app, pass a specific
+   stack name as an argument.
+4. The CLI will prompt you to pass in the actual names of the resources you are
+   importing. After you supply it, the import starts.
+5. When `cdk import` reports success, the resource is managed by CDK. Any subsequent
+   changes in the construct configuration will be reflected on the resource.
+
+#### Limitations
+
+This feature is currently in preview. Be aware of the following limitations:
+
+- Importing resources in nested stacks is not possible.
+- Uses the deploy role credentials (necessary to read the encrypted staging
+  bucket). Requires a new version (version 12) of the bootstrap stack, for the added
+  IAM permissions to the `deploy-role`.
+- There is no check on whether the properties you specify are correct and complete
+  for the imported resource. Try starting a drift detection operation after importing.
+- Resources that depend on other resources must all be imported together, or one-by-one
+  in the right order. The CLI will not help you import dependent resources in the right
+  order, the CloudFormation deployment will fail with unresolved references.
+
 ### `cdk destroy`
 
 Deletes a stack from it's environment. This will cause the resources in the stack to be destroyed (unless they were
@@ -521,10 +569,10 @@ NOTICES
 16603   Toggling off auto_delete_objects for Bucket empties the bucket
 
         Overview: If a stack is deployed with an S3 bucket with
-                  auto_delete_objects=True, and then re-deployed with 
-                  auto_delete_objects=False, all the objects in the bucket 
+                  auto_delete_objects=True, and then re-deployed with
+                  auto_delete_objects=False, all the objects in the bucket
                   will be deleted.
-                 
+
         Affected versions: <1.126.0.
 
         More information at: https://github.com/aws/aws-cdk/issues/16603
@@ -533,12 +581,12 @@ NOTICES
 17061   Error when building EKS cluster with monocdk import
 
         Overview: When using monocdk/aws-eks to build a stack containing
-                  an EKS cluster, error is thrown about missing 
+                  an EKS cluster, error is thrown about missing
                   lambda-layer-node-proxy-agent/layer/package.json.
-         
+
         Affected versions: >=1.126.0 <=1.130.0.
 
-        More information at: https://github.com/aws/aws-cdk/issues/17061 
+        More information at: https://github.com/aws/aws-cdk/issues/17061
 
 
 If you don’t want to see an notice anymore, use "cdk acknowledge ID". For example, "cdk acknowledge 16603".
@@ -580,7 +628,7 @@ $cdk acknowledge 16603
 ### `cdk notices`
 
 List the notices that are relevant to the current CDK repository, regardless of context flags or notices that
-have been acknowledged: 
+have been acknowledged:
 
 ```console
 $ cdk notices
@@ -589,9 +637,9 @@ NOTICES
 
 16603   Toggling off auto_delete_objects for Bucket empties the bucket
 
-        Overview: if a stack is deployed with an S3 bucket with 
-                  auto_delete_objects=True, and then re-deployed with 
-                  auto_delete_objects=False, all the objects in the bucket 
+        Overview: if a stack is deployed with an S3 bucket with
+                  auto_delete_objects=True, and then re-deployed with
+                  auto_delete_objects=False, all the objects in the bucket
                   will be deleted.
 
         Affected versions: framework: <=2.15.0 >=2.10.0
diff --git a/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml b/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml
index 15d7a22f1edfd..d4f674dfa2cac 100644
--- a/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml
+++ b/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml
@@ -453,6 +453,8 @@ Resources:
                   - cloudformation:DeleteStack
                   - cloudformation:UpdateTerminationProtection
                   - sts:GetCallerIdentity
+                  # `cdk import`
+                  - cloudformation:GetTemplateSummary
                 Resource: "*"
                 Effect: Allow
               - Sid: CliStagingBucket
@@ -507,7 +509,7 @@ Resources:
       Type: String
       Name:
         Fn::Sub: '/cdk-bootstrap/${Qualifier}/version'
-      Value: '11'
+      Value: '12'
 Outputs:
   BucketName:
     Description: The name of the S3 bucket owned by the CDK toolkit stack
diff --git a/packages/aws-cdk/lib/api/cloudformation-deployments.ts b/packages/aws-cdk/lib/api/cloudformation-deployments.ts
index ebf40bbb7442b..5594c71a42630 100644
--- a/packages/aws-cdk/lib/api/cloudformation-deployments.ts
+++ b/packages/aws-cdk/lib/api/cloudformation-deployments.ts
@@ -6,10 +6,10 @@ import { publishAssets } from '../util/asset-publishing';
 import { Mode } from './aws-auth/credentials';
 import { ISDK } from './aws-auth/sdk';
 import { SdkProvider } from './aws-auth/sdk-provider';
-import { deployStack, DeployStackResult, destroyStack } from './deploy-stack';
+import { deployStack, DeployStackResult, destroyStack, makeBodyParameterAndUpload } from './deploy-stack';
 import { loadCurrentTemplateWithNestedStacks, loadCurrentTemplate } from './nested-stack-helpers';
 import { ToolkitInfo } from './toolkit-info';
-import { CloudFormationStack, Template } from './util/cloudformation';
+import { CloudFormationStack, Template, ResourcesToImport, ResourceIdentifierSummaries } from './util/cloudformation';
 import { StackActivityProgress } from './util/cloudformation/stack-activity-monitor';
 import { replaceEnvPlaceholders } from './util/placeholders';
 
@@ -224,6 +224,18 @@ export interface DeployStackOptions {
    * @default - nothing extra is appended to the User-Agent header
    */
   readonly extraUserAgent?: string;
+
+  /**
+   * List of existing resources to be IMPORTED into the stack, instead of being CREATED
+   */
+  readonly resourcesToImport?: ResourcesToImport;
+
+  /**
+   * If present, use this given template instead of the stored one
+   *
+   * @default - Use the stored template
+   */
+  readonly overrideTemplate?: any;
 }
 
 export interface DestroyStackOptions {
@@ -280,23 +292,52 @@ export class CloudFormationDeployments {
   }
 
   public async readCurrentTemplateWithNestedStacks(rootStackArtifact: cxapi.CloudFormationStackArtifact): Promise<Template> {
-    const sdk = await this.prepareSdkWithLookupOrDeployRole(rootStackArtifact);
+    const sdk = (await this.prepareSdkWithLookupOrDeployRole(rootStackArtifact)).stackSdk;
     return (await loadCurrentTemplateWithNestedStacks(rootStackArtifact, sdk)).deployedTemplate;
   }
 
   public async readCurrentTemplate(stackArtifact: cxapi.CloudFormationStackArtifact): Promise<Template> {
     debug(`Reading existing template for stack ${stackArtifact.displayName}.`);
-    const sdk = await this.prepareSdkWithLookupOrDeployRole(stackArtifact);
+    const sdk = (await this.prepareSdkWithLookupOrDeployRole(stackArtifact)).stackSdk;
     return loadCurrentTemplate(stackArtifact, sdk);
   }
 
+  public async resourceIdentifierSummaries(
+    stackArtifact: cxapi.CloudFormationStackArtifact,
+    toolkitStackName?: string,
+  ): Promise<ResourceIdentifierSummaries> {
+    debug(`Retrieving template summary for stack ${stackArtifact.displayName}.`);
+    // Currently, needs to use `deploy-role` since it may need to read templates in the staging
+    // bucket which have been encrypted with a KMS key (and lookup-role may not read encrypted things)
+    const { stackSdk, resolvedEnvironment } = await this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
+    const cfn = stackSdk.cloudFormation();
+
+    const toolkitInfo = await ToolkitInfo.lookup(resolvedEnvironment, stackSdk, toolkitStackName);
+
+    // Upload the template, if necessary, before passing it to CFN
+    const cfnParam = await makeBodyParameterAndUpload(
+      stackArtifact,
+      resolvedEnvironment,
+      toolkitInfo,
+      this.sdkProvider,
+      stackSdk);
+
+    const response = await cfn.getTemplateSummary(cfnParam).promise();
+    if (!response.ResourceIdentifierSummaries) {
+      debug('GetTemplateSummary API call did not return "ResourceIdentifierSummaries"');
+    }
+    return response.ResourceIdentifierSummaries ?? [];
+  }
+
   public async deployStack(options: DeployStackOptions): Promise<DeployStackResult> {
     const { stackSdk, resolvedEnvironment, cloudFormationRoleArn } = await this.prepareSdkFor(options.stack, options.roleArn);
 
     const toolkitInfo = await ToolkitInfo.lookup(resolvedEnvironment, stackSdk, options.toolkitStackName);
 
-    // Publish any assets before doing the actual deploy
-    await this.publishStackAssets(options.stack, toolkitInfo);
+    // Publish any assets before doing the actual deploy (do not publish any assets on import operation)
+    if (options.resourcesToImport === undefined) {
+      await this.publishStackAssets(options.stack, toolkitInfo);
+    }
 
     // Do a verification of the bootstrap stack version
     await this.validateBootstrapStackVersion(
@@ -327,6 +368,8 @@ export class CloudFormationDeployments {
       rollback: options.rollback,
       hotswap: options.hotswap,
       extraUserAgent: options.extraUserAgent,
+      resourcesToImport: options.resourcesToImport,
+      overrideTemplate: options.overrideTemplate,
     });
   }
 
@@ -348,16 +391,19 @@ export class CloudFormationDeployments {
     return stack.exists;
   }
 
-  private async prepareSdkWithLookupOrDeployRole(stackArtifact: cxapi.CloudFormationStackArtifact): Promise<ISDK> {
+  private async prepareSdkWithLookupOrDeployRole(stackArtifact: cxapi.CloudFormationStackArtifact): Promise<PreparedSdkForEnvironment> {
     // try to assume the lookup role
     try {
       const result = await prepareSdkWithLookupRoleFor(this.sdkProvider, stackArtifact);
       if (result.didAssumeRole) {
-        return result.sdk;
+        return {
+          resolvedEnvironment: result.resolvedEnvironment,
+          stackSdk: result.sdk,
+        };
       }
     } catch { }
     // fall back to the deploy role
-    return (await this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading)).stackSdk;
+    return this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
   }
 
   /**
diff --git a/packages/aws-cdk/lib/api/deploy-stack.ts b/packages/aws-cdk/lib/api/deploy-stack.ts
index 76b9386cc9550..f87fa183b329b 100644
--- a/packages/aws-cdk/lib/api/deploy-stack.ts
+++ b/packages/aws-cdk/lib/api/deploy-stack.ts
@@ -1,5 +1,6 @@
 import * as cxapi from '@aws-cdk/cx-api';
 import * as chalk from 'chalk';
+import * as fs from 'fs-extra';
 import * as uuid from 'uuid';
 import { addMetadataAssetsToManifest } from '../assets';
 import { Tag } from '../cdk-toolkit';
@@ -15,7 +16,7 @@ import { ICON } from './hotswap/common';
 import { ToolkitInfo } from './toolkit-info';
 import {
   changeSetHasNoChanges, CloudFormationStack, TemplateParameters, waitForChangeSet,
-  waitForStackDeploy, waitForStackDelete, ParameterValues, ParameterChanges,
+  waitForStackDeploy, waitForStackDelete, ParameterValues, ParameterChanges, ResourcesToImport,
 } from './util/cloudformation';
 import { StackActivityMonitor, StackActivityProgress } from './util/cloudformation/stack-activity-monitor';
 
@@ -189,6 +190,19 @@ export interface DeployStackOptions {
    * @default - nothing extra is appended to the User-Agent header
    */
   readonly extraUserAgent?: string;
+
+  /**
+   * If set, change set of type IMPORT will be created, and resourcesToImport
+   * passed to it.
+   */
+  readonly resourcesToImport?: ResourcesToImport;
+
+  /**
+   * If present, use this given template instead of the stored one
+   *
+   * @default - Use the stored template
+   */
+  readonly overrideTemplate?: any;
 }
 
 const LARGE_TEMPLATE_SIZE_KB = 50;
@@ -245,7 +259,13 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
     debug(`${deployName}: deploying...`);
   }
 
-  const bodyParameter = await makeBodyParameter(stackArtifact, options.resolvedEnvironment, legacyAssets, options.toolkitInfo, options.sdk);
+  const bodyParameter = await makeBodyParameter(
+    stackArtifact,
+    options.resolvedEnvironment,
+    legacyAssets,
+    options.toolkitInfo,
+    options.sdk,
+    options.overrideTemplate);
   await publishAssets(legacyAssets.toManifest(stackArtifact.assembly.directory), options.sdkProvider, stackEnv);
 
   if (options.hotswap) {
@@ -298,7 +318,8 @@ async function prepareAndExecuteChangeSet(
   const changeSet = await cfn.createChangeSet({
     StackName: deployName,
     ChangeSetName: changeSetName,
-    ChangeSetType: update ? 'UPDATE' : 'CREATE',
+    ChangeSetType: options.resourcesToImport ? 'IMPORT' : update ? 'UPDATE' : 'CREATE',
+    ResourcesToImport: options.resourcesToImport,
     Description: `CDK Changeset for execution ${executionId}`,
     TemplateBody: bodyParameter.TemplateBody,
     TemplateURL: bodyParameter.TemplateURL,
@@ -386,15 +407,17 @@ async function makeBodyParameter(
   resolvedEnvironment: cxapi.Environment,
   assetManifest: AssetManifestBuilder,
   toolkitInfo: ToolkitInfo,
-  sdk: ISDK): Promise<TemplateBodyParameter> {
+  sdk: ISDK,
+  overrideTemplate?: any,
+): Promise<TemplateBodyParameter> {
 
   // If the template has already been uploaded to S3, just use it from there.
-  if (stack.stackTemplateAssetObjectUrl) {
+  if (stack.stackTemplateAssetObjectUrl && !overrideTemplate) {
     return { TemplateURL: restUrlFromManifest(stack.stackTemplateAssetObjectUrl, resolvedEnvironment, sdk) };
   }
 
   // Otherwise, pass via API call (if small) or upload here (if large)
-  const templateJson = toYAML(stack.template);
+  const templateJson = toYAML(overrideTemplate ?? stack.template);
 
   if (templateJson.length <= LARGE_TEMPLATE_SIZE_KB * 1024) {
     return { TemplateBody: templateJson };
@@ -413,8 +436,15 @@ async function makeBodyParameter(
   const templateHash = contentHash(templateJson);
   const key = `cdk/${stack.id}/${templateHash}.yml`;
 
+  let templateFile = stack.templateFile;
+  if (overrideTemplate) {
+    // Add a variant of this template
+    templateFile = `${stack.templateFile}-${templateHash}.yaml`;
+    await fs.writeFile(templateFile, templateJson, { encoding: 'utf-8' });
+  }
+
   assetManifest.addFileAsset(templateHash, {
-    path: stack.templateFile,
+    path: templateFile,
   }, {
     bucketName: toolkitInfo.bucketName,
     objectKey: key,
@@ -425,6 +455,33 @@ async function makeBodyParameter(
   return { TemplateURL: templateURL };
 }
 
+/**
+ * Prepare a body parameter for CFN, performing the upload
+ *
+ * Return it as-is if it is small enough to pass in the API call,
+ * upload to S3 and return the coordinates if it is not.
+ */
+export async function makeBodyParameterAndUpload(
+  stack: cxapi.CloudFormationStackArtifact,
+  resolvedEnvironment: cxapi.Environment,
+  toolkitInfo: ToolkitInfo,
+  sdkProvider: SdkProvider,
+  sdk: ISDK,
+  overrideTemplate?: any): Promise<TemplateBodyParameter> {
+
+  // We don't have access to the actual asset manifest here, so pretend that the
+  // stack doesn't have a pre-published URL.
+  const forceUploadStack = Object.create(stack, {
+    stackTemplateAssetObjectUrl: { value: undefined },
+  });
+
+  const builder = new AssetManifestBuilder();
+  const bodyparam = await makeBodyParameter(forceUploadStack, resolvedEnvironment, builder, toolkitInfo, sdk, overrideTemplate);
+  const manifest = builder.toManifest(stack.assembly.directory);
+  await publishAssets(manifest, sdkProvider, resolvedEnvironment, { quiet: true });
+  return bodyparam;
+}
+
 export interface DestroyStackOptions {
   /**
    * The stack to be destroyed
diff --git a/packages/aws-cdk/lib/api/util/cloudformation.ts b/packages/aws-cdk/lib/api/util/cloudformation.ts
index b3b5660d727c4..6e84e542045a7 100644
--- a/packages/aws-cdk/lib/api/util/cloudformation.ts
+++ b/packages/aws-cdk/lib/api/util/cloudformation.ts
@@ -16,6 +16,10 @@ interface TemplateParameter {
   [key: string]: any;
 }
 
+export type ResourceIdentifierProperties = CloudFormation.ResourceIdentifierProperties;
+export type ResourceIdentifierSummaries = CloudFormation.ResourceIdentifierSummaries;
+export type ResourcesToImport = CloudFormation.ResourcesToImport;
+
 /**
  * Represents an (existing) Stack in CloudFormation
  *
diff --git a/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts b/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts
index 748de9b664610..d67105ed46a88 100644
--- a/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts
+++ b/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts
@@ -665,6 +665,7 @@ export class CurrentActivityPrinter extends ActivityPrinterBase {
 
     // Display in the same block space, otherwise we're going to have silly empty lines.
     this.block.displayLines(lines);
+    this.block.removeEmptyLines(lines);
   }
 
   private progressBar(width: number) {
diff --git a/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts b/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts
index e26886225eea8..76069868cf99b 100644
--- a/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts
+++ b/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts
@@ -34,7 +34,7 @@ export class StackStatus {
   }
 
   get isDeploySuccess(): boolean {
-    return !this.isNotFound && (this.name === 'CREATE_COMPLETE' || this.name === 'UPDATE_COMPLETE');
+    return !this.isNotFound && (this.name === 'CREATE_COMPLETE' || this.name === 'UPDATE_COMPLETE' || this.name === 'IMPORT_COMPLETE');
   }
 
   public toString(): string {
diff --git a/packages/aws-cdk/lib/api/util/display.ts b/packages/aws-cdk/lib/api/util/display.ts
index d7b136a36f178..a7071ed6a12a4 100644
--- a/packages/aws-cdk/lib/api/util/display.ts
+++ b/packages/aws-cdk/lib/api/util/display.ts
@@ -16,8 +16,13 @@ export class RewritableBlock {
     return this.stream.columns;
   }
 
+  public get height() {
+    // Might get changed if the user resizes the terminal
+    return this.stream.rows;
+  }
+
   public displayLines(lines: string[]) {
-    lines = terminalWrap(this.width, expandNewlines(lines));
+    lines = terminalWrap(this.width, expandNewlines(lines)).slice(0, getMaxBlockHeight(this.height, this.lastHeight, lines));
 
     this.stream.write(cursorUp(this.lastHeight));
     for (const line of lines) {
@@ -31,6 +36,10 @@ export class RewritableBlock {
     // The block can only ever get bigger
     this.lastHeight = Math.max(this.lastHeight, lines.length);
   }
+
+  public removeEmptyLines(lines: string[]) {
+    this.stream.write(cursorUp(this.lastHeight - lines.length));
+  }
 }
 
 const ESC = '\u001b';
@@ -73,4 +82,9 @@ function expandNewlines(lines: string[]): string[] {
     ret.push(...line.split('\n'));
   }
   return ret;
+}
+
+function getMaxBlockHeight(windowHeight: number | undefined, lastHeight: number, lines: string[]): number {
+  if (windowHeight === undefined) { return Math.max(lines.length, lastHeight); }
+  return lines.length < windowHeight ? lines.length : windowHeight - 1;
 }
\ No newline at end of file
diff --git a/packages/aws-cdk/lib/cdk-toolkit.ts b/packages/aws-cdk/lib/cdk-toolkit.ts
index 3d9901a0610fe..3e7c6f38dafbc 100644
--- a/packages/aws-cdk/lib/cdk-toolkit.ts
+++ b/packages/aws-cdk/lib/cdk-toolkit.ts
@@ -15,6 +15,7 @@ import { findCloudWatchLogGroups } from './api/logs/find-cloudwatch-logs';
 import { CloudWatchLogEventMonitor } from './api/logs/logs-monitor';
 import { StackActivityProgress } from './api/util/cloudformation/stack-activity-monitor';
 import { printSecurityDiff, printStackDiff, RequireApproval } from './diff';
+import { ResourceImporter } from './import';
 import { data, debug, error, highlight, print, success, warning } from './logging';
 import { deserializeStructure, serializeStructure } from './serialize';
 import { Configuration, PROJECT_CONFIG } from './settings';
@@ -360,6 +361,83 @@ export class CdkToolkit {
     });
   }
 
+  public async import(options: ImportOptions) {
+    print(chalk.grey("The 'cdk import' feature is currently in preview."));
+    const stacks = await this.selectStacksForDeploy(options.selector, true, true);
+
+    if (stacks.stackCount > 1) {
+      throw new Error(`Stack selection is ambiguous, please choose a specific stack for import [${stacks.stackArtifacts.map(x => x.id).join(', ')}]`);
+    }
+
+    if (!process.stdout.isTTY && !options.resourceMappingFile) {
+      throw new Error('--resource-mapping-file is required when input is not a terminal');
+    }
+
+    const stack = stacks.stackArtifacts[0];
+
+    highlight(stack.displayName);
+
+    const resourceImporter = new ResourceImporter(stack, this.props.cloudFormation, {
+      toolkitStackName: options.toolkitStackName,
+    });
+    const { additions, hasNonAdditions } = await resourceImporter.discoverImportableResources(options.force);
+    if (additions.length === 0) {
+      warning('%s: no new resources compared to the currently deployed stack, skipping import.', chalk.bold(stack.displayName));
+      return;
+    }
+
+    // Prepare a mapping of physical resources to CDK constructs
+    const actualImport = !options.resourceMappingFile
+      ? await resourceImporter.askForResourceIdentifiers(additions)
+      : await resourceImporter.loadResourceIdentifiers(additions, options.resourceMappingFile);
+
+    if (actualImport.importResources.length === 0) {
+      warning('No resources selected for import.');
+      return;
+    }
+
+    // If "--create-resource-mapping" option was passed, write the resource mapping to the given file and exit
+    if (options.recordResourceMapping) {
+      const outputFile = options.recordResourceMapping;
+      fs.ensureFileSync(outputFile);
+      await fs.writeJson(outputFile, actualImport.resourceMap, {
+        spaces: 2,
+        encoding: 'utf8',
+      });
+      print('%s: mapping file written.', outputFile);
+      return;
+    }
+
+    // Import the resources according to the given mapping
+    print('%s: importing resources into stack...', chalk.bold(stack.displayName));
+    const tags = tagsForStack(stack);
+    await resourceImporter.importResources(actualImport, {
+      stack,
+      deployName: stack.stackName,
+      roleArn: options.roleArn,
+      toolkitStackName: options.toolkitStackName,
+      tags,
+      execute: options.execute,
+      changeSetName: options.changeSetName,
+      usePreviousParameters: true,
+      progress: options.progress,
+      rollback: options.rollback,
+    });
+
+    // Notify user of next steps
+    print(
+      `Import operation complete. We recommend you run a ${chalk.blueBright('drift detection')} operation `
+      + 'to confirm your CDK app resource definitions are up-to-date. Read more here: '
+      + chalk.underline.blueBright('https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html'));
+    if (actualImport.importResources.length < additions.length) {
+      print('');
+      warning(`Some resources were skipped. Run another ${chalk.blueBright('cdk import')} or a ${chalk.blueBright('cdk deploy')} to bring the stack up-to-date with your CDK app definition.`);
+    } else if (hasNonAdditions) {
+      print('');
+      warning(`Your app has pending updates or deletes excluded from this import operation. Run a ${chalk.blueBright('cdk deploy')} to bring the stack up-to-date with your CDK app definition.`);
+    }
+  }
+
   public async destroy(options: DestroyOptions) {
     let stacks = await this.selectStacksForDestroy(options.selector, options.exclusively);
 
@@ -691,19 +769,12 @@ export interface DiffOptions {
   securityOnly?: boolean;
 }
 
-interface WatchOptions {
+interface CfnDeployOptions {
   /**
    * Criteria for selecting stacks to deploy
    */
   selector: StackSelector;
 
-  /**
-   * Only select the given stack
-   *
-   * @default false
-   */
-  exclusively?: boolean;
-
   /**
    * Name of the toolkit stack to use/deploy
    *
@@ -716,11 +787,6 @@ interface WatchOptions {
    */
   roleArn?: string;
 
-  /**
-   * Reuse the assets with the given asset IDs
-   */
-  reuseAssets?: string[];
-
   /**
    * Optional name to use for the CloudFormation change set.
    * If not provided, a name will be generated automatically.
@@ -728,10 +794,11 @@ interface WatchOptions {
   changeSetName?: string;
 
   /**
-   * Always deploy, even if templates are identical.
-   * @default false
+   * Whether to execute the ChangeSet
+   * Not providing `execute` parameter will result in execution of ChangeSet
+   * @default true
    */
-  force?: boolean;
+  execute?: boolean;
 
   /**
    * Display mode for stack deployment progress.
@@ -747,6 +814,26 @@ interface WatchOptions {
    * @default true
    */
   readonly rollback?: boolean;
+}
+
+interface WatchOptions extends Omit<CfnDeployOptions, 'execute'> {
+  /**
+   * Only select the given stack
+   *
+   * @default false
+   */
+  exclusively?: boolean;
+
+  /**
+   * Reuse the assets with the given asset IDs
+   */
+  reuseAssets?: string[];
+
+  /**
+   * Always deploy, even if templates are identical.
+   * @default false
+   */
+  force?: boolean;
 
   /**
    * Whether to perform a 'hotswap' deployment.
@@ -773,7 +860,7 @@ interface WatchOptions {
   readonly traceLogs?: boolean;
 }
 
-export interface DeployOptions extends WatchOptions {
+export interface DeployOptions extends CfnDeployOptions, WatchOptions {
   /**
    * ARNs of SNS topics that CloudFormation will notify with stack related events
    */
@@ -791,13 +878,6 @@ export interface DeployOptions extends WatchOptions {
    */
   tags?: Tag[];
 
-  /**
-   * Whether to execute the ChangeSet
-   * Not providing `execute` parameter will result in execution of ChangeSet
-   * @default true
-   */
-  execute?: boolean;
-
   /**
    * Additional parameters for CloudFormation at deploy time
    * @default {}
@@ -851,6 +931,30 @@ export interface DeployOptions extends WatchOptions {
   readonly cloudWatchLogMonitor?: CloudWatchLogEventMonitor;
 }
 
+export interface ImportOptions extends CfnDeployOptions {
+  /**
+   * Build a physical resource mapping and write it to the given file, without performing the actual import operation
+   *
+   * @default - No file
+   */
+
+  readonly recordResourceMapping?: string;
+
+  /**
+   * Path to a file with with the physical resource mapping to CDK constructs in JSON format
+   *
+   * @default - No mapping file
+   */
+  readonly resourceMappingFile?: string;
+
+  /**
+   * Allow non-addition changes to the template
+   *
+   * @default false
+   */
+  readonly force?: boolean;
+}
+
 export interface DestroyOptions {
   /**
    * Criteria for selecting stacks to deploy
diff --git a/packages/aws-cdk/lib/cli.ts b/packages/aws-cdk/lib/cli.ts
index 1a20ed9edf279..684b415dd2524 100644
--- a/packages/aws-cdk/lib/cli.ts
+++ b/packages/aws-cdk/lib/cli.ts
@@ -148,6 +148,35 @@ async function parseCommandLineArguments() {
           "Only in effect if specified alongside the '--watch' option",
       }),
     )
+    .command('import [STACK]', 'Import existing resource(s) into the given STACK', (yargs: Argv) => yargs
+      .option('execute', { type: 'boolean', desc: 'Whether to execute ChangeSet (--no-execute will NOT execute the ChangeSet)', default: true })
+      .option('change-set-name', { type: 'string', desc: 'Name of the CloudFormation change set to create' })
+      .option('toolkit-stack-name', { type: 'string', desc: 'The name of the CDK toolkit stack to create', requiresArg: true })
+      .option('rollback', {
+        type: 'boolean',
+        desc: "Rollback stack to stable state on failure. Defaults to 'true', iterate more rapidly with --no-rollback or -R. " +
+          'Note: do **not** disable this flag for deployments with resource replacements, as that will always fail',
+      })
+      .option('force', {
+        alias: 'f',
+        type: 'boolean',
+        desc: 'Do not abort if the template diff includes updates or deletes. This is probably safe but we\'re not sure, let us know how it goes.',
+      })
+      .option('record-resource-mapping', {
+        type: 'string',
+        alias: 'r',
+        requiresArg: true,
+        desc: 'If specified, CDK will generate a mapping of existing physical resources to CDK resources to be imported as. The mapping ' +
+          'will be written in the given file path. No actual import operation will be performed',
+      })
+      .option('resource-mapping', {
+        type: 'string',
+        alias: 'm',
+        requiresArg: true,
+        desc: 'If specified, CDK will use the given file to map physical resources to CDK resources for import, instead of interactively ' +
+          'asking the user. Can be run from scripts',
+      }),
+    )
     .command('watch [STACKS..]', "Shortcut for 'deploy --watch'", (yargs: Argv) => yargs
       // I'm fairly certain none of these options, present for 'deploy', make sense for 'watch':
       // .option('all', { type: 'boolean', default: false, desc: 'Deploy all available stacks' })
@@ -343,8 +372,8 @@ async function initCommandLine() {
       throw new Error('You must either specify a list of Stacks or the `--all` argument');
     }
 
-    args.STACKS = args.STACKS || [];
-    args.ENVIRONMENTS = args.ENVIRONMENTS || [];
+    args.STACKS = args.STACKS ?? (args.STACK ? [args.STACK] : []);
+    args.ENVIRONMENTS = args.ENVIRONMENTS ?? [];
 
     const selector: StackSelector = {
       allTopLevel: args.all,
@@ -446,6 +475,20 @@ async function initCommandLine() {
           traceLogs: args.logs,
         });
 
+      case 'import':
+        return cli.import({
+          selector,
+          toolkitStackName,
+          roleArn: args.roleArn,
+          execute: args.execute,
+          changeSetName: args.changeSetName,
+          progress: configuration.settings.get(['progress']),
+          rollback: configuration.settings.get(['rollback']),
+          recordResourceMapping: args['record-resource-mapping'],
+          resourceMappingFile: args['resource-mapping'],
+          force: args.force,
+        });
+
       case 'watch':
         return cli.watch({
           selector,
diff --git a/packages/aws-cdk/lib/import.ts b/packages/aws-cdk/lib/import.ts
new file mode 100644
index 0000000000000..0a5795313fbc0
--- /dev/null
+++ b/packages/aws-cdk/lib/import.ts
@@ -0,0 +1,367 @@
+import * as cfnDiff from '@aws-cdk/cloudformation-diff';
+import { ResourceDifference } from '@aws-cdk/cloudformation-diff';
+import * as cxapi from '@aws-cdk/cx-api';
+import * as chalk from 'chalk';
+import * as fs from 'fs-extra';
+import * as promptly from 'promptly';
+import { CloudFormationDeployments, DeployStackOptions } from './api/cloudformation-deployments';
+import { ResourceIdentifierProperties, ResourcesToImport } from './api/util/cloudformation';
+import { error, print, success, warning } from './logging';
+
+/**
+ * Parameters that uniquely identify a physical resource of a given type
+ * for the import operation, example:
+ *
+ * ```
+ * {
+ *   "AWS::S3::Bucket": ["BucketName"],
+ *   "AWS::IAM::Role": ["RoleName"],
+ *   "AWS::EC2::VPC": ["VpcId"]
+ * }
+ * ```
+ */
+export type ResourceIdentifiers = { [resourceType: string]: string[] };
+
+/**
+ * Mapping of CDK resources (L1 constructs) to physical resources to be imported
+ * in their place, example:
+ *
+ * ```
+ * {
+ *   "MyStack/MyS3Bucket/Resource": {
+ *     "BucketName": "my-manually-created-s3-bucket"
+ *   },
+ *   "MyStack/MyVpc/Resource": {
+ *     "VpcId": "vpc-123456789"
+ *   }
+ * }
+ * ```
+ */
+export type ResourceMap = { [logicalResource: string]: ResourceIdentifierProperties };
+
+export interface ResourceImporterOptions {
+  /**
+   * Name of toolkit stack if non-default
+   *
+   * @default - Default toolkit stack name
+   */
+  readonly toolkitStackName?: string;
+}
+
+/**
+ * Resource importing utility class
+ *
+ * - Determines the resources added to a template (compared to the deployed version)
+ * - Look up the identification information
+ *   - Load them from a file, or
+ *   - Ask the user, based on information supplied to us by CloudFormation's GetTemplateSummary
+ * - Translate the input to a structure expected by CloudFormation, update the template to add the
+ *   importable resources, then run an IMPORT changeset.
+ */
+export class ResourceImporter {
+  private _currentTemplate: any;
+
+  constructor(
+    private readonly stack: cxapi.CloudFormationStackArtifact,
+    private readonly cfn: CloudFormationDeployments,
+    private readonly options: ResourceImporterOptions = {}) { }
+
+  /**
+   * Ask the user for resources to import
+   */
+  public async askForResourceIdentifiers(available: ImportableResource[]): Promise<ImportMap> {
+    const ret: ImportMap = { importResources: [], resourceMap: {} };
+    const resourceIdentifiers = await this.resourceIdentifiers();
+
+    for (const resource of available) {
+      const identifier = await this.askForResourceIdentifier(resourceIdentifiers, resource);
+      if (!identifier) {
+        continue;
+      }
+
+      ret.importResources.push(resource);
+      ret.resourceMap[resource.logicalId] = identifier;
+    }
+
+    return ret;
+  }
+
+  /**
+   * Load the resources to import from a file
+   */
+  public async loadResourceIdentifiers(available: ImportableResource[], filename: string): Promise<ImportMap> {
+    const contents = await fs.readJson(filename);
+
+    const ret: ImportMap = { importResources: [], resourceMap: {} };
+    for (const resource of available) {
+      const descr = this.describeResource(resource.logicalId);
+      const idProps = contents[resource.logicalId];
+      if (idProps) {
+        print('%s: importing using %s', chalk.blue(descr), chalk.blue(fmtdict(idProps)));
+
+        ret.importResources.push(resource);
+        ret.resourceMap[resource.logicalId] = idProps;
+        delete contents[resource.logicalId];
+      } else {
+        print('%s: skipping', chalk.blue(descr));
+      }
+    }
+
+    const unknown = Object.keys(contents);
+    if (unknown.length > 0) {
+      warning(`Unrecognized resource identifiers in mapping file: ${unknown.join(', ')}`);
+    }
+
+    return ret;
+  }
+
+  /**
+   * Based on the provided resource mapping, prepare CFN structures for import (template,
+   * ResourcesToImport structure) and perform the import operation (CloudFormation deployment)
+   *
+   * @param resourceMap Mapping from CDK construct tree path to physical resource import identifiers
+   * @param options Options to pass to CloudFormation deploy operation
+   */
+  public async importResources(importMap: ImportMap, options: DeployStackOptions) {
+    const resourcesToImport: ResourcesToImport = await this.makeResourcesToImport(importMap);
+    const updatedTemplate = await this.currentTemplateWithAdditions(importMap.importResources);
+
+    try {
+      const result = await this.cfn.deployStack({
+        ...options,
+        overrideTemplate: updatedTemplate,
+        resourcesToImport,
+      });
+
+      const message = result.noOp
+        ? ' ✅  %s (no changes)'
+        : ' ✅  %s';
+
+      success('\n' + message, options.stack.displayName);
+    } catch (e) {
+      error('\n ❌  %s failed: %s', chalk.bold(options.stack.displayName), e);
+      throw e;
+    }
+  }
+
+  /**
+   * Perform a diff between the currently running and the new template, enusre that it is valid
+   * for importing and return a list of resources that are being added in the new version
+   *
+   * @return mapping logicalResourceId -> resourceDifference
+   */
+  public async discoverImportableResources(allowNonAdditions = false): Promise<DiscoverImportableResourcesResult> {
+    const currentTemplate = await this.currentTemplate();
+
+    const diff = cfnDiff.diffTemplate(currentTemplate, this.stack.template);
+
+    // Ignore changes to CDKMetadata
+    const resourceChanges = Object.entries(diff.resources.changes)
+      .filter(([logicalId, _]) => logicalId !== 'CDKMetadata');
+
+    // Split the changes into additions and non-additions. Imports only make sense
+    // for newly-added resources.
+    const nonAdditions = resourceChanges.filter(([_, dif]) => !dif.isAddition);
+    const additions = resourceChanges.filter(([_, dif]) => dif.isAddition);
+
+    if (nonAdditions.length) {
+      const offendingResources = nonAdditions.map(([logId, _]) => this.describeResource(logId));
+
+      if (allowNonAdditions) {
+        warning(`Ignoring updated/deleted resources (--force): ${offendingResources.join(', ')}`);
+      } else {
+        throw new Error('No resource updates or deletes are allowed on import operation. Make sure to resolve pending changes ' +
+                        `to existing resources, before attempting an import. Updated/deleted resources: ${offendingResources.join(', ')} (--force to override)`);
+      }
+    }
+
+    // Resources in the new template, that are not present in the current template, are a potential import candidates
+    return {
+      additions: additions.map(([logicalId, resourceDiff]) => ({
+        logicalId,
+        resourceDiff,
+        resourceDefinition: addDefaultDeletionPolicy(this.stack.template?.Resources?.[logicalId] ?? {}),
+      })),
+      hasNonAdditions: nonAdditions.length > 0,
+    };
+  }
+
+  /**
+   * Get currently deployed template of the given stack (SINGLETON)
+   *
+   * @returns Currently deployed CloudFormation template
+   */
+  private async currentTemplate(): Promise<any> {
+    if (!this._currentTemplate) {
+      this._currentTemplate = await this.cfn.readCurrentTemplate(this.stack);
+    }
+    return this._currentTemplate;
+  }
+
+  /**
+   * Return teh current template, with the given resources added to it
+   */
+  private async currentTemplateWithAdditions(additions: ImportableResource[]): Promise<any> {
+    const template = await this.currentTemplate();
+    if (!template.Resources) {
+      template.Resources = {};
+    }
+
+    for (const add of additions) {
+      template.Resources[add.logicalId] = add.resourceDefinition;
+    }
+
+    return template;
+  }
+
+  /**
+   * Get a list of import identifiers for all resource types used in the given
+   * template that do support the import operation (SINGLETON)
+   *
+   * @returns a mapping from a resource type to a list of property names that together identify the resource for import
+   */
+  private async resourceIdentifiers(): Promise<ResourceIdentifiers> {
+    const ret: ResourceIdentifiers = {};
+    const resourceIdentifierSummaries = await this.cfn.resourceIdentifierSummaries(this.stack, this.options.toolkitStackName);
+    for (const summary of resourceIdentifierSummaries) {
+      if ('ResourceType' in summary && summary.ResourceType && 'ResourceIdentifiers' in summary && summary.ResourceIdentifiers) {
+        ret[summary.ResourceType] = summary.ResourceIdentifiers;
+      }
+    }
+    return ret;
+  }
+
+  private async askForResourceIdentifier(
+    resourceIdentifiers: ResourceIdentifiers,
+    chg: ImportableResource,
+  ): Promise<ResourceIdentifierProperties | undefined> {
+    const resourceName = this.describeResource(chg.logicalId);
+
+    // Skip resources that do not support importing
+    const resourceType = chg.resourceDiff.newResourceType;
+    if (resourceType === undefined || !(resourceType in resourceIdentifiers)) {
+      warning(`${resourceName}: unsupported resource type ${resourceType}, skipping import.`);
+      return undefined;
+    }
+
+    const idProps = resourceIdentifiers[resourceType];
+    const resourceProps = chg.resourceDefinition.Properties ?? {};
+
+    const fixedIdProps = idProps.filter(p => resourceProps[p]);
+    const fixedIdInput: ResourceIdentifierProperties = Object.fromEntries(fixedIdProps.map(p => [p, resourceProps[p]]));
+
+    const missingIdProps = idProps.filter(p => !resourceProps[p]);
+
+    if (missingIdProps.length === 0) {
+      // We can auto-import this, but ask the user to confirm
+      const props = fmtdict(fixedIdInput);
+
+      if (!await promptly.confirm(
+        `${chalk.blue(resourceName)} (${resourceType}): import with ${chalk.yellow(props)} (yes/no) [default: yes]? `,
+        { default: 'yes' },
+      )) {
+        print(chalk.grey(`Skipping import of ${resourceName}`));
+        return undefined;
+      }
+    }
+
+    // Ask the user to provide missing props
+    const userInput: ResourceIdentifierProperties = {};
+    for (const missingIdProp of missingIdProps) {
+      const response = (await promptly.prompt(
+        `${chalk.blue(resourceName)} (${resourceType}): enter ${chalk.blue(missingIdProp)} to import (empty to skip):`,
+        { default: '', trim: true },
+      ));
+      if (!response) {
+        print(chalk.grey(`Skipping import of ${resourceName}`));
+        return undefined;
+      }
+      userInput[missingIdProp] = response;
+    }
+
+    return {
+      ...fixedIdInput,
+      ...userInput,
+    };
+  }
+
+  /**
+   * Convert the internal "resource mapping" structure to CloudFormation accepted "ResourcesToImport" structure
+   */
+  private async makeResourcesToImport(resourceMap: ImportMap): Promise<ResourcesToImport> {
+    return resourceMap.importResources.map(res => ({
+      LogicalResourceId: res.logicalId,
+      ResourceType: res.resourceDiff.newResourceType!,
+      ResourceIdentifier: resourceMap.resourceMap[res.logicalId],
+    }));
+  }
+
+  /**
+   * Convert CloudFormation logical resource ID to CDK construct tree path
+   *
+   * @param logicalId CloudFormation logical ID of the resource (the key in the template's Resources section)
+   * @returns Forward-slash separated path of the resource in CDK construct tree, e.g. MyStack/MyBucket/Resource
+   */
+  private describeResource(logicalId: string): string {
+    return this.stack.template?.Resources?.[logicalId]?.Metadata?.['aws:cdk:path'] ?? logicalId;
+  }
+}
+
+/**
+ * Information about a resource in the template that is importable
+ */
+export interface ImportableResource {
+  /**
+   * The logical ID of the resource
+   */
+  readonly logicalId: string;
+
+  /**
+   * The resource definition in the new template
+   */
+  readonly resourceDefinition: any;
+
+  /**
+   * The diff as reported by `cloudformation-diff`.
+   */
+  readonly resourceDiff: ResourceDifference;
+}
+
+/**
+ * The information necessary to execute an import operation
+ */
+export interface ImportMap {
+  /**
+   * Mapping logical IDs to physical names
+   */
+  readonly resourceMap: ResourceMap;
+
+  /**
+   * The selection of resources we are actually importing
+   *
+   * For each of the resources in this list, there is a corresponding entry in
+   * the `resourceMap` map.
+   */
+  readonly importResources: ImportableResource[];
+}
+
+function fmtdict<A>(xs: Record<string, A>) {
+  return Object.entries(xs).map(([k, v]) => `${k}=${v}`).join(', ');
+}
+
+/**
+ * Add a default 'Delete' policy, which is required to make the import succeed
+ */
+function addDefaultDeletionPolicy(resource: any): any {
+  if (resource.DeletionPolicy) { return resource; }
+
+  return {
+    ...resource,
+    DeletionPolicy: 'Delete',
+  };
+}
+
+export interface DiscoverImportableResourcesResult {
+  readonly additions: ImportableResource[];
+  readonly hasNonAdditions: boolean;
+}
\ No newline at end of file
diff --git a/packages/aws-cdk/lib/util/asset-publishing.ts b/packages/aws-cdk/lib/util/asset-publishing.ts
index a795528e739d4..bfa204530ed08 100644
--- a/packages/aws-cdk/lib/util/asset-publishing.ts
+++ b/packages/aws-cdk/lib/util/asset-publishing.ts
@@ -6,20 +6,36 @@ import { ISDK } from '../api/aws-auth/sdk';
 import { SdkProvider } from '../api/aws-auth/sdk-provider';
 import { debug, error, print } from '../logging';
 
+export interface PublishAssetsOptions {
+  /**
+   * Print progress at 'debug' level
+   */
+  readonly quiet?: boolean;
+}
+
 /**
  * Use cdk-assets to publish all assets in the given manifest.
  */
-export async function publishAssets(manifest: cdk_assets.AssetManifest, sdk: SdkProvider, targetEnv: cxapi.Environment) {
+export async function publishAssets(
+  manifest: cdk_assets.AssetManifest,
+  sdk: SdkProvider,
+  targetEnv: cxapi.Environment,
+  options: PublishAssetsOptions = {},
+) {
   // This shouldn't really happen (it's a programming error), but we don't have
   // the types here to guide us. Do an runtime validation to be super super sure.
-  if (targetEnv.account === undefined || targetEnv.account === cxapi.UNKNOWN_ACCOUNT
-    || targetEnv.region === undefined || targetEnv.account === cxapi.UNKNOWN_REGION) {
-    throw new Error(`Asset publishing requires resolved account and region, got ${JSON.stringify(targetEnv)}`);
+  if (
+    targetEnv.account === undefined ||
+    targetEnv.account === cxapi.UNKNOWN_ACCOUNT ||
+    targetEnv.region === undefined ||
+    targetEnv.account === cxapi.UNKNOWN_REGION
+  ) {
+    throw new Error(`Asset publishing requires resolved account and region, got ${JSON.stringify( targetEnv)}`);
   }
 
   const publisher = new cdk_assets.AssetPublishing(manifest, {
     aws: new PublishingAws(sdk, targetEnv),
-    progressListener: new PublishingProgressListener(),
+    progressListener: new PublishingProgressListener(options.quiet ?? false),
     throwOnError: false,
     publishInParallel: true,
   });
@@ -119,7 +135,11 @@ const EVENT_TO_LOGGER: Record<cdk_assets.EventType, (x: string) => void> = {
 };
 
 class PublishingProgressListener implements cdk_assets.IPublishProgressListener {
+  constructor(private readonly quiet: boolean) {
+  }
+
   public onPublishEvent(type: cdk_assets.EventType, event: cdk_assets.IPublishProgress): void {
-    EVENT_TO_LOGGER[type](`[${event.percentComplete}%] ${type}: ${event.message}`);
+    const handler = this.quiet && type !== 'fail' ? debug : EVENT_TO_LOGGER[type];
+    handler(`[${event.percentComplete}%] ${type}: ${event.message}`);
   }
 }
diff --git a/packages/aws-cdk/package.json b/packages/aws-cdk/package.json
index 10f11cca662e6..f0ada3fa7de3d 100644
--- a/packages/aws-cdk/package.json
+++ b/packages/aws-cdk/package.json
@@ -46,7 +46,7 @@
         "BSD-2-Clause",
         "0BSD"
       ],
-      "dontAttribute": "^@aws-cdk/|^cdk-assets$",
+      "dontAttribute": "^@aws-cdk/|^cdk-assets$|^cdk-cli-wrapper$",
       "test": "bin/cdk --version"
     }
   },
diff --git a/packages/aws-cdk/test/api/util/display.test.ts b/packages/aws-cdk/test/api/util/display.test.ts
new file mode 100644
index 0000000000000..26b54b736b104
--- /dev/null
+++ b/packages/aws-cdk/test/api/util/display.test.ts
@@ -0,0 +1,39 @@
+import { RewritableBlock } from '../../../lib/api/util/display';
+import { stderr } from '../console-listener';
+
+
+describe('Rewritable Block Tests', () => {
+  let block: RewritableBlock;
+  beforeEach(() => {
+    block = new RewritableBlock(process.stderr);
+    process.stderr.rows = 80;
+  });
+
+  test('displayLines writes maximum lines based on rows if there are more lines than rows', () => {
+    const lines = Array.from(Array(100).keys()).map(line => line.toString());
+    const output = stderr.inspectSync(() => {
+      block.displayLines(lines);
+    });
+
+    expect(output.length).toEqual(block.height!);
+  });
+
+  test('displayLines writes maximum lines based on lines length if there are less lines than rows', () => {
+    const lines = Array.from(Array(45).keys()).map(line => line.toString());
+    const output = stderr.inspectSync(() => {
+      block.displayLines(lines);
+    });
+
+    expect(output.length).toEqual(46);
+  });
+
+  test('displayLines writes maximum lines based on lines length if rows is undefined', () => {
+    const lines = Array.from(Array(5).keys()).map(line => line.toString());
+    process.stderr.rows = undefined;
+    const output = stderr.inspectSync(() => {
+      block.displayLines(lines);
+    });
+
+    expect(output.length).toEqual(6);
+  });
+});
\ No newline at end of file
diff --git a/packages/aws-cdk/test/cdk-toolkit.test.ts b/packages/aws-cdk/test/cdk-toolkit.test.ts
index 52922d51ed50f..fd77172a9dff7 100644
--- a/packages/aws-cdk/test/cdk-toolkit.test.ts
+++ b/packages/aws-cdk/test/cdk-toolkit.test.ts
@@ -681,7 +681,9 @@ describe('synth', () => {
     const toolkit = defaultToolkitSetup();
     await toolkit.synth([], false, false);
 
-    expect(stderrMock.mock.calls[1][0]).toMatch('Test-Stack-A-Display-Name, Test-Stack-B');
+    // Separate tests as colorizing hampers detection
+    expect(stderrMock.mock.calls[1][0]).toMatch('Test-Stack-A-Display-Name');
+    expect(stderrMock.mock.calls[1][0]).toMatch('Test-Stack-B');
   });
 
   test('with no stdout option', async () => {
diff --git a/packages/aws-cdk/test/import.test.ts b/packages/aws-cdk/test/import.test.ts
new file mode 100644
index 0000000000000..816b89abd535d
--- /dev/null
+++ b/packages/aws-cdk/test/import.test.ts
@@ -0,0 +1,207 @@
+jest.mock('promptly', () => {
+  return {
+    ...jest.requireActual('promptly'),
+    confirm: jest.fn(),
+    prompt: jest.fn(),
+  };
+});
+
+import * as promptly from 'promptly';
+import { CloudFormationDeployments } from '../lib/api/cloudformation-deployments';
+import { ResourceImporter, ImportMap } from '../lib/import';
+import { testStack } from './util';
+import { MockSdkProvider } from './util/mock-sdk';
+
+const promptlyConfirm = promptly.confirm as jest.Mock;
+const promptlyPrompt = promptly.prompt as jest.Mock;
+
+let createChangeSetInput: AWS.CloudFormation.CreateChangeSetInput | undefined;
+
+const STACK_WITH_QUEUE = testStack({
+  stackName: 'StackWithQueue',
+  template: {
+    Resources: {
+      MyQueue: {
+        Type: 'AWS::SQS::Queue',
+        Properties: {},
+      },
+    },
+  },
+});
+
+const STACK_WITH_NAMED_QUEUE = testStack({
+  stackName: 'StackWithQueue',
+  template: {
+    Resources: {
+      MyQueue: {
+        Type: 'AWS::SQS::Queue',
+        Properties: {
+          QueueName: 'TheQueueName',
+        },
+      },
+    },
+  },
+});
+
+let sdkProvider: MockSdkProvider;
+let deployments: CloudFormationDeployments;
+beforeEach(() => {
+  jest.resetAllMocks();
+  sdkProvider = new MockSdkProvider({ realSdk: false });
+  deployments = new CloudFormationDeployments({ sdkProvider });
+  createChangeSetInput = undefined;
+});
+
+test('discovers importable resources', async () => {
+  givenCurrentStack(STACK_WITH_QUEUE.stackName, {
+    Resources: {},
+  });
+
+  const importer = new ResourceImporter(STACK_WITH_QUEUE, deployments);
+  const { additions } = await importer.discoverImportableResources();
+  expect(additions).toEqual([
+    expect.objectContaining({
+      logicalId: 'MyQueue',
+    }),
+  ]);
+});
+
+test('by default, its an error if there are non-addition changes in the template', async () => {
+  givenCurrentStack(STACK_WITH_QUEUE.stackName, {
+    Resources: {
+      SomethingThatDisappeared: {
+        Type: 'AWS::S3::Bucket',
+      },
+    },
+  });
+
+  const importer = new ResourceImporter(STACK_WITH_QUEUE, deployments);
+  await expect(importer.discoverImportableResources()).rejects.toThrow(/No resource updates or deletes/);
+
+  // But the error can be silenced
+  await expect(importer.discoverImportableResources(true)).resolves.toBeTruthy();
+});
+
+test('asks human for resource identifiers', async () => {
+  // GIVEN
+  givenCurrentStack(STACK_WITH_QUEUE.stackName, { Resources: {} });
+  const importer = new ResourceImporter(STACK_WITH_QUEUE, deployments);
+  const { additions } = await importer.discoverImportableResources();
+
+  // WHEN
+  promptlyPrompt.mockResolvedValue('TheQueueName');
+  const importable = await importer.askForResourceIdentifiers(additions);
+
+  // THEN
+  expect(importable.resourceMap).toEqual({
+    MyQueue: {
+      QueueName: 'TheQueueName',
+    },
+  });
+  expect(importable.importResources).toEqual([
+    expect.objectContaining({
+      logicalId: 'MyQueue',
+    }),
+  ]);
+});
+
+test('asks human to confirm automic import if identifier is in template', async () => {
+  // GIVEN
+  givenCurrentStack(STACK_WITH_NAMED_QUEUE.stackName, { Resources: {} });
+  const importer = new ResourceImporter(STACK_WITH_NAMED_QUEUE, deployments);
+  const { additions } = await importer.discoverImportableResources();
+
+  // WHEN
+  promptlyConfirm.mockResolvedValue(true);
+  const importable = await importer.askForResourceIdentifiers(additions);
+
+  // THEN
+  expect(importable.resourceMap).toEqual({
+    MyQueue: {
+      QueueName: 'TheQueueName',
+    },
+  });
+  expect(importable.importResources).toEqual([
+    expect.objectContaining({
+      logicalId: 'MyQueue',
+    }),
+  ]);
+});
+
+test('asks human to confirm automic import if identifier is in template', async () => {
+  // GIVEN
+  givenCurrentStack(STACK_WITH_QUEUE.stackName, { Resources: {} });
+  const importer = new ResourceImporter(STACK_WITH_QUEUE, deployments);
+  const { additions } = await importer.discoverImportableResources();
+  const importMap: ImportMap = {
+    importResources: additions,
+    resourceMap: {
+      MyQueue: { QueueName: 'TheQueueName' },
+    },
+  };
+
+  // WHEN
+  await importer.importResources(importMap, {
+    stack: STACK_WITH_QUEUE,
+  });
+
+  expect(createChangeSetInput?.ResourcesToImport).toEqual([
+    {
+      LogicalResourceId: 'MyQueue',
+      ResourceIdentifier: { QueueName: 'TheQueueName' },
+      ResourceType: 'AWS::SQS::Queue',
+    },
+  ]);
+});
+
+function givenCurrentStack(stackName: string, template: any) {
+  sdkProvider.stubCloudFormation({
+    describeStacks() {
+      return {
+        Stacks: [
+          {
+            StackName: stackName,
+            CreationTime: new Date(),
+            StackStatus: 'UPDATE_COMPLETE',
+            StackStatusReason: 'It is magic',
+            Outputs: [],
+          },
+        ],
+      };
+    },
+    getTemplate() {
+      return {
+        TemplateBody: JSON.stringify(template),
+      };
+    },
+    getTemplateSummary() {
+      return {
+        ResourceIdentifierSummaries: [
+          {
+            ResourceType: 'AWS::SQS::Queue',
+            ResourceIdentifiers: ['QueueName'],
+          },
+        ],
+      };
+    },
+    deleteChangeSet() {
+      return {};
+    },
+    createChangeSet(request) {
+      createChangeSetInput = request;
+      return {};
+    },
+    describeChangeSet() {
+      return {
+        Status: 'CREATE_COMPLETE',
+        Changes: [],
+      };
+    },
+    executeChangeSet() {
+      return {};
+    },
+    describeStackEvents() {
+      return {};
+    },
+  });
+}
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/cli/app/app.js b/packages/aws-cdk/test/integ/cli/app/app.js
index 834b6369079c9..c98afe071d1fb 100644
--- a/packages/aws-cdk/test/integ/cli/app/app.js
+++ b/packages/aws-cdk/test/integ/cli/app/app.js
@@ -8,6 +8,7 @@ if (process.env.PACKAGE_LAYOUT_VERSION === '1') {
   var ssm = require('@aws-cdk/aws-ssm');
   var iam = require('@aws-cdk/aws-iam');
   var sns = require('@aws-cdk/aws-sns');
+  var sqs = require('@aws-cdk/aws-sqs');
   var lambda = require('@aws-cdk/aws-lambda');
   var docker = require('@aws-cdk/aws-ecr-assets');
 } else {
@@ -18,6 +19,7 @@ if (process.env.PACKAGE_LAYOUT_VERSION === '1') {
     aws_ssm: ssm,
     aws_iam: iam,
     aws_sns: sns,
+    aws_sqs: sqs,
     aws_lambda: lambda,
     aws_ecr_assets: docker
   } = require('aws-cdk-lib');
@@ -61,6 +63,27 @@ class YourStack extends cdk.Stack {
   }
 }
 
+class ImportableStack extends cdk.Stack {
+  constructor(parent, id, props) {
+    super(parent, id, props);
+
+    if (!process.env.OMIT_TOPIC) {
+      const queue = new sqs.Queue(this, 'Queue', {
+        removalPolicy: process.env.ORPHAN_TOPIC ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+      });
+
+      new cdk.CfnOutput(this, 'QueueName', {
+        value: queue.queueName,
+      });
+      new cdk.CfnOutput(this, 'QueueLogicalId', {
+        value: queue.node.defaultChild.logicalId,
+      });
+    }
+
+    new cdk.CfnWaitConditionHandle(this, 'Handle');
+  }
+}
+
 class StackUsingContext extends cdk.Stack {
   constructor(parent, id, props) {
     super(parent, id, props);
@@ -367,6 +390,8 @@ switch (stackSet) {
     new SomeStage(app, `${stackPrefix}-stage`);
 
     new BuiltinLambdaStack(app, `${stackPrefix}-builtin-lambda-function`);
+
+    new ImportableStack(app, `${stackPrefix}-importable-stack`);
     break;
 
   case 'stage-using-context':
diff --git a/packages/aws-cdk/test/integ/cli/cli.integtest.ts b/packages/aws-cdk/test/integ/cli/cli.integtest.ts
index 7f65950550cb4..07a282b8beed5 100644
--- a/packages/aws-cdk/test/integ/cli/cli.integtest.ts
+++ b/packages/aws-cdk/test/integ/cli/cli.integtest.ts
@@ -988,6 +988,42 @@ integTest('skips notice refresh', withDefaultFixture(async (fixture) => {
   await expect(output).not.toContain('Notices refresh failed');
 }));
 
+/**
+ * Create a queue with a fresh name, redeploy orphaning the queue, then import it again
+ */
+integTest('test resource import', withDefaultFixture(async (fixture) => {
+  const outputsFile = path.join(fixture.integTestDir, 'outputs', 'outputs.json');
+  await fs.mkdir(path.dirname(outputsFile), { recursive: true });
+
+  // Initial deploy
+  await fixture.cdkDeploy('importable-stack', {
+    modEnv: { ORPHAN_TOPIC: '1' },
+    options: ['--outputs-file', outputsFile],
+  });
+
+  const outputs = JSON.parse((await fs.readFile(outputsFile, { encoding: 'utf-8' })).toString());
+  const queueName = outputs.QueueName;
+  const queueLogicalId = outputs.QueueLogicalId;
+  fixture.log(`Setup complete, created queue ${queueName}`);
+  try {
+    // Deploy again, orphaning the queue
+    await fixture.cdkDeploy('importable-stack', {
+      modEnv: { OMIT_TOPIC: '1' },
+    });
+
+    // Write a resource mapping file based on the ID from step one, then run an import
+    const mappingFile = path.join(fixture.integTestDir, 'outputs', 'mapping.json');
+    await fs.writeFile(mappingFile, JSON.stringify({ [queueLogicalId]: { QueueName: queueName } }), { encoding: 'utf-8' });
+
+    await fixture.cdk(['import',
+      '--resource-mapping', mappingFile,
+      fixture.fullStackName('importable-stack')]);
+  } finally {
+    // Cleanup
+    await fixture.cdkDestroy('importable-stack');
+  }
+}));
+
 async function listChildren(parent: string, pred: (x: string) => Promise<boolean>) {
   const ret = new Array<string>();
   for (const child of await fs.readdir(parent, { encoding: 'utf-8' })) {
diff --git a/packages/aws-cdk/test/integ/helpers/cdk.ts b/packages/aws-cdk/test/integ/helpers/cdk.ts
index 72dd0299f66ab..7fdeb052d21c3 100644
--- a/packages/aws-cdk/test/integ/helpers/cdk.ts
+++ b/packages/aws-cdk/test/integ/helpers/cdk.ts
@@ -109,6 +109,7 @@ export function withCdkApp<A extends TestContext & AwsContext>(block: (context:
         await installNpmPackages(fixture, {
           '@aws-cdk/core': installationVersion,
           '@aws-cdk/aws-sns': installationVersion,
+          '@aws-cdk/aws-sqs': installationVersion,
           '@aws-cdk/aws-iam': installationVersion,
           '@aws-cdk/aws-lambda': installationVersion,
           '@aws-cdk/aws-ssm': installationVersion,
@@ -722,9 +723,7 @@ const installNpm7 = memoize0(async (): Promise<string> => {
   await shell(['rm', '-rf', installDir]);
   await shell(['mkdir', '-p', installDir]);
 
-  await shell(['npm', 'install',
-    '--prefix', installDir,
-    'npm@7']);
+  await shell(['npm', 'install', 'npm@7'], { cwd: installDir });
 
   return path.join(installDir, 'node_modules', '.bin', 'npm');
 });
diff --git a/packages/aws-cdk/test/integ/helpers/test-helpers.ts b/packages/aws-cdk/test/integ/helpers/test-helpers.ts
index e74d7d000a777..5dc65f6ed492e 100644
--- a/packages/aws-cdk/test/integ/helpers/test-helpers.ts
+++ b/packages/aws-cdk/test/integ/helpers/test-helpers.ts
@@ -25,8 +25,6 @@ export function integTest(
   const runner = shouldSkip(name) ? testKind.skip : testKind;
 
   runner(name, async () => {
-    // eslint-disable-next-line no-console
-    console.log(`running test ${name} using ${runner.name}`);
     const output = new MemoryStream();
 
     output.write('================================================================\n');
diff --git a/packages/aws-cdk/test/util/mock-sdk.ts b/packages/aws-cdk/test/util/mock-sdk.ts
index 7b721cdf57a12..ae3d590e70f7e 100644
--- a/packages/aws-cdk/test/util/mock-sdk.ts
+++ b/packages/aws-cdk/test/util/mock-sdk.ts
@@ -31,6 +31,7 @@ export interface MockSdkProviderOptions {
  */
 export class MockSdkProvider extends SdkProvider {
   public readonly sdk: ISDK;
+  private readonly _mockSdk?: MockSdk;
 
   constructor(options: MockSdkProviderOptions = {}) {
     super(FAKE_CREDENTIAL_CHAIN, 'bermuda-triangle-1337', { customUserAgent: 'aws-cdk/jest' });
@@ -40,10 +41,17 @@ export class MockSdkProvider extends SdkProvider {
     if (options.realSdk ?? true) {
       this.sdk = new SDK(FAKE_CREDENTIALS, this.defaultRegion, { customUserAgent: 'aws-cdk/jest' });
     } else {
-      this.sdk = new MockSdk();
+      this.sdk = this._mockSdk = new MockSdk();
     }
   }
 
+  public get mockSdk(): MockSdk {
+    if (!this._mockSdk) {
+      throw new Error('MockSdkProvider was not created with \'realSdk: false\'');
+    }
+    return this._mockSdk;
+  }
+
   async baseCredentialsPartition(_environment: cxapi.Environment, _mode: Mode): Promise<string | undefined> {
     return undefined;
   }
diff --git a/packages/aws-cdk/tsconfig.json b/packages/aws-cdk/tsconfig.json
index ae3c57a0f5064..b1de148db28b3 100644
--- a/packages/aws-cdk/tsconfig.json
+++ b/packages/aws-cdk/tsconfig.json
@@ -1,8 +1,8 @@
 {
     "compilerOptions": {
-        "target": "ES2018",
+        "target": "ES2019",
         "module": "commonjs",
-        "lib": ["es2018", "dom"],
+        "lib": ["es2019", "dom"],
         "strict": true,
         "alwaysStrict": true,
         "declaration": true,
diff --git a/packages/cdk-cli-wrapper/lib/cdk-wrapper.ts b/packages/cdk-cli-wrapper/lib/cdk-wrapper.ts
index 80bc2f407555a..654327764f2a1 100644
--- a/packages/cdk-cli-wrapper/lib/cdk-wrapper.ts
+++ b/packages/cdk-cli-wrapper/lib/cdk-wrapper.ts
@@ -104,17 +104,22 @@ export class CdkCliWrapper implements ICdk {
     this.directory = options.directory;
     this.env = options.env;
     try {
-      this.cdk = require.resolve(options.cdkExecutable ?? 'aws-cdk/bin/cdk');
+      this.cdk = options.cdkExecutable ?? require.resolve('aws-cdk/bin/cdk');
     } catch (e) {
       throw new Error(`could not resolve path to cdk executable: "${options.cdkExecutable}"`);
     }
   }
 
+  private validateArgs(options: DefaultCdkOptions): void {
+    if (!options.stacks && !options.all) {
+      throw new Error('one of "app" or "stacks" must be provided');
+    }
+  }
+
   public list(options: ListOptions): string {
     const listCommandArgs: string[] = [
-      ...this.createDefaultArguments(options),
       ...renderBooleanArg('long', options.long),
-      ...options.stacks,
+      ...this.createDefaultArguments(options),
     ];
 
     return exec([this.cdk, 'ls', ...listCommandArgs], {
@@ -128,7 +133,6 @@ export class CdkCliWrapper implements ICdk {
    */
   public deploy(options: DeployOptions): void {
     const deployCommandArgs: string[] = [
-      ...this.createDefaultArguments(options),
       ...renderBooleanArg('ci', options.ci),
       ...renderBooleanArg('execute', options.execute),
       ...renderBooleanArg('exclusively', options.exclusively),
@@ -143,7 +147,7 @@ export class CdkCliWrapper implements ICdk {
       ...options.requireApproval ? ['--require-approval', options.requireApproval] : [],
       ...options.changeSetName ? ['--change-set-name', options.changeSetName] : [],
       ...options.toolkitStackName ? ['--toolkit-stack-name', options.toolkitStackName] : [],
-      ...options.stacks,
+      ...this.createDefaultArguments(options),
     ];
 
     exec([this.cdk, 'deploy', ...deployCommandArgs], {
@@ -158,10 +162,9 @@ export class CdkCliWrapper implements ICdk {
    */
   public destroy(options: DestroyOptions): void {
     const destroyCommandArgs: string[] = [
-      ...this.createDefaultArguments(options),
       ...renderBooleanArg('force', options.force),
       ...renderBooleanArg('exclusively', options.exclusively),
-      ...options.stacks,
+      ...this.createDefaultArguments(options),
     ];
 
     exec([this.cdk, 'destroy', ...destroyCommandArgs], {
@@ -176,11 +179,10 @@ export class CdkCliWrapper implements ICdk {
    */
   public synth(options: SynthOptions): void {
     const synthCommandArgs: string[] = [
-      ...this.createDefaultArguments(options),
       ...renderBooleanArg('validation', options.validation),
       ...renderBooleanArg('quiet', options.quiet),
       ...renderBooleanArg('exclusively', options.exclusively),
-      ...options.stacks,
+      ...this.createDefaultArguments(options),
     ];
 
     exec([this.cdk, 'synth', ...synthCommandArgs], {
@@ -209,6 +211,8 @@ export class CdkCliWrapper implements ICdk {
   }
 
   private createDefaultArguments(options: DefaultCdkOptions): string[] {
+    this.validateArgs(options);
+    const stacks = options.stacks ?? [];
     return [
       ...options.app ? ['--app', options.app] : [],
       ...renderBooleanArg('strict', options.strict),
@@ -230,6 +234,8 @@ export class CdkCliWrapper implements ICdk {
       ...options.caBundlePath ? ['--ca-bundle-path', options.caBundlePath] : [],
       ...options.roleArn ? ['--role-arn', options.roleArn] : [],
       ...options.output ? ['--output', options.output] : [],
+      ...stacks,
+      ...options.all ? ['--all'] : [],
     ];
   }
 }
diff --git a/packages/cdk-cli-wrapper/lib/commands/common.ts b/packages/cdk-cli-wrapper/lib/commands/common.ts
index 78e027cd922ca..01ab969b63098 100644
--- a/packages/cdk-cli-wrapper/lib/commands/common.ts
+++ b/packages/cdk-cli-wrapper/lib/commands/common.ts
@@ -24,8 +24,21 @@ export enum RequireApproval {
 export interface DefaultCdkOptions {
   /**
    * List of stacks to deploy
+   *
+   * Requried if `all` is not set
+   *
+   * @default - []
+   */
+  readonly stacks?: string[];
+
+  /**
+   * Deploy all stacks
+   *
+   * Requried if `stacks` is not set
+   *
+   * @default - false
    */
-  readonly stacks: string[];
+  readonly all?: boolean;
 
   /**
    * command-line for executing your app or a cloud assembly directory
diff --git a/packages/cdk-cli-wrapper/package.json b/packages/cdk-cli-wrapper/package.json
index 7fc3bc4271d9f..4a213298bf2e5 100644
--- a/packages/cdk-cli-wrapper/package.json
+++ b/packages/cdk-cli-wrapper/package.json
@@ -65,8 +65,7 @@
     "@types/node": "^10.17.60",
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "jest": "^27.5.1",
-    "@aws-cdk/pkglint": "0.0.0",
-    "aws-cdk": "0.0.0"
+    "@aws-cdk/pkglint": "0.0.0"
   },
   "repository": {
     "url": "https://github.com/aws/aws-cdk.git",
diff --git a/packages/cdk-cli-wrapper/test/cdk-wrapper.test.ts b/packages/cdk-cli-wrapper/test/cdk-wrapper.test.ts
index 2f25054632cae..c4ac86963dbc9 100644
--- a/packages/cdk-cli-wrapper/test/cdk-wrapper.test.ts
+++ b/packages/cdk-cli-wrapper/test/cdk-wrapper.test.ts
@@ -1,6 +1,6 @@
 import * as child_process from 'child_process';
 import { CdkCliWrapper } from '../lib/cdk-wrapper';
-import { RequireApproval } from '../lib/commands/common';
+import { RequireApproval } from '../lib/commands';
 let spawnSyncMock: jest.SpyInstance;
 
 beforeEach(() => {
@@ -89,8 +89,6 @@ test('deploy with all arguments', () => {
     expect.stringMatching(/aws-cdk\/bin\/cdk/),
     expect.arrayContaining([
       'deploy',
-      '--app',
-      'node bin/my-app.js',
       '--no-strict',
       '--no-trace',
       '--no-lookups',
@@ -122,6 +120,8 @@ test('deploy with all arguments', () => {
       '--change-set-name', 'my-change-set',
       '--toolkit-stack-name', 'Toolkit',
       '--previous-parameters',
+      '--app',
+      'node bin/my-app.js',
       'test-stack1',
     ]),
     expect.objectContaining({
@@ -182,10 +182,10 @@ test('can parse parameters', () => {
     expect.stringMatching(/aws-cdk\/bin\/cdk/),
     [
       'deploy',
-      '--app',
-      'node bin/my-app.js',
       '--parameters', 'myparam=test',
       '--parameters', 'test-stack1:myotherparam=test',
+      '--app',
+      'node bin/my-app.js',
       'test-stack1',
     ],
     expect.objectContaining({
@@ -246,10 +246,10 @@ test('can parse array arguments', () => {
     expect.stringMatching(/aws-cdk\/bin\/cdk/),
     [
       'deploy',
-      '--app',
-      'node bin/my-app.js',
       '--notification-arns', 'arn:aws:us-east-1:1111111111:some:resource',
       '--notification-arns', 'arn:aws:us-east-1:1111111111:some:other-resource',
+      '--app',
+      'node bin/my-app.js',
       'test-stack1',
     ],
     expect.objectContaining({
@@ -355,7 +355,7 @@ test('destroy arguments', () => {
   // THEN
   expect(spawnSyncMock).toHaveBeenCalledWith(
     expect.stringMatching(/aws-cdk\/bin\/cdk/),
-    ['destroy', '--app', 'node bin/my-app.js', '--force', '--no-exclusively', 'test-stack1'],
+    ['destroy', '--force', '--no-exclusively', '--app', 'node bin/my-app.js', 'test-stack1'],
     expect.objectContaining({
       env: expect.objectContaining({
         KEY: 'value',
@@ -416,7 +416,7 @@ test('ls arguments', () => {
   // THEN
   expect(spawnSyncMock).toHaveBeenCalledWith(
     expect.stringMatching(/aws-cdk\/bin\/cdk/),
-    ['ls', '--app', 'node bin/my-app.js', '--long', '*'],
+    ['ls', '--long', '--app', 'node bin/my-app.js', '*'],
     expect.objectContaining({
       env: expect.objectContaining({
         KEY: 'value',
@@ -462,12 +462,3 @@ test('can synth fast', () => {
     }),
   );
 });
-
-test('cannot resolve executable', () => {
-  expect(() => {
-    new CdkCliWrapper({
-      directory: '/project',
-      cdkExecutable: 'invalid',
-    });
-  }).toThrow(/could not resolve path to cdk executable: "invalid"/);
-});
diff --git a/tools/@aws-cdk/cdk-build-tools/lib/package-info.ts b/tools/@aws-cdk/cdk-build-tools/lib/package-info.ts
index afc76b48bdefd..83ca5563887e6 100644
--- a/tools/@aws-cdk/cdk-build-tools/lib/package-info.ts
+++ b/tools/@aws-cdk/cdk-build-tools/lib/package-info.ts
@@ -83,6 +83,7 @@ export async function unitTestFiles(): Promise<File[]> {
 }
 
 export async function hasIntegTests(): Promise<boolean> {
+  if (currentPackageJson().name === '@aws-cdk/integ-runner') return false;
   const files = await listFiles('test', f => f.filename.startsWith('integ.') && f.filename.endsWith('.js'));
   return files.length > 0;
 }
diff --git a/tools/@aws-cdk/pkglint/lib/rules.ts b/tools/@aws-cdk/pkglint/lib/rules.ts
index e1d8e42582b6d..1a3df33fb4fa1 100644
--- a/tools/@aws-cdk/pkglint/lib/rules.ts
+++ b/tools/@aws-cdk/pkglint/lib/rules.ts
@@ -178,7 +178,7 @@ export class BundledCLI extends ValidationRule {
     '0BSD',
   ];
 
-  private static readonly DONT_ATTRIBUTE = '^@aws-cdk\/|^cdk-assets$';
+  private static readonly DONT_ATTRIBUTE = '^@aws-cdk\/|^cdk-assets$|^cdk-cli-wrapper$';
 
   public readonly name = 'bundle';
 
diff --git a/yarn.lock b/yarn.lock
index dddaf06264d5a..469782c499a97 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1994,6 +1994,13 @@
   resolved "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz#bd86a43617df0594787d38b735f55c805becf1bc"
   integrity sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw==
 
+"@types/workerpool@^6.1.0":
+  version "6.1.0"
+  resolved "https://registry.npmjs.org/@types/workerpool/-/workerpool-6.1.0.tgz#16c3b9d3c62a8f6e6ad2e4d6212a68130f0cd3b1"
+  integrity sha512-C+J/c1BHyc351xJuiH2Jbe+V9hjf5mCzRP0UK4KEpF5SpuU+vJ/FC5GLZsCU/PJpp/3I6Uwtfm3DG7Lmrb7LOQ==
+  dependencies:
+    "@types/node" "*"
+
 "@types/wrap-ansi@^3.0.0":
   version "3.0.0"
   resolved "https://registry.npmjs.org/@types/wrap-ansi/-/wrap-ansi-3.0.0.tgz#18b97a972f94f60a679fd5c796d96421b9abb9fd"