diff --git a/.yarnrc b/.yarnrc
index 591e9c3d57b96..46241e3f5e5bc 100644
--- a/.yarnrc
+++ b/.yarnrc
@@ -1 +1,2 @@
 --install.check-files     true      # install will verify file tree of packages for consistency
+ignore-engines            true      # the 'engines' key for 'aws-cdk-lib' has specifies node14 as min while v1 will remain at node10
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c6ffbb423465..731ddcf6c5e4f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.85.0](https://github.com/aws/aws-cdk/compare/v1.84.0...v1.85.0) (2021-01-14)
+
+* **s3-deployment**: This version includes an important update, please upgrade to prevent deployment failure. This is in prepartion of Lambda deprecation of the request module in boto, more details are available in [AWS blog](https://aws.amazon.com/blogs/compute/upcoming-changes-to-the-python-sdk-in-aws-lambda/). Note, users of versions < `1.81.0` will not be impacted by this deprecation, but are still encouraged to upgrade to the latest version.
+
+### Features
+
+* **apigatewayv2:** http api - disable execute api endpoint ([#12426](https://github.com/aws/aws-cdk/issues/12426)) ([1724da7](https://github.com/aws/aws-cdk/commit/1724da758666ec92f7b923c899d2f2f439083ba2)), closes [#12241](https://github.com/aws/aws-cdk/issues/12241)
+* **appmesh:** add listener TLS certificates for VirtualNodes and VirtualGateways ([#11863](https://github.com/aws/aws-cdk/issues/11863)) ([175a257](https://github.com/aws/aws-cdk/commit/175a2570465d484aa0a73a7bded34e686da493ed)), closes [#10051](https://github.com/aws/aws-cdk/issues/10051)
+* **cfnspec:** CloudFormation resource specification update to v23.0.0 ([#12490](https://github.com/aws/aws-cdk/issues/12490)) ([a7a2236](https://github.com/aws/aws-cdk/commit/a7a2236367f8f01b00b6d90f1d3fe7bf674b1aee))
+
+
+### Bug Fixes
+
+* **appsync:** rds data source configured with cluster arn ([#12255](https://github.com/aws/aws-cdk/issues/12255)) ([d0305f3](https://github.com/aws/aws-cdk/commit/d0305f33da41ce1f07a5d571eb21c0ee9ea852d0)), closes [#11536](https://github.com/aws/aws-cdk/issues/11536)
+* **aws-ecs:** Support configuring Windows capacity for cluster ASGs ([#12365](https://github.com/aws/aws-cdk/issues/12365)) ([6d9a0f1](https://github.com/aws/aws-cdk/commit/6d9a0f1ea0c05e7902ccca4d0fc4040e688846e5))
+* **eks:** aws-node-termination-handler incorrectly deployed to on-demand instances as well ([#12369](https://github.com/aws/aws-cdk/issues/12369)) ([05c0b5f](https://github.com/aws/aws-cdk/commit/05c0b5f5a31c3fe89c47c6db8d9051f7165641a9)), closes [#12368](https://github.com/aws/aws-cdk/issues/12368)
+* **s3:** Bucket.grantWrite() no longer adds s3:PutObject* permission ([#12391](https://github.com/aws/aws-cdk/issues/12391)) ([cd437cf](https://github.com/aws/aws-cdk/commit/cd437cf630266086a3ddf9e326f215b5d1acdfd7))
+* **s3-deployment:** stop using deprecated API's that will cause breakage post 01/31/21 ([#12491](https://github.com/aws/aws-cdk/issues/12491)) ([f50f928](https://github.com/aws/aws-cdk/commit/f50f92880bbc219c331c858eaace712e0757507d))
+* **sns:** require topic name for fifo topic [#12386](https://github.com/aws/aws-cdk/issues/12386) ([#12437](https://github.com/aws/aws-cdk/issues/12437)) ([37d8ccc](https://github.com/aws/aws-cdk/commit/37d8ccc763f532999bc9f114264f3d29725b0f28))
+
 ## [1.84.0](https://github.com/aws/aws-cdk/compare/v1.83.0...v1.84.0) (2021-01-12)
 
 
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/environment.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/environment.ts
index dcff0d28960b4..d83c286f0cdd6 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/environment.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/environment.ts
@@ -3,6 +3,10 @@ import * as ecs from '@aws-cdk/aws-ecs';
 import * as cdk from '@aws-cdk/core';
 import { EnvironmentCapacityType } from './extensions/extension-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Settings for the environment you want to deploy.
  * services within.
@@ -64,11 +68,11 @@ export interface IEnvironment {
  * or it can create it's own VPC and cluster. By default it will create
  * a cluster with Fargate capacity.
  */
-export class Environment extends cdk.Construct implements IEnvironment {
+export class Environment extends Construct implements IEnvironment {
   /**
    * Import an existing environment from its attributes.
    */
-  public static fromEnvironmentAttributes(scope: cdk.Construct, id: string, attrs: EnvironmentAttributes): IEnvironment {
+  public static fromEnvironmentAttributes(scope: Construct, id: string, attrs: EnvironmentAttributes): IEnvironment {
     return new ImportedEnvironment(scope, id, attrs);
   }
 
@@ -94,7 +98,7 @@ export class Environment extends cdk.Construct implements IEnvironment {
 
   private readonly scope: cdk.Construct;
 
-  constructor(scope: cdk.Construct, id: string, props?: EnvironmentProps) {
+  constructor(scope: Construct, id: string, props?: EnvironmentProps) {
     super(scope, id);
 
     this.scope = scope;
@@ -139,13 +143,13 @@ export interface EnvironmentAttributes {
   cluster: ecs.ICluster;
 }
 
-export class ImportedEnvironment extends cdk.Construct implements IEnvironment {
+export class ImportedEnvironment extends Construct implements IEnvironment {
   public readonly capacityType: EnvironmentCapacityType;
   public readonly cluster: ecs.ICluster;
   public readonly id: string;
   public readonly vpc: ec2.IVpc;
 
-  constructor(scope: cdk.Construct, id: string, props: EnvironmentAttributes) {
+  constructor(scope: Construct, id: string, props: EnvironmentAttributes) {
     super(scope, id);
 
     this.id = id;
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/appmesh.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/appmesh.ts
index 65f77a81c9fac..fb93375423798 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/appmesh.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/appmesh.ts
@@ -9,6 +9,10 @@ import { Service } from '../service';
 import { Container } from './container';
 import { ServiceExtension, ServiceBuild } from './extension-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 // The version of the App Mesh envoy sidecar to add to the task.
 const APP_MESH_ENVOY_SIDECAR_VERSION = 'v1.15.1.0-prod';
 
@@ -63,7 +67,7 @@ export class AppMeshExtension extends ServiceExtension {
     }
   }
 
-  public prehook(service: Service, scope: cdk.Construct) {
+  public prehook(service: Service, scope: Construct) {
     this.parentService = service;
     this.scope = scope;
 
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/assign-public-ip.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/assign-public-ip.ts
index 57f71764019b8..3c019d44867b4 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/assign-public-ip.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/assign-public-ip.ts
@@ -1,12 +1,15 @@
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as route53 from '@aws-cdk/aws-route53';
-import * as cdk from '@aws-cdk/core';
 import { Service } from '../../service';
 import { Container } from '../container';
 import { ServiceExtension, ServiceBuild, EnvironmentCapacityType } from '../extension-interfaces';
 import { TaskRecordManager } from './task-record-manager';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 export interface AssignPublicIpExtensionOptions {
   /**
    * Enable publishing task public IPs to a recordset in a Route 53 hosted zone.
@@ -52,7 +55,7 @@ export class AssignPublicIpExtension extends ServiceExtension {
     return Boolean(this.dns);
   }
 
-  public prehook(service: Service, _scope: cdk.Construct) {
+  public prehook(service: Service, _scope: Construct) {
     super.prehook(service, _scope);
 
     if (service.capacityType != EnvironmentCapacityType.FARGATE) {
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/task-record-manager.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/task-record-manager.ts
index 3772f4432cc04..67db42400ee5b 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/task-record-manager.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/assign-public-ip/task-record-manager.ts
@@ -11,6 +11,10 @@ import * as sqs from '@aws-cdk/aws-sqs';
 import * as cdk from '@aws-cdk/core';
 import * as customresources from '@aws-cdk/custom-resources';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 export interface TaskRecordManagerProps {
   service: ecs.Ec2Service | ecs.FargateService;
   dnsZone: route53.IHostedZone;
@@ -21,8 +25,8 @@ export interface TaskRecordManagerProps {
  * An event-driven serverless app to maintain a list of public ips in a Route 53
  * hosted zone.
  */
-export class TaskRecordManager extends cdk.Construct {
-  constructor(scope: cdk.Construct, id: string, props: TaskRecordManagerProps) {
+export class TaskRecordManager extends Construct {
+  constructor(scope: Construct, id: string, props: TaskRecordManagerProps) {
     super(scope, id);
 
     // Poison pills go here.
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/cloudwatch-agent.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/cloudwatch-agent.ts
index cd59b24f27860..ceed938e995cb 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/cloudwatch-agent.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/cloudwatch-agent.ts
@@ -1,9 +1,12 @@
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as iam from '@aws-cdk/aws-iam';
-import * as cdk from '@aws-cdk/core';
 import { Service } from '../service';
 import { ServiceExtension } from './extension-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 const CLOUDWATCH_AGENT_IMAGE = 'amazon/cloudwatch-agent:latest';
 
 /**
@@ -28,7 +31,7 @@ export class CloudwatchAgentExtension extends ServiceExtension {
     super('cloudwatchAgent');
   }
 
-  public prehook(service: Service, scope: cdk.Construct) {
+  public prehook(service: Service, scope: Construct) {
     this.parentService = service;
     this.scope = scope;
   }
@@ -70,4 +73,4 @@ export class CloudwatchAgentExtension extends ServiceExtension {
       });
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/container.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/container.ts
index 3ae65bfe6994b..1bbc61ff4f8f7 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/container.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/container.ts
@@ -1,8 +1,11 @@
 import * as ecs from '@aws-cdk/aws-ecs';
-import * as cdk from '@aws-cdk/core';
 import { Service } from '../service';
 import { ServiceExtension } from './extension-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Setting for the main application container of a service
  */
@@ -59,7 +62,7 @@ export class Container extends ServiceExtension {
   }
 
   // @ts-ignore - Ignore unused params that are required for abstract class extend
-  public prehook(service: Service, scope: cdk.Construct) {
+  public prehook(service: Service, scope: Construct) {
     this.parentService = service;
   }
 
@@ -142,4 +145,4 @@ export class Container extends ServiceExtension {
       });
     }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/extension-interfaces.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/extension-interfaces.ts
index bf1b213a25ba3..fa0d42602c563 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/extension-interfaces.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/extension-interfaces.ts
@@ -2,6 +2,10 @@ import * as ecs from '@aws-cdk/aws-ecs';
 import * as cdk from '@aws-cdk/core';
 import { Service } from '../service';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * A list of the capacity types that are supported. These
  * capacity types may change the behavior of an extension.
@@ -154,7 +158,7 @@ export abstract class ServiceExtension {
    * @param parent - The parent service which this extension has been added to
    * @param scope - The scope that this extension should create resources in
    */
-  public prehook(parent: Service, scope: cdk.Construct) {
+  public prehook(parent: Service, scope: Construct) {
     this.parentService = parent;
     this.scope = scope;
   }
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/firelens.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/firelens.ts
index 03c23e015eaf7..1dfc8e1f1b0b0 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/firelens.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/firelens.ts
@@ -5,6 +5,10 @@ import { Service } from '../service';
 import { Container } from './container';
 import { ContainerMutatingHook, ServiceExtension } from './extension-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Settings for the hook which mutates the application container
  * to route logs through FireLens
@@ -63,7 +67,7 @@ export class FireLensExtension extends ServiceExtension {
     super('firelens');
   }
 
-  public prehook(service: Service, scope: cdk.Construct) {
+  public prehook(service: Service, scope: Construct) {
     this.parentService = service;
 
     // Create a log group for the service, into which FireLens
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/http-load-balancer.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/http-load-balancer.ts
index c00481d1f424c..884477b4d38db 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/http-load-balancer.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/http-load-balancer.ts
@@ -4,6 +4,10 @@ import * as cdk from '@aws-cdk/core';
 import { Service } from '../service';
 import { ServiceExtension, ServiceBuild } from './extension-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * This extension add a public facing load balancer for sending traffic
  * to one or more replicas of the application container
@@ -17,7 +21,7 @@ export class HttpLoadBalancerExtension extends ServiceExtension {
   }
 
   // Before the service is created go ahead and create the load balancer itself.
-  public prehook(service: Service, scope: cdk.Construct) {
+  public prehook(service: Service, scope: Construct) {
     this.parentService = service;
 
     this.loadBalancer = new alb.ApplicationLoadBalancer(scope, `${this.parentService.id}-load-balancer`, {
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/xray.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/xray.ts
index 3ba344f4133d8..5e9affe0ffa3a 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/xray.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/xray.ts
@@ -4,6 +4,10 @@ import * as cdk from '@aws-cdk/core';
 import { Service } from '../service';
 import { ServiceExtension } from './extension-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 const XRAY_DAEMON_IMAGE = 'amazon/aws-xray-daemon:latest';
 
 /**
@@ -17,7 +21,7 @@ export class XRayExtension extends ServiceExtension {
   }
 
   // @ts-ignore - Ignore unused params that are required for abstract class extend
-  public prehook(service: Service, scope: cdk.Construct) {
+  public prehook(service: Service, scope: Construct) {
     this.parentService = service;
   }
 
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/service.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/service.ts
index 29134a8c83260..c988c0592b6bf 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/service.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/service.ts
@@ -5,6 +5,10 @@ import { IEnvironment } from './environment';
 import { EnvironmentCapacityType, ServiceBuild } from './extensions/extension-interfaces';
 import { ServiceDescription } from './service-description';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * The settings for an ECS Service
  */
@@ -24,7 +28,7 @@ export interface ServiceProps {
  * A service builder class. This construct support various extensions
  * which can construct an ECS service progressively.
  */
-export class Service extends cdk.Construct {
+export class Service extends Construct {
   /**
    * The underlying ECS service that was created
    */
@@ -74,7 +78,7 @@ export class Service extends cdk.Construct {
 
   private readonly scope: cdk.Construct;
 
-  constructor(scope: cdk.Construct, id: string, props: ServiceProps) {
+  constructor(scope: Construct, id: string, props: ServiceProps) {
     super(scope, id);
 
     this.scope = scope;
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/package.json b/packages/@aws-cdk-containers/ecs-service-extensions/package.json
index d5249726f297e..f388877969ce0 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/package.json
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/package.json
@@ -18,8 +18,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat"
   },
   "keywords": [
diff --git a/packages/@aws-cdk/alexa-ask/README.md b/packages/@aws-cdk/alexa-ask/README.md
index 125b909867ec7..766afeef6d3cd 100644
--- a/packages/@aws-cdk/alexa-ask/README.md
+++ b/packages/@aws-cdk/alexa-ask/README.md
@@ -9,14 +9,6 @@
 >
 > [CFN Resources]: https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib
 
-![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)
-
-> The APIs of higher level constructs in this module are experimental and under active development.
-> They are subject to non-backward compatible changes or removal in any future version. These are
-> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
-> announced in the release notes. This means that while you may use them, you may need to update
-> your source code when upgrading to a newer version of this package.
-
 ---
 
 <!--END STABILITY BANNER-->
diff --git a/packages/@aws-cdk/alexa-ask/package.json b/packages/@aws-cdk/alexa-ask/package.json
index 1233a4a1993ea..46cd2dc7d28a1 100644
--- a/packages/@aws-cdk/alexa-ask/package.json
+++ b/packages/@aws-cdk/alexa-ask/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -91,7 +91,7 @@
     "node": ">= 10.13.0 <13 || >=13.7.0"
   },
   "stability": "experimental",
-  "maturity": "experimental",
+  "maturity": "cfn-only",
   "awscdkio": {
     "announce": false
   }
diff --git a/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts b/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
index 03685cfc9c413..cd7f97e6629a1 100644
--- a/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
+++ b/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
@@ -6,6 +6,10 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cdk from '@aws-cdk/core';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 export interface PipelineDeployStackActionProps {
   /**
    * The CDK stack to be deployed.
@@ -147,7 +151,7 @@ export class PipelineDeployStackAction implements codepipeline.IAction {
     });
   }
 
-  public bind(scope: cdk.Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  public bind(scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     if (this.stack.environment !== cdk.Stack.of(scope).environment) {
       // FIXME: Add the necessary to extend to stacks in a different account
diff --git a/packages/@aws-cdk/app-delivery/package.json b/packages/@aws-cdk/app-delivery/package.json
index 703d259f6ecbc..0e09f47c797f9 100644
--- a/packages/@aws-cdk/app-delivery/package.json
+++ b/packages/@aws-cdk/app-delivery/package.json
@@ -41,8 +41,8 @@
     "lint": "cdk-lint",
     "integ": "cdk-integ",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/assert/package.json b/packages/@aws-cdk/assert/package.json
index cb651d3ba12df..9842fc4dcdfe3 100644
--- a/packages/@aws-cdk/assert/package.json
+++ b/packages/@aws-cdk/assert/package.json
@@ -11,8 +11,8 @@
     "test": "cdk-test",
     "pkglint": "pkglint -f",
     "package": "cdk-package",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test"
   },
   "author": {
     "name": "Amazon Web Services",
diff --git a/packages/@aws-cdk/assets/package.json b/packages/@aws-cdk/assets/package.json
index 901bd0454e9c4..06ffdd566d398 100644
--- a/packages/@aws-cdk/assets/package.json
+++ b/packages/@aws-cdk/assets/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-accessanalyzer/package.json b/packages/@aws-cdk/aws-accessanalyzer/package.json
index e955f78425632..f024b44b3ac47 100644
--- a/packages/@aws-cdk/aws-accessanalyzer/package.json
+++ b/packages/@aws-cdk/aws-accessanalyzer/package.json
@@ -49,8 +49,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "compat": "cdk-compat",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-acmpca/README.md b/packages/@aws-cdk/aws-acmpca/README.md
index fd3c39c9f5e4c..04d167836539c 100644
--- a/packages/@aws-cdk/aws-acmpca/README.md
+++ b/packages/@aws-cdk/aws-acmpca/README.md
@@ -9,6 +9,14 @@
 >
 > [CFN Resources]: https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib
 
+![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)
+
+> The APIs of higher level constructs in this module are experimental and under active development.
+> They are subject to non-backward compatible changes or removal in any future version. These are
+> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
+> announced in the release notes. This means that while you may use them, you may need to update
+> your source code when upgrading to a newer version of this package.
+
 ---
 
 <!--END STABILITY BANNER-->
diff --git a/packages/@aws-cdk/aws-acmpca/package.json b/packages/@aws-cdk/aws-acmpca/package.json
index 3baab6e8894b3..d6209b0eb267f 100644
--- a/packages/@aws-cdk/aws-acmpca/package.json
+++ b/packages/@aws-cdk/aws-acmpca/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -92,7 +92,7 @@
     "node": ">= 10.13.0 <13 || >=13.7.0"
   },
   "stability": "experimental",
-  "maturity": "cfn-only",
+  "maturity": "experimental",
   "awscdkio": {
     "announce": false
   }
diff --git a/packages/@aws-cdk/aws-amazonmq/package.json b/packages/@aws-cdk/aws-amazonmq/package.json
index 81d725a784638..ef256d4227b82 100644
--- a/packages/@aws-cdk/aws-amazonmq/package.json
+++ b/packages/@aws-cdk/aws-amazonmq/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-amplify/package.json b/packages/@aws-cdk/aws-amplify/package.json
index 7008e08ae00f6..47452fd72008c 100644
--- a/packages/@aws-cdk/aws-amplify/package.json
+++ b/packages/@aws-cdk/aws-amplify/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-apigateway/lib/api-definition.ts b/packages/@aws-cdk/aws-apigateway/lib/api-definition.ts
index 652c531de9c38..01be9ebd17c59 100644
--- a/packages/@aws-cdk/aws-apigateway/lib/api-definition.ts
+++ b/packages/@aws-cdk/aws-apigateway/lib/api-definition.ts
@@ -1,6 +1,9 @@
 import * as s3 from '@aws-cdk/aws-s3';
 import * as s3_assets from '@aws-cdk/aws-s3-assets';
-import * as cdk from '@aws-cdk/core';
+
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
 
 /**
  * Represents an OpenAPI definition asset.
@@ -80,7 +83,7 @@ export abstract class ApiDefinition {
    * @param scope The binding scope. Don't be smart about trying to down-cast or
    * assume it's initialized. You may just use it as a construct scope.
    */
-  public abstract bind(scope: cdk.Construct): ApiDefinitionConfig;
+  public abstract bind(scope: Construct): ApiDefinitionConfig;
 }
 
 /**
@@ -136,7 +139,7 @@ export class S3ApiDefinition extends ApiDefinition {
     this.bucketName = bucket.bucketName;
   }
 
-  public bind(_scope: cdk.Construct): ApiDefinitionConfig {
+  public bind(_scope: Construct): ApiDefinitionConfig {
     return {
       s3Location: {
         bucket: this.bucketName,
@@ -164,7 +167,7 @@ export class InlineApiDefinition extends ApiDefinition {
     }
   }
 
-  public bind(_scope: cdk.Construct): ApiDefinitionConfig {
+  public bind(_scope: Construct): ApiDefinitionConfig {
     return {
       inlineDefinition: this.definition,
     };
@@ -182,7 +185,7 @@ export class AssetApiDefinition extends ApiDefinition {
     super();
   }
 
-  public bind(scope: cdk.Construct): ApiDefinitionConfig {
+  public bind(scope: Construct): ApiDefinitionConfig {
     // If the same AssetAPIDefinition is used multiple times, retain only the first instantiation.
     if (this.asset === undefined) {
       this.asset = new s3_assets.Asset(scope, 'APIDefinition', {
diff --git a/packages/@aws-cdk/aws-apigateway/lib/apigatewayv2.ts b/packages/@aws-cdk/aws-apigateway/lib/apigatewayv2.ts
index e04bcef476fca..98ee1ba04acbf 100644
--- a/packages/@aws-cdk/aws-apigateway/lib/apigatewayv2.ts
+++ b/packages/@aws-cdk/aws-apigateway/lib/apigatewayv2.ts
@@ -5,6 +5,10 @@
 
 import * as cdk from '@aws-cdk/core';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for defining a `AWS::ApiGatewayV2::Api`
  *
@@ -288,7 +292,7 @@ export class CfnApiV2 extends cdk.CfnResource implements cdk.IInspectable {
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnApiV2Props = {}) {
+  constructor(scope: Construct, id: string, props: CfnApiV2Props = {}) {
     super(scope, id, { type: CfnApiV2.CFN_RESOURCE_TYPE_NAME, properties: props });
 
     this.apiKeySelectionExpression = props.apiKeySelectionExpression;
@@ -616,7 +620,7 @@ export class CfnApiMappingV2 extends cdk.CfnResource implements cdk.IInspectable
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnApiMappingV2Props) {
+  constructor(scope: Construct, id: string, props: CfnApiMappingV2Props) {
     super(scope, id, { type: CfnApiMappingV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'domainName', this);
@@ -842,7 +846,7 @@ export class CfnAuthorizerV2 extends cdk.CfnResource implements cdk.IInspectable
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnAuthorizerV2Props) {
+  constructor(scope: Construct, id: string, props: CfnAuthorizerV2Props) {
     super(scope, id, { type: CfnAuthorizerV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'authorizerType', this);
@@ -1047,7 +1051,7 @@ export class CfnDeploymentV2 extends cdk.CfnResource implements cdk.IInspectable
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnDeploymentV2Props) {
+  constructor(scope: Construct, id: string, props: CfnDeploymentV2Props) {
     super(scope, id, { type: CfnDeploymentV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
 
@@ -1192,7 +1196,7 @@ export class CfnDomainNameV2 extends cdk.CfnResource implements cdk.IInspectable
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnDomainNameV2Props) {
+  constructor(scope: Construct, id: string, props: CfnDomainNameV2Props) {
     super(scope, id, { type: CfnDomainNameV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'domainName', this);
     this.attrRegionalDomainName = cdk.Token.asString(this.getAtt('RegionalDomainName'));
@@ -1546,7 +1550,7 @@ export class CfnIntegrationV2 extends cdk.CfnResource implements cdk.IInspectabl
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnIntegrationV2Props) {
+  constructor(scope: Construct, id: string, props: CfnIntegrationV2Props) {
     super(scope, id, { type: CfnIntegrationV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'integrationType', this);
@@ -1762,7 +1766,7 @@ export class CfnIntegrationResponseV2 extends cdk.CfnResource implements cdk.IIn
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnIntegrationResponseV2Props) {
+  constructor(scope: Construct, id: string, props: CfnIntegrationResponseV2Props) {
     super(scope, id, { type: CfnIntegrationResponseV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'integrationId', this);
@@ -1937,7 +1941,7 @@ export class CfnModelV2 extends cdk.CfnResource implements cdk.IInspectable {
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnModelV2Props) {
+  constructor(scope: Construct, id: string, props: CfnModelV2Props) {
     super(scope, id, { type: CfnModelV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'name', this);
@@ -2205,7 +2209,7 @@ export class CfnRouteV2 extends cdk.CfnResource implements cdk.IInspectable {
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnRouteV2Props) {
+  constructor(scope: Construct, id: string, props: CfnRouteV2Props) {
     super(scope, id, { type: CfnRouteV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'routeKey', this);
@@ -2452,7 +2456,7 @@ export class CfnRouteResponseV2 extends cdk.CfnResource implements cdk.IInspecta
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnRouteResponseV2Props) {
+  constructor(scope: Construct, id: string, props: CfnRouteResponseV2Props) {
     super(scope, id, { type: CfnRouteResponseV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'routeId', this);
@@ -2757,7 +2761,7 @@ export class CfnStageV2 extends cdk.CfnResource implements cdk.IInspectable {
    * @param id    - scoped id of the resource
    * @param props - resource properties
    */
-  constructor(scope: cdk.Construct, id: string, props: CfnStageV2Props) {
+  constructor(scope: Construct, id: string, props: CfnStageV2Props) {
     super(scope, id, { type: CfnStageV2.CFN_RESOURCE_TYPE_NAME, properties: props });
     cdk.requireProperty(props, 'apiId', this);
     cdk.requireProperty(props, 'stageName', this);
diff --git a/packages/@aws-cdk/aws-apigateway/package.json b/packages/@aws-cdk/aws-apigateway/package.json
index ad1bda1d82227..76feffb5a432e 100644
--- a/packages/@aws-cdk/aws-apigateway/package.json
+++ b/packages/@aws-cdk/aws-apigateway/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-apigatewayv2-integrations/package.json b/packages/@aws-cdk/aws-apigatewayv2-integrations/package.json
index bf769841adbd8..1f2b016b95a88 100644
--- a/packages/@aws-cdk/aws-apigatewayv2-integrations/package.json
+++ b/packages/@aws-cdk/aws-apigatewayv2-integrations/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "compat": "cdk-compat",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
   "cdk-build": {
diff --git a/packages/@aws-cdk/aws-apigatewayv2/package.json b/packages/@aws-cdk/aws-apigatewayv2/package.json
index b00184f1a7d83..ef28447efd9b5 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/package.json
+++ b/packages/@aws-cdk/aws-apigatewayv2/package.json
@@ -53,8 +53,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "compat": "cdk-compat",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-appconfig/package.json b/packages/@aws-cdk/aws-appconfig/package.json
index 43c2433d295fb..ddcb61b055eed 100644
--- a/packages/@aws-cdk/aws-appconfig/package.json
+++ b/packages/@aws-cdk/aws-appconfig/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-appflow/package.json b/packages/@aws-cdk/aws-appflow/package.json
index 983ec73f62e09..bfba890d339b9 100644
--- a/packages/@aws-cdk/aws-appflow/package.json
+++ b/packages/@aws-cdk/aws-appflow/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/lib/base-scalable-attribute.ts b/packages/@aws-cdk/aws-applicationautoscaling/lib/base-scalable-attribute.ts
index ee955d6d120d1..762da275c33a5 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/lib/base-scalable-attribute.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/lib/base-scalable-attribute.ts
@@ -1,10 +1,13 @@
 import * as iam from '@aws-cdk/aws-iam';
-import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { ScalableTarget, ScalingSchedule, ServiceNamespace } from './scalable-target';
 import { BasicStepScalingPolicyProps } from './step-scaling-policy';
 import { BasicTargetTrackingScalingPolicyProps } from './target-tracking-scaling-policy';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Properties for a ScalableTableAttribute
  */
@@ -44,7 +47,7 @@ export interface BaseScalableAttributeProps extends EnableScalingProps {
  * - Don't expose all scaling methods (for example Dynamo tables don't support
  *   Step Scaling, so the Dynamo subclass won't expose this method).
  */
-export abstract class BaseScalableAttribute extends cdk.Construct {
+export abstract class BaseScalableAttribute extends CoreConstruct {
   private target: ScalableTarget;
 
   public constructor(scope: Construct, id: string, protected readonly props: BaseScalableAttributeProps) {
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-action.ts b/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-action.ts
index 4cb7aa2328ebc..67021e74f71bf 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-action.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-action.ts
@@ -3,6 +3,10 @@ import { Construct } from 'constructs';
 import { CfnScalingPolicy } from './applicationautoscaling.generated';
 import { IScalableTarget } from './scalable-target';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Properties for a scaling policy
  */
@@ -67,7 +71,7 @@ export interface StepScalingActionProps {
  *
  * This Action must be used as the target of a CloudWatch alarm to take effect.
  */
-export class StepScalingAction extends cdk.Construct {
+export class StepScalingAction extends CoreConstruct {
   /**
    * ARN of the scaling policy
    */
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-policy.ts b/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-policy.ts
index 455e9ebbbd9e9..417ecf34f1970 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-policy.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/lib/step-scaling-policy.ts
@@ -5,6 +5,10 @@ import { Construct } from 'constructs';
 import { IScalableTarget } from './scalable-target';
 import { AdjustmentType, MetricAggregationType, StepScalingAction } from './step-scaling-action';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 export interface BasicStepScalingPolicyProps {
   /**
    * Metric to scale on.
@@ -63,7 +67,7 @@ export interface StepScalingPolicyProps extends BasicStepScalingPolicyProps {
  *
  * Implemented using one or more CloudWatch alarms and Step Scaling Policies.
  */
-export class StepScalingPolicy extends cdk.Construct {
+export class StepScalingPolicy extends CoreConstruct {
   public readonly lowerAlarm?: cloudwatch.Alarm;
   public readonly lowerAction?: StepScalingAction;
   public readonly upperAlarm?: cloudwatch.Alarm;
@@ -210,7 +214,7 @@ class StepScalingAlarmAction implements cloudwatch.IAlarmAction {
   constructor(private readonly stepScalingAction: StepScalingAction) {
   }
 
-  public bind(_scope: cdk.Construct, _alarm: cloudwatch.IAlarm): cloudwatch.AlarmActionConfig {
+  public bind(_scope: CoreConstruct, _alarm: cloudwatch.IAlarm): cloudwatch.AlarmActionConfig {
     return { alarmActionArn: this.stepScalingAction.scalingPolicyArn };
   }
 }
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/lib/target-tracking-scaling-policy.ts b/packages/@aws-cdk/aws-applicationautoscaling/lib/target-tracking-scaling-policy.ts
index 65146b754757b..f7ccaff153ffe 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/lib/target-tracking-scaling-policy.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/lib/target-tracking-scaling-policy.ts
@@ -4,6 +4,10 @@ import { Construct } from 'constructs';
 import { CfnScalingPolicy } from './applicationautoscaling.generated';
 import { IScalableTarget } from './scalable-target';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Base interface for target tracking props
  *
@@ -115,7 +119,7 @@ export interface TargetTrackingScalingPolicyProps extends BasicTargetTrackingSca
   readonly scalingTarget: IScalableTarget;
 }
 
-export class TargetTrackingScalingPolicy extends cdk.Construct {
+export class TargetTrackingScalingPolicy extends CoreConstruct {
   /**
    * ARN of the scaling policy
    */
@@ -234,4 +238,9 @@ export enum PredefinedMetric {
    * @see https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics.html#monitoring-metrics-concurrency
    */
   LAMBDA_PROVISIONED_CONCURRENCY_UTILIZATION = 'LambdaProvisionedConcurrencyUtilization',
+  /**
+   * KAFKA_BROKER_STORAGE_UTILIZATION
+   * @see https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PredefinedMetricSpecification.html
+   */
+  KAFKA_BROKER_STORAGE_UTILIZATION = 'KafkaBrokerStorageUtilization',
 }
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/package.json b/packages/@aws-cdk/aws-applicationautoscaling/package.json
index f9b8ce510249c..8f32e7e72abff 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/package.json
+++ b/packages/@aws-cdk/aws-applicationautoscaling/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-applicationinsights/package.json b/packages/@aws-cdk/aws-applicationinsights/package.json
index 541919b17dffd..b85047d8e2afa 100644
--- a/packages/@aws-cdk/aws-applicationinsights/package.json
+++ b/packages/@aws-cdk/aws-applicationinsights/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-appmesh/lib/client-policy.ts b/packages/@aws-cdk/aws-appmesh/lib/client-policy.ts
index 03236ee1c8f32..8f39b88399111 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/client-policy.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/client-policy.ts
@@ -1,7 +1,10 @@
 import * as acmpca from '@aws-cdk/aws-acmpca';
-import * as cdk from '@aws-cdk/core';
 import { CfnVirtualNode } from './appmesh.generated';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 enum CertificateType {
   ACMPCA = 'acm',
   FILE = 'file',
@@ -71,7 +74,7 @@ export abstract class ClientPolicy {
   /**
    * Returns Trust context based on trust type.
    */
-  public abstract bind(scope: cdk.Construct): ClientPolicyConfig;
+  public abstract bind(scope: Construct): ClientPolicyConfig;
 
 }
 
@@ -81,7 +84,7 @@ class ClientPolicyImpl extends ClientPolicy {
     private readonly certificateChain: string | undefined,
     private readonly certificateAuthorityArns: acmpca.ICertificateAuthority[] | undefined) { super(); }
 
-  public bind(_scope: cdk.Construct): ClientPolicyConfig {
+  public bind(_scope: Construct): ClientPolicyConfig {
     if (this.certificateType === CertificateType.ACMPCA && this.certificateAuthorityArns?.map(certificateArn =>
       certificateArn.certificateAuthorityArn).length === 0) {
       throw new Error('You must provide at least one Certificate Authority when creating an ACM Trust ClientPolicy');
diff --git a/packages/@aws-cdk/aws-appmesh/lib/gateway-route-spec.ts b/packages/@aws-cdk/aws-appmesh/lib/gateway-route-spec.ts
index 525bc4d2ba7e0..0a90fb1632ff9 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/gateway-route-spec.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/gateway-route-spec.ts
@@ -1,8 +1,11 @@
-import * as cdk from '@aws-cdk/core';
 import { CfnGatewayRoute } from './appmesh.generated';
 import { Protocol } from './shared-interfaces';
 import { IVirtualService } from './virtual-service';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * The criterion for determining a request match for this GatewayRoute
  */
@@ -119,7 +122,7 @@ export abstract class GatewayRouteSpec {
    * Called when the GatewayRouteSpec type is initialized. Can be used to enforce
    * mutual exclusivity with future properties
    */
-  public abstract bind(scope: cdk.Construct): GatewayRouteSpecConfig;
+  public abstract bind(scope: Construct): GatewayRouteSpecConfig;
 }
 
 class HttpGatewayRouteSpec extends GatewayRouteSpec {
@@ -147,7 +150,7 @@ class HttpGatewayRouteSpec extends GatewayRouteSpec {
     this.match = options.match;
   }
 
-  public bind(_scope: cdk.Construct): GatewayRouteSpecConfig {
+  public bind(_scope: Construct): GatewayRouteSpecConfig {
     const prefixPath = this.match ? this.match.prefixPath : '/';
     if (prefixPath[0] != '/') {
       throw new Error(`Prefix Path must start with \'/\', got: ${prefixPath}`);
@@ -190,7 +193,7 @@ class GrpcGatewayRouteSpec extends GatewayRouteSpec {
     this.routeTarget = options.routeTarget;
   }
 
-  public bind(_scope: cdk.Construct): GatewayRouteSpecConfig {
+  public bind(_scope: Construct): GatewayRouteSpecConfig {
     return {
       grpcSpecConfig: {
         action: {
diff --git a/packages/@aws-cdk/aws-appmesh/lib/route-spec.ts b/packages/@aws-cdk/aws-appmesh/lib/route-spec.ts
index b3ce09f0c0031..74b16976b69ca 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/route-spec.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/route-spec.ts
@@ -1,8 +1,11 @@
-import * as cdk from '@aws-cdk/core';
 import { CfnRoute } from './appmesh.generated';
 import { Protocol, HttpTimeout, GrpcTimeout, TcpTimeout } from './shared-interfaces';
 import { IVirtualNode } from './virtual-node';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for the Weighted Targets in the route
  */
@@ -176,7 +179,7 @@ export abstract class RouteSpec {
    * Called when the GatewayRouteSpec type is initialized. Can be used to enforce
    * mutual exclusivity with future properties
    */
-  public abstract bind(scope: cdk.Construct): RouteSpecConfig;
+  public abstract bind(scope: Construct): RouteSpecConfig;
 }
 
 class HttpRouteSpec extends RouteSpec {
@@ -208,7 +211,7 @@ class HttpRouteSpec extends RouteSpec {
     this.timeout = props.timeout;
   }
 
-  public bind(_scope: cdk.Construct): RouteSpecConfig {
+  public bind(_scope: Construct): RouteSpecConfig {
     const prefixPath = this.match ? this.match.prefixPath : '/';
     if (prefixPath[0] != '/') {
       throw new Error(`Prefix Path must start with \'/\', got: ${prefixPath}`);
@@ -246,7 +249,7 @@ class TcpRouteSpec extends RouteSpec {
     this.timeout = props.timeout;
   }
 
-  public bind(_scope: cdk.Construct): RouteSpecConfig {
+  public bind(_scope: Construct): RouteSpecConfig {
     return {
       tcpRouteSpec: {
         action: {
@@ -270,7 +273,7 @@ class GrpcRouteSpec extends RouteSpec {
     this.timeout = props.timeout;
   }
 
-  public bind(_scope: cdk.Construct): RouteSpecConfig {
+  public bind(_scope: Construct): RouteSpecConfig {
     return {
       grpcRouteSpec: {
         action: {
diff --git a/packages/@aws-cdk/aws-appmesh/lib/service-discovery.ts b/packages/@aws-cdk/aws-appmesh/lib/service-discovery.ts
index b5fca6525c851..961357945a16b 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/service-discovery.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/service-discovery.ts
@@ -1,7 +1,10 @@
 import * as cloudmap from '@aws-cdk/aws-servicediscovery';
-import * as cdk from '@aws-cdk/core';
 import { CfnVirtualNode } from './appmesh.generated';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 
 /**
  * Represents the properties needed to define CloudMap Service Discovery
@@ -63,7 +66,7 @@ export abstract class ServiceDiscovery {
   /**
    * Binds the current object when adding Service Discovery to a VirtualNode
    */
-  public abstract bind(scope: cdk.Construct): ServiceDiscoveryConfig;
+  public abstract bind(scope: Construct): ServiceDiscoveryConfig;
 }
 
 class DnsServiceDiscovery extends ServiceDiscovery {
@@ -74,7 +77,7 @@ class DnsServiceDiscovery extends ServiceDiscovery {
     this.hostname = hostname;
   }
 
-  public bind(_scope: cdk.Construct): ServiceDiscoveryConfig {
+  public bind(_scope: Construct): ServiceDiscoveryConfig {
     return {
       dns: {
         hostname: this.hostname,
@@ -93,7 +96,7 @@ class CloudMapServiceDiscovery extends ServiceDiscovery {
     this.instanceAttributes = options.instanceAttributes;
   }
 
-  public bind(_scope: cdk.Construct): ServiceDiscoveryConfig {
+  public bind(_scope: Construct): ServiceDiscoveryConfig {
     return {
       cloudmap: {
         namespaceName: this.service.namespace.namespaceName,
diff --git a/packages/@aws-cdk/aws-appmesh/lib/shared-interfaces.ts b/packages/@aws-cdk/aws-appmesh/lib/shared-interfaces.ts
index cbd574489f9c4..831db66e49e0c 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/shared-interfaces.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/shared-interfaces.ts
@@ -1,6 +1,10 @@
 import * as cdk from '@aws-cdk/core';
 import { CfnVirtualGateway, CfnVirtualNode } from './appmesh.generated';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Represents timeouts for HTTP protocols.
  */
@@ -155,7 +159,7 @@ export abstract class AccessLog {
    * Called when the AccessLog type is initialized. Can be used to enforce
    * mutual exclusivity with future properties
    */
-  public abstract bind(scope: cdk.Construct): AccessLogConfig;
+  public abstract bind(scope: Construct): AccessLogConfig;
 }
 
 /**
@@ -174,7 +178,7 @@ class FileAccessLog extends AccessLog {
     this.filePath = filePath;
   }
 
-  public bind(_scope: cdk.Construct): AccessLogConfig {
+  public bind(_scope: Construct): AccessLogConfig {
     return {
       virtualNodeAccessLog: {
         file: {
diff --git a/packages/@aws-cdk/aws-appmesh/lib/tls-certificate.ts b/packages/@aws-cdk/aws-appmesh/lib/tls-certificate.ts
index 524eb079d8702..ec227fb13df99 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/tls-certificate.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/tls-certificate.ts
@@ -1,7 +1,10 @@
 import * as acm from '@aws-cdk/aws-certificatemanager';
-import * as cdk from '@aws-cdk/core';
 import { CfnVirtualNode } from './appmesh.generated';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Enum of supported TLS modes
  */
@@ -93,7 +96,7 @@ export abstract class TlsCertificate {
   /**
    * Returns TLS certificate based provider.
    */
-  public abstract bind(_scope: cdk.Construct): TlsCertificateConfig;
+  public abstract bind(_scope: Construct): TlsCertificateConfig;
 
 }
 
@@ -119,7 +122,7 @@ class AcmTlsCertificate extends TlsCertificate {
     this.acmCertificate = props.certificate;
   }
 
-  bind(_scope: cdk.Construct): TlsCertificateConfig {
+  bind(_scope: Construct): TlsCertificateConfig {
     return {
       tlsCertificate: {
         acm: {
@@ -159,7 +162,7 @@ class FileTlsCertificate extends TlsCertificate {
     this.privateKey = props.privateKeyPath;
   }
 
-  bind(_scope: cdk.Construct): TlsCertificateConfig {
+  bind(_scope: Construct): TlsCertificateConfig {
     return {
       tlsCertificate: {
         file: {
diff --git a/packages/@aws-cdk/aws-appmesh/lib/virtual-gateway-listener.ts b/packages/@aws-cdk/aws-appmesh/lib/virtual-gateway-listener.ts
index afe21479ede0c..9f081ffdefd60 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/virtual-gateway-listener.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/virtual-gateway-listener.ts
@@ -4,6 +4,10 @@ import { validateHealthChecks } from './private/utils';
 import { HealthCheck, Protocol } from './shared-interfaces';
 import { TlsCertificate, TlsCertificateConfig } from './tls-certificate';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Represents the properties needed to define HTTP Listeners for a VirtualGateway
  */
@@ -95,7 +99,7 @@ export abstract class VirtualGatewayListener {
    * Called when the GatewayListener type is initialized. Can be used to enforce
    * mutual exclusivity
    */
-  public abstract bind(scope: cdk.Construct): VirtualGatewayListenerConfig;
+  public abstract bind(scope: Construct): VirtualGatewayListenerConfig;
 }
 
 /**
@@ -114,7 +118,7 @@ class VirtualGatewayListenerImpl extends VirtualGatewayListener {
    * Called when the GatewayListener type is initialized. Can be used to enforce
    * mutual exclusivity
    */
-  public bind(scope: cdk.Construct): VirtualGatewayListenerConfig {
+  public bind(scope: Construct): VirtualGatewayListenerConfig {
     const tlsConfig = this.tlsCertificate?.bind(scope);
     return {
       listener: {
diff --git a/packages/@aws-cdk/aws-appmesh/lib/virtual-node-listener.ts b/packages/@aws-cdk/aws-appmesh/lib/virtual-node-listener.ts
index 332e7c5771d15..883d05583d5c7 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/virtual-node-listener.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/virtual-node-listener.ts
@@ -4,6 +4,10 @@ import { validateHealthChecks } from './private/utils';
 import { HealthCheck, Protocol, HttpTimeout, GrpcTimeout, TcpTimeout } from './shared-interfaces';
 import { TlsCertificate, TlsCertificateConfig } from './tls-certificate';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for a VirtualNode listener
  */
@@ -111,7 +115,7 @@ export abstract class VirtualNodeListener {
   /**
    * Binds the current object when adding Listener to a VirtualNode
    */
-  public abstract bind(scope: cdk.Construct): VirtualNodeListenerConfig;
+  public abstract bind(scope: Construct): VirtualNodeListenerConfig;
 
 }
 
@@ -122,7 +126,7 @@ class VirtualNodeListenerImpl extends VirtualNodeListener {
     private readonly port: number = 8080,
     private readonly tlsCertificate: TlsCertificate | undefined) { super(); }
 
-  public bind(scope: cdk.Construct): VirtualNodeListenerConfig {
+  public bind(scope: Construct): VirtualNodeListenerConfig {
     const tlsConfig = this.tlsCertificate?.bind(scope);
     return {
       listener: {
diff --git a/packages/@aws-cdk/aws-appmesh/lib/virtual-router-listener.ts b/packages/@aws-cdk/aws-appmesh/lib/virtual-router-listener.ts
index 7a5e867d0b7c9..ced6279d78664 100644
--- a/packages/@aws-cdk/aws-appmesh/lib/virtual-router-listener.ts
+++ b/packages/@aws-cdk/aws-appmesh/lib/virtual-router-listener.ts
@@ -1,7 +1,10 @@
-import * as cdk from '@aws-cdk/core';
 import { CfnVirtualRouter } from './appmesh.generated';
 import { Protocol } from './shared-interfaces';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for a VirtualRouter listener
  */
@@ -56,7 +59,7 @@ export abstract class VirtualRouterListener {
    * Called when the VirtualRouterListener type is initialized. Can be used to enforce
    * mutual exclusivity
    */
-  public abstract bind(scope: cdk.Construct): VirtualRouterListenerConfig;
+  public abstract bind(scope: Construct): VirtualRouterListenerConfig;
 }
 
 class VirtualRouterListenerImpl extends VirtualRouterListener {
@@ -69,7 +72,7 @@ class VirtualRouterListenerImpl extends VirtualRouterListener {
     this.port = port ?? 8080;
   }
 
-  bind(_scope: cdk.Construct): VirtualRouterListenerConfig {
+  bind(_scope: Construct): VirtualRouterListenerConfig {
     return {
       listener: {
         portMapping: {
diff --git a/packages/@aws-cdk/aws-appmesh/package.json b/packages/@aws-cdk/aws-appmesh/package.json
index 4f8f64891e3c7..6bb978e952163 100644
--- a/packages/@aws-cdk/aws-appmesh/package.json
+++ b/packages/@aws-cdk/aws-appmesh/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-appstream/package.json b/packages/@aws-cdk/aws-appstream/package.json
index d016bfd710ea9..1eae7b83435fe 100644
--- a/packages/@aws-cdk/aws-appstream/package.json
+++ b/packages/@aws-cdk/aws-appstream/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-appsync/package.json b/packages/@aws-cdk/aws-appsync/package.json
index 3d55d00b96177..8ed0cd17ab24a 100644
--- a/packages/@aws-cdk/aws-appsync/package.json
+++ b/packages/@aws-cdk/aws-appsync/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-athena/package.json b/packages/@aws-cdk/aws-athena/package.json
index 31a915a4e3c28..f4cc47dd94d78 100644
--- a/packages/@aws-cdk/aws-athena/package.json
+++ b/packages/@aws-cdk/aws-athena/package.json
@@ -54,8 +54,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-auditmanager/package.json b/packages/@aws-cdk/aws-auditmanager/package.json
index 35a6fdbe08a93..0eae1ffec4d63 100644
--- a/packages/@aws-cdk/aws-auditmanager/package.json
+++ b/packages/@aws-cdk/aws-auditmanager/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-autoscaling-common/package.json b/packages/@aws-cdk/aws-autoscaling-common/package.json
index 1a733ec3c7541..f691bbc0f1806 100644
--- a/packages/@aws-cdk/aws-autoscaling-common/package.json
+++ b/packages/@aws-cdk/aws-autoscaling-common/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json b/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json
index 8b248b409edc1..a5362f036a8f0 100644
--- a/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json
+++ b/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-autoscaling/package.json b/packages/@aws-cdk/aws-autoscaling/package.json
index dae1b16cd2ef7..503a85adef837 100644
--- a/packages/@aws-cdk/aws-autoscaling/package.json
+++ b/packages/@aws-cdk/aws-autoscaling/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts b/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts
index 86604a52d3404..5207897cd1786 100644
--- a/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts
+++ b/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts
@@ -7,6 +7,10 @@ import * as constructs from 'constructs';
 import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as autoscaling from '../lib';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 nodeunitShim({
   'target tracking policies': {
     'cpu utilization'(test: Test) {
@@ -273,7 +277,7 @@ nodeunitShim({
   },
 });
 
-class ASGFixture extends cdk.Construct {
+class ASGFixture extends Construct {
   public readonly vpc: ec2.Vpc;
   public readonly asg: autoscaling.AutoScalingGroup;
 
diff --git a/packages/@aws-cdk/aws-autoscalingplans/package.json b/packages/@aws-cdk/aws-autoscalingplans/package.json
index b759ade9a0f5d..9f3781e3b8747 100644
--- a/packages/@aws-cdk/aws-autoscalingplans/package.json
+++ b/packages/@aws-cdk/aws-autoscalingplans/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-backup/package.json b/packages/@aws-cdk/aws-backup/package.json
index 93a382bfb6188..71cbaa5dd64ae 100644
--- a/packages/@aws-cdk/aws-backup/package.json
+++ b/packages/@aws-cdk/aws-backup/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-batch/package.json b/packages/@aws-cdk/aws-batch/package.json
index ace4bf6d5fa51..30345183b2040 100644
--- a/packages/@aws-cdk/aws-batch/package.json
+++ b/packages/@aws-cdk/aws-batch/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-budgets/package.json b/packages/@aws-cdk/aws-budgets/package.json
index 88615407e5a16..826c9b8158478 100644
--- a/packages/@aws-cdk/aws-budgets/package.json
+++ b/packages/@aws-cdk/aws-budgets/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-cassandra/package.json b/packages/@aws-cdk/aws-cassandra/package.json
index dbf22f7b0acf4..67940de8d8e51 100644
--- a/packages/@aws-cdk/aws-cassandra/package.json
+++ b/packages/@aws-cdk/aws-cassandra/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-ce/package.json b/packages/@aws-cdk/aws-ce/package.json
index 323ca8cceb82f..23b2760ca9625 100644
--- a/packages/@aws-cdk/aws-ce/package.json
+++ b/packages/@aws-cdk/aws-ce/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-certificatemanager/package.json b/packages/@aws-cdk/aws-certificatemanager/package.json
index 5ef9c714cde23..74ab70c82c4dc 100644
--- a/packages/@aws-cdk/aws-certificatemanager/package.json
+++ b/packages/@aws-cdk/aws-certificatemanager/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-chatbot/package.json b/packages/@aws-cdk/aws-chatbot/package.json
index eb4c05bdcdab2..d3a2d70d80528 100644
--- a/packages/@aws-cdk/aws-chatbot/package.json
+++ b/packages/@aws-cdk/aws-chatbot/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-cloud9/package.json b/packages/@aws-cdk/aws-cloud9/package.json
index ba53213d22aac..aa0b7cf43ff5e 100644
--- a/packages/@aws-cdk/aws-cloud9/package.json
+++ b/packages/@aws-cdk/aws-cloud9/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-cloudformation/lib/custom-resource.ts b/packages/@aws-cdk/aws-cloudformation/lib/custom-resource.ts
index 93ac7d4b9913a..a36411c8504f3 100644
--- a/packages/@aws-cdk/aws-cloudformation/lib/custom-resource.ts
+++ b/packages/@aws-cdk/aws-cloudformation/lib/custom-resource.ts
@@ -2,6 +2,10 @@ import * as lambda from '@aws-cdk/aws-lambda';
 import * as sns from '@aws-cdk/aws-sns';
 import * as core from '@aws-cdk/core';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Collection of arbitrary properties
  */
@@ -28,7 +32,7 @@ export interface ICustomResourceProvider {
    * @param scope The resource that uses this provider.
    * @returns provider configuration
    */
-  bind(scope: core.Construct): CustomResourceProviderConfig;
+  bind(scope: Construct): CustomResourceProviderConfig;
 }
 
 /**
@@ -68,7 +72,7 @@ export class CustomResourceProvider implements ICustomResourceProvider {
    */
   private constructor(public readonly serviceToken: string) { }
 
-  public bind(_: core.Construct): CustomResourceProviderConfig {
+  public bind(_: Construct): CustomResourceProviderConfig {
     return { serviceToken: this.serviceToken };
   }
 }
@@ -151,7 +155,7 @@ export interface CustomResourceProps {
  * @deprecated use `core.CustomResource`
  */
 export class CustomResource extends core.CustomResource {
-  constructor(scope: core.Construct, id: string, props: CustomResourceProps) {
+  constructor(scope: Construct, id: string, props: CustomResourceProps) {
     super(scope, id, {
       pascalCaseProperties: true,
       properties: props.properties,
diff --git a/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts b/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts
index bb9481d2a75c2..81487ac1470b4 100644
--- a/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts
+++ b/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts
@@ -1,6 +1,10 @@
 import * as sns from '@aws-cdk/aws-sns';
 import * as core from '@aws-cdk/core';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Initialization props for the `NestedStack` construct.
  *
@@ -63,7 +67,7 @@ export interface NestedStackProps {
  * @experimental
  */
 export class NestedStack extends core.NestedStack {
-  constructor(scope: core.Construct, id: string, props: NestedStackProps = { }) {
+  constructor(scope: Construct, id: string, props: NestedStackProps = { }) {
     super(scope, id, {
       parameters: props.parameters,
       timeout: props.timeout,
diff --git a/packages/@aws-cdk/aws-cloudformation/package.json b/packages/@aws-cdk/aws-cloudformation/package.json
index 299816954909b..e6b20deb692dd 100644
--- a/packages/@aws-cdk/aws-cloudformation/package.json
+++ b/packages/@aws-cdk/aws-cloudformation/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-cloudformation/test/integ.trivial-lambda-resource.ts b/packages/@aws-cdk/aws-cloudformation/test/integ.trivial-lambda-resource.ts
index e18bafe3736a8..5d2b63f9b88b0 100644
--- a/packages/@aws-cdk/aws-cloudformation/test/integ.trivial-lambda-resource.ts
+++ b/packages/@aws-cdk/aws-cloudformation/test/integ.trivial-lambda-resource.ts
@@ -3,6 +3,10 @@ import * as lambda from '@aws-cdk/aws-lambda';
 import * as cdk from '@aws-cdk/core';
 import { CustomResource, CustomResourceProvider } from '../lib';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /* eslint-disable cdk/no-core-construct */
 
 interface DemoResourceProps {
@@ -17,10 +21,10 @@ interface DemoResourceProps {
   failCreate?: boolean;
 }
 
-class DemoResource extends cdk.Construct {
+class DemoResource extends Construct {
   public readonly response: string;
 
-  constructor(scope: cdk.Construct, id: string, props: DemoResourceProps) {
+  constructor(scope: Construct, id: string, props: DemoResourceProps) {
     super(scope, id);
 
     const resource = new CustomResource(this, 'Resource', {
diff --git a/packages/@aws-cdk/aws-cloudformation/test/test.resource.ts b/packages/@aws-cdk/aws-cloudformation/test/test.resource.ts
index 9f90779190d71..7015fe21bf948 100644
--- a/packages/@aws-cdk/aws-cloudformation/test/test.resource.ts
+++ b/packages/@aws-cdk/aws-cloudformation/test/test.resource.ts
@@ -5,6 +5,10 @@ import * as cdk from '@aws-cdk/core';
 import { Test, testCase } from 'nodeunit';
 import { CustomResource, CustomResourceProvider } from '../lib';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /* eslint-disable cdk/no-core-construct */
 /* eslint-disable quote-props */
 
@@ -212,10 +216,10 @@ export = testCase({
   },
 });
 
-class TestCustomResource extends cdk.Construct {
+class TestCustomResource extends Construct {
   public readonly resource: CustomResource;
 
-  constructor(scope: cdk.Construct, id: string, opts: { removalPolicy?: cdk.RemovalPolicy } = {}) {
+  constructor(scope: Construct, id: string, opts: { removalPolicy?: cdk.RemovalPolicy } = {}) {
     super(scope, id);
 
     const singletonLambda = new lambda.SingletonFunction(this, 'Lambda', {
diff --git a/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts b/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
index 948b3390ebea1..518e3e728ec1a 100644
--- a/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
+++ b/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
@@ -3,6 +3,10 @@ import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
 import { HttpOrigin } from './http-origin';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties to use to customize an S3 Origin.
  */
@@ -41,7 +45,7 @@ export class S3Origin implements cloudfront.IOrigin {
       new S3BucketOrigin(bucket, props);
   }
 
-  public bind(scope: cdk.Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig {
+  public bind(scope: Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig {
     return this.origin.bind(scope, options);
   }
 }
@@ -61,7 +65,7 @@ class S3BucketOrigin extends cloudfront.OriginBase {
     }
   }
 
-  public bind(scope: cdk.Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig {
+  public bind(scope: Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig {
     if (!this.originAccessIdentity) {
       // Using a bucket from another stack creates a cyclic reference with
       // the bucket taking a dependency on the generated S3CanonicalUserId when `grantRead` is called,
diff --git a/packages/@aws-cdk/aws-cloudfront-origins/package.json b/packages/@aws-cdk/aws-cloudfront-origins/package.json
index f2d620b5f80d7..0c625a16bcebd 100644
--- a/packages/@aws-cdk/aws-cloudfront-origins/package.json
+++ b/packages/@aws-cdk/aws-cloudfront-origins/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
@@ -73,7 +73,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "pkglint": "0.0.0"
diff --git a/packages/@aws-cdk/aws-cloudfront/package.json b/packages/@aws-cdk/aws-cloudfront/package.json
index 47af43c3bf2ca..346130bcfed37 100644
--- a/packages/@aws-cdk/aws-cloudfront/package.json
+++ b/packages/@aws-cdk/aws-cloudfront/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -74,7 +74,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-cloudtrail/package.json b/packages/@aws-cdk/aws-cloudtrail/package.json
index b3577f87bbe06..c99342c9ebb0f 100644
--- a/packages/@aws-cdk/aws-cloudtrail/package.json
+++ b/packages/@aws-cdk/aws-cloudtrail/package.json
@@ -47,8 +47,8 @@
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
     "integ": "cdk-integ",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -74,7 +74,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-cloudwatch-actions/lib/appscaling.ts b/packages/@aws-cdk/aws-cloudwatch-actions/lib/appscaling.ts
index 2241796f47d2b..a37f6badf5ecb 100644
--- a/packages/@aws-cdk/aws-cloudwatch-actions/lib/appscaling.ts
+++ b/packages/@aws-cdk/aws-cloudwatch-actions/lib/appscaling.ts
@@ -1,6 +1,9 @@
 import * as appscaling from '@aws-cdk/aws-applicationautoscaling';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
-import * as cdk from '@aws-cdk/core';
+
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
 
 /**
  * Use an ApplicationAutoScaling StepScalingAction as an Alarm Action
@@ -13,7 +16,7 @@ export class ApplicationScalingAction implements cloudwatch.IAlarmAction {
    * Returns an alarm action configuration to use an ApplicationScaling StepScalingAction
    * as an alarm action
    */
-  public bind(_scope: cdk.Construct, _alarm: cloudwatch.IAlarm): cloudwatch.AlarmActionConfig {
+  public bind(_scope: Construct, _alarm: cloudwatch.IAlarm): cloudwatch.AlarmActionConfig {
     return { alarmActionArn: this.stepScalingAction.scalingPolicyArn };
   }
 }
diff --git a/packages/@aws-cdk/aws-cloudwatch-actions/lib/autoscaling.ts b/packages/@aws-cdk/aws-cloudwatch-actions/lib/autoscaling.ts
index 5ec6e62fe246c..2ce075d4cd129 100644
--- a/packages/@aws-cdk/aws-cloudwatch-actions/lib/autoscaling.ts
+++ b/packages/@aws-cdk/aws-cloudwatch-actions/lib/autoscaling.ts
@@ -1,6 +1,9 @@
 import * as autoscaling from '@aws-cdk/aws-autoscaling';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
-import * as cdk from '@aws-cdk/core';
+
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
 
 /**
  * Use an AutoScaling StepScalingAction as an Alarm Action
@@ -13,7 +16,7 @@ export class AutoScalingAction implements cloudwatch.IAlarmAction {
    * Returns an alarm action configuration to use an AutoScaling StepScalingAction
    * as an alarm action
    */
-  public bind(_scope: cdk.Construct, _alarm: cloudwatch.IAlarm): cloudwatch.AlarmActionConfig {
+  public bind(_scope: Construct, _alarm: cloudwatch.IAlarm): cloudwatch.AlarmActionConfig {
     return { alarmActionArn: this.stepScalingAction.scalingPolicyArn };
   }
 }
diff --git a/packages/@aws-cdk/aws-cloudwatch-actions/package.json b/packages/@aws-cdk/aws-cloudwatch-actions/package.json
index 7955ca032bef2..b3e76e6403307 100644
--- a/packages/@aws-cdk/aws-cloudwatch-actions/package.json
+++ b/packages/@aws-cdk/aws-cloudwatch-actions/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-cloudwatch/lib/metric.ts b/packages/@aws-cdk/aws-cloudwatch/lib/metric.ts
index 3cc51050341b0..fa900333ef0fa 100644
--- a/packages/@aws-cdk/aws-cloudwatch/lib/metric.ts
+++ b/packages/@aws-cdk/aws-cloudwatch/lib/metric.ts
@@ -6,6 +6,10 @@ import { Dimension, IMetric, MetricAlarmConfig, MetricConfig, MetricGraphConfig,
 import { dispatchMetric, metricKey } from './private/metric-util';
 import { normalizeStatistic, parseStatistic } from './private/statistic';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 export type DimensionHash = {[dim: string]: any};
 
 /**
@@ -351,7 +355,7 @@ export class Metric implements IMetric {
    * Combines both properties that may adjust the metric (aggregation) as well
    * as alarm properties.
    */
-  public createAlarm(scope: cdk.Construct, id: string, props: CreateAlarmOptions): Alarm {
+  public createAlarm(scope: Construct, id: string, props: CreateAlarmOptions): Alarm {
     return new Alarm(scope, id, {
       metric: this.with({
         statistic: props.statistic,
@@ -503,7 +507,7 @@ export class MathExpression implements IMetric {
    * Combines both properties that may adjust the metric (aggregation) as well
    * as alarm properties.
    */
-  public createAlarm(scope: cdk.Construct, id: string, props: CreateAlarmOptions): Alarm {
+  public createAlarm(scope: Construct, id: string, props: CreateAlarmOptions): Alarm {
     return new Alarm(scope, id, {
       metric: this.with({
         period: props.period,
diff --git a/packages/@aws-cdk/aws-cloudwatch/package.json b/packages/@aws-cdk/aws-cloudwatch/package.json
index 5a90a27f7e2ea..27fd54f8cab7f 100644
--- a/packages/@aws-cdk/aws-cloudwatch/package.json
+++ b/packages/@aws-cdk/aws-cloudwatch/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codeartifact/package.json b/packages/@aws-cdk/aws-codeartifact/package.json
index 32bcd12d1a022..a767be3c5f17f 100644
--- a/packages/@aws-cdk/aws-codeartifact/package.json
+++ b/packages/@aws-cdk/aws-codeartifact/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codebuild/lib/linux-gpu-build-image.ts b/packages/@aws-cdk/aws-codebuild/lib/linux-gpu-build-image.ts
index b3f4c1d6dad61..6cbf5bcfc2f7e 100644
--- a/packages/@aws-cdk/aws-codebuild/lib/linux-gpu-build-image.ts
+++ b/packages/@aws-cdk/aws-codebuild/lib/linux-gpu-build-image.ts
@@ -8,6 +8,10 @@ import {
   ImagePullPrincipalType, IProject,
 } from './project';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 const mappingName = 'AwsDeepLearningContainersRepositoriesAccounts';
 
 /**
@@ -99,7 +103,7 @@ export class LinuxGpuBuildImage implements IBindableBuildImage {
     this.imageId = `${this.accountExpression}.dkr.ecr.${core.Aws.REGION}.${core.Aws.URL_SUFFIX}/${repositoryName}:${tag}`;
   }
 
-  public bind(scope: core.Construct, project: IProject, _options: BuildImageBindOptions): BuildImageConfig {
+  public bind(scope: Construct, project: IProject, _options: BuildImageBindOptions): BuildImageConfig {
     if (!this.account) {
       const scopeStack = core.Stack.of(scope);
       // Unfortunately, the account IDs of the DLC repositories are not the same in all regions.
diff --git a/packages/@aws-cdk/aws-codebuild/lib/project.ts b/packages/@aws-cdk/aws-codebuild/lib/project.ts
index 13df5688ee151..796422b379782 100644
--- a/packages/@aws-cdk/aws-codebuild/lib/project.ts
+++ b/packages/@aws-cdk/aws-codebuild/lib/project.ts
@@ -1778,8 +1778,10 @@ export interface BuildEnvironmentVariable {
   readonly type?: BuildEnvironmentVariableType;
 
   /**
-   * The value of the environment variable (or the name of the parameter in
-   * the SSM parameter store.)
+   * The value of the environment variable.
+   * For plain-text variables (the default), this is the literal value of variable.
+   * For SSM parameter variables, pass the name of the parameter here (`parameterName` property of `IParameter`).
+   * For SecretsManager variables secrets, pass the secret name here (`secretName` property of `ISecret`).
    */
   readonly value: any;
 }
diff --git a/packages/@aws-cdk/aws-codebuild/package.json b/packages/@aws-cdk/aws-codebuild/package.json
index 3d6f1f2ae1765..10c84560e465e 100644
--- a/packages/@aws-cdk/aws-codebuild/package.json
+++ b/packages/@aws-cdk/aws-codebuild/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -80,7 +80,7 @@
     "@aws-cdk/aws-sns": "0.0.0",
     "@aws-cdk/aws-sqs": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-codecommit/package.json b/packages/@aws-cdk/aws-codecommit/package.json
index f5169ac4b65b3..fccf4d5727932 100644
--- a/packages/@aws-cdk/aws-codecommit/package.json
+++ b/packages/@aws-cdk/aws-codecommit/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -80,7 +80,7 @@
     "@aws-cdk/assert": "0.0.0",
     "@aws-cdk/aws-sns": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-codedeploy/package.json b/packages/@aws-cdk/aws-codedeploy/package.json
index 2214d3414ee72..a13752f5336c0 100644
--- a/packages/@aws-cdk/aws-codedeploy/package.json
+++ b/packages/@aws-cdk/aws-codedeploy/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codeguruprofiler/package.json b/packages/@aws-cdk/aws-codeguruprofiler/package.json
index e20b324f116dd..8ef5becab4f21 100644
--- a/packages/@aws-cdk/aws-codeguruprofiler/package.json
+++ b/packages/@aws-cdk/aws-codeguruprofiler/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codegurureviewer/package.json b/packages/@aws-cdk/aws-codegurureviewer/package.json
index b41bb825eed97..71f71cf4a0f35 100644
--- a/packages/@aws-cdk/aws-codegurureviewer/package.json
+++ b/packages/@aws-cdk/aws-codegurureviewer/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/README.md b/packages/@aws-cdk/aws-codepipeline-actions/README.md
index babb3687077e2..e241c5104ff22 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/README.md
+++ b/packages/@aws-cdk/aws-codepipeline-actions/README.md
@@ -137,7 +137,7 @@ CodePipeline can use a BitBucket Git repository as a source:
 **Note**: you have to manually connect CodePipeline through the AWS Console with your BitBucket account.
 This is a one-time operation for a given AWS account in a given region.
 The simplest way to do that is to either start creating a new CodePipeline,
-or edit na existing one, while being logged in to BitBucket.
+or edit an existing one, while being logged in to BitBucket.
 Choose BitBucket as the source,
 and grant CodePipeline permissions to your BitBucket account.
 Copy & paste the Connection ARN that you get in the console,
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/pipeline-actions.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/pipeline-actions.ts
index 1ba14d469120d..b4a300d887ad4 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/pipeline-actions.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/pipeline-actions.ts
@@ -4,6 +4,10 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
 import { Action } from '../action';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties common to all CloudFormation actions
  */
@@ -82,7 +86,7 @@ abstract class CloudFormationAction extends Action {
     this.props = props;
   }
 
-  protected bound(_scope: cdk.Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(_scope: Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     const singletonPolicy = SingletonPolicy.forRole(options.role);
 
@@ -123,7 +127,7 @@ export class CloudFormationExecuteChangeSetAction extends CloudFormationAction {
     this.props2 = props;
   }
 
-  protected bound(scope: cdk.Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     SingletonPolicy.forRole(options.role).grantExecuteChangeSet(this.props2);
 
@@ -259,7 +263,7 @@ abstract class CloudFormationDeployAction extends CloudFormationAction {
     return this.getDeploymentRole('property role()');
   }
 
-  protected bound(scope: cdk.Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     if (this.props2.deploymentRole) {
       this._deploymentRole = this.props2.deploymentRole;
@@ -359,7 +363,7 @@ export class CloudFormationCreateReplaceChangeSetAction extends CloudFormationDe
     this.props3 = props;
   }
 
-  protected bound(scope: cdk.Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     // the super call order is to preserve the existing order of statements in policies
     const actionConfig = super.bound(scope, stage, options);
@@ -428,7 +432,7 @@ export class CloudFormationCreateUpdateStackAction extends CloudFormationDeployA
     this.props3 = props;
   }
 
-  protected bound(scope: cdk.Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     // the super call order is to preserve the existing order of statements in policies
     const actionConfig = super.bound(scope, stage, options);
@@ -467,7 +471,7 @@ export class CloudFormationDeleteStackAction extends CloudFormationDeployAction
     this.props3 = props;
   }
 
-  protected bound(scope: cdk.Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     // the super call order is to preserve the existing order of statements in policies
     const actionConfig = super.bound(scope, stage, options);
@@ -493,7 +497,7 @@ export class CloudFormationDeleteStackAction extends CloudFormationDeployAction
  * Statements created outside of this class are not considered when adding new
  * permissions.
  */
-class SingletonPolicy extends cdk.Construct implements iam.IGrantable {
+class SingletonPolicy extends Construct implements iam.IGrantable {
   /**
    * Obtain a SingletonPolicy for a given role.
    * @param role the Role this policy is bound to.
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts
index aa2d3be190029..b55d9742c514b 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts
@@ -5,6 +5,10 @@ import * as cdk from '@aws-cdk/core';
 import { BitBucketSourceAction } from '..';
 import { Action } from '../action';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * The type of the CodeBuild action that determines its CodePipeline Category -
  * Build, or Test.
@@ -132,7 +136,7 @@ export class CodeBuildAction extends Action {
     return this.variableExpression(variableName);
   }
 
-  protected bound(scope: cdk.Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(scope: Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     // check for a cross-account action if there are any outputs
     if ((this.actionProperties.outputs || []).length > 0) {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/custom-action-registration.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/custom-action-registration.ts
index ae75a1adeb5c0..41e34ac8a0b5d 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/custom-action-registration.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/custom-action-registration.ts
@@ -1,5 +1,8 @@
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
-import * as cdk from '@aws-cdk/core';
+
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
 
 /**
  * The creation attributes used for defining a configuration property
@@ -109,8 +112,8 @@ export interface CustomActionRegistrationProps {
  * representing your custom Action, extending the Action class,
  * and taking the `actionProperties` as properly typed, construction properties.
  */
-export class CustomActionRegistration extends cdk.Construct {
-  constructor(parent: cdk.Construct, id: string, props: CustomActionRegistrationProps) {
+export class CustomActionRegistration extends Construct {
+  constructor(parent: Construct, id: string, props: CustomActionRegistrationProps) {
     super(parent, id);
 
     new codepipeline.CfnCustomActionType(this, 'Resource', {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/jenkins/jenkins-provider.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/jenkins/jenkins-provider.ts
index a739fc2f0ec6a..923b1a1e39e7c 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/jenkins/jenkins-provider.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/jenkins/jenkins-provider.ts
@@ -3,6 +3,10 @@ import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { CustomActionRegistration } from '../custom-action-registration';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * A Jenkins provider.
  *
@@ -103,7 +107,7 @@ export interface JenkinsProviderProps {
   readonly forTest?: boolean;
 }
 
-export abstract class BaseJenkinsProvider extends cdk.Construct implements IJenkinsProvider {
+export abstract class BaseJenkinsProvider extends CoreConstruct implements IJenkinsProvider {
   public abstract readonly providerName: string;
   public abstract readonly serverUrl: string;
   public readonly version: string;
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/manual-approval-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/manual-approval-action.ts
index 5ddfdb974c4e9..bf91f75b7359b 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/manual-approval-action.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/manual-approval-action.ts
@@ -1,9 +1,12 @@
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as sns from '@aws-cdk/aws-sns';
 import * as subs from '@aws-cdk/aws-sns-subscriptions';
-import * as cdk from '@aws-cdk/core';
 import { Action } from './action';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Construction properties of the {@link ManualApprovalAction}.
  */
@@ -60,7 +63,7 @@ export class ManualApprovalAction extends Action {
     return this._notificationTopic;
   }
 
-  protected bound(scope: cdk.Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(scope: Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     if (this.props.notificationTopic) {
       this._notificationTopic = this.props.notificationTopic;
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/stepfunctions/invoke-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/stepfunctions/invoke-action.ts
index ae05cd093892f..bf6c34ab505a8 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/stepfunctions/invoke-action.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/stepfunctions/invoke-action.ts
@@ -4,6 +4,10 @@ import * as stepfunction from '@aws-cdk/aws-stepfunctions';
 import * as cdk from '@aws-cdk/core';
 import { Action } from '../action';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Represents the input for the StateMachine.
  */
@@ -121,7 +125,7 @@ export class StepFunctionInvokeAction extends Action {
     this.props = props;
   }
 
-  protected bound(_scope: cdk.Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+  protected bound(_scope: Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
   codepipeline.ActionConfig {
     // allow pipeline to invoke this step function
     options.role.addToPolicy(new iam.PolicyStatement({
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/package.json b/packages/@aws-cdk/aws-codepipeline-actions/package.json
index 4ec325a8c2382..86339799ac45e 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/package.json
+++ b/packages/@aws-cdk/aws-codepipeline-actions/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
@@ -70,7 +70,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@aws-cdk/aws-cloudtrail": "0.0.0",
-    "@types/lodash": "^4.14.167",
+    "@types/lodash": "^4.14.168",
     "@types/nodeunit": "^0.0.31",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
diff --git a/packages/@aws-cdk/aws-codepipeline/lib/private/cross-region-support-stack.ts b/packages/@aws-cdk/aws-codepipeline/lib/private/cross-region-support-stack.ts
index 33a81467a23d9..e52e6c7f68a40 100644
--- a/packages/@aws-cdk/aws-codepipeline/lib/private/cross-region-support-stack.ts
+++ b/packages/@aws-cdk/aws-codepipeline/lib/private/cross-region-support-stack.ts
@@ -2,6 +2,10 @@ import * as kms from '@aws-cdk/aws-kms';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 const REQUIRED_ALIAS_PREFIX = 'alias/';
 
 /**
@@ -42,10 +46,10 @@ export interface CrossRegionSupportConstructProps {
   readonly createKmsKey?: boolean;
 }
 
-export class CrossRegionSupportConstruct extends cdk.Construct {
+export class CrossRegionSupportConstruct extends Construct {
   public readonly replicationBucket: s3.IBucket;
 
-  constructor(scope: cdk.Construct, id: string, props: CrossRegionSupportConstructProps = {}) {
+  constructor(scope: Construct, id: string, props: CrossRegionSupportConstructProps = {}) {
     super(scope, id);
 
     const createKmsKey = props.createKmsKey ?? true;
@@ -114,7 +118,7 @@ export class CrossRegionSupportStack extends cdk.Stack {
    */
   public readonly replicationBucket: s3.IBucket;
 
-  constructor(scope: cdk.Construct, id: string, props: CrossRegionSupportStackProps) {
+  constructor(scope: Construct, id: string, props: CrossRegionSupportStackProps) {
     super(scope, id, {
       stackName: generateStackName(props),
       env: {
diff --git a/packages/@aws-cdk/aws-codepipeline/package.json b/packages/@aws-cdk/aws-codepipeline/package.json
index c5cd1428b32ad..066dd370be14b 100644
--- a/packages/@aws-cdk/aws-codepipeline/package.json
+++ b/packages/@aws-cdk/aws-codepipeline/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codestar/package.json b/packages/@aws-cdk/aws-codestar/package.json
index 81e22a59fa6d6..2b021939efff2 100644
--- a/packages/@aws-cdk/aws-codestar/package.json
+++ b/packages/@aws-cdk/aws-codestar/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codestarconnections/package.json b/packages/@aws-cdk/aws-codestarconnections/package.json
index 6f2bcef93d1de..f3eab5579ac12 100644
--- a/packages/@aws-cdk/aws-codestarconnections/package.json
+++ b/packages/@aws-cdk/aws-codestarconnections/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-codestarnotifications/package.json b/packages/@aws-cdk/aws-codestarnotifications/package.json
index 6175bb8240cfc..008fd34635cae 100644
--- a/packages/@aws-cdk/aws-codestarnotifications/package.json
+++ b/packages/@aws-cdk/aws-codestarnotifications/package.json
@@ -49,8 +49,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "compat": "cdk-compat",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-cognito/README.md b/packages/@aws-cdk/aws-cognito/README.md
index f139f9e7b55bc..5067ae8f44b63 100644
--- a/packages/@aws-cdk/aws-cognito/README.md
+++ b/packages/@aws-cdk/aws-cognito/README.md
@@ -572,6 +572,30 @@ pool.addClient('app-client', {
 });
 ```
 
+Clients can (and should) be allowed to read and write relevant user attributes only. Usually every client can be allowed to read the `given_name`
+attribute but not every client should be allowed to set the `email_verified` attribute.
+The same criteria applies for both standard and custom attributes, more info is available at
+[Attribute Permissions and Scopes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-attribute-permissions-and-scopes).
+The default behaviour is to allow read and write permissions on all attributes. The following code shows how this can be configured for a client.
+
+```ts
+const pool = new cognito.UserPool(this, 'Pool');
+
+const clientWriteAttributes = (new ClientAttributes())
+  .withStandardAttributes({name: true, email: true})
+  .withCustomAttributes(['favouritePizza']);
+
+const clientReadAttributes = clientWriteAttributes
+  .withStandardAttributes({emailVerified: true})
+  .withCustomAttributes(['pointsEarned']);
+
+pool.addClient('app-client', {
+  // ...
+  readAttributes: clientReadAttributes,
+  writeAttributes: clientWriteAttributes,
+});
+```
+
 ### Resource Servers
 
 A resource server is a server for access-protected resources. It handles authenticated requests from an app that has an
diff --git a/packages/@aws-cdk/aws-cognito/lib/private/attr-names.ts b/packages/@aws-cdk/aws-cognito/lib/private/attr-names.ts
index 1f0891cec1704..c3b07ddbb7742 100644
--- a/packages/@aws-cdk/aws-cognito/lib/private/attr-names.ts
+++ b/packages/@aws-cdk/aws-cognito/lib/private/attr-names.ts
@@ -16,4 +16,6 @@ export const StandardAttributeNames = {
   timezone: 'zoneinfo',
   lastUpdateTime: 'updated_at',
   website: 'website',
+  emailVerified: 'email_verified',
+  phoneNumberVerified: 'phone_number_verified',
 };
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-cognito/lib/user-pool-attr.ts b/packages/@aws-cdk/aws-cognito/lib/user-pool-attr.ts
index e9881bd8b3a14..0687a0cb123ba 100644
--- a/packages/@aws-cdk/aws-cognito/lib/user-pool-attr.ts
+++ b/packages/@aws-cdk/aws-cognito/lib/user-pool-attr.ts
@@ -1,4 +1,5 @@
 import { Token } from '@aws-cdk/core';
+import { StandardAttributeNames } from './private/attr-names';
 
 /**
  * The set of standard attributes that can be marked as required or mutable.
@@ -107,6 +108,18 @@ export interface StandardAttributes {
    * @default - see the defaults under `StandardAttribute`
    */
   readonly website?: StandardAttribute;
+
+  /**
+   * Whether the email address has been verified.
+   * @default - see the defaults under `StandardAttribute`
+   */
+  readonly emailVerified?: StandardAttribute;
+
+  /**
+   * Whether the phone number has been verified.
+   * @default - see the defaults under `StandardAttribute`
+   */
+  readonly phoneNumberVerified?: StandardAttribute;
 }
 
 /**
@@ -341,3 +354,190 @@ export class DateTimeAttribute implements ICustomAttribute {
     };
   }
 }
+
+/**
+ * This interface contains all standard attributes recognized by Cognito
+ * from https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html
+ * including `email_verified` and `phone_number_verified`
+ */
+export interface StandardAttributesMask {
+  /**
+   * The user's postal address.
+   * @default false
+   */
+  readonly address?: boolean;
+
+  /**
+   * The user's birthday, represented as an ISO 8601:2004 format.
+   * @default false
+   */
+  readonly birthdate?: boolean;
+
+  /**
+   * The user's e-mail address, represented as an RFC 5322 [RFC5322] addr-spec.
+   * @default false
+   */
+  readonly email?: boolean;
+
+  /**
+   * The surname or last name of the user.
+   * @default false
+   */
+  readonly familyName?: boolean;
+
+  /**
+   * The user's gender.
+   * @default false
+   */
+  readonly gender?: boolean;
+
+  /**
+   * The user's first name or give name.
+   * @default false
+   */
+  readonly givenName?: boolean;
+
+  /**
+   * The user's locale, represented as a BCP47 [RFC5646] language tag.
+   * @default false
+   */
+  readonly locale?: boolean;
+
+  /**
+   * The user's middle name.
+   * @default false
+   */
+  readonly middleName?: boolean;
+
+  /**
+   * The user's full name in displayable form, including all name parts, titles and suffixes.
+   * @default false
+   */
+  readonly fullname?: boolean;
+
+  /**
+   * The user's nickname or casual name.
+   * @default false
+   */
+  readonly nickname?: boolean;
+
+  /**
+   * The user's telephone number.
+   * @default false
+   */
+  readonly phoneNumber?: boolean;
+
+  /**
+   * The URL to the user's profile picture.
+   * @default false
+   */
+  readonly profilePicture?: boolean;
+
+  /**
+   * The user's preffered username, different from the immutable user name.
+   * @default false
+   */
+  readonly preferredUsername?: boolean;
+
+  /**
+   * The URL to the user's profile page.
+   * @default false
+   */
+  readonly profilePage?: boolean;
+
+  /**
+   * The user's time zone.
+   * @default false
+   */
+  readonly timezone?: boolean;
+
+  /**
+   * The time, the user's information was last updated.
+   * @default false
+   */
+  readonly lastUpdateTime?: boolean;
+
+  /**
+   * The URL to the user's web page or blog.
+   * @default false
+   */
+  readonly website?: boolean;
+
+  /**
+   * Whether the email address has been verified.
+   * @default false
+   */
+  readonly emailVerified?: boolean;
+
+  /**
+   * Whether the phone number has been verified.
+   * @default false
+   */
+  readonly phoneNumberVerified?: boolean;
+}
+
+
+/**
+ * A set of attributes, useful to set Read and Write attributes
+ */
+export class ClientAttributes {
+
+  /**
+   * The set of attributes
+   */
+  private attributesSet: Set<string>;
+
+  /**
+   * Creates a ClientAttributes with the specified attributes
+   *
+   * @default - a ClientAttributes object without any attributes
+   */
+  constructor() {
+    this.attributesSet = new Set<string>();
+  }
+
+  /**
+   * Creates a custom ClientAttributes with the specified attributes
+   * @param attributes a list of standard attributes to add to the set
+   */
+  public withStandardAttributes(attributes: StandardAttributesMask): ClientAttributes {
+    let attributesSet = new Set(this.attributesSet);
+    // iterate through key-values in the `StandardAttributeNames` constant
+    // to get the value for all attributes
+    for (const attributeKey in StandardAttributeNames) {
+      if ((attributes as any)[attributeKey] === true) {
+        const attributeName = (StandardAttributeNames as any)[attributeKey];
+        attributesSet.add(attributeName);
+      }
+    }
+    let aux = new ClientAttributes();
+    aux.attributesSet = attributesSet;
+    return aux;
+  }
+
+  /**
+   * Creates a custom ClientAttributes with the specified attributes
+   * @param attributes a list of custom attributes to add to the set
+   */
+  public withCustomAttributes(...attributes: string[]): ClientAttributes {
+    let attributesSet: Set<string> = new Set(this.attributesSet);
+    for (let attribute of attributes) {
+      // custom attributes MUST begin with `custom:`, so add the string if not present
+      if (!attribute.startsWith('custom:')) {
+        attribute = 'custom:' + attribute;
+      }
+      attributesSet.add(attribute);
+    }
+    let aux = new ClientAttributes();
+    aux.attributesSet = attributesSet;
+    return aux;
+  }
+
+  /**
+   * The list of attributes represented by this ClientAttributes
+   */
+  public attributes(): string[] {
+    // sorting is unnecessary but it simplify testing
+    return Array.from(this.attributesSet).sort();
+  }
+}
diff --git a/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts b/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
index d8c8ae2d946bf..ea5693f45d1c4 100644
--- a/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
+++ b/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
@@ -2,6 +2,7 @@ import { IResource, Resource, Duration } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { CfnUserPoolClient } from './cognito.generated';
 import { IUserPool } from './user-pool';
+import { ClientAttributes } from './user-pool-attr';
 import { IUserPoolResourceServer, ResourceServerScope } from './user-pool-resource-server';
 
 /**
@@ -272,6 +273,20 @@ export interface UserPoolClientOptions {
    * @default Duration.minutes(60)
    */
   readonly accessTokenValidity?: Duration;
+
+  /**
+   * The set of attributes this client will be able to read.
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-attribute-permissions-and-scopes
+   * @default - all standard and custom attributes
+   */
+  readonly readAttributes?: ClientAttributes;
+
+  /**
+   * The set of attributes this client will be able to write.
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-attribute-permissions-and-scopes
+   * @default - all standard and custom attributes
+   */
+  readonly writeAttributes?: ClientAttributes;
 }
 
 /**
@@ -358,6 +373,8 @@ export class UserPoolClient extends Resource implements IUserPoolClient {
       allowedOAuthFlowsUserPoolClient: !props.disableOAuth,
       preventUserExistenceErrors: this.configurePreventUserExistenceErrors(props.preventUserExistenceErrors),
       supportedIdentityProviders: this.configureIdentityProviders(props),
+      readAttributes: props.readAttributes?.attributes(),
+      writeAttributes: props.writeAttributes?.attributes(),
     });
     this.configureTokenValidity(resource, props);
 
diff --git a/packages/@aws-cdk/aws-cognito/package.json b/packages/@aws-cdk/aws-cognito/package.json
index a258cec6a5828..f2b969fba3688 100644
--- a/packages/@aws-cdk/aws-cognito/package.json
+++ b/packages/@aws-cdk/aws-cognito/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.expected.json b/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.expected.json
index be2e268a29eac..6d118b0cf046c 100644
--- a/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.expected.json
+++ b/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.expected.json
@@ -62,6 +62,11 @@
         "PreventUserExistenceErrors": "ENABLED",
         "SupportedIdentityProviders": [
           "COGNITO"
+        ],
+        "WriteAttributes": [
+          "address", "birthdate", "custom:attribute_one", "custom:attribute_two", "email",
+          "family_name", "gender", "given_name", "locale", "middle_name", "name", "nickname", "phone_number",
+          "picture", "preferred_username", "profile", "updated_at", "website", "zoneinfo"
         ]
       }
     }
diff --git a/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.ts b/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.ts
index dbad2591fc1bc..2cd4557cdb48a 100644
--- a/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.ts
+++ b/packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.ts
@@ -1,5 +1,5 @@
 import { App, Stack } from '@aws-cdk/core';
-import { OAuthScope, UserPool } from '../lib';
+import { OAuthScope, UserPool, ClientAttributes } from '../lib';
 
 const app = new App();
 const stack = new Stack(app, 'integ-user-pool-client-explicit-props');
@@ -30,4 +30,24 @@ userpool.addClient('myuserpoolclient', {
     callbackUrls: ['https://redirect-here.myapp.com'],
   },
   preventUserExistenceErrors: true,
+  writeAttributes: (new ClientAttributes()).withStandardAttributes(
+    {
+      address: true,
+      birthdate: true,
+      email: true,
+      familyName: true,
+      fullname: true,
+      gender: true,
+      givenName: true,
+      lastUpdateTime: true,
+      locale: true,
+      middleName: true,
+      nickname: true,
+      phoneNumber: true,
+      preferredUsername: true,
+      profilePage: true,
+      profilePicture: true,
+      timezone: true,
+      website: true,
+    }).withCustomAttributes('attribute_one', 'attribute_two'),
 });
diff --git a/packages/@aws-cdk/aws-cognito/test/user-pool-attr.test.ts b/packages/@aws-cdk/aws-cognito/test/user-pool-attr.test.ts
index 43ef1a48d5dd1..1d5b5a7bd5d5f 100644
--- a/packages/@aws-cdk/aws-cognito/test/user-pool-attr.test.ts
+++ b/packages/@aws-cdk/aws-cognito/test/user-pool-attr.test.ts
@@ -1,6 +1,7 @@
 import '@aws-cdk/assert/jest';
 import { CfnParameter, Stack } from '@aws-cdk/core';
-import { BooleanAttribute, CustomAttributeConfig, DateTimeAttribute, ICustomAttribute, NumberAttribute, StringAttribute } from '../lib';
+import { BooleanAttribute, CustomAttributeConfig, DateTimeAttribute, ICustomAttribute, NumberAttribute, StringAttribute, ClientAttributes } from '../lib';
+import { StandardAttributeNames } from '../lib/private/attr-names';
 
 describe('User Pool Attributes', () => {
 
@@ -178,4 +179,113 @@ describe('User Pool Attributes', () => {
       expect(bound.numberConstraints).toBeUndefined();
     });
   });
+
+  describe('ClientAttributes', () => {
+    test('create empty ClientAttributes', () => {
+      // WHEN
+      const clientAttributes = (new ClientAttributes());
+
+      // THEN
+      expect(clientAttributes.attributes()).toStrictEqual([]);
+    });
+
+    test('create ClientAttributes with all standard attributes', () => {
+      // GIVEN
+      const customAttributes = ['custom:my_attribute'];
+
+      // WHEN
+      const clientAttributes = (new ClientAttributes()).withStandardAttributes({
+        address: true,
+        birthdate: true,
+        email: true,
+        emailVerified: true,
+        familyName: true,
+        fullname: true,
+        gender: true,
+        givenName: true,
+        lastUpdateTime: true,
+        locale: true,
+        middleName: true,
+        nickname: true,
+        phoneNumber: true,
+        phoneNumberVerified: true,
+        preferredUsername: true,
+        profilePage: true,
+        profilePicture: true,
+        timezone: true,
+        website: true,
+      }).withCustomAttributes(...customAttributes);
+      const attributes = clientAttributes.attributes();
+
+      // THEN
+      expect(attributes.length).toEqual(20);
+      expect(attributes).toContain('preferred_username');
+      expect(attributes).toContain('email_verified');
+      expect(attributes).toContain('phone_number_verified');
+      expect(attributes).toContain('custom:my_attribute');
+    });
+
+    test('create ClientAttributes copying another one', () => {
+      // GIVEN
+      const original = (new ClientAttributes())
+        .withStandardAttributes({ email: true })
+        .withCustomAttributes('custom1');
+      const copied = original
+        .withStandardAttributes({ emailVerified: true })
+        .withCustomAttributes('custom2');
+
+      // WHEN
+      const originalAttributes = original.attributes();
+      const copiedAttributes = copied.attributes();
+
+      // THEN
+      expect(originalAttributes.length).toEqual(2);
+      expect(copiedAttributes.length).toEqual(4);
+      // originals MUST NOT contain the added ones
+      expect(originalAttributes).toContain('email');
+      expect(originalAttributes).toContain('custom:custom1');
+      expect(originalAttributes).not.toContain('email_verified');
+      expect(originalAttributes).not.toContain('custom:custom2');
+      // copied MUST contain all attributes
+      expect(copiedAttributes).toContain('email');
+      expect(copiedAttributes).toContain('custom:custom1');
+      expect(copiedAttributes).toContain('email_verified');
+      expect(copiedAttributes).toContain('custom:custom2');
+    });
+
+    test('create ClientAttributes with custom attributes only', () => {
+      // GIVEN
+      const customAttributes = ['custom:my_first', 'my_second'];
+
+      // WHEN
+      const clientAttributes = (new ClientAttributes()).withCustomAttributes(...customAttributes);
+      const attributes = clientAttributes.attributes();
+
+      // EXPECT
+      expect(attributes.length).toEqual(2);
+      expect(attributes).toContain('custom:my_first');
+      expect(attributes).toContain('custom:my_second');
+    });
+
+    test('create ClientAttributes with all StandardAttributeNames', () => {
+      // this test is intended to check if changes in the `StandardAttributeNames` constant
+      // does not reflect as changes in the `StandardAttributesMask`
+      // GIVEN
+      let allStandardAttributes = {} as any;
+      let standardAttributeNamesCount = 0; // the count of StandardAttributeNames
+      // iterate through the standard attribute names
+      for (const attributeKey in StandardAttributeNames) {
+        standardAttributeNamesCount += 1;
+        expect(StandardAttributeNames).toHaveProperty(attributeKey);
+        // add the standard attribute
+        allStandardAttributes[attributeKey] = true;
+      }
+
+      // WHEN
+      const attributes = (new ClientAttributes()).withStandardAttributes(allStandardAttributes).attributes();
+
+      // EXPECT
+      expect(attributes.length).toEqual(standardAttributeNamesCount);
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-cognito/test/user-pool-client.test.ts b/packages/@aws-cdk/aws-cognito/test/user-pool-client.test.ts
index 1f961616b095b..3a056cd02dda7 100644
--- a/packages/@aws-cdk/aws-cognito/test/user-pool-client.test.ts
+++ b/packages/@aws-cdk/aws-cognito/test/user-pool-client.test.ts
@@ -1,7 +1,7 @@
-import { ABSENT } from '@aws-cdk/assert';
+import { ABSENT, arrayWith } from '@aws-cdk/assert';
 import '@aws-cdk/assert/jest';
 import { Stack, Duration } from '@aws-cdk/core';
-import { OAuthScope, ResourceServerScope, UserPool, UserPoolClient, UserPoolClientIdentityProvider, UserPoolIdentityProvider } from '../lib';
+import { OAuthScope, ResourceServerScope, UserPool, UserPoolClient, UserPoolClientIdentityProvider, UserPoolIdentityProvider, ClientAttributes } from '../lib';
 
 describe('User Pool Client', () => {
   test('default setup', () => {
@@ -827,4 +827,61 @@ describe('User Pool Client', () => {
       });
     });
   });
+
+  describe('read and write attributes', () => {
+    test('undefined by default', () => {
+      // GIVEN
+      const stack = new Stack();
+      const pool = new UserPool(stack, 'Pool');
+
+      // WHEN
+      pool.addClient('Client', {});
+
+      // EXPECT
+      expect(stack).toHaveResourceLike('AWS::Cognito::UserPoolClient', {
+        ReadAttributes: ABSENT,
+        WriteAttributes: ABSENT,
+      });
+    });
+
+    test('set attributes', () => {
+      // GIVEN
+      const stack = new Stack();
+      const pool = new UserPool(stack, 'Pool');
+      const writeAttributes = (new ClientAttributes()).withCustomAttributes('my_first').withStandardAttributes({ givenName: true, familyName: true });
+      const readAttributes = (new ClientAttributes()).withStandardAttributes({
+        address: true,
+        birthdate: true,
+        email: true,
+        emailVerified: true,
+        familyName: true,
+        fullname: true,
+        gender: true,
+        givenName: true,
+        lastUpdateTime: true,
+        locale: true,
+        middleName: true,
+        nickname: true,
+        phoneNumber: true,
+        phoneNumberVerified: true,
+        preferredUsername: true,
+        profilePage: true,
+        profilePicture: true,
+        timezone: true,
+        website: true,
+      });
+
+      // WHEN
+      pool.addClient('Client', {
+        readAttributes,
+        writeAttributes,
+      });
+
+      // EXPECT
+      expect(stack).toHaveResourceLike('AWS::Cognito::UserPoolClient', {
+        ReadAttributes: arrayWith('name', 'given_name', 'family_name', 'middle_name', 'nickname', 'preferred_username', 'profile', 'picture', 'website', 'email', 'email_verified', 'gender', 'birthdate', 'zoneinfo', 'locale', 'phone_number', 'phone_number_verified', 'address', 'updated_at'),
+        WriteAttributes: arrayWith('given_name', 'family_name', 'custom:my_first'),
+      });
+    });
+  });
 });
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-config/package.json b/packages/@aws-cdk/aws-config/package.json
index b804ca3107272..4c464d04f12dc 100644
--- a/packages/@aws-cdk/aws-config/package.json
+++ b/packages/@aws-cdk/aws-config/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-databrew/package.json b/packages/@aws-cdk/aws-databrew/package.json
index 206ef596eddc4..a8b2c33035bab 100644
--- a/packages/@aws-cdk/aws-databrew/package.json
+++ b/packages/@aws-cdk/aws-databrew/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-datapipeline/package.json b/packages/@aws-cdk/aws-datapipeline/package.json
index 1d06793bc468d..2d92c5a227f94 100644
--- a/packages/@aws-cdk/aws-datapipeline/package.json
+++ b/packages/@aws-cdk/aws-datapipeline/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-datasync/package.json b/packages/@aws-cdk/aws-datasync/package.json
index 2b97e1d28dc2e..1bf9332782749 100644
--- a/packages/@aws-cdk/aws-datasync/package.json
+++ b/packages/@aws-cdk/aws-datasync/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-dax/package.json b/packages/@aws-cdk/aws-dax/package.json
index fda4919536bda..4e2a362815e16 100644
--- a/packages/@aws-cdk/aws-dax/package.json
+++ b/packages/@aws-cdk/aws-dax/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-detective/package.json b/packages/@aws-cdk/aws-detective/package.json
index 4ba81cd9cfe6d..2fc52b6fd80c8 100644
--- a/packages/@aws-cdk/aws-detective/package.json
+++ b/packages/@aws-cdk/aws-detective/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-devopsguru/package.json b/packages/@aws-cdk/aws-devopsguru/package.json
index b97c74e633c97..f28c625fe2aaf 100644
--- a/packages/@aws-cdk/aws-devopsguru/package.json
+++ b/packages/@aws-cdk/aws-devopsguru/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-directoryservice/package.json b/packages/@aws-cdk/aws-directoryservice/package.json
index cef38d0658370..96561ced90109 100644
--- a/packages/@aws-cdk/aws-directoryservice/package.json
+++ b/packages/@aws-cdk/aws-directoryservice/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-dlm/package.json b/packages/@aws-cdk/aws-dlm/package.json
index 6dbd27a82fd13..8b4043ac8ae25 100644
--- a/packages/@aws-cdk/aws-dlm/package.json
+++ b/packages/@aws-cdk/aws-dlm/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-dms/package.json b/packages/@aws-cdk/aws-dms/package.json
index d8b4006f21b2b..a4e4b172609cf 100644
--- a/packages/@aws-cdk/aws-dms/package.json
+++ b/packages/@aws-cdk/aws-dms/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-docdb/package.json b/packages/@aws-cdk/aws-docdb/package.json
index 8f094c3a7afa2..c6c841a62ad15 100644
--- a/packages/@aws-cdk/aws-docdb/package.json
+++ b/packages/@aws-cdk/aws-docdb/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-dynamodb-global/lib/aws-dynamodb-global.ts b/packages/@aws-cdk/aws-dynamodb-global/lib/aws-dynamodb-global.ts
index a76e2b8940abc..caa9eedec0c4d 100644
--- a/packages/@aws-cdk/aws-dynamodb-global/lib/aws-dynamodb-global.ts
+++ b/packages/@aws-cdk/aws-dynamodb-global/lib/aws-dynamodb-global.ts
@@ -2,6 +2,10 @@ import * as dynamodb from '@aws-cdk/aws-dynamodb';
 import * as cdk from '@aws-cdk/core';
 import { GlobalTableCoordinator } from './global-table-coordinator';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for the multiple DynamoDB tables to mash together into a
  * global table
@@ -26,7 +30,7 @@ export interface GlobalTableProps extends cdk.StackProps, dynamodb.TableOptions
  *
  * @deprecated use `@aws-cdk/aws-dynamodb.Table.replicationRegions` instead
  */
-export class GlobalTable extends cdk.Construct {
+export class GlobalTable extends Construct {
   /**
    * Creates the cloudformation custom resource that launches a lambda to tie it all together
    */
@@ -37,7 +41,7 @@ export class GlobalTable extends cdk.Construct {
    */
   private readonly _regionalTables = new Array<dynamodb.Table>();
 
-  constructor(scope: cdk.Construct, id: string, props: GlobalTableProps) {
+  constructor(scope: Construct, id: string, props: GlobalTableProps) {
     super(scope, id);
 
     cdk.Annotations.of(this).addWarning('The @aws-cdk/aws-dynamodb-global module has been deprecated in favor of @aws-cdk/aws-dynamodb.Table.replicationRegions');
diff --git a/packages/@aws-cdk/aws-dynamodb-global/lib/global-table-coordinator.ts b/packages/@aws-cdk/aws-dynamodb-global/lib/global-table-coordinator.ts
index 0d1f8c3b42835..0acd9b1cdc3d6 100644
--- a/packages/@aws-cdk/aws-dynamodb-global/lib/global-table-coordinator.ts
+++ b/packages/@aws-cdk/aws-dynamodb-global/lib/global-table-coordinator.ts
@@ -4,12 +4,16 @@ import * as lambda from '@aws-cdk/aws-lambda';
 import * as cdk from '@aws-cdk/core';
 import { GlobalTableProps } from './aws-dynamodb-global';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * A stack that will make a Lambda that will launch a lambda to glue
  * together all the DynamoDB tables into a global table
  */
 export class GlobalTableCoordinator extends cdk.Stack {
-  constructor(scope: cdk.Construct, id: string, props: GlobalTableProps) {
+  constructor(scope: Construct, id: string, props: GlobalTableProps) {
     super(scope, id, props);
     const lambdaFunction = new lambda.SingletonFunction(this, 'SingletonLambda', {
       code: lambda.Code.fromAsset(path.resolve(__dirname, '../', 'lambda-packages', 'aws-global-table-coordinator', 'lib')),
diff --git a/packages/@aws-cdk/aws-dynamodb-global/package.json b/packages/@aws-cdk/aws-dynamodb-global/package.json
index 0c320e49802cf..adef76058d728 100644
--- a/packages/@aws-cdk/aws-dynamodb-global/package.json
+++ b/packages/@aws-cdk/aws-dynamodb-global/package.json
@@ -81,8 +81,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-dynamodb/package.json b/packages/@aws-cdk/aws-dynamodb/package.json
index d5897ede6d0cf..589bc051ee3ef 100644
--- a/packages/@aws-cdk/aws-dynamodb/package.json
+++ b/packages/@aws-cdk/aws-dynamodb/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -75,7 +75,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@types/jest": "^26.0.15",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "aws-sdk-mock": "^5.1.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
diff --git a/packages/@aws-cdk/aws-ec2/README.md b/packages/@aws-cdk/aws-ec2/README.md
index b8a583d1a2ea5..6ab25bfb78b3f 100644
--- a/packages/@aws-cdk/aws-ec2/README.md
+++ b/packages/@aws-cdk/aws-ec2/README.md
@@ -382,10 +382,45 @@ otherwise. Subnet names will be determined from the `aws-cdk:subnet-name` tag
 on the subnet if it exists, or will mirror the subnet type otherwise (i.e.
 a public subnet will have the name `"Public"`).
 
+The result of the `Vpc.fromLookup()` operation will be written to a file
+called `cdk.context.json`. You must commit this file to source control so
+that the lookup values are available in non-privileged environments such
+as CI build steps, and to ensure your template builds are repeatable.
+
 Here's how `Vpc.fromLookup()` can be used:
 
 [importing existing VPCs](test/integ.import-default-vpc.lit.ts)
 
+`Vpc.fromLookup` is the recommended way to import VPCs. If for whatever
+reason you do not want to use the context mechanism to look up a VPC at
+synthesis time, you can also use `Vpc.fromVpcAttributes`. This has the
+following limitations:
+
+* Every subnet group in the VPC must have a subnet in each availability zone
+  (for example, each AZ must have both a public and private subnet). Asymmetric
+  VPCs are not supported.
+* All VpcId, SubnetId, RouteTableId, ... parameters must either be known at
+  synthesis time, or they must come from deploy-time list parameters whose
+  deploy-time lengths are known at synthesis time.
+
+Using `Vpc.fromVpcAttributes()` looks like this:
+
+```ts
+const vpc = ec2.Vpc.fromVpcAttributes(stack, 'VPC', {
+  vpcId: 'vpc-1234',
+  availabilityZones: ['us-east-1a', 'us-east-1b'],
+
+  // Either pass literals for all IDs
+  publicSubnetIds: ['s-12345', 's-67890'],
+
+  // OR: import a list of known length
+  privateSubnetIds: Fn.importListValue('PrivateSubnetIds', 2),
+
+  // OR: split an imported string to a list of known length
+  isolatedSubnetIds: Fn.split(',', ssm.StringParameter.valueForStringParameter(stack, `MyParameter`), 2),
+});
+```
+
 ## Allowing Connections
 
 In AWS, all network traffic in and out of **Elastic Network Interfaces** (ENIs)
diff --git a/packages/@aws-cdk/aws-ec2/lib/instance-types.ts b/packages/@aws-cdk/aws-ec2/lib/instance-types.ts
index 336106e65c14b..be2a58561b181 100644
--- a/packages/@aws-cdk/aws-ec2/lib/instance-types.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/instance-types.ts
@@ -260,6 +260,18 @@ export enum InstanceClass {
    */
   C6GD = 'c6gd',
 
+  /**
+   * Compute optimized instances for high performance computing, 6th generation with Graviton2 processors
+   * and high network bandwidth capabilities
+   */
+  COMPUTE6_GRAVITON2_HIGH_NETWORK_BANDWITH = 'c6gn',
+
+  /**
+   * Compute optimized instances for high performance computing, 6th generation with Graviton2 processors
+   * and high network bandwidth capabilities
+   */
+  C6GN = 'c6gn',
+
   /**
    * Storage-optimized instances, 2nd generation
    */
diff --git a/packages/@aws-cdk/aws-ec2/lib/vpc.ts b/packages/@aws-cdk/aws-ec2/lib/vpc.ts
index f642f131d5a70..d23433b2637d8 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpc.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpc.ts
@@ -1809,6 +1809,13 @@ class ImportedVpc extends VpcBase {
     this._vpnGatewayId = props.vpnGatewayId;
     this.incompleteSubnetDefinition = isIncomplete;
 
+    // None of the values may be unresolved list tokens
+    for (const k of Object.keys(props) as Array<keyof VpcAttributes>) {
+      if (Array.isArray(props[k]) && Token.isUnresolved(props[k])) {
+        Annotations.of(this).addWarning(`fromVpcAttributes: '${k}' is a list token: the imported VPC will not work with constructs that require a list of subnets at synthesis time. Use 'Vpc.fromLookup()' or 'Fn.importListValue' instead.`);
+      }
+    }
+
     /* eslint-disable max-len */
     const pub = new ImportSubnetGroup(props.publicSubnetIds, props.publicSubnetNames, props.publicSubnetRouteTableIds, SubnetType.PUBLIC, this.availabilityZones, 'publicSubnetIds', 'publicSubnetNames', 'publicSubnetRouteTableIds');
     const priv = new ImportSubnetGroup(props.privateSubnetIds, props.privateSubnetNames, props.privateSubnetRouteTableIds, SubnetType.PRIVATE, this.availabilityZones, 'privateSubnetIds', 'privateSubnetNames', 'privateSubnetRouteTableIds');
diff --git a/packages/@aws-cdk/aws-ec2/package.json b/packages/@aws-cdk/aws-ec2/package.json
index bb73e8b467e48..cc11cda8277b4 100644
--- a/packages/@aws-cdk/aws-ec2/package.json
+++ b/packages/@aws-cdk/aws-ec2/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-ec2/test/integ.share-vpcs.lit.ts b/packages/@aws-cdk/aws-ec2/test/integ.share-vpcs.lit.ts
index 0ea254d29afa7..e7c65834019cc 100644
--- a/packages/@aws-cdk/aws-ec2/test/integ.share-vpcs.lit.ts
+++ b/packages/@aws-cdk/aws-ec2/test/integ.share-vpcs.lit.ts
@@ -3,13 +3,17 @@ import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import * as ec2 from '../lib';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 const app = new cdk.App();
 
 interface ConstructThatTakesAVpcProps {
   vpc: ec2.IVpc;
 }
 
-class ConstructThatTakesAVpc extends cdk.Construct {
+class ConstructThatTakesAVpc extends Construct {
   constructor(scope: constructs.Construct, id: string, _props: ConstructThatTakesAVpcProps) {
     super(scope, id);
 
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
index 0b9401f289119..9f4ceaf1357d6 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
@@ -1,4 +1,4 @@
-import { countResources, expect, haveResource, haveResourceLike, isSuperObject, MatchStyle } from '@aws-cdk/assert';
+import { countResources, expect as cdkExpect, haveResource, haveResourceLike, isSuperObject, MatchStyle, SynthUtils } from '@aws-cdk/assert';
 import { CfnOutput, CfnResource, Fn, Lazy, Stack, Tags } from '@aws-cdk/core';
 import { nodeunitShim, Test } from 'nodeunit-shim';
 import {
@@ -21,7 +21,7 @@ nodeunitShim({
       'it uses the correct network range'(test: Test) {
         const stack = getTestStack();
         new Vpc(stack, 'TheVPC');
-        expect(stack).to(haveResource('AWS::EC2::VPC', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
           CidrBlock: Vpc.DEFAULT_CIDR_RANGE,
           EnableDnsHostnames: true,
           EnableDnsSupport: true,
@@ -32,11 +32,11 @@ nodeunitShim({
       'the Name tag is defaulted to path'(test: Test) {
         const stack = getTestStack();
         new Vpc(stack, 'TheVPC');
-        expect(stack).to(
+        cdkExpect(stack).to(
           haveResource('AWS::EC2::VPC',
             hasTags( [{ Key: 'Name', Value: 'TestStack/TheVPC' }])),
         );
-        expect(stack).to(
+        cdkExpect(stack).to(
           haveResource('AWS::EC2::InternetGateway',
             hasTags( [{ Key: 'Name', Value: 'TestStack/TheVPC' }])),
         );
@@ -54,7 +54,7 @@ nodeunitShim({
         defaultInstanceTenancy: DefaultInstanceTenancy.DEDICATED,
       });
 
-      expect(stack).to(haveResource('AWS::EC2::VPC', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
         CidrBlock: '192.168.0.0/16',
         EnableDnsHostnames: false,
         EnableDnsSupport: false,
@@ -86,7 +86,7 @@ nodeunitShim({
             defaultInstanceTenancy: DefaultInstanceTenancy.DEDICATED,
           });
 
-          expect(stack).to(haveResource('AWS::EC2::VPC', {
+          cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
             CidrBlock: '192.168.0.0/16',
             EnableDnsHostnames: input.dnsHostnames,
             EnableDnsSupport: input.dnsSupport,
@@ -130,9 +130,9 @@ nodeunitShim({
           },
         ],
       });
-      expect(stack).notTo(haveResource('AWS::EC2::InternetGateway'));
-      expect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
-      expect(stack).to(haveResource('AWS::EC2::Subnet', {
+      cdkExpect(stack).notTo(haveResource('AWS::EC2::InternetGateway'));
+      cdkExpect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
+      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
         MapPublicIpOnLaunch: false,
       }));
       test.done();
@@ -152,9 +152,9 @@ nodeunitShim({
           },
         ],
       });
-      expect(stack).to(countResources('AWS::EC2::InternetGateway', 1))
+      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1))
       ;
-      expect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
+      cdkExpect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
       test.done();
     },
     'with private subnets and custom networkAcl.'(test: Test) {
@@ -193,9 +193,9 @@ nodeunitShim({
         cidr: AclCidr.anyIpv4(),
       });
 
-      expect(stack).to(countResources('AWS::EC2::NetworkAcl', 1));
-      expect(stack).to(countResources('AWS::EC2::NetworkAclEntry', 2));
-      expect(stack).to(countResources('AWS::EC2::SubnetNetworkAclAssociation', 3));
+      cdkExpect(stack).to(countResources('AWS::EC2::NetworkAcl', 1));
+      cdkExpect(stack).to(countResources('AWS::EC2::NetworkAclEntry', 2));
+      cdkExpect(stack).to(countResources('AWS::EC2::SubnetNetworkAclAssociation', 3));
       test.done();
     },
 
@@ -203,8 +203,8 @@ nodeunitShim({
       const stack = getTestStack();
       const zones = stack.availabilityZones.length;
       new Vpc(stack, 'TheVPC', { });
-      expect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
-      expect(stack).to(countResources('AWS::EC2::NatGateway', zones));
+      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
+      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', zones));
       test.done();
     },
 
@@ -227,8 +227,8 @@ nodeunitShim({
         routerType: RouterType.GATEWAY,
         destinationCidrBlock: '8.8.8.8/32',
       });
-      expect(stack).to(haveResource('AWS::EC2::InternetGateway'));
-      expect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::InternetGateway'));
+      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '8.8.8.8/32',
         GatewayId: { },
       }));
@@ -246,7 +246,7 @@ nodeunitShim({
         ],
       });
       test.equal(vpc.internetGatewayId, undefined);
-      expect(stack).notTo(haveResource('AWS::EC2::InternetGateway'));
+      cdkExpect(stack).notTo(haveResource('AWS::EC2::InternetGateway'));
       test.done();
     },
 
@@ -274,7 +274,7 @@ nodeunitShim({
         ],
         maxAzs: 3,
       });
-      expect(stack).to(countResources('AWS::EC2::Subnet', 6));
+      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 6));
       test.done();
     },
     'with reserved subnets, any other subnets should not have cidrBlock from within reserved space'(test: Test) {
@@ -302,17 +302,17 @@ nodeunitShim({
         maxAzs: 3,
       });
       for (let i = 0; i < 3; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
         }));
       }
       for (let i = 3; i < 6; i++) {
-        expect(stack).notTo(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).notTo(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
         }));
       }
       for (let i = 6; i < 9; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
         }));
       }
@@ -342,16 +342,16 @@ nodeunitShim({
         ],
         maxAzs: 3,
       });
-      expect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
-      expect(stack).to(countResources('AWS::EC2::NatGateway', zones));
-      expect(stack).to(countResources('AWS::EC2::Subnet', 9));
+      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
+      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', zones));
+      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 9));
       for (let i = 0; i < 6; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
         }));
       }
       for (let i = 0; i < 3; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.6.${i * 16}/28`,
         }));
       }
@@ -381,16 +381,16 @@ nodeunitShim({
         ],
         maxAzs: 3,
       });
-      expect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
-      expect(stack).to(countResources('AWS::EC2::NatGateway', 2));
-      expect(stack).to(countResources('AWS::EC2::Subnet', 9));
+      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
+      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', 2));
+      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 9));
       for (let i = 0; i < 6; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
         }));
       }
       for (let i = 0; i < 3; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.6.${i * 16}/28`,
         }));
       }
@@ -416,9 +416,9 @@ nodeunitShim({
           },
         ],
       });
-      expect(stack).to(countResources('AWS::EC2::Subnet', 1));
-      expect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
-      expect(stack).to(haveResource('AWS::EC2::Subnet', {
+      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 1));
+      cdkExpect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
+      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
         MapPublicIpOnLaunch: true,
       }));
       test.done();
@@ -427,14 +427,14 @@ nodeunitShim({
     'maxAZs defaults to 3 if unset'(test: Test) {
       const stack = getTestStack();
       new Vpc(stack, 'VPC');
-      expect(stack).to(countResources('AWS::EC2::Subnet', 6));
-      expect(stack).to(countResources('AWS::EC2::Route', 6));
+      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 6));
+      cdkExpect(stack).to(countResources('AWS::EC2::Route', 6));
       for (let i = 0; i < 6; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i * 32}.0/19`,
         }));
       }
-      expect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NatGatewayId: { },
       }));
@@ -445,14 +445,14 @@ nodeunitShim({
     'with maxAZs set to 2'(test: Test) {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', { maxAzs: 2 });
-      expect(stack).to(countResources('AWS::EC2::Subnet', 4));
-      expect(stack).to(countResources('AWS::EC2::Route', 4));
+      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 4));
+      cdkExpect(stack).to(countResources('AWS::EC2::Route', 4));
       for (let i = 0; i < 4; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', {
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i * 64}.0/18`,
         }));
       }
-      expect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NatGatewayId: { },
       }));
@@ -463,10 +463,10 @@ nodeunitShim({
       new Vpc(stack, 'VPC', {
         natGateways: 1,
       });
-      expect(stack).to(countResources('AWS::EC2::Subnet', 6));
-      expect(stack).to(countResources('AWS::EC2::Route', 6));
-      expect(stack).to(countResources('AWS::EC2::NatGateway', 1));
-      expect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 6));
+      cdkExpect(stack).to(countResources('AWS::EC2::Route', 6));
+      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', 1));
+      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NatGatewayId: { },
       }));
@@ -496,9 +496,9 @@ nodeunitShim({
           subnetGroupName: 'egress',
         },
       });
-      expect(stack).to(countResources('AWS::EC2::NatGateway', 3));
+      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', 3));
       for (let i = 1; i < 4; i++) {
-        expect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
           Key: 'Name',
           Value: `TestStack/VPC/egressSubnet${i}`,
         }, {
@@ -535,7 +535,7 @@ nodeunitShim({
       new Vpc(stack, 'VPC', {
         natGateways: 0,
       });
-      expect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
         Key: 'aws-cdk:subnet-type',
         Value: 'Isolated',
       }])));
@@ -545,7 +545,7 @@ nodeunitShim({
     'unspecified natGateways constructs with PRIVATE subnet'(test: Test) {
       const stack = getTestStack();
       new Vpc(stack, 'VPC');
-      expect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
         Key: 'aws-cdk:subnet-type',
         Value: 'Private',
       }])));
@@ -569,7 +569,7 @@ nodeunitShim({
         ],
         natGateways: 0,
       });
-      expect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
         Key: 'aws-cdk:subnet-name',
         Value: 'ingress',
       }])));
@@ -604,12 +604,12 @@ nodeunitShim({
         vpnGatewayAsn: 65000,
       });
 
-      expect(stack).to(haveResource('AWS::EC2::VPNGateway', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGateway', {
         AmazonSideAsn: 65000,
         Type: 'ipsec.1',
       }));
 
-      expect(stack).to(haveResource('AWS::EC2::VPCGatewayAttachment', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPCGatewayAttachment', {
         VpcId: {
           Ref: 'VPCB9E5F0B4',
         },
@@ -618,7 +618,7 @@ nodeunitShim({
         },
       }));
 
-      expect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCPrivateSubnet1RouteTableBE8A6027',
@@ -652,7 +652,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCIsolatedSubnet1RouteTableEB156210',
@@ -690,7 +690,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCPrivateSubnet1RouteTableBE8A6027',
@@ -728,7 +728,7 @@ nodeunitShim({
         vpnGateway: true,
       });
 
-      expect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCIsolatedSubnet1RouteTableEB156210',
@@ -756,7 +756,7 @@ nodeunitShim({
         vpnGateway: true,
       });
 
-      expect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCPublicSubnet1RouteTableFEE4B781',
@@ -848,7 +848,7 @@ nodeunitShim({
 
       // THEN
 
-      expect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
         DestinationIpv6CidrBlock: '2001:4860:4860::8888/32',
         NetworkInterfaceId: 'router-1',
       }));
@@ -869,7 +869,7 @@ nodeunitShim({
 
       // THEN
 
-      expect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NetworkInterfaceId: 'router-1',
       }));
@@ -893,13 +893,13 @@ nodeunitShim({
       new Vpc(stack, 'TheVPC', { natGatewayProvider });
 
       // THEN
-      expect(stack).to(countResources('AWS::EC2::Instance', 3));
-      expect(stack).to(haveResource('AWS::EC2::Instance', {
+      cdkExpect(stack).to(countResources('AWS::EC2::Instance', 3));
+      cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
         ImageId: 'ami-1',
         InstanceType: 'q86.mega',
         SourceDestCheck: false,
       }));
-      expect(stack).to(haveResource('AWS::EC2::Route', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::Route', {
         RouteTableId: { Ref: 'TheVPCPrivateSubnet1RouteTableF6513BC2' },
         DestinationCidrBlock: '0.0.0.0/0',
         InstanceId: { Ref: 'TheVPCPublicSubnet1NatInstanceCC514192' },
@@ -924,7 +924,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(countResources('AWS::EC2::Instance', 1));
+      cdkExpect(stack).to(countResources('AWS::EC2::Instance', 1));
 
       test.done();
     },
@@ -947,7 +947,7 @@ nodeunitShim({
       provider.connections.allowFrom(Peer.ipv4('1.2.3.4/32'), Port.tcp(86));
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
         SecurityGroupIngress: [
           {
             CidrIp: '1.2.3.4/32',
@@ -975,7 +975,7 @@ nodeunitShim({
         value: (vpc.publicSubnets[0] as Subnet).subnetNetworkAclAssociationId,
       });
 
-      expect(stack).toMatch({
+      cdkExpect(stack).toMatch({
         Outputs: {
           Output: {
             Value: { 'Fn::GetAtt': ['TheVPCPublicSubnet1Subnet770D4FF2', 'NetworkAclAssociationId'] },
@@ -1000,7 +1000,7 @@ nodeunitShim({
         subnetSelection: { subnetType: SubnetType.PUBLIC },
       });
 
-      expect(stack).toMatch({
+      cdkExpect(stack).toMatch({
         Outputs: {
           Output: {
             Value: { Ref: 'ACLDBD1BB49' },
@@ -1016,7 +1016,7 @@ nodeunitShim({
     'vpc.vpcCidrBlock is the correct network range'(test: Test) {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', { cidr: '192.168.0.0/16' });
-      expect(stack).to(haveResource('AWS::EC2::VPC', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
         CidrBlock: '192.168.0.0/16',
       }));
       test.done();
@@ -1037,13 +1037,13 @@ nodeunitShim({
       // overwrite to set propagate
       Tags.of(vpc).add('BusinessUnit', 'Marketing', { includeResourceTypes: [CfnVPC.CFN_RESOURCE_TYPE_NAME] });
       Tags.of(vpc).add('VpcType', 'Good');
-      expect(stack).to(haveResource('AWS::EC2::VPC', hasTags(toCfnTags(allTags))));
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', hasTags(toCfnTags(allTags))));
       const taggables = ['Subnet', 'InternetGateway', 'NatGateway', 'RouteTable'];
       const propTags = toCfnTags(tags);
       const noProp = toCfnTags(noPropTags);
       for (const resource of taggables) {
-        expect(stack).to(haveResource(`AWS::EC2::${resource}`, hasTags(propTags)));
-        expect(stack).notTo(haveResource(`AWS::EC2::${resource}`, hasTags(noProp)));
+        cdkExpect(stack).to(haveResource(`AWS::EC2::${resource}`, hasTags(propTags)));
+        cdkExpect(stack).notTo(haveResource(`AWS::EC2::${resource}`, hasTags(noProp)));
       }
       test.done();
     },
@@ -1052,12 +1052,12 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'TheVPC');
       for (const subnet of vpc.publicSubnets) {
         const tag = { Key: 'Name', Value: subnet.node.path };
-        expect(stack).to(haveResource('AWS::EC2::NatGateway', hasTags([tag])));
-        expect(stack).to(haveResource('AWS::EC2::RouteTable', hasTags([tag])));
+        cdkExpect(stack).to(haveResource('AWS::EC2::NatGateway', hasTags([tag])));
+        cdkExpect(stack).to(haveResource('AWS::EC2::RouteTable', hasTags([tag])));
       }
       for (const subnet of vpc.privateSubnets) {
         const tag = { Key: 'Name', Value: subnet.node.path };
-        expect(stack).to(haveResource('AWS::EC2::RouteTable', hasTags([tag])));
+        cdkExpect(stack).to(haveResource('AWS::EC2::RouteTable', hasTags([tag])));
       }
       test.done();
     },
@@ -1066,9 +1066,9 @@ nodeunitShim({
 
       const vpc = new Vpc(stack, 'TheVPC');
       const tag = { Key: 'Late', Value: 'Adder' };
-      expect(stack).notTo(haveResource('AWS::EC2::VPC', hasTags([tag])));
+      cdkExpect(stack).notTo(haveResource('AWS::EC2::VPC', hasTags([tag])));
       Tags.of(vpc).add(tag.Key, tag.Value);
-      expect(stack).to(haveResource('AWS::EC2::VPC', hasTags([tag])));
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', hasTags([tag])));
       test.done();
     },
   },
@@ -1227,7 +1227,7 @@ nodeunitShim({
       test.done();
     },
 
-    'fromVpcAttributes using imported refs'(test: Test) {
+    'fromVpcAttributes using unknown-length list tokens'(test: Test) {
       // GIVEN
       const stack = getTestStack();
 
@@ -1250,10 +1250,58 @@ nodeunitShim({
       });
 
       // THEN - No exception
-      expect(stack).to(haveResource('Some::Resource', {
+      cdkExpect(stack).to(haveResource('Some::Resource', {
         subnetIds: { 'Fn::Split': [',', { 'Fn::ImportValue': 'myPublicSubnetIds' }] },
       }));
 
+      // THEN - Warnings have been added to the stack metadata
+      const asm = SynthUtils.synthesize(stack);
+      expect(asm.messages).toEqual(expect.arrayContaining([
+        expect.objectContaining(
+          {
+            entry: {
+              type: 'aws:cdk:warning',
+              data: "fromVpcAttributes: 'availabilityZones' is a list token: the imported VPC will not work with constructs that require a list of subnets at synthesis time. Use 'Vpc.fromLookup()' or 'Fn.importListValue' instead.",
+            },
+          },
+        ),
+      ]));
+
+      test.done();
+    },
+
+    'fromVpcAttributes using fixed-length list tokens'(test: Test) {
+      // GIVEN
+      const stack = getTestStack();
+
+      const vpcId = Fn.importValue('myVpcId');
+      const availabilityZones = Fn.importListValue('myAvailabilityZones', 2);
+      const publicSubnetIds = Fn.importListValue('myPublicSubnetIds', 2);
+
+      // WHEN
+      const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
+        vpcId,
+        availabilityZones,
+        publicSubnetIds,
+      });
+
+      new CfnResource(stack, 'Resource', {
+        type: 'Some::Resource',
+        properties: {
+          subnetIds: vpc.selectSubnets().subnetIds,
+        },
+      });
+
+      // THEN - No exception
+
+      const publicSubnetList = { 'Fn::Split': [',', { 'Fn::ImportValue': 'myPublicSubnetIds' }] };
+      cdkExpect(stack).to(haveResource('Some::Resource', {
+        subnetIds: [
+          { 'Fn::Select': [0, publicSubnetList] },
+          { 'Fn::Select': [1, publicSubnetList] },
+        ],
+      }));
+
       test.done();
     },
 
@@ -1352,7 +1400,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
@@ -1383,7 +1431,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
@@ -1435,7 +1483,7 @@ nodeunitShim({
       // THEN
       // 10.0.160.0/19 is the third subnet, sequentially, if you split
       // 10.0.0.0/16 into 6 pieces
-      expect(stack).to(haveResource('AWS::EC2::Instance', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
         SubnetId: {
           Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
         },
@@ -1466,7 +1514,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      cdkExpect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
diff --git a/packages/@aws-cdk/aws-ecr-assets/package.json b/packages/@aws-cdk/aws-ecr-assets/package.json
index fa6016506e107..988ae2bd147c3 100644
--- a/packages/@aws-cdk/aws-ecr-assets/package.json
+++ b/packages/@aws-cdk/aws-ecr-assets/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-ecr/package.json b/packages/@aws-cdk/aws-ecr/package.json
index 670fa0ef23d8d..9e8d5a19fbdb9 100644
--- a/packages/@aws-cdk/aws-ecr/package.json
+++ b/packages/@aws-cdk/aws-ecr/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
index 3bcade2f49a73..769756999ad0c 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
@@ -11,6 +11,10 @@ import { LoadBalancerTarget } from '@aws-cdk/aws-route53-targets';
 import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Describes the type of DNS record the service should create
  */
@@ -306,7 +310,7 @@ export interface ApplicationLoadBalancedTaskImageOptions {
 /**
  * The base class for ApplicationLoadBalancedEc2Service and ApplicationLoadBalancedFargateService services.
  */
-export abstract class ApplicationLoadBalancedServiceBase extends cdk.Construct {
+export abstract class ApplicationLoadBalancedServiceBase extends CoreConstruct {
 
   /**
    * The desired number of instantiations of the task definition to keep running on the service.
@@ -467,7 +471,7 @@ export abstract class ApplicationLoadBalancedServiceBase extends cdk.Construct {
   /**
    * Returns the default cluster.
    */
-  protected getDefaultCluster(scope: cdk.Construct, vpc?: IVpc): Cluster {
+  protected getDefaultCluster(scope: CoreConstruct, vpc?: IVpc): Cluster {
     // magic string to avoid collision with user-defined constructs
     const DEFAULT_CLUSTER_ID = `EcsDefaultClusterMnL3mNNYN${vpc ? vpc.node.id : ''}`;
     const stack = cdk.Stack.of(scope);
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts
index 8329db85f2792..ffdcb3b75912a 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts
@@ -7,6 +7,10 @@ import { LoadBalancerTarget } from '@aws-cdk/aws-route53-targets';
 import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Describes the type of DNS record the service should create
  */
@@ -256,7 +260,7 @@ export interface NetworkLoadBalancedTaskImageOptions {
 /**
  * The base class for NetworkLoadBalancedEc2Service and NetworkLoadBalancedFargateService services.
  */
-export abstract class NetworkLoadBalancedServiceBase extends cdk.Construct {
+export abstract class NetworkLoadBalancedServiceBase extends CoreConstruct {
   /**
    * The desired number of instantiations of the task definition to keep running on the service.
    */
@@ -361,7 +365,7 @@ export abstract class NetworkLoadBalancedServiceBase extends cdk.Construct {
   /**
    * Returns the default cluster.
    */
-  protected getDefaultCluster(scope: cdk.Construct, vpc?: IVpc): Cluster {
+  protected getDefaultCluster(scope: CoreConstruct, vpc?: IVpc): Cluster {
     // magic string to avoid collision with user-defined constructs
     const DEFAULT_CLUSTER_ID = `EcsDefaultClusterMnL3mNNYN${vpc ? vpc.node.id : ''}`;
     const stack = cdk.Stack.of(scope);
diff --git a/packages/@aws-cdk/aws-ecs-patterns/package.json b/packages/@aws-cdk/aws-ecs-patterns/package.json
index 87077ba19645b..004e34ecf1ae1 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/package.json
+++ b/packages/@aws-cdk/aws-ecs-patterns/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-ecs/lib/cluster.ts b/packages/@aws-cdk/aws-ecs/lib/cluster.ts
index b68e212f3dd74..fcc28784229e5 100644
--- a/packages/@aws-cdk/aws-ecs/lib/cluster.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/cluster.ts
@@ -334,7 +334,7 @@ export class Cluster extends Resource implements ICluster {
     autoScalingGroup.addUserData(`[Environment]::SetEnvironmentVariable("ECS_CLUSTER", "${this.clusterName}", "Machine")`);
     autoScalingGroup.addUserData('[Environment]::SetEnvironmentVariable("ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE", "true", "Machine")');
     // tslint:disable-next-line: max-line-length
-    autoScalingGroup.addUserData('[Environment]::SetEnvironmentVariable("ECS_AVAILABLE_LOGGING_DRIVERS", "[\"json-file\",\"awslogs\"]", "Machine")');
+    autoScalingGroup.addUserData('[Environment]::SetEnvironmentVariable("ECS_AVAILABLE_LOGGING_DRIVERS", \'["json-file","awslogs"]\', "Machine")');
 
     // enable instance draining
     if (autoScalingGroup.spotPrice && options.spotInstanceDraining) {
@@ -344,7 +344,7 @@ export class Cluster extends Resource implements ICluster {
     // enable task iam role
     if (!options.canContainersAccessInstanceRole) {
       autoScalingGroup.addUserData('[Environment]::SetEnvironmentVariable("ECS_ENABLE_TASK_IAM_ROLE", "true", "Machine")');
-      autoScalingGroup.addUserData(`Initialize-ECSAgent -Cluster '${this.clusterName}' -EnableTaskIAMRole'`);
+      autoScalingGroup.addUserData(`Initialize-ECSAgent -Cluster '${this.clusterName}' -EnableTaskIAMRole`);
     } else {
       autoScalingGroup.addUserData(`Initialize-ECSAgent -Cluster '${this.clusterName}'`);
     }
diff --git a/packages/@aws-cdk/aws-ecs/lib/container-definition.ts b/packages/@aws-cdk/aws-ecs/lib/container-definition.ts
index 1ac4ec541df85..b4d31c56133fc 100644
--- a/packages/@aws-cdk/aws-ecs/lib/container-definition.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/container-definition.ts
@@ -10,6 +10,10 @@ import { EnvironmentFile, EnvironmentFileConfig } from './environment-file';
 import { LinuxParameters } from './linux-parameters';
 import { LogDriver, LogDriverConfig } from './log-drivers/log-driver';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * A secret environment variable.
  */
@@ -301,7 +305,7 @@ export interface ContainerDefinitionProps extends ContainerDefinitionOptions {
 /**
  * A container definition is used in a task definition to describe the containers that are launched as part of a task.
  */
-export class ContainerDefinition extends cdk.Construct {
+export class ContainerDefinition extends CoreConstruct {
   /**
    * The Linux-specific modifications that are applied to the container, such as Linux kernel capabilities.
    */
diff --git a/packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts b/packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
index a11b6dce3bbb8..cb0f9a57d6288 100644
--- a/packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
@@ -9,6 +9,10 @@ import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { ICluster } from '../cluster';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 // Reference for the source in this package:
 //
 // https://github.com/aws-samples/ecs-refarch-cloudformation/blob/master/infrastructure/lifecyclehook.yaml
@@ -49,7 +53,7 @@ export interface InstanceDrainHookProps {
 /**
  * A hook to drain instances from ECS traffic before they're terminated
  */
-export class InstanceDrainHook extends cdk.Construct {
+export class InstanceDrainHook extends CoreConstruct {
 
   /**
    * Constructs a new instance of the InstanceDrainHook class.
diff --git a/packages/@aws-cdk/aws-ecs/lib/images/tag-parameter-container-image.ts b/packages/@aws-cdk/aws-ecs/lib/images/tag-parameter-container-image.ts
index de738d3c562e3..b033e8783a514 100644
--- a/packages/@aws-cdk/aws-ecs/lib/images/tag-parameter-container-image.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/images/tag-parameter-container-image.ts
@@ -3,6 +3,10 @@ import * as cdk from '@aws-cdk/core';
 import { ContainerDefinition } from '../container-definition';
 import { ContainerImage, ContainerImageConfig } from '../container-image';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * A special type of {@link ContainerImage} that uses an ECR repository for the image,
  * but a CloudFormation Parameter for the tag of the image in that repository.
@@ -21,7 +25,7 @@ export class TagParameterContainerImage extends ContainerImage {
     this.repository = repository;
   }
 
-  public bind(scope: cdk.Construct, containerDefinition: ContainerDefinition): ContainerImageConfig {
+  public bind(scope: Construct, containerDefinition: ContainerDefinition): ContainerImageConfig {
     this.repository.grantPull(containerDefinition.taskDefinition.obtainExecutionRole());
     const imageTagParameter = new cdk.CfnParameter(scope, 'ImageTagParam');
     this.imageTagParameter = imageTagParameter;
diff --git a/packages/@aws-cdk/aws-ecs/lib/linux-parameters.ts b/packages/@aws-cdk/aws-ecs/lib/linux-parameters.ts
index 45e792126fd20..b83b208552b95 100644
--- a/packages/@aws-cdk/aws-ecs/lib/linux-parameters.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/linux-parameters.ts
@@ -2,6 +2,10 @@ import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { CfnTaskDefinition } from './ecs.generated';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * The properties for defining Linux-specific options that are applied to the container.
  */
@@ -24,7 +28,7 @@ export interface LinuxParametersProps {
 /**
  * Linux-specific options that are applied to the container.
  */
-export class LinuxParameters extends cdk.Construct {
+export class LinuxParameters extends CoreConstruct {
   /**
    * Whether the init process is enabled
    */
diff --git a/packages/@aws-cdk/aws-ecs/package.json b/packages/@aws-cdk/aws-ecs/package.json
index 41f459b775c7f..aff848df27a3a 100644
--- a/packages/@aws-cdk/aws-ecs/package.json
+++ b/packages/@aws-cdk/aws-ecs/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-ecs/test/ec2/integ.environment-file.expected.json b/packages/@aws-cdk/aws-ecs/test/ec2/integ.environment-file.expected.json
index 7ba376073123b..34017cbb94b10 100644
--- a/packages/@aws-cdk/aws-ecs/test/ec2/integ.environment-file.expected.json
+++ b/packages/@aws-cdk/aws-ecs/test/ec2/integ.environment-file.expected.json
@@ -711,14 +711,12 @@
         "Code": {
           "ZipFile": "import boto3, json, os, time\n\necs = boto3.client('ecs')\nautoscaling = boto3.client('autoscaling')\n\n\ndef lambda_handler(event, context):\n  print(json.dumps(event))\n  cluster = os.environ['CLUSTER']\n  snsTopicArn = event['Records'][0]['Sns']['TopicArn']\n  lifecycle_event = json.loads(event['Records'][0]['Sns']['Message'])\n  instance_id = lifecycle_event.get('EC2InstanceId')\n  if not instance_id:\n    print('Got event without EC2InstanceId: %s', json.dumps(event))\n    return\n\n  instance_arn = container_instance_arn(cluster, instance_id)\n  print('Instance %s has container instance ARN %s' % (lifecycle_event['EC2InstanceId'], instance_arn))\n\n  if not instance_arn:\n    return\n\n  while has_tasks(cluster, instance_arn):\n    time.sleep(10)\n\n  try:\n    print('Terminating instance %s' % instance_id)\n    autoscaling.complete_lifecycle_action(\n        LifecycleActionResult='CONTINUE',\n        **pick(lifecycle_event, 'LifecycleHookName', 'LifecycleActionToken', 'AutoScalingGroupName'))\n  except Exception as e:\n    # Lifecycle action may have already completed.\n    print(str(e))\n\n\ndef container_instance_arn(cluster, instance_id):\n  \"\"\"Turn an instance ID into a container instance ARN.\"\"\"\n  arns = ecs.list_container_instances(cluster=cluster, filter='ec2InstanceId==' + instance_id)['containerInstanceArns']\n  if not arns:\n    return None\n  return arns[0]\n\n\ndef has_tasks(cluster, instance_arn):\n  \"\"\"Return True if the instance is running tasks for the given cluster.\"\"\"\n  instances = ecs.describe_container_instances(cluster=cluster, containerInstances=[instance_arn])['containerInstances']\n  if not instances:\n    return False\n  instance = instances[0]\n\n  if instance['status'] == 'ACTIVE':\n    # Start draining, then try again later\n    set_container_instance_to_draining(cluster, instance_arn)\n    return True\n\n  tasks = instance['runningTasksCount'] + instance['pendingTasksCount']\n  print('Instance %s has %s tasks' % (instance_arn, tasks))\n\n  return tasks > 0\n\n\ndef set_container_instance_to_draining(cluster, instance_arn):\n  ecs.update_container_instances_state(\n      cluster=cluster,\n      containerInstances=[instance_arn], status='DRAINING')\n\n\ndef pick(dct, *keys):\n  \"\"\"Pick a subset of a dict.\"\"\"\n  return {k: v for k, v in dct.items() if k in keys}\n"
         },
-        "Handler": "index.lambda_handler",
         "Role": {
           "Fn::GetAtt": [
             "EcsClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRole94543EDA",
             "Arn"
           ]
         },
-        "Runtime": "python3.6",
         "Environment": {
           "Variables": {
             "CLUSTER": {
@@ -726,6 +724,8 @@
             }
           }
         },
+        "Handler": "index.lambda_handler",
+        "Runtime": "python3.6",
         "Tags": [
           {
             "Key": "Name",
@@ -1219,7 +1219,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3Bucket28CE5152"
+            "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3BucketFD1BBE00"
           },
           "S3Key": {
             "Fn::Join": [
@@ -1232,7 +1232,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED"
+                          "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76"
                         }
                       ]
                     }
@@ -1245,7 +1245,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED"
+                          "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76"
                         }
                       ]
                     }
@@ -1255,19 +1255,19 @@
             ]
           }
         },
-        "Handler": "index.handler",
         "Role": {
           "Fn::GetAtt": [
             "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
             "Arn"
           ]
         },
-        "Runtime": "python3.6",
+        "Handler": "index.handler",
         "Layers": [
           {
             "Ref": "EnvFileDeploymentAwsCliLayerA8FC897D"
           }
         ],
+        "Runtime": "python3.6",
         "Timeout": 900
       },
       "DependsOn": [
@@ -1348,17 +1348,17 @@
       "Type": "String",
       "Description": "Artifact hash for asset \"e9882ab123687399f934da0d45effe675ecc8ce13b40cb946f3e1d6141fe8d68\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3Bucket28CE5152": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3BucketFD1BBE00": {
       "Type": "String",
-      "Description": "S3 bucket for asset \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "S3 bucket for asset \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76": {
       "Type": "String",
-      "Description": "S3 key for asset version \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "S3 key for asset version \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7ArtifactHash8926088E": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aArtifactHash595EC1E7": {
       "Type": "String",
-      "Description": "Artifact hash for asset \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "Artifact hash for asset \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
     "AssetParameters972240f9dd6e036a93d5f081af9a24315b2053828ac049b3b19b2fa12d7ae64aS3Bucket1F1A8472": {
       "Type": "String",
diff --git a/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts b/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts
index b8f3b3621a71c..71a5fc23081d4 100644
--- a/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts
+++ b/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts
@@ -794,11 +794,11 @@ export = {
               {
                 Ref: 'EcsCluster97242B84',
               },
-              "\", \"Machine\")\n[Environment]::SetEnvironmentVariable(\"ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE\", \"true\", \"Machine\")\n[Environment]::SetEnvironmentVariable(\"ECS_AVAILABLE_LOGGING_DRIVERS\", \"[\"json-file\",\"awslogs\"]\", \"Machine\")\n[Environment]::SetEnvironmentVariable(\"ECS_ENABLE_TASK_IAM_ROLE\", \"true\", \"Machine\")\nInitialize-ECSAgent -Cluster '",
+              "\", \"Machine\")\n[Environment]::SetEnvironmentVariable(\"ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE\", \"true\", \"Machine\")\n[Environment]::SetEnvironmentVariable(\"ECS_AVAILABLE_LOGGING_DRIVERS\", '[\"json-file\",\"awslogs\"]', \"Machine\")\n[Environment]::SetEnvironmentVariable(\"ECS_ENABLE_TASK_IAM_ROLE\", \"true\", \"Machine\")\nInitialize-ECSAgent -Cluster '",
               {
                 Ref: 'EcsCluster97242B84',
               },
-              "' -EnableTaskIAMRole'</powershell>",
+              "' -EnableTaskIAMRole</powershell>",
             ],
           ],
         },
diff --git a/packages/@aws-cdk/aws-efs/package.json b/packages/@aws-cdk/aws-efs/package.json
index 5594f391a0065..2e6ba4dac3bda 100644
--- a/packages/@aws-cdk/aws-efs/package.json
+++ b/packages/@aws-cdk/aws-efs/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-eks-legacy/package.json b/packages/@aws-cdk/aws-eks-legacy/package.json
index 2ce08cf6d1da2..671891b88fc6e 100644
--- a/packages/@aws-cdk/aws-eks-legacy/package.json
+++ b/packages/@aws-cdk/aws-eks-legacy/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-eks/README.md b/packages/@aws-cdk/aws-eks/README.md
index 27f9eda6f0d16..35fc9c24c244e 100644
--- a/packages/@aws-cdk/aws-eks/README.md
+++ b/packages/@aws-cdk/aws-eks/README.md
@@ -232,8 +232,40 @@ cluster.addNodegroupCapacity('extra-ng-spot', {
 
 #### Launch Template Support
 
-You can specify a launch template that the node group will use. Note that when using a custom AMI, Amazon EKS doesn't merge any user data.
-Rather, You are responsible for supplying the required bootstrap commands for nodes to join the cluster.
+You can specify a launch template that the node group will use. For example, this can be useful if you want to use
+a custom AMI or add custom user data.
+
+When supplying a custom user data script, it must be encoded in the MIME multi-part archive format, since Amazon EKS merges with its own user data. Visit the [Launch Template Docs](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html#launch-template-user-data)
+for mode details.
+
+```ts
+const userData = `MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="==MYBOUNDARY=="
+
+--==MYBOUNDARY==
+Content-Type: text/x-shellscript; charset="us-ascii"
+
+#!/bin/bash
+echo "Running custom user data script"
+
+--==MYBOUNDARY==--\\
+`;
+const lt = new ec2.CfnLaunchTemplate(this, 'LaunchTemplate', {
+  launchTemplateData: {
+    instanceType: 't3.small',
+    userData: Fn.base64(userData),
+  },
+});
+cluster.addNodegroupCapacity('extra-ng', {
+  launchTemplateSpec: {
+    id: lt.ref,
+    version: lt.attrLatestVersionNumber,
+  },
+});
+
+```
+
+Note that when using a custom AMI, Amazon EKS doesn't merge any user data. Which means you do not need the multi-part encoding. and are responsible for supplying the required bootstrap commands for nodes to join the cluster.
 In the following example, `/ect/eks/bootstrap.sh` from the AMI will be used to bootstrap the node.
 
 ```ts
@@ -245,19 +277,19 @@ userData.addCommands(
 const lt = new ec2.CfnLaunchTemplate(this, 'LaunchTemplate', {
   launchTemplateData: {
     imageId: 'some-ami-id', // custom AMI
-    instanceType: new ec2.InstanceType('t3.small').toString(),
+    instanceType: 't3.small',
     userData: Fn.base64(userData.render()),
   },
 });
 cluster.addNodegroupCapacity('extra-ng', {
   launchTemplateSpec: {
     id: lt.ref,
-    version: lt.attrDefaultVersionNumber,
+    version: lt.attrLatestVersionNumber,
   },
 });
 ```
 
-You may specify one or instance types in either the `instanceTypes` property of `NodeGroup` or in the launch template, **but not both**.
+You may specify one `instanceType` in the launch template or multiple `instanceTypes` in the node group, **but not both**.
 
 > For more details visit [Launch Template Support](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html).
 
diff --git a/packages/@aws-cdk/aws-eks/lib/cluster.ts b/packages/@aws-cdk/aws-eks/lib/cluster.ts
index 1af5b1bc15046..6737ac1c7f604 100644
--- a/packages/@aws-cdk/aws-eks/lib/cluster.ts
+++ b/packages/@aws-cdk/aws-eks/lib/cluster.ts
@@ -961,8 +961,13 @@ export class Cluster extends ClusterBase {
 
     this.vpcSubnets = props.vpcSubnets ?? [{ subnetType: ec2.SubnetType.PUBLIC }, { subnetType: ec2.SubnetType.PRIVATE }];
 
+    const selectedSubnetIdsPerGroup = this.vpcSubnets.map(s => this.vpc.selectSubnets(s).subnetIds);
+    if (selectedSubnetIdsPerGroup.some(Token.isUnresolved) && selectedSubnetIdsPerGroup.length > 1) {
+      throw new Error('eks.Cluster: cannot select multiple subnet groups from a VPC imported from list tokens with unknown length. Select only one subnet group, pass a length to Fn.split, or switch to Vpc.fromLookup.');
+    }
+
     // Get subnetIds for all selected subnets
-    const subnetIds = [...new Set(Array().concat(...this.vpcSubnets.map(s => this.vpc.selectSubnets(s).subnetIds)))];
+    const subnetIds = Array.from(new Set(flatten(selectedSubnetIdsPerGroup)));
 
 
     this.endpointAccess = props.endpointAccess ?? EndpointAccess.PUBLIC_AND_PRIVATE;
@@ -1488,7 +1493,7 @@ export class Cluster extends ClusterBase {
         if (!ec2.Subnet.isVpcSubnet(subnet)) {
           // message (if token): "could not auto-tag public/private subnet with tag..."
           // message (if not token): "count not auto-tag public/private subnet xxxxx with tag..."
-          const subnetID = Token.isUnresolved(subnet.subnetId) ? '' : ` ${subnet.subnetId}`;
+          const subnetID = Token.isUnresolved(subnet.subnetId) || Token.isUnresolved([subnet.subnetId]) ? '' : ` ${subnet.subnetId}`;
           Annotations.of(this).addWarning(`Could not auto-tag ${type} subnet${subnetID} with "${tag}=1", please remember to do this manually`);
           continue;
         }
@@ -1944,3 +1949,7 @@ function cpuArchForInstanceType(instanceType: ec2.InstanceType) {
     INSTANCE_TYPES.graviton.includes(instanceType.toString().substring(0, 2)) ? CpuArch.ARM_64 :
       CpuArch.X86_64;
 }
+
+function flatten<A>(xss: A[][]): A[] {
+  return Array.prototype.concat.call([], ...xss);
+}
diff --git a/packages/@aws-cdk/aws-eks/package.json b/packages/@aws-cdk/aws-eks/package.json
index 914143934e167..186fbc88d2717 100644
--- a/packages/@aws-cdk/aws-eks/package.json
+++ b/packages/@aws-cdk/aws-eks/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -75,7 +75,7 @@
     "@aws-cdk/assert": "0.0.0",
     "@types/nodeunit": "^0.0.31",
     "@types/yaml": "1.9.6",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-eks/test/test.cluster.ts b/packages/@aws-cdk/aws-eks/test/test.cluster.ts
index f94bafa8f9798..7e7f01d7ede84 100644
--- a/packages/@aws-cdk/aws-eks/test/test.cluster.ts
+++ b/packages/@aws-cdk/aws-eks/test/test.cluster.ts
@@ -40,7 +40,6 @@ export = {
   },
 
   'throws when trying to place cluster handlers in a vpc with no private subnets'(test: Test) {
-
     const { stack } = testFixture();
 
     const vpc = new ec2.Vpc(stack, 'Vpc');
@@ -57,6 +56,69 @@ export = {
     test.done();
   },
 
+  'imported Vpc from unparseable list tokens': (() => {
+    let stack: cdk.Stack;
+    let vpc: ec2.IVpc;
+
+    return {
+      'setUp'(cb: () => void) {
+        stack = new cdk.Stack();
+        const vpcId = cdk.Fn.importValue('myVpcId');
+        const availabilityZones = cdk.Fn.split(',', cdk.Fn.importValue('myAvailabilityZones'));
+        const publicSubnetIds = cdk.Fn.split(',', cdk.Fn.importValue('myPublicSubnetIds'));
+        const privateSubnetIds = cdk.Fn.split(',', cdk.Fn.importValue('myPrivateSubnetIds'));
+        const isolatedSubnetIds = cdk.Fn.split(',', cdk.Fn.importValue('myIsolatedSubnetIds'));
+
+        vpc = ec2.Vpc.fromVpcAttributes(stack, 'importedVpc', {
+          vpcId,
+          availabilityZones,
+          publicSubnetIds,
+          privateSubnetIds,
+          isolatedSubnetIds,
+        });
+
+        cb();
+      },
+
+      'throws if selecting more than one subnet group'(test: Test) {
+        test.throws(() => new eks.Cluster(stack, 'Cluster', {
+          vpc: vpc,
+          vpcSubnets: [{ subnetType: ec2.SubnetType.PUBLIC }, { subnetType: ec2.SubnetType.PRIVATE }],
+          defaultCapacity: 0,
+          version: eks.KubernetesVersion.V1_18,
+        }), /cannot select multiple subnet groups/);
+
+        test.done();
+      },
+
+      'synthesis works if only one subnet group is selected'(test: Test) {
+        // WHEN
+        new eks.Cluster(stack, 'Cluster', {
+          vpc: vpc,
+          vpcSubnets: [{ subnetType: ec2.SubnetType.PUBLIC }],
+          defaultCapacity: 0,
+          version: eks.KubernetesVersion.V1_18,
+        });
+
+        // THEN
+        expect(stack).to(haveResourceLike('Custom::AWSCDK-EKS-Cluster', {
+          Config: {
+            resourcesVpcConfig: {
+              subnetIds: {
+                'Fn::Split': [
+                  ',',
+                  { 'Fn::ImportValue': 'myPublicSubnetIds' },
+                ],
+              },
+            },
+          },
+        }));
+
+        test.done();
+      },
+    };
+  })(),
+
   'throws when accessing cluster security group for imported cluster without cluster security group id'(test: Test) {
 
     const { stack } = testFixture();
diff --git a/packages/@aws-cdk/aws-elasticache/package.json b/packages/@aws-cdk/aws-elasticache/package.json
index c56a2e4d94129..5903bbbbb7973 100644
--- a/packages/@aws-cdk/aws-elasticache/package.json
+++ b/packages/@aws-cdk/aws-elasticache/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-elasticbeanstalk/package.json b/packages/@aws-cdk/aws-elasticbeanstalk/package.json
index 397a0727a0c79..e7e6dd43c9b2d 100644
--- a/packages/@aws-cdk/aws-elasticbeanstalk/package.json
+++ b/packages/@aws-cdk/aws-elasticbeanstalk/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-elasticloadbalancing/package.json b/packages/@aws-cdk/aws-elasticloadbalancing/package.json
index 67dad28cdc322..0c52d072ad915 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancing/package.json
+++ b/packages/@aws-cdk/aws-elasticloadbalancing/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2-actions/package.json b/packages/@aws-cdk/aws-elasticloadbalancingv2-actions/package.json
index b96e5ad634f5c..805b84d8bb6ac 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2-actions/package.json
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2-actions/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json b/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json
index a0bc55a5ddc2f..85319dcdfb239 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-certificate.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-certificate.ts
index 4dab6b23ba2b0..2ff867a4721a2 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-certificate.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-certificate.ts
@@ -1,9 +1,12 @@
-import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { CfnListenerCertificate } from '../elasticloadbalancingv2.generated';
 import { IListenerCertificate } from '../shared/listener-certificate';
 import { IApplicationListener } from './application-listener';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Properties for adding a set of certificates to a listener
  */
@@ -36,7 +39,7 @@ export interface ApplicationListenerCertificateProps {
 /**
  * Add certificates to a listener
  */
-export class ApplicationListenerCertificate extends cdk.Construct {
+export class ApplicationListenerCertificate extends CoreConstruct {
   constructor(scope: Construct, id: string, props: ApplicationListenerCertificateProps) {
     super(scope, id);
 
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts
index edc0e04551f46..e109bc7624f9c 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts
@@ -7,6 +7,10 @@ import { ListenerAction } from './application-listener-action';
 import { IApplicationTargetGroup } from './application-target-group';
 import { ListenerCondition } from './conditions';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Basic properties for defining a rule on a listener
  */
@@ -194,7 +198,7 @@ export interface RedirectResponse {
 /**
  * Define a new listener rule
  */
-export class ApplicationListenerRule extends cdk.Construct {
+export class ApplicationListenerRule extends CoreConstruct {
   /**
    * The ARN of this rule
    */
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
index f9155bb1430eb..0ff63805aab90 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
@@ -5,6 +5,10 @@ import { CfnTargetGroup } from '../elasticloadbalancingv2.generated';
 import { Protocol, TargetType } from './enums';
 import { Attributes, renderAttributes } from './util';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Basic properties of both Application and Network Target Groups
  */
@@ -145,7 +149,7 @@ export interface HealthCheck {
 /**
  * Define the target of a load balancer
  */
-export abstract class TargetGroupBase extends cdk.Construct implements ITargetGroup {
+export abstract class TargetGroupBase extends CoreConstruct implements ITargetGroup {
   /**
    * The ARN of the target group
    */
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/imported.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/imported.ts
index 52643b49a97cd..59594c636d118 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/imported.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/imported.ts
@@ -2,10 +2,14 @@ import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { ITargetGroup, TargetGroupImportProps } from './base-target-group';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Base internal class for existing target groups
  */
-export abstract class ImportedTargetGroupBase extends cdk.Construct implements ITargetGroup {
+export abstract class ImportedTargetGroupBase extends CoreConstruct implements ITargetGroup {
   /**
    * ARN of the target group
    */
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json b/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json
index 974ddc9b78c0d..6f08433889688 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts
index 8fa9d3361db33..6378f8ac0c8ed 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts
@@ -1,9 +1,12 @@
 import * as ec2 from '@aws-cdk/aws-ec2';
-import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import * as elbv2 from '../lib';
 
-export class FakeSelfRegisteringTarget extends cdk.Construct implements elbv2.IApplicationLoadBalancerTarget, elbv2.INetworkLoadBalancerTarget,
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
+export class FakeSelfRegisteringTarget extends Construct implements elbv2.IApplicationLoadBalancerTarget, elbv2.INetworkLoadBalancerTarget,
     ec2.IConnectable {
   public readonly securityGroup: ec2.SecurityGroup;
   public readonly connections: ec2.Connections;
diff --git a/packages/@aws-cdk/aws-elasticsearch/README.md b/packages/@aws-cdk/aws-elasticsearch/README.md
index f6e94c7c62c49..35d3f63c6bf55 100644
--- a/packages/@aws-cdk/aws-elasticsearch/README.md
+++ b/packages/@aws-cdk/aws-elasticsearch/README.md
@@ -210,3 +210,18 @@ const domain = new es.Domain(this, 'Domain', {
     },
 });
 ```
+
+## UltraWarm
+
+UltraWarm nodes can be enabled to provide a cost-effective way to store large amounts of read-only data.
+
+```ts
+const domain = new es.Domain(this, 'Domain', {
+    version: es.ElasticsearchVersion.V7_9,
+    capacity: {
+        masterNodes: 2,
+        warmNodes: 2,
+        warmInstanceType: 'ultrawarm1.medium.elasticsearch',
+    },
+});
+```
diff --git a/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts b/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
index 668086dab5372..5a8bcb984c362 100644
--- a/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
+++ b/packages/@aws-cdk/aws-elasticsearch/lib/domain.ts
@@ -124,6 +124,24 @@ export interface CapacityConfig {
    * @default - r5.large.elasticsearch
    */
   readonly dataNodeInstanceType?: string;
+
+  /**
+   * The number of UltraWarm nodes (instances) to use in the Amazon ES domain.
+   *
+   * @default - no UltraWarm nodes
+   */
+  readonly warmNodes?: number;
+
+  /**
+   * The instance type for your UltraWarm node, such as `ultrawarm1.medium.elasticsearch`.
+   * For valid values, see [UltraWarm Storage Limits]
+   * (https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-limits.html#limits-ultrawarm)
+   * in the Amazon Elasticsearch Service Developer Guide.
+   *
+   * @default - ultrawarm1.medium.elasticsearch
+   */
+  readonly warmInstanceType?: string;
+
 }
 
 /**
@@ -1214,6 +1232,7 @@ export class Domain extends DomainBase implements IDomain {
     });
 
     const defaultInstanceType = 'r5.large.elasticsearch';
+    const warmDefaultInstanceType = 'ultrawarm1.medium.elasticsearch';
 
     const dedicatedMasterType =
       props.capacity?.masterNodeInstanceType?.toLowerCase() ??
@@ -1226,6 +1245,12 @@ export class Domain extends DomainBase implements IDomain {
       defaultInstanceType;
     const instanceCount = props.capacity?.dataNodes ?? 1;
 
+    const warmType =
+      props.capacity?.warmInstanceType?.toLowerCase() ??
+      warmDefaultInstanceType;
+    const warmCount = props.capacity?.warmNodes ?? 0;
+    const warmEnabled = warmCount > 0;
+
     const availabilityZoneCount =
       props.zoneAwareness?.availabilityZoneCount ?? 2;
 
@@ -1243,8 +1268,12 @@ export class Domain extends DomainBase implements IDomain {
       throw new Error('When providing vpc options you need to provide a subnet for each AZ you are using');
     };
 
-    if ([dedicatedMasterType, instanceType].some(t => !t.endsWith('.elasticsearch'))) {
-      throw new Error('Master and data node instance types must end with ".elasticsearch".');
+    if ([dedicatedMasterType, instanceType, warmType].some(t => !t.endsWith('.elasticsearch'))) {
+      throw new Error('Master, data and UltraWarm node instance types must end with ".elasticsearch".');
+    }
+
+    if (!warmType.startsWith('ultrawarm')) {
+      throw new Error('UltraWarm node instance type must start with "ultrawarm".');
     }
 
     const elasticsearchVersion = props.version.version;
@@ -1369,6 +1398,10 @@ export class Domain extends DomainBase implements IDomain {
       }
     }
 
+    if (elasticsearchVersionNum < 6.8 && warmEnabled) {
+      throw new Error('UltraWarm requires Elasticsearch 6.8 or later.');
+    }
+
     // Validate against instance type restrictions, per
     // https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-supported-instance-types.html
     if (isInstanceType('i3') && ebsEnabled) {
@@ -1383,6 +1416,10 @@ export class Domain extends DomainBase implements IDomain {
       throw new Error('The t2.micro.elasticsearch instance type supports only Elasticsearch 1.5 and 2.3.');
     }
 
+    if (isSomeInstanceType('t2', 't3') && warmEnabled) {
+      throw new Error('T2 and T3 instance types do not support UltraWarm storage.');
+    }
+
     // Only R3 and I3 support instance storage, per
     // https://aws.amazon.com/elasticsearch-service/pricing/
     if (!ebsEnabled && !isEveryInstanceType('r3', 'i3')) {
@@ -1409,6 +1446,12 @@ export class Domain extends DomainBase implements IDomain {
       throw new Error('Fine-grained access control is required when audit logs publishing is enabled.');
     }
 
+    // Validate UltraWarm requirement for dedicated master nodes, per
+    // https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ultrawarm.html
+    if (warmEnabled && !dedicatedMasterEnabled) {
+      throw new Error('Dedicated master node is required when UltraWarm storage is enabled.');
+    }
+
     let cfnVpcOptions: CfnDomain.VPCOptionsProperty | undefined;
     if (props.vpcOptions) {
       cfnVpcOptions = {
@@ -1518,6 +1561,15 @@ export class Domain extends DomainBase implements IDomain {
           : undefined,
         instanceCount,
         instanceType,
+        warmEnabled: warmEnabled
+          ? warmEnabled
+          : undefined,
+        warmCount: warmEnabled
+          ? warmCount
+          : undefined,
+        warmType: warmEnabled
+          ? warmType
+          : undefined,
         zoneAwarenessEnabled,
         zoneAwarenessConfig: zoneAwarenessEnabled
           ? { availabilityZoneCount }
diff --git a/packages/@aws-cdk/aws-elasticsearch/lib/elasticsearch-access-policy.ts b/packages/@aws-cdk/aws-elasticsearch/lib/elasticsearch-access-policy.ts
index 78e0e4e8c5003..bb5a530211719 100644
--- a/packages/@aws-cdk/aws-elasticsearch/lib/elasticsearch-access-policy.ts
+++ b/packages/@aws-cdk/aws-elasticsearch/lib/elasticsearch-access-policy.ts
@@ -1,7 +1,10 @@
 import * as iam from '@aws-cdk/aws-iam';
-import * as cdk from '@aws-cdk/core';
 import * as cr from '@aws-cdk/custom-resources';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Construction properties for ElasticsearchAccessPolicy
  */
@@ -26,7 +29,7 @@ export interface ElasticsearchAccessPolicyProps {
  * Creates LogGroup resource policies.
  */
 export class ElasticsearchAccessPolicy extends cr.AwsCustomResource {
-  constructor(scope: cdk.Construct, id: string, props: ElasticsearchAccessPolicyProps) {
+  constructor(scope: Construct, id: string, props: ElasticsearchAccessPolicyProps) {
     const policyDocument = new iam.PolicyDocument({
       statements: props.accessPolicies,
     });
diff --git a/packages/@aws-cdk/aws-elasticsearch/lib/log-group-resource-policy.ts b/packages/@aws-cdk/aws-elasticsearch/lib/log-group-resource-policy.ts
index 949f03aa61baa..e53eb9a913540 100644
--- a/packages/@aws-cdk/aws-elasticsearch/lib/log-group-resource-policy.ts
+++ b/packages/@aws-cdk/aws-elasticsearch/lib/log-group-resource-policy.ts
@@ -1,7 +1,10 @@
 import * as iam from '@aws-cdk/aws-iam';
-import * as cdk from '@aws-cdk/core';
 import * as cr from '@aws-cdk/custom-resources';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Construction properties for LogGroupResourcePolicy
  */
@@ -20,7 +23,7 @@ export interface LogGroupResourcePolicyProps {
  * Creates LogGroup resource policies.
  */
 export class LogGroupResourcePolicy extends cr.AwsCustomResource {
-  constructor(scope: cdk.Construct, id: string, props: LogGroupResourcePolicyProps) {
+  constructor(scope: Construct, id: string, props: LogGroupResourcePolicyProps) {
     const policyDocument = new iam.PolicyDocument({
       statements: props.policyStatements,
     });
diff --git a/packages/@aws-cdk/aws-elasticsearch/package.json b/packages/@aws-cdk/aws-elasticsearch/package.json
index c8844413e9853..5a25fadf6b91f 100644
--- a/packages/@aws-cdk/aws-elasticsearch/package.json
+++ b/packages/@aws-cdk/aws-elasticsearch/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts b/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts
index ff85a85e218f8..f01fba3c4b332 100644
--- a/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts
+++ b/packages/@aws-cdk/aws-elasticsearch/test/domain.test.ts
@@ -113,6 +113,49 @@ test('can enable version upgrade update policy', () => {
   }, assert.ResourcePart.CompleteDefinition);
 });
 
+describe('UltraWarm instances', () => {
+
+  test('can enable UltraWarm instances', () => {
+    new Domain(stack, 'Domain', {
+      version: ElasticsearchVersion.V7_1,
+      capacity: {
+        masterNodes: 2,
+        warmNodes: 2,
+      },
+    });
+
+    expect(stack).toHaveResourceLike('AWS::Elasticsearch::Domain', {
+      ElasticsearchClusterConfig: {
+        DedicatedMasterEnabled: true,
+        WarmEnabled: true,
+        WarmCount: 2,
+        WarmType: 'ultrawarm1.medium.elasticsearch',
+      },
+    });
+  });
+
+  test('can enable UltraWarm instances with specific instance type', () => {
+    new Domain(stack, 'Domain', {
+      version: ElasticsearchVersion.V7_1,
+      capacity: {
+        masterNodes: 2,
+        warmNodes: 2,
+        warmInstanceType: 'ultrawarm1.large.elasticsearch',
+      },
+    });
+
+    expect(stack).toHaveResourceLike('AWS::Elasticsearch::Domain', {
+      ElasticsearchClusterConfig: {
+        DedicatedMasterEnabled: true,
+        WarmEnabled: true,
+        WarmCount: 2,
+        WarmType: 'ultrawarm1.large.elasticsearch',
+      },
+    });
+  });
+
+});
+
 describe('log groups', () => {
 
   test('slowSearchLogEnabled should create a custom log group', () => {
@@ -968,7 +1011,7 @@ describe('custom error responses', () => {
     })).toThrow(/you need to provide a subnet for each AZ you are using/);
   });
 
-  test('error when master or data node instance types do not end with .elasticsearch', () => {
+  test('error when master, data or Ultra Warm instance types do not end with .elasticsearch', () => {
     const error = /instance types must end with ".elasticsearch"/;
     expect(() => new Domain(stack, 'Domain1', {
       version: ElasticsearchVersion.V7_4,
@@ -982,6 +1025,22 @@ describe('custom error responses', () => {
         dataNodeInstanceType: 'c5.2xlarge',
       },
     })).toThrow(error);
+    expect(() => new Domain(stack, 'Domain3', {
+      version: ElasticsearchVersion.V7_4,
+      capacity: {
+        warmInstanceType: 'ultrawarm1.medium',
+      },
+    })).toThrow(error);
+  });
+
+  test('error when Ultra Warm instance types do not start with ultrawarm', () => {
+    const error = /UltraWarm node instance type must start with "ultrawarm"./;
+    expect(() => new Domain(stack, 'Domain1', {
+      version: ElasticsearchVersion.V7_4,
+      capacity: {
+        warmInstanceType: 't3.small.elasticsearch',
+      },
+    })).toThrow(error);
   });
 
   test('error when elasticsearchVersion is unsupported/unknown', () => {
@@ -1169,6 +1228,44 @@ describe('custom error responses', () => {
     })).toThrow(/Invalid zone awareness configuration; availabilityZoneCount must be 2 or 3/);
   });
 
+  test('error when UltraWarm instance is used and not supported by elasticsearchVersion', () => {
+    expect(() => new Domain(stack, 'Domain1', {
+      version: ElasticsearchVersion.V6_7,
+      capacity: {
+        masterNodes: 1,
+        warmNodes: 1,
+      },
+    })).toThrow(/UltraWarm requires Elasticsearch 6\.8 or later/);
+  });
+
+  test('error when t2 or t3 instance types are specified with UltramWarm enabled', () => {
+    const error = /T2 and T3 instance types do not support UltraWarm storage/;
+    expect(() => new Domain(stack, 'Domain1', {
+      version: ElasticsearchVersion.V7_4,
+      capacity: {
+        masterNodeInstanceType: 't2.2xlarge.elasticsearch',
+        warmNodes: 1,
+      },
+    })).toThrow(error);
+    expect(() => new Domain(stack, 'Domain2', {
+      version: ElasticsearchVersion.V7_4,
+      capacity: {
+        masterNodeInstanceType: 't3.2xlarge.elasticsearch',
+        warmNodes: 1,
+      },
+    })).toThrow(error);
+  });
+
+  test('error when UltraWarm instance is used and no dedicated master instance specified', () => {
+    expect(() => new Domain(stack, 'Domain1', {
+      version: ElasticsearchVersion.V7_4,
+      capacity: {
+        warmNodes: 1,
+        masterNodes: 0,
+      },
+    })).toThrow(/Dedicated master node is required when UltraWarm storage is enabled/);
+  });
+
 });
 
 test('can specify future version', () => {
diff --git a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.advancedsecurity.expected.json b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.advancedsecurity.expected.json
index e919ee6365e8e..dac2d95d68b54 100644
--- a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.advancedsecurity.expected.json
+++ b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.advancedsecurity.expected.json
@@ -47,4 +47,4 @@
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.custom-kms-key.expected.json b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.custom-kms-key.expected.json
index fafc653e73740..201e3d81bd99d 100644
--- a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.custom-kms-key.expected.json
+++ b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.custom-kms-key.expected.json
@@ -436,13 +436,13 @@
             ]
           }
         },
+        "Handler": "index.handler",
         "Role": {
           "Fn::GetAtt": [
             "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2",
             "Arn"
           ]
         },
-        "Handler": "index.handler",
         "Runtime": "nodejs12.x",
         "Timeout": 120
       },
diff --git a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.expected.json b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.expected.json
index 6c782aee20cc9..e43b6bb5f62e6 100644
--- a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.expected.json
+++ b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.expected.json
@@ -352,13 +352,13 @@
             ]
           }
         },
+        "Handler": "index.handler",
         "Role": {
           "Fn::GetAtt": [
             "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2",
             "Arn"
           ]
         },
-        "Handler": "index.handler",
         "Runtime": "nodejs12.x",
         "Timeout": 120
       },
diff --git a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.ultrawarm.expected.json b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.ultrawarm.expected.json
new file mode 100644
index 0000000000000..c24aeb2f30740
--- /dev/null
+++ b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.ultrawarm.expected.json
@@ -0,0 +1,40 @@
+{
+  "Resources": {
+    "Domain66AC69E0": {
+      "Type": "AWS::Elasticsearch::Domain",
+      "Properties": {
+        "CognitoOptions": {
+          "Enabled": false
+        },
+        "DomainEndpointOptions": {
+          "EnforceHTTPS": false,
+          "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"
+        },
+        "EBSOptions": {
+          "EBSEnabled": true,
+          "VolumeSize": 10,
+          "VolumeType": "gp2"
+        },
+        "ElasticsearchClusterConfig": {
+          "DedicatedMasterCount": 2,
+          "DedicatedMasterEnabled": true,
+          "DedicatedMasterType": "r5.large.elasticsearch",
+          "InstanceCount": 1,
+          "InstanceType": "r5.large.elasticsearch",
+          "WarmCount": 2,
+          "WarmEnabled": true,
+          "WarmType": "ultrawarm1.medium.elasticsearch",
+          "ZoneAwarenessEnabled": false
+        },
+        "ElasticsearchVersion": "7.1",
+        "EncryptionAtRestOptions": {
+          "Enabled": false
+        },
+        "LogPublishingOptions": {},
+        "NodeToNodeEncryptionOptions": {
+          "Enabled": false
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.ultrawarm.ts b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.ultrawarm.ts
new file mode 100644
index 0000000000000..259f43fe0cef2
--- /dev/null
+++ b/packages/@aws-cdk/aws-elasticsearch/test/integ.elasticsearch.ultrawarm.ts
@@ -0,0 +1,21 @@
+import { App, Stack, StackProps } from '@aws-cdk/core';
+import { Construct } from 'constructs';
+import * as es from '../lib';
+
+class TestStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    new es.Domain(this, 'Domain', {
+      version: es.ElasticsearchVersion.V7_1,
+      capacity: {
+        masterNodes: 2,
+        warmNodes: 2,
+      },
+    });
+  }
+}
+
+const app = new App();
+new TestStack(app, 'cdk-integ-elasticsearch-ultrawarm');
+app.synth();
diff --git a/packages/@aws-cdk/aws-emr/package.json b/packages/@aws-cdk/aws-emr/package.json
index 82653f7f15f3d..0db5f2a5daf20 100644
--- a/packages/@aws-cdk/aws-emr/package.json
+++ b/packages/@aws-cdk/aws-emr/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-events-targets/lib/log-group-resource-policy.ts b/packages/@aws-cdk/aws-events-targets/lib/log-group-resource-policy.ts
index d0bbaca87f689..a4fdccd042e8f 100644
--- a/packages/@aws-cdk/aws-events-targets/lib/log-group-resource-policy.ts
+++ b/packages/@aws-cdk/aws-events-targets/lib/log-group-resource-policy.ts
@@ -2,6 +2,10 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
 import * as cr from '@aws-cdk/custom-resources';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties to configure a log group resource policy
  */
@@ -20,7 +24,7 @@ export interface LogGroupResourcePolicyProps {
  * Creates LogGroup resource policies.
  */
 export class LogGroupResourcePolicy extends cr.AwsCustomResource {
-  constructor(scope: cdk.Construct, id: string, props: LogGroupResourcePolicyProps) {
+  constructor(scope: Construct, id: string, props: LogGroupResourcePolicyProps) {
     const policyDocument = new iam.PolicyDocument({
       statements: props.policyStatements,
     });
diff --git a/packages/@aws-cdk/aws-events-targets/package.json b/packages/@aws-cdk/aws-events-targets/package.json
index 1c1438f8584bd..8b211a1e214d0 100644
--- a/packages/@aws-cdk/aws-events-targets/package.json
+++ b/packages/@aws-cdk/aws-events-targets/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "node ./build-tools/gen.js",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -76,7 +76,7 @@
     "@aws-cdk/assert": "0.0.0",
     "@aws-cdk/aws-codecommit": "0.0.0",
     "@aws-cdk/aws-s3": "0.0.0",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "aws-sdk-mock": "^5.1.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
diff --git a/packages/@aws-cdk/aws-events/package.json b/packages/@aws-cdk/aws-events/package.json
index 084f246783f23..37a634383e41f 100644
--- a/packages/@aws-cdk/aws-events/package.json
+++ b/packages/@aws-cdk/aws-events/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-eventschemas/package.json b/packages/@aws-cdk/aws-eventschemas/package.json
index fe4e491a8ace9..ace14dd7ca207 100644
--- a/packages/@aws-cdk/aws-eventschemas/package.json
+++ b/packages/@aws-cdk/aws-eventschemas/package.json
@@ -49,8 +49,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "compat": "cdk-compat",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-fms/package.json b/packages/@aws-cdk/aws-fms/package.json
index 2414df6719d2e..7c0f163088f01 100644
--- a/packages/@aws-cdk/aws-fms/package.json
+++ b/packages/@aws-cdk/aws-fms/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-fsx/package.json b/packages/@aws-cdk/aws-fsx/package.json
index 485a1f3c330f4..df9e7d2c91a8e 100644
--- a/packages/@aws-cdk/aws-fsx/package.json
+++ b/packages/@aws-cdk/aws-fsx/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-gamelift/package.json b/packages/@aws-cdk/aws-gamelift/package.json
index a43def9979e29..31ea31a600460 100644
--- a/packages/@aws-cdk/aws-gamelift/package.json
+++ b/packages/@aws-cdk/aws-gamelift/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-globalaccelerator/lib/endpoint-group.ts b/packages/@aws-cdk/aws-globalaccelerator/lib/endpoint-group.ts
index a2532aecdffa0..b5c96bcd547ba 100644
--- a/packages/@aws-cdk/aws-globalaccelerator/lib/endpoint-group.ts
+++ b/packages/@aws-cdk/aws-globalaccelerator/lib/endpoint-group.ts
@@ -3,6 +3,10 @@ import { Construct } from 'constructs';
 import * as ga from './globalaccelerator.generated';
 import { IListener } from './listener';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * The interface of the EndpointGroup
  */
@@ -113,7 +117,7 @@ export interface EndpointGroupProps {
 /**
  * The class for endpoint configuration
  */
-export class EndpointConfiguration extends cdk.Construct {
+export class EndpointConfiguration extends CoreConstruct {
   /**
    * The property containing all the configuration to be rendered
    */
diff --git a/packages/@aws-cdk/aws-globalaccelerator/package.json b/packages/@aws-cdk/aws-globalaccelerator/package.json
index 945d312b2dc02..d9bbe45012208 100644
--- a/packages/@aws-cdk/aws-globalaccelerator/package.json
+++ b/packages/@aws-cdk/aws-globalaccelerator/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-glue/package.json b/packages/@aws-cdk/aws-glue/package.json
index 53071428690fb..88403823a6018 100644
--- a/packages/@aws-cdk/aws-glue/package.json
+++ b/packages/@aws-cdk/aws-glue/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-greengrass/package.json b/packages/@aws-cdk/aws-greengrass/package.json
index 9ac1e1e9bcfe8..ccdb88f736470 100644
--- a/packages/@aws-cdk/aws-greengrass/package.json
+++ b/packages/@aws-cdk/aws-greengrass/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-greengrassv2/package.json b/packages/@aws-cdk/aws-greengrassv2/package.json
index c8d835f70b02a..6d76123af4e1c 100644
--- a/packages/@aws-cdk/aws-greengrassv2/package.json
+++ b/packages/@aws-cdk/aws-greengrassv2/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-guardduty/package.json b/packages/@aws-cdk/aws-guardduty/package.json
index e4008753c6578..27c6527f23f7b 100644
--- a/packages/@aws-cdk/aws-guardduty/package.json
+++ b/packages/@aws-cdk/aws-guardduty/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iam/lib/policy-statement.ts b/packages/@aws-cdk/aws-iam/lib/policy-statement.ts
index fd89301cb766c..ce817a58e508e 100644
--- a/packages/@aws-cdk/aws-iam/lib/policy-statement.ts
+++ b/packages/@aws-cdk/aws-iam/lib/policy-statement.ts
@@ -1,4 +1,5 @@
 import * as cdk from '@aws-cdk/core';
+import { Group } from './group';
 import {
   AccountPrincipal, AccountRootPrincipal, Anyone, ArnPrincipal, CanonicalUserPrincipal,
   FederatedPrincipal, IPrincipal, PrincipalBase, PrincipalPolicyFragment, ServicePrincipal, ServicePrincipalOpts,
@@ -138,6 +139,7 @@ export class PolicyStatement {
       throw new Error('Cannot add \'Principals\' to policy statement if \'NotPrincipals\' have been added');
     }
     for (const principal of principals) {
+      this.validatePolicyPrincipal(principal);
       const fragment = principal.policyFragment;
       mergePrincipal(this.principal, fragment.principalJson);
       this.addPrincipalConditions(fragment.conditions);
@@ -157,12 +159,19 @@ export class PolicyStatement {
       throw new Error('Cannot add \'NotPrincipals\' to policy statement if \'Principals\' have been added');
     }
     for (const notPrincipal of notPrincipals) {
+      this.validatePolicyPrincipal(notPrincipal);
       const fragment = notPrincipal.policyFragment;
       mergePrincipal(this.notPrincipal, fragment.principalJson);
       this.addPrincipalConditions(fragment.conditions);
     }
   }
 
+  private validatePolicyPrincipal(principal: IPrincipal) {
+    if (principal instanceof Group) {
+      throw new Error('Cannot use an IAM Group as the \'Principal\' or \'NotPrincipal\' in an IAM Policy');
+    }
+  }
+
   /**
    * Specify AWS account ID as the principal entity to the "Principal" section of a policy statement.
    */
diff --git a/packages/@aws-cdk/aws-iam/package.json b/packages/@aws-cdk/aws-iam/package.json
index aca4f4a77e613..0ae9e2167dcec 100644
--- a/packages/@aws-cdk/aws-iam/package.json
+++ b/packages/@aws-cdk/aws-iam/package.json
@@ -54,8 +54,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iam/test/example.attaching.lit.ts b/packages/@aws-cdk/aws-iam/test/example.attaching.lit.ts
index 5b04bac60cd3f..f85f7514c91b6 100644
--- a/packages/@aws-cdk/aws-iam/test/example.attaching.lit.ts
+++ b/packages/@aws-cdk/aws-iam/test/example.attaching.lit.ts
@@ -2,7 +2,11 @@ import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import { Group, Policy, User } from '../lib';
 
-export class ExampleConstruct extends cdk.Construct {
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
+export class ExampleConstruct extends Construct {
   constructor(scope: constructs.Construct, id: string) {
     super(scope, id);
 
diff --git a/packages/@aws-cdk/aws-iam/test/example.external-id.lit.ts b/packages/@aws-cdk/aws-iam/test/example.external-id.lit.ts
index ddbcb4cd5ea07..f13fae1c0837b 100644
--- a/packages/@aws-cdk/aws-iam/test/example.external-id.lit.ts
+++ b/packages/@aws-cdk/aws-iam/test/example.external-id.lit.ts
@@ -1,8 +1,11 @@
-import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import * as iam from '../lib';
 
-export class ExampleConstruct extends cdk.Construct {
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
+export class ExampleConstruct extends Construct {
   constructor(scope: constructs.Construct, id: string) {
     super(scope, id);
 
diff --git a/packages/@aws-cdk/aws-iam/test/example.managedpolicy.lit.ts b/packages/@aws-cdk/aws-iam/test/example.managedpolicy.lit.ts
index 8eb514aae90da..6e2859ad24a60 100644
--- a/packages/@aws-cdk/aws-iam/test/example.managedpolicy.lit.ts
+++ b/packages/@aws-cdk/aws-iam/test/example.managedpolicy.lit.ts
@@ -1,8 +1,11 @@
-import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import { Group, ManagedPolicy } from '../lib';
 
-export class ExampleConstruct extends cdk.Construct {
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
+export class ExampleConstruct extends Construct {
   constructor(scope: constructs.Construct, id: string) {
     super(scope, id);
 
diff --git a/packages/@aws-cdk/aws-iam/test/example.role.lit.ts b/packages/@aws-cdk/aws-iam/test/example.role.lit.ts
index 92ff9d2a96127..0a2c6eb9ecb48 100644
--- a/packages/@aws-cdk/aws-iam/test/example.role.lit.ts
+++ b/packages/@aws-cdk/aws-iam/test/example.role.lit.ts
@@ -1,8 +1,11 @@
-import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import { PolicyStatement, Role, ServicePrincipal } from '../lib';
 
-export class ExampleConstruct extends cdk.Construct {
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
+export class ExampleConstruct extends Construct {
   constructor(scope: constructs.Construct, id: string) {
     super(scope, id);
 
diff --git a/packages/@aws-cdk/aws-iam/test/policy-statement.test.ts b/packages/@aws-cdk/aws-iam/test/policy-statement.test.ts
index 5f08f45e814a1..089fa34dba74e 100644
--- a/packages/@aws-cdk/aws-iam/test/policy-statement.test.ts
+++ b/packages/@aws-cdk/aws-iam/test/policy-statement.test.ts
@@ -1,6 +1,6 @@
 import '@aws-cdk/assert/jest';
 import { Stack } from '@aws-cdk/core';
-import { AnyPrincipal, PolicyDocument, PolicyStatement } from '../lib';
+import { AnyPrincipal, Group, PolicyDocument, PolicyStatement } from '../lib';
 
 describe('IAM policy statement', () => {
 
@@ -180,4 +180,14 @@ describe('IAM policy statement', () => {
     });
   });
 
+  test('throws error when group is specified for \'Principal\' or \'NotPrincipal\'', () => {
+    const stack = new Stack();
+    const group = new Group(stack, 'groupId');
+    const policyStatement = new PolicyStatement();
+
+    expect(() => policyStatement.addPrincipals(group))
+      .toThrow(/Cannot use an IAM Group as the 'Principal' or 'NotPrincipal' in an IAM Policy/);
+    expect(() => policyStatement.addNotPrincipals(group))
+      .toThrow(/Cannot use an IAM Group as the 'Principal' or 'NotPrincipal' in an IAM Policy/);
+  });
 });
diff --git a/packages/@aws-cdk/aws-imagebuilder/package.json b/packages/@aws-cdk/aws-imagebuilder/package.json
index 2742ce7697bf3..5b84409f94615 100644
--- a/packages/@aws-cdk/aws-imagebuilder/package.json
+++ b/packages/@aws-cdk/aws-imagebuilder/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-inspector/package.json b/packages/@aws-cdk/aws-inspector/package.json
index 86170a7e0c04c..d7096ba2d0973 100644
--- a/packages/@aws-cdk/aws-inspector/package.json
+++ b/packages/@aws-cdk/aws-inspector/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iot/package.json b/packages/@aws-cdk/aws-iot/package.json
index be216a8faee2d..af7c5eb104c2c 100644
--- a/packages/@aws-cdk/aws-iot/package.json
+++ b/packages/@aws-cdk/aws-iot/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iot1click/package.json b/packages/@aws-cdk/aws-iot1click/package.json
index 335455eb17d37..b59de6853d0a3 100644
--- a/packages/@aws-cdk/aws-iot1click/package.json
+++ b/packages/@aws-cdk/aws-iot1click/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iotanalytics/package.json b/packages/@aws-cdk/aws-iotanalytics/package.json
index 3339cb21c96a5..14beda91b0a06 100644
--- a/packages/@aws-cdk/aws-iotanalytics/package.json
+++ b/packages/@aws-cdk/aws-iotanalytics/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iotevents/package.json b/packages/@aws-cdk/aws-iotevents/package.json
index 894a4444c427b..db3c7bfda4f2e 100644
--- a/packages/@aws-cdk/aws-iotevents/package.json
+++ b/packages/@aws-cdk/aws-iotevents/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iotsitewise/package.json b/packages/@aws-cdk/aws-iotsitewise/package.json
index 08126c3b4a3fe..2f83f0e2de91e 100644
--- a/packages/@aws-cdk/aws-iotsitewise/package.json
+++ b/packages/@aws-cdk/aws-iotsitewise/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iotthingsgraph/package.json b/packages/@aws-cdk/aws-iotthingsgraph/package.json
index 2e9108ec10b42..4f7c632f3f21c 100644
--- a/packages/@aws-cdk/aws-iotthingsgraph/package.json
+++ b/packages/@aws-cdk/aws-iotthingsgraph/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-iotwireless/package.json b/packages/@aws-cdk/aws-iotwireless/package.json
index c76906933023d..9f4546fa0f19c 100644
--- a/packages/@aws-cdk/aws-iotwireless/package.json
+++ b/packages/@aws-cdk/aws-iotwireless/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-ivs/package.json b/packages/@aws-cdk/aws-ivs/package.json
index 1e631e4d46db0..5f04b34b92fb1 100644
--- a/packages/@aws-cdk/aws-ivs/package.json
+++ b/packages/@aws-cdk/aws-ivs/package.json
@@ -57,8 +57,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-kendra/package.json b/packages/@aws-cdk/aws-kendra/package.json
index 27fe34bbe973b..f00e07f932527 100644
--- a/packages/@aws-cdk/aws-kendra/package.json
+++ b/packages/@aws-cdk/aws-kendra/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-kinesis/package.json b/packages/@aws-cdk/aws-kinesis/package.json
index 3fa0c93ec77f1..86bad035680df 100644
--- a/packages/@aws-cdk/aws-kinesis/package.json
+++ b/packages/@aws-cdk/aws-kinesis/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-kinesisanalytics/package.json b/packages/@aws-cdk/aws-kinesisanalytics/package.json
index 2488c436bd3c3..e2892051cbf20 100644
--- a/packages/@aws-cdk/aws-kinesisanalytics/package.json
+++ b/packages/@aws-cdk/aws-kinesisanalytics/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-kinesisfirehose/package.json b/packages/@aws-cdk/aws-kinesisfirehose/package.json
index 69c3ac1385552..9e16c728da250 100644
--- a/packages/@aws-cdk/aws-kinesisfirehose/package.json
+++ b/packages/@aws-cdk/aws-kinesisfirehose/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-kms/package.json b/packages/@aws-cdk/aws-kms/package.json
index 04ed686b059de..9ce005fa301e5 100644
--- a/packages/@aws-cdk/aws-kms/package.json
+++ b/packages/@aws-cdk/aws-kms/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-lakeformation/package.json b/packages/@aws-cdk/aws-lakeformation/package.json
index 22b480da5f72b..0497f9da337f9 100644
--- a/packages/@aws-cdk/aws-lakeformation/package.json
+++ b/packages/@aws-cdk/aws-lakeformation/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-lambda-destinations/package.json b/packages/@aws-cdk/aws-lambda-destinations/package.json
index 701f56d4b33f1..6bb6f0a90a09f 100644
--- a/packages/@aws-cdk/aws-lambda-destinations/package.json
+++ b/packages/@aws-cdk/aws-lambda-destinations/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-lambda-event-sources/package.json b/packages/@aws-cdk/aws-lambda-event-sources/package.json
index 603f3c8b82626..b6e2d033ebbe1 100644
--- a/packages/@aws-cdk/aws-lambda-event-sources/package.json
+++ b/packages/@aws-cdk/aws-lambda-event-sources/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-lambda-nodejs/lib/function.ts b/packages/@aws-cdk/aws-lambda-nodejs/lib/function.ts
index 5e4e160eaa717..680a6f7330356 100644
--- a/packages/@aws-cdk/aws-lambda-nodejs/lib/function.ts
+++ b/packages/@aws-cdk/aws-lambda-nodejs/lib/function.ts
@@ -1,11 +1,14 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as lambda from '@aws-cdk/aws-lambda';
-import * as cdk from '@aws-cdk/core';
 import { Bundling } from './bundling';
 import { BundlingOptions } from './types';
 import { callsites, findUp, LockFile, nodeMajorVersion } from './util';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for a NodejsFunction
  */
@@ -76,7 +79,7 @@ export interface NodejsFunctionProps extends lambda.FunctionOptions {
  * A Node.js Lambda function bundled using esbuild
  */
 export class NodejsFunction extends lambda.Function {
-  constructor(scope: cdk.Construct, id: string, props: NodejsFunctionProps = {}) {
+  constructor(scope: Construct, id: string, props: NodejsFunctionProps = {}) {
     if (props.runtime && props.runtime.family !== lambda.RuntimeFamily.NODEJS) {
       throw new Error('Only `NODEJS` runtimes are supported.');
     }
diff --git a/packages/@aws-cdk/aws-lambda-nodejs/package.json b/packages/@aws-cdk/aws-lambda-nodejs/package.json
index 604169b7d65ba..04fa549fb73e0 100644
--- a/packages/@aws-cdk/aws-lambda-nodejs/package.json
+++ b/packages/@aws-cdk/aws-lambda-nodejs/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
@@ -69,7 +69,7 @@
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "delay": "4.4.0",
-    "esbuild": "^0.8.32",
+    "esbuild": "^0.8.33",
     "pkglint": "0.0.0"
   },
   "dependencies": {
diff --git a/packages/@aws-cdk/aws-lambda-python/lib/function.ts b/packages/@aws-cdk/aws-lambda-python/lib/function.ts
index 77f794704e967..267245738cbe6 100644
--- a/packages/@aws-cdk/aws-lambda-python/lib/function.ts
+++ b/packages/@aws-cdk/aws-lambda-python/lib/function.ts
@@ -1,9 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as lambda from '@aws-cdk/aws-lambda';
-import * as cdk from '@aws-cdk/core';
 import { bundle } from './bundling';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for a PythonFunction
  */
@@ -40,7 +43,7 @@ export interface PythonFunctionProps extends lambda.FunctionOptions {
  * A Python Lambda function
  */
 export class PythonFunction extends lambda.Function {
-  constructor(scope: cdk.Construct, id: string, props: PythonFunctionProps) {
+  constructor(scope: Construct, id: string, props: PythonFunctionProps) {
     if (props.runtime && props.runtime.family !== lambda.RuntimeFamily.PYTHON) {
       throw new Error('Only `PYTHON` runtimes are supported.');
     }
diff --git a/packages/@aws-cdk/aws-lambda-python/lib/layer.ts b/packages/@aws-cdk/aws-lambda-python/lib/layer.ts
index 8b090eed6a989..3299781bb413c 100644
--- a/packages/@aws-cdk/aws-lambda-python/lib/layer.ts
+++ b/packages/@aws-cdk/aws-lambda-python/lib/layer.ts
@@ -1,8 +1,11 @@
 import * as path from 'path';
 import * as lambda from '@aws-cdk/aws-lambda';
-import * as cdk from '@aws-cdk/core';
 import { bundle } from './bundling';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Properties for PythonLayerVersion
  */
@@ -26,7 +29,7 @@ export interface PythonLayerVersionProps extends lambda.LayerVersionOptions {
  * @experimental
  */
 export class PythonLayerVersion extends lambda.LayerVersion {
-  constructor(scope: cdk.Construct, id: string, props: PythonLayerVersionProps) {
+  constructor(scope: Construct, id: string, props: PythonLayerVersionProps) {
     const compatibleRuntimes = props.compatibleRuntimes ?? [lambda.Runtime.PYTHON_3_7];
 
     // Ensure that all compatible runtimes are python
diff --git a/packages/@aws-cdk/aws-lambda-python/package.json b/packages/@aws-cdk/aws-lambda-python/package.json
index 15a41e3b22806..65795a087d7d9 100644
--- a/packages/@aws-cdk/aws-lambda-python/package.json
+++ b/packages/@aws-cdk/aws-lambda-python/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-lambda/lib/code.ts b/packages/@aws-cdk/aws-lambda/lib/code.ts
index b2323008bb5fd..29cd3d02ae4de 100644
--- a/packages/@aws-cdk/aws-lambda/lib/code.ts
+++ b/packages/@aws-cdk/aws-lambda/lib/code.ts
@@ -5,6 +5,10 @@ import * as s3 from '@aws-cdk/aws-s3';
 import * as s3_assets from '@aws-cdk/aws-s3-assets';
 import * as cdk from '@aws-cdk/core';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Represents the Lambda Handler Code.
  */
@@ -112,7 +116,7 @@ export abstract class Code {
    * @param scope The binding scope. Don't be smart about trying to down-cast or
    * assume it's initialized. You may just use it as a construct scope.
    */
-  public abstract bind(scope: cdk.Construct): CodeConfig;
+  public abstract bind(scope: Construct): CodeConfig;
 
   /**
    * Called after the CFN function resource has been created to allow the code
@@ -191,7 +195,7 @@ export class S3Code extends Code {
     this.bucketName = bucket.bucketName;
   }
 
-  public bind(_scope: cdk.Construct): CodeConfig {
+  public bind(_scope: Construct): CodeConfig {
     return {
       s3Location: {
         bucketName: this.bucketName,
@@ -220,7 +224,7 @@ export class InlineCode extends Code {
     }
   }
 
-  public bind(_scope: cdk.Construct): CodeConfig {
+  public bind(_scope: Construct): CodeConfig {
     return {
       inlineCode: this.code,
     };
@@ -241,7 +245,7 @@ export class AssetCode extends Code {
     super();
   }
 
-  public bind(scope: cdk.Construct): CodeConfig {
+  public bind(scope: Construct): CodeConfig {
     // If the same AssetCode is used multiple times, retain only the first instantiation.
     if (!this.asset) {
       this.asset = new s3_assets.Asset(scope, 'Code', {
@@ -327,7 +331,7 @@ export class CfnParametersCode extends Code {
     this._objectKeyParam = props.objectKeyParam;
   }
 
-  public bind(scope: cdk.Construct): CodeConfig {
+  public bind(scope: Construct): CodeConfig {
     if (!this._bucketNameParam) {
       this._bucketNameParam = new cdk.CfnParameter(scope, 'LambdaSourceBucketNameParameter', {
         type: 'String',
@@ -422,7 +426,7 @@ export class EcrImageCode extends Code {
     super();
   }
 
-  public bind(_: cdk.Construct): CodeConfig {
+  public bind(_: Construct): CodeConfig {
     this.repository.grantPull(new iam.ServicePrincipal('lambda.amazonaws.com'));
 
     return {
@@ -467,7 +471,7 @@ export class AssetImageCode extends Code {
     super();
   }
 
-  public bind(scope: cdk.Construct): CodeConfig {
+  public bind(scope: Construct): CodeConfig {
     const asset = new ecr_assets.DockerImageAsset(scope, 'AssetImage', {
       directory: this.directory,
       ...this.props,
diff --git a/packages/@aws-cdk/aws-lambda/package.json b/packages/@aws-cdk/aws-lambda/package.json
index 79ab230a1b09d..90c497b8ea3fd 100644
--- a/packages/@aws-cdk/aws-lambda/package.json
+++ b/packages/@aws-cdk/aws-lambda/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -79,7 +79,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@types/aws-lambda": "^8.10.64",
-    "@types/lodash": "^4.14.167",
+    "@types/lodash": "^4.14.168",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-licensemanager/package.json b/packages/@aws-cdk/aws-licensemanager/package.json
index 92031bf0a7206..6682f02d39e3e 100644
--- a/packages/@aws-cdk/aws-licensemanager/package.json
+++ b/packages/@aws-cdk/aws-licensemanager/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-logs-destinations/package.json b/packages/@aws-cdk/aws-logs-destinations/package.json
index fb995e0755637..81e8328abba90 100644
--- a/packages/@aws-cdk/aws-logs-destinations/package.json
+++ b/packages/@aws-cdk/aws-logs-destinations/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-logs/lib/cross-account-destination.ts b/packages/@aws-cdk/aws-logs/lib/cross-account-destination.ts
index f9dfefdfed9f6..2d024ad8e88e1 100644
--- a/packages/@aws-cdk/aws-logs/lib/cross-account-destination.ts
+++ b/packages/@aws-cdk/aws-logs/lib/cross-account-destination.ts
@@ -5,6 +5,10 @@ import { ILogGroup } from './log-group';
 import { CfnDestination } from './logs.generated';
 import { ILogSubscriptionDestination, LogSubscriptionDestinationConfig } from './subscription-filter';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Properties for a CrossAccountDestination
  */
@@ -93,7 +97,7 @@ export class CrossAccountDestination extends cdk.Resource implements ILogSubscri
     this.policyDocument.addStatements(statement);
   }
 
-  public bind(_scope: cdk.Construct, _sourceLogGroup: ILogGroup): LogSubscriptionDestinationConfig {
+  public bind(_scope: CoreConstruct, _sourceLogGroup: ILogGroup): LogSubscriptionDestinationConfig {
     return { arn: this.destinationArn };
   }
 
diff --git a/packages/@aws-cdk/aws-logs/lib/log-retention.ts b/packages/@aws-cdk/aws-logs/lib/log-retention.ts
index 44f36e5891cbe..4056c0a0f09c9 100644
--- a/packages/@aws-cdk/aws-logs/lib/log-retention.ts
+++ b/packages/@aws-cdk/aws-logs/lib/log-retention.ts
@@ -5,6 +5,10 @@ import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { RetentionDays } from './log-group';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Construction properties for a LogRetention.
  */
@@ -65,7 +69,7 @@ export interface LogRetentionRetryOptions {
  * Log group can be created in the region that is different from stack region by
  * specifying `logGroupRegion`
  */
-export class LogRetention extends cdk.Construct {
+export class LogRetention extends CoreConstruct {
 
   /**
    * The ARN of the LogGroup.
@@ -124,7 +128,7 @@ export class LogRetention extends cdk.Construct {
 /**
  * Private provider Lambda function to support the log retention custom resource.
  */
-class LogRetentionFunction extends cdk.Construct {
+class LogRetentionFunction extends CoreConstruct {
   public readonly functionArn: cdk.Reference;
 
   constructor(scope: Construct, id: string, props: LogRetentionProps) {
diff --git a/packages/@aws-cdk/aws-logs/package.json b/packages/@aws-cdk/aws-logs/package.json
index b412ac28e8369..696a9227a9c73 100644
--- a/packages/@aws-cdk/aws-logs/package.json
+++ b/packages/@aws-cdk/aws-logs/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -74,7 +74,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "aws-sdk-mock": "^5.1.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
diff --git a/packages/@aws-cdk/aws-macie/package.json b/packages/@aws-cdk/aws-macie/package.json
index 8e09af4e347ff..1a18787e4cafe 100644
--- a/packages/@aws-cdk/aws-macie/package.json
+++ b/packages/@aws-cdk/aws-macie/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-managedblockchain/package.json b/packages/@aws-cdk/aws-managedblockchain/package.json
index a5bda96e3e0c4..228060fe9557c 100644
--- a/packages/@aws-cdk/aws-managedblockchain/package.json
+++ b/packages/@aws-cdk/aws-managedblockchain/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-mediaconnect/package.json b/packages/@aws-cdk/aws-mediaconnect/package.json
index 7c6fa4af10a93..6c3e66059fe3e 100644
--- a/packages/@aws-cdk/aws-mediaconnect/package.json
+++ b/packages/@aws-cdk/aws-mediaconnect/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-mediaconvert/package.json b/packages/@aws-cdk/aws-mediaconvert/package.json
index 1e87cc0db2737..12a82fe01564a 100644
--- a/packages/@aws-cdk/aws-mediaconvert/package.json
+++ b/packages/@aws-cdk/aws-mediaconvert/package.json
@@ -49,8 +49,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "compat": "cdk-compat",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-medialive/package.json b/packages/@aws-cdk/aws-medialive/package.json
index 5931e3d7ed57c..6e9a1af8b717f 100644
--- a/packages/@aws-cdk/aws-medialive/package.json
+++ b/packages/@aws-cdk/aws-medialive/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-mediapackage/package.json b/packages/@aws-cdk/aws-mediapackage/package.json
index adba0df0f44f9..0f6f06b2a3cb6 100644
--- a/packages/@aws-cdk/aws-mediapackage/package.json
+++ b/packages/@aws-cdk/aws-mediapackage/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-mediastore/package.json b/packages/@aws-cdk/aws-mediastore/package.json
index ecfc189e69e82..fab9020cde940 100644
--- a/packages/@aws-cdk/aws-mediastore/package.json
+++ b/packages/@aws-cdk/aws-mediastore/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-msk/package.json b/packages/@aws-cdk/aws-msk/package.json
index af31390fd9492..d797ededb2e56 100644
--- a/packages/@aws-cdk/aws-msk/package.json
+++ b/packages/@aws-cdk/aws-msk/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-mwaa/package.json b/packages/@aws-cdk/aws-mwaa/package.json
index adc834fe5c6e2..5e22e775f3692 100644
--- a/packages/@aws-cdk/aws-mwaa/package.json
+++ b/packages/@aws-cdk/aws-mwaa/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-neptune/package.json b/packages/@aws-cdk/aws-neptune/package.json
index a8957ab3c5597..897073be25b47 100644
--- a/packages/@aws-cdk/aws-neptune/package.json
+++ b/packages/@aws-cdk/aws-neptune/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-networkfirewall/package.json b/packages/@aws-cdk/aws-networkfirewall/package.json
index 4244a68ab8977..149a6fc714f03 100644
--- a/packages/@aws-cdk/aws-networkfirewall/package.json
+++ b/packages/@aws-cdk/aws-networkfirewall/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-networkmanager/package.json b/packages/@aws-cdk/aws-networkmanager/package.json
index 6384bf99c98d3..3df03b23c2927 100644
--- a/packages/@aws-cdk/aws-networkmanager/package.json
+++ b/packages/@aws-cdk/aws-networkmanager/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-opsworks/package.json b/packages/@aws-cdk/aws-opsworks/package.json
index f4522ff87d766..22dfdf098b20d 100644
--- a/packages/@aws-cdk/aws-opsworks/package.json
+++ b/packages/@aws-cdk/aws-opsworks/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-opsworkscm/package.json b/packages/@aws-cdk/aws-opsworkscm/package.json
index 10eda477f9572..3af369621c10b 100644
--- a/packages/@aws-cdk/aws-opsworkscm/package.json
+++ b/packages/@aws-cdk/aws-opsworkscm/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-pinpoint/package.json b/packages/@aws-cdk/aws-pinpoint/package.json
index 17191f2fef2b3..2bc061cc17cce 100644
--- a/packages/@aws-cdk/aws-pinpoint/package.json
+++ b/packages/@aws-cdk/aws-pinpoint/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-pinpointemail/package.json b/packages/@aws-cdk/aws-pinpointemail/package.json
index d18a2055e9c9d..05e334ed89b5f 100644
--- a/packages/@aws-cdk/aws-pinpointemail/package.json
+++ b/packages/@aws-cdk/aws-pinpointemail/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-qldb/package.json b/packages/@aws-cdk/aws-qldb/package.json
index dc8e42e6eb538..11aac9c3847c1 100644
--- a/packages/@aws-cdk/aws-qldb/package.json
+++ b/packages/@aws-cdk/aws-qldb/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-ram/package.json b/packages/@aws-cdk/aws-ram/package.json
index f0ae21655882d..2b5fed1221d91 100644
--- a/packages/@aws-cdk/aws-ram/package.json
+++ b/packages/@aws-cdk/aws-ram/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts b/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts
index 9905362f4669a..9c2645f64ab43 100644
--- a/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts
+++ b/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts
@@ -1,10 +1,13 @@
 import * as iam from '@aws-cdk/aws-iam';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
-import * as core from '@aws-cdk/core';
 import { IEngine } from './engine';
 import { EngineVersion } from './engine-version';
 import { IParameterGroup, ParameterGroup } from './parameter-group';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * The extra options passed to the {@link IClusterEngine.bindToCluster} method.
  */
@@ -97,7 +100,7 @@ export interface IClusterEngine extends IEngine {
   /**
    * Method called when the engine is used to create a new cluster.
    */
-  bindToCluster(scope: core.Construct, options: ClusterEngineBindOptions): ClusterEngineConfig;
+  bindToCluster(scope: Construct, options: ClusterEngineBindOptions): ClusterEngineConfig;
 }
 
 interface ClusterEngineBaseProps {
@@ -130,7 +133,7 @@ abstract class ClusterEngineBase implements IClusterEngine {
     this.parameterGroupFamily = this.engineVersion ? `${this.engineType}${this.engineVersion.majorVersion}` : undefined;
   }
 
-  public bindToCluster(scope: core.Construct, options: ClusterEngineBindOptions): ClusterEngineConfig {
+  public bindToCluster(scope: Construct, options: ClusterEngineBindOptions): ClusterEngineConfig {
     const parameterGroup = options.parameterGroup ?? this.defaultParameterGroup(scope);
     return {
       parameterGroup,
@@ -144,7 +147,7 @@ abstract class ClusterEngineBase implements IClusterEngine {
    * possibly an imported one,
    * if one wasn't provided by the customer explicitly.
    */
-  protected abstract defaultParameterGroup(scope: core.Construct): IParameterGroup | undefined;
+  protected abstract defaultParameterGroup(scope: Construct): IParameterGroup | undefined;
 }
 
 interface MysqlClusterEngineBaseProps {
@@ -166,7 +169,7 @@ abstract class MySqlClusterEngineBase extends ClusterEngineBase {
     });
   }
 
-  public bindToCluster(scope: core.Construct, options: ClusterEngineBindOptions): ClusterEngineConfig {
+  public bindToCluster(scope: Construct, options: ClusterEngineBindOptions): ClusterEngineConfig {
     const config = super.bindToCluster(scope, options);
     const parameterGroup = options.parameterGroup ?? (options.s3ImportRole || options.s3ExportRole
       ? new ParameterGroup(scope, 'ClusterParameterGroup', {
@@ -271,7 +274,7 @@ class AuroraClusterEngine extends MySqlClusterEngineBase {
     });
   }
 
-  protected defaultParameterGroup(_scope: core.Construct): IParameterGroup | undefined {
+  protected defaultParameterGroup(_scope: Construct): IParameterGroup | undefined {
     // the default.aurora5.6 ParameterGroup is actually the default,
     // so just return undefined in this case
     return undefined;
@@ -380,7 +383,7 @@ class AuroraMysqlClusterEngine extends MySqlClusterEngineBase {
     });
   }
 
-  protected defaultParameterGroup(scope: core.Construct): IParameterGroup | undefined {
+  protected defaultParameterGroup(scope: Construct): IParameterGroup | undefined {
     return ParameterGroup.fromParameterGroupName(scope, 'AuroraMySqlDatabaseClusterEngineDefaultParameterGroup',
       `default.${this.parameterGroupFamily}`);
   }
@@ -536,7 +539,7 @@ class AuroraPostgresClusterEngine extends ClusterEngineBase {
     });
   }
 
-  public bindToCluster(scope: core.Construct, options: ClusterEngineBindOptions): ClusterEngineConfig {
+  public bindToCluster(scope: Construct, options: ClusterEngineBindOptions): ClusterEngineConfig {
     const config = super.bindToCluster(scope, options);
     // skip validation for unversioned as it might be supported/unsupported. we cannot reliably tell at compile-time
     if (this.engineVersion?.fullVersion) {
@@ -550,7 +553,7 @@ class AuroraPostgresClusterEngine extends ClusterEngineBase {
     return config;
   }
 
-  protected defaultParameterGroup(scope: core.Construct): IParameterGroup | undefined {
+  protected defaultParameterGroup(scope: Construct): IParameterGroup | undefined {
     if (!this.parameterGroupFamily) {
       throw new Error('Could not create a new ParameterGroup for an unversioned aurora-postgresql cluster engine. ' +
         'Please either use a versioned engine, or pass an explicit ParameterGroup when creating the cluster');
diff --git a/packages/@aws-cdk/aws-rds/lib/instance-engine.ts b/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
index f3f41a00df8b7..e2e425eb71736 100644
--- a/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
+++ b/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
@@ -1,10 +1,13 @@
 import * as iam from '@aws-cdk/aws-iam';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
-import * as core from '@aws-cdk/core';
 import { IEngine } from './engine';
 import { EngineVersion } from './engine-version';
 import { IOptionGroup, OptionGroup } from './option-group';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * The options passed to {@link IInstanceEngine.bind}.
  */
@@ -100,7 +103,7 @@ export interface IInstanceEngine extends IEngine {
   /**
    * Method called when the engine is used to create a new instance.
    */
-  bindToInstance(scope: core.Construct, options: InstanceEngineBindOptions): InstanceEngineConfig;
+  bindToInstance(scope: Construct, options: InstanceEngineBindOptions): InstanceEngineConfig;
 }
 
 interface InstanceEngineBaseProps {
@@ -134,7 +137,7 @@ abstract class InstanceEngineBase implements IInstanceEngine {
     this.engineFamily = props.engineFamily;
   }
 
-  public bindToInstance(_scope: core.Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
+  public bindToInstance(_scope: Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
     if (options.timezone && !this.supportsTimezone) {
       throw new Error(`timezone property can not be configured for ${this.engineType}`);
     }
@@ -261,7 +264,7 @@ class MariaDbInstanceEngine extends InstanceEngineBase {
     });
   }
 
-  public bindToInstance(scope: core.Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
+  public bindToInstance(scope: Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
     if (options.domain) {
       throw new Error(`domain property cannot be configured for ${this.engineType}`);
     }
@@ -828,7 +831,7 @@ abstract class OracleInstanceEngineBase extends InstanceEngineBase {
     });
   }
 
-  public bindToInstance(scope: core.Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
+  public bindToInstance(scope: Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
     const config = super.bindToInstance(scope, options);
 
     let optionGroup = options.optionGroup;
@@ -1097,7 +1100,7 @@ abstract class SqlServerInstanceEngineBase extends InstanceEngineBase {
     });
   }
 
-  public bindToInstance(scope: core.Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
+  public bindToInstance(scope: Construct, options: InstanceEngineBindOptions): InstanceEngineConfig {
     const config = super.bindToInstance(scope, options);
 
     let optionGroup = options.optionGroup;
diff --git a/packages/@aws-cdk/aws-rds/package.json b/packages/@aws-cdk/aws-rds/package.json
index 82e3e67bd09ea..dd05c7fde39f2 100644
--- a/packages/@aws-cdk/aws-rds/package.json
+++ b/packages/@aws-cdk/aws-rds/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-redshift/package.json b/packages/@aws-cdk/aws-redshift/package.json
index dd45d0f4c0984..5e706968eb432 100644
--- a/packages/@aws-cdk/aws-redshift/package.json
+++ b/packages/@aws-cdk/aws-redshift/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-resourcegroups/package.json b/packages/@aws-cdk/aws-resourcegroups/package.json
index fa6436b9696ca..85008469bb322 100644
--- a/packages/@aws-cdk/aws-resourcegroups/package.json
+++ b/packages/@aws-cdk/aws-resourcegroups/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-robomaker/package.json b/packages/@aws-cdk/aws-robomaker/package.json
index 556ab61ddf960..4cc043309bdde 100644
--- a/packages/@aws-cdk/aws-robomaker/package.json
+++ b/packages/@aws-cdk/aws-robomaker/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-route53-patterns/package.json b/packages/@aws-cdk/aws-route53-patterns/package.json
index 0390f220803d5..ec4aa0cae9eb8 100644
--- a/packages/@aws-cdk/aws-route53-patterns/package.json
+++ b/packages/@aws-cdk/aws-route53-patterns/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-route53-targets/package.json b/packages/@aws-cdk/aws-route53-targets/package.json
index c106bcdfec9d2..0356465db442f 100644
--- a/packages/@aws-cdk/aws-route53-targets/package.json
+++ b/packages/@aws-cdk/aws-route53-targets/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-route53/package.json b/packages/@aws-cdk/aws-route53/package.json
index 27f771de7a6db..5d3e45c16ef99 100644
--- a/packages/@aws-cdk/aws-route53/package.json
+++ b/packages/@aws-cdk/aws-route53/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -74,7 +74,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-route53resolver/README.md b/packages/@aws-cdk/aws-route53resolver/README.md
index f6eea77064f22..9cf4ab7748b3d 100644
--- a/packages/@aws-cdk/aws-route53resolver/README.md
+++ b/packages/@aws-cdk/aws-route53resolver/README.md
@@ -9,14 +9,6 @@
 >
 > [CFN Resources]: https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib
 
-![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)
-
-> The APIs of higher level constructs in this module are experimental and under active development.
-> They are subject to non-backward compatible changes or removal in any future version. These are
-> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
-> announced in the release notes. This means that while you may use them, you may need to update
-> your source code when upgrading to a newer version of this package.
-
 ---
 
 <!--END STABILITY BANNER-->
diff --git a/packages/@aws-cdk/aws-route53resolver/package.json b/packages/@aws-cdk/aws-route53resolver/package.json
index 027c64fba0408..743274a312208 100644
--- a/packages/@aws-cdk/aws-route53resolver/package.json
+++ b/packages/@aws-cdk/aws-route53resolver/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -91,7 +91,7 @@
     "node": ">= 10.13.0 <13 || >=13.7.0"
   },
   "stability": "experimental",
-  "maturity": "experimental",
+  "maturity": "cfn-only",
   "awscdkio": {
     "announce": false
   }
diff --git a/packages/@aws-cdk/aws-s3-assets/lib/asset.ts b/packages/@aws-cdk/aws-s3-assets/lib/asset.ts
index cc730b82170de..938778d1381f4 100644
--- a/packages/@aws-cdk/aws-s3-assets/lib/asset.ts
+++ b/packages/@aws-cdk/aws-s3-assets/lib/asset.ts
@@ -9,6 +9,10 @@ import * as cxapi from '@aws-cdk/cx-api';
 import { Construct } from 'constructs';
 import { toSymlinkFollow } from './compat';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 const ARCHIVE_EXTENSIONS = ['.zip', '.jar'];
 
 export interface AssetOptions extends assets.CopyOptions, cdk.AssetOptions {
@@ -54,7 +58,7 @@ export interface AssetProps extends AssetOptions {
  * An asset represents a local file or directory, which is automatically uploaded to S3
  * and then can be referenced within a CDK application.
  */
-export class Asset extends cdk.Construct implements cdk.IAsset {
+export class Asset extends CoreConstruct implements cdk.IAsset {
   /**
    * Attribute that represents the name of the bucket this asset exists in.
    */
diff --git a/packages/@aws-cdk/aws-s3-assets/package.json b/packages/@aws-cdk/aws-s3-assets/package.json
index d85639e72166b..ab689b0ec2663 100644
--- a/packages/@aws-cdk/aws-s3-assets/package.json
+++ b/packages/@aws-cdk/aws-s3-assets/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-s3-deployment/README.md b/packages/@aws-cdk/aws-s3-deployment/README.md
index 2509372e55c11..eb8a4d4a08a7c 100644
--- a/packages/@aws-cdk/aws-s3-deployment/README.md
+++ b/packages/@aws-cdk/aws-s3-deployment/README.md
@@ -90,7 +90,7 @@ based on file extensions:
 
 ```ts
 new BucketDeployment(this, 'BucketDeployment', {
-  sources: [Source.asset('./website', { exclude: ['index.html' })],
+  sources: [Source.asset('./website', { exclude: ['index.html'] })],
   destinationBucket: bucket,
   cacheControl: [CacheControl.fromString('max-age=31536000,public,immutable')],
   prune: false,
diff --git a/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts b/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts
index 352f350b91600..9e1c20ae02ef7 100644
--- a/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts
+++ b/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts
@@ -9,6 +9,10 @@ import { AwsCliLayer } from '@aws-cdk/lambda-layer-awscli';
 import { Construct } from 'constructs';
 import { ISource, SourceConfig } from './source';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 export interface BucketDeploymentProps {
   /**
    * The sources from which to deploy the contents of this bucket.
@@ -175,7 +179,7 @@ export interface BucketDeploymentProps {
   readonly vpcSubnets?: ec2.SubnetSelection;
 }
 
-export class BucketDeployment extends cdk.Construct {
+export class BucketDeployment extends CoreConstruct {
   constructor(scope: Construct, id: string, props: BucketDeploymentProps) {
     super(scope, id);
 
diff --git a/packages/@aws-cdk/aws-s3-deployment/lib/lambda/index.py b/packages/@aws-cdk/aws-s3-deployment/lib/lambda/index.py
index 34a2da1681f4d..bf16d84608517 100644
--- a/packages/@aws-cdk/aws-s3-deployment/lib/lambda/index.py
+++ b/packages/@aws-cdk/aws-s3-deployment/lib/lambda/index.py
@@ -7,10 +7,11 @@
 import logging
 import shutil
 import boto3
+import contextlib
 from datetime import datetime
 from uuid import uuid4
 
-from botocore.vendored import requests
+from urllib.request import Request, urlopen
 from zipfile import ZipFile
 
 logger = logging.getLogger()
@@ -212,8 +213,9 @@ def cfn_send(event, context, responseStatus, responseData={}, physicalResourceId
     }
 
     try:
-        response = requests.put(responseUrl, data=body, headers=headers)
-        logger.info("| status code: " + response.reason)
+        request = Request(responseUrl, method='PUT', data=bytes(body.encode('utf-8')), headers=headers)
+        with contextlib.closing(urlopen(request)) as response:
+          logger.info("| status code: " + response.reason)
     except Exception as e:
         logger.error("| unable to send response to CloudFormation")
         logger.exception(e)
diff --git a/packages/@aws-cdk/aws-s3-deployment/lib/source.ts b/packages/@aws-cdk/aws-s3-deployment/lib/source.ts
index 6f0f877662891..558c32556c25c 100644
--- a/packages/@aws-cdk/aws-s3-deployment/lib/source.ts
+++ b/packages/@aws-cdk/aws-s3-deployment/lib/source.ts
@@ -1,7 +1,10 @@
 import * as iam from '@aws-cdk/aws-iam';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as s3_assets from '@aws-cdk/aws-s3-assets';
-import * as cdk from '@aws-cdk/core';
+
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
 
 export interface SourceConfig {
   /**
@@ -33,7 +36,7 @@ export interface ISource {
    * Binds the source to a bucket deployment.
    * @param scope The construct tree context.
    */
-  bind(scope: cdk.Construct, context?: DeploymentSourceContext): SourceConfig;
+  bind(scope: Construct, context?: DeploymentSourceContext): SourceConfig;
 }
 
 /**
@@ -54,7 +57,7 @@ export class Source {
    */
   public static bucket(bucket: s3.IBucket, zipObjectKey: string): ISource {
     return {
-      bind: (_: cdk.Construct, context?: DeploymentSourceContext) => {
+      bind: (_: Construct, context?: DeploymentSourceContext) => {
         if (!context) {
           throw new Error('To use a Source.bucket(), context must be provided');
         }
@@ -71,7 +74,7 @@ export class Source {
    */
   public static asset(path: string, options?: s3_assets.AssetOptions): ISource {
     return {
-      bind(scope: cdk.Construct, context?: DeploymentSourceContext): SourceConfig {
+      bind(scope: Construct, context?: DeploymentSourceContext): SourceConfig {
         if (!context) {
           throw new Error('To use a Source.asset(), context must be provided');
         }
diff --git a/packages/@aws-cdk/aws-s3-deployment/package.json b/packages/@aws-cdk/aws-s3-deployment/package.json
index fc802538bb33f..e342c0e7bac08 100644
--- a/packages/@aws-cdk/aws-s3-deployment/package.json
+++ b/packages/@aws-cdk/aws-s3-deployment/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.expected.json b/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.expected.json
index aa8c7fddd60c7..3e138f405e0d6 100644
--- a/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.expected.json
+++ b/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.expected.json
@@ -295,7 +295,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3Bucket28CE5152"
+            "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3BucketFD1BBE00"
           },
           "S3Key": {
             "Fn::Join": [
@@ -308,7 +308,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED"
+                          "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76"
                         }
                       ]
                     }
@@ -321,7 +321,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED"
+                          "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76"
                         }
                       ]
                     }
@@ -331,19 +331,19 @@
             ]
           }
         },
-        "Handler": "index.handler",
         "Role": {
           "Fn::GetAtt": [
             "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
             "Arn"
           ]
         },
-        "Runtime": "python3.6",
+        "Handler": "index.handler",
         "Layers": [
           {
             "Ref": "DeployWithInvalidationAwsCliLayerDEDD5787"
           }
         ],
+        "Runtime": "python3.6",
         "Timeout": 900
       },
       "DependsOn": [
@@ -365,17 +365,17 @@
       "Type": "String",
       "Description": "Artifact hash for asset \"e9882ab123687399f934da0d45effe675ecc8ce13b40cb946f3e1d6141fe8d68\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3Bucket28CE5152": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3BucketFD1BBE00": {
       "Type": "String",
-      "Description": "S3 bucket for asset \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "S3 bucket for asset \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76": {
       "Type": "String",
-      "Description": "S3 key for asset version \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "S3 key for asset version \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7ArtifactHash8926088E": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aArtifactHash595EC1E7": {
       "Type": "String",
-      "Description": "Artifact hash for asset \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "Artifact hash for asset \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
     "AssetParametersfc4481abf279255619ff7418faa5d24456fef3432ea0da59c95542578ff0222eS3Bucket9CD8B20A": {
       "Type": "String",
diff --git a/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment.expected.json b/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment.expected.json
index 267c6eaa23476..9d52b89269f5a 100644
--- a/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment.expected.json
+++ b/packages/@aws-cdk/aws-s3-deployment/test/integ.bucket-deployment.expected.json
@@ -304,7 +304,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3Bucket28CE5152"
+            "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3BucketFD1BBE00"
           },
           "S3Key": {
             "Fn::Join": [
@@ -317,7 +317,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED"
+                          "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76"
                         }
                       ]
                     }
@@ -330,7 +330,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED"
+                          "Ref": "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76"
                         }
                       ]
                     }
@@ -340,19 +340,19 @@
             ]
           }
         },
-        "Handler": "index.handler",
         "Role": {
           "Fn::GetAtt": [
             "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
             "Arn"
           ]
         },
-        "Runtime": "python3.6",
+        "Handler": "index.handler",
         "Layers": [
           {
             "Ref": "DeployMeAwsCliLayer5F9219E9"
           }
         ],
+        "Runtime": "python3.6",
         "Timeout": 900
       },
       "DependsOn": [
@@ -700,17 +700,17 @@
       "Type": "String",
       "Description": "Artifact hash for asset \"e9882ab123687399f934da0d45effe675ecc8ce13b40cb946f3e1d6141fe8d68\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3Bucket28CE5152": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3BucketFD1BBE00": {
       "Type": "String",
-      "Description": "S3 bucket for asset \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "S3 bucket for asset \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7S3VersionKeyAF6E05ED": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aS3VersionKey6E54DC76": {
       "Type": "String",
-      "Description": "S3 key for asset version \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "S3 key for asset version \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
-    "AssetParameters3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7ArtifactHash8926088E": {
+    "AssetParameters8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59aArtifactHash595EC1E7": {
       "Type": "String",
-      "Description": "Artifact hash for asset \"3c3ed777478fe845fb5950df5e26461242b39cf220f00e0683aab244d9d7c0f7\""
+      "Description": "Artifact hash for asset \"8bda025b845a88fbeb54ef75e52048aa9f3378463116cb413f12f6014673a59a\""
     },
     "AssetParametersfc4481abf279255619ff7418faa5d24456fef3432ea0da59c95542578ff0222eS3Bucket9CD8B20A": {
       "Type": "String",
diff --git a/packages/@aws-cdk/aws-s3-deployment/test/lambda/test.py b/packages/@aws-cdk/aws-s3-deployment/test/lambda/test.py
index cd88eaf6a5269..fcd79f18af4d5 100644
--- a/packages/@aws-cdk/aws-s3-deployment/test/lambda/test.py
+++ b/packages/@aws-cdk/aws-s3-deployment/test/lambda/test.py
@@ -425,7 +425,7 @@ def read_aws_out():
 #   resourceProps: map to pass to "ResourceProperties"
 #   expected_status: "SUCCESS" or "FAILED"
 def invoke_handler(requestType, resourceProps, old_resource_props=None, physical_id=None, expected_status='SUCCESS'):
-    response_url = '<response-url>'
+    response_url = 'http://<response-url>'
 
     event={
         'ResponseURL': response_url,
@@ -443,25 +443,33 @@ def invoke_handler(requestType, resourceProps, old_resource_props=None, physical
         event['PhysicalResourceId'] = physical_id
 
     class ContextMock: log_stream_name = 'log_stream'
-    class ResponseMock: reason = 'OK'
+    class ResponseMock:
+      reason = 'OK'
+      # needed because the context manager calls this
+      close = lambda _: _
 
     context = ContextMock()
-    requests.put = MagicMock(return_value=ResponseMock())
+    index.urlopen = MagicMock(return_value=ResponseMock())
 
     #--------------------
     # invoke the handler
     #--------------------
     index.handler(event, context)
 
-    requests.put.assert_called_once()
-    (pos_args, kw_args) = requests.put.call_args
+    index.urlopen.assert_called_once()
+    (pos_args, _) = index.urlopen.call_args
 
-    actual_url = pos_args[0]
-    actual_data = kw_args['data']
+    actual_request = pos_args[0]
+    actual_url = actual_request.full_url
+    actual_data = actual_request.data
+    actual_method = actual_request.method
 
     if actual_url != response_url:
         raise Exception("Invalid url used for sending CFN response. expected=%s actual=%s" % (response_url, actual_url))
 
+    if actual_method != 'PUT':
+        raise Exception("Invalid method used for sending CFN response. expected=PUT actual=%s" % (actual_method,))
+
     resp = json.loads(actual_data)
 
     def assert_field(name, expect=None):
diff --git a/packages/@aws-cdk/aws-s3-notifications/package.json b/packages/@aws-cdk/aws-s3-notifications/package.json
index 5615003d2434a..18ef7a665783f 100644
--- a/packages/@aws-cdk/aws-s3-notifications/package.json
+++ b/packages/@aws-cdk/aws-s3-notifications/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-s3/README.md b/packages/@aws-cdk/aws-s3/README.md
index a81b67e2b7bb4..1ce00f56ba0a9 100644
--- a/packages/@aws-cdk/aws-s3/README.md
+++ b/packages/@aws-cdk/aws-s3/README.md
@@ -64,6 +64,19 @@ const bucket = new Bucket(this, 'MyEncryptedBucket', {
 assert(bucket.encryptionKey === myKmsKey);
 ```
 
+Enable KMS-SSE encryption via [S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html):
+
+```ts
+const myKmsKey = new kms.Key(this, 'MyKey');
+
+const bucket = new Bucket(this, 'MyEncryptedBucket', {
+    encryption: BucketEncryption.KMS,
+    bucketKeyEnabled: true
+});
+
+assert(bucket.bucketKeyEnabled === true);
+```
+
 Use `BucketEncryption.ManagedKms` to use the S3 master KMS key:
 
 ```ts
diff --git a/packages/@aws-cdk/aws-s3/lib/bucket.ts b/packages/@aws-cdk/aws-s3/lib/bucket.ts
index 811acbe631067..5c5abfbfec559 100644
--- a/packages/@aws-cdk/aws-s3/lib/bucket.ts
+++ b/packages/@aws-cdk/aws-s3/lib/bucket.ts
@@ -1064,6 +1064,16 @@ export interface BucketProps {
    */
   readonly encryptionKey?: kms.IKey;
 
+  /**
+   * Specifies whether Amazon S3 should use an S3 Bucket Key with server-side
+   * encryption using KMS (SSE-KMS) for new objects in the bucket.
+   *
+   * Only relevant, when Encryption is set to {@link BucketEncryption.KMS}
+   *
+   * @default - false
+   */
+  readonly bucketKeyEnabled?: boolean;
+
   /**
    * Physical name of this bucket.
    *
@@ -1533,6 +1543,11 @@ export class Bucket extends BucketBase {
       throw new Error(`encryptionKey is specified, so 'encryption' must be set to KMS (value: ${encryptionType})`);
     }
 
+    // if bucketKeyEnabled is set, encryption must be set to KMS.
+    if (props.bucketKeyEnabled && encryptionType !== BucketEncryption.KMS) {
+      throw new Error(`bucketKeyEnabled is specified, so 'encryption' must be set to KMS (value: ${encryptionType})`);
+    }
+
     if (encryptionType === BucketEncryption.UNENCRYPTED) {
       return { bucketEncryption: undefined, encryptionKey: undefined };
     }
@@ -1545,6 +1560,7 @@ export class Bucket extends BucketBase {
       const bucketEncryption = {
         serverSideEncryptionConfiguration: [
           {
+            bucketKeyEnabled: props.bucketKeyEnabled,
             serverSideEncryptionByDefault: {
               sseAlgorithm: 'aws:kms',
               kmsMasterKeyId: encryptionKey.keyArn,
diff --git a/packages/@aws-cdk/aws-s3/lib/destination.ts b/packages/@aws-cdk/aws-s3/lib/destination.ts
index 31a7ac94ef9ac..021aa80a803c4 100644
--- a/packages/@aws-cdk/aws-s3/lib/destination.ts
+++ b/packages/@aws-cdk/aws-s3/lib/destination.ts
@@ -1,6 +1,10 @@
 import * as cdk from '@aws-cdk/core';
 import { IBucket } from './bucket';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Implemented by constructs that can be used as bucket notification destinations.
  */
@@ -12,7 +16,7 @@ export interface IBucketNotificationDestination {
    * idempotency in each destination.
    * @param bucket The bucket object to bind to
    */
-  bind(scope: cdk.Construct, bucket: IBucket): BucketNotificationDestinationConfig;
+  bind(scope: Construct, bucket: IBucket): BucketNotificationDestinationConfig;
 }
 
 /**
diff --git a/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts b/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts
index 4ceced2e93e2d..cd7427a5cbc6f 100644
--- a/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts
+++ b/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts
@@ -1,6 +1,10 @@
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * A Lambda-based custom resource handler that provisions S3 bucket
  * notifications for a bucket.
@@ -18,14 +22,14 @@ import * as cdk from '@aws-cdk/core';
  * Sadly, we can't use @aws-cdk/aws-lambda as it will introduce a dependency
  * cycle, so this uses raw `cdk.Resource`s.
  */
-export class NotificationsResourceHandler extends cdk.Construct {
+export class NotificationsResourceHandler extends Construct {
   /**
    * Defines a stack-singleton lambda function with the logic for a CloudFormation custom
    * resource that provisions bucket notification configuration for a bucket.
    *
    * @returns The ARN of the custom resource lambda function.
    */
-  public static singleton(context: cdk.Construct) {
+  public static singleton(context: Construct) {
     const root = cdk.Stack.of(context);
 
     // well-known logical id to ensure stack singletonity
@@ -44,7 +48,7 @@ export class NotificationsResourceHandler extends cdk.Construct {
    */
   public readonly functionArn: string;
 
-  constructor(scope: cdk.Construct, id: string) {
+  constructor(scope: Construct, id: string) {
     super(scope, id);
 
     const role = new iam.Role(this, 'Role', {
diff --git a/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource.ts b/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource.ts
index 91bb688b28857..3c2194ddf7eb9 100644
--- a/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource.ts
+++ b/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource.ts
@@ -3,6 +3,10 @@ import { Bucket, EventType, NotificationKeyFilter } from '../bucket';
 import { BucketNotificationDestinationType, IBucketNotificationDestination } from '../destination';
 import { NotificationsResourceHandler } from './notifications-resource-handler';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 interface NotificationsProps {
   /**
    * The bucket to manage notifications for.
@@ -28,14 +32,14 @@ interface NotificationsProps {
  * @see
  * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-notificationconfig.html
  */
-export class BucketNotifications extends cdk.Construct {
+export class BucketNotifications extends Construct {
   private readonly lambdaNotifications = new Array<LambdaFunctionConfiguration>();
   private readonly queueNotifications = new Array<QueueConfiguration>();
   private readonly topicNotifications = new Array<TopicConfiguration>();
   private resource?: cdk.CfnResource;
   private readonly bucket: Bucket;
 
-  constructor(scope: cdk.Construct, id: string, props: NotificationsProps) {
+  constructor(scope: Construct, id: string, props: NotificationsProps) {
     super(scope, id);
     this.bucket = props.bucket;
   }
diff --git a/packages/@aws-cdk/aws-s3/package.json b/packages/@aws-cdk/aws-s3/package.json
index 8adbd67cf204b..06fd2e61fb7ee 100644
--- a/packages/@aws-cdk/aws-s3/package.json
+++ b/packages/@aws-cdk/aws-s3/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-s3/test/bucket.test.ts b/packages/@aws-cdk/aws-s3/test/bucket.test.ts
index cb9202b28cfd7..0d4e5b03f8258 100644
--- a/packages/@aws-cdk/aws-s3/test/bucket.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/bucket.test.ts
@@ -335,6 +335,45 @@ nodeunitShim({
     test.done();
   },
 
+  'bucketKeyEnabled can be enabled'(test: Test) {
+    const stack = new cdk.Stack();
+
+    new s3.Bucket(stack, 'MyBucket', { bucketKeyEnabled: true, encryption: s3.BucketEncryption.KMS });
+
+    expect(stack).to(haveResource('AWS::S3::Bucket', {
+      'BucketEncryption': {
+        'ServerSideEncryptionConfiguration': [
+          {
+            'BucketKeyEnabled': true,
+            'ServerSideEncryptionByDefault': {
+              'KMSMasterKeyID': {
+                'Fn::GetAtt': [
+                  'MyBucketKeyC17130CF',
+                  'Arn',
+                ],
+              },
+              'SSEAlgorithm': 'aws:kms',
+            },
+          },
+        ],
+      },
+    }),
+    );
+    test.done();
+  },
+
+  'throws error if bucketKeyEnabled is set, but encryption is not KMS'(test: Test) {
+    const stack = new cdk.Stack();
+
+    test.throws(() => {
+      new s3.Bucket(stack, 'MyBucket', { bucketKeyEnabled: true, encryption: s3.BucketEncryption.S3_MANAGED });
+    }, "bucketKeyEnabled is specified, so 'encryption' must be set to KMS (value: S3MANAGED)");
+    test.throws(() => {
+      new s3.Bucket(stack, 'MyBucket3', { bucketKeyEnabled: true });
+    }, "bucketKeyEnabled is specified, so 'encryption' must be set to KMS (value: NONE)");
+    test.done();
+  },
+
   'bucket with versioning turned on'(test: Test) {
     const stack = new cdk.Stack();
     new s3.Bucket(stack, 'MyBucket', {
diff --git a/packages/@aws-cdk/aws-sagemaker/package.json b/packages/@aws-cdk/aws-sagemaker/package.json
index a88ab5c1bd71f..af213ca7042fb 100644
--- a/packages/@aws-cdk/aws-sagemaker/package.json
+++ b/packages/@aws-cdk/aws-sagemaker/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-sam/package.json b/packages/@aws-cdk/aws-sam/package.json
index 05e50e259af14..1e45a9d01c5f8 100644
--- a/packages/@aws-cdk/aws-sam/package.json
+++ b/packages/@aws-cdk/aws-sam/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-sdb/package.json b/packages/@aws-cdk/aws-sdb/package.json
index 8168f1103341d..f65aaf343704d 100644
--- a/packages/@aws-cdk/aws-sdb/package.json
+++ b/packages/@aws-cdk/aws-sdb/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-secretsmanager/package.json b/packages/@aws-cdk/aws-secretsmanager/package.json
index 1a95dd50304ea..dfe117941fe88 100644
--- a/packages/@aws-cdk/aws-secretsmanager/package.json
+++ b/packages/@aws-cdk/aws-secretsmanager/package.json
@@ -48,8 +48,8 @@
     "watch": "cdk-watch",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-securityhub/package.json b/packages/@aws-cdk/aws-securityhub/package.json
index 9df5bf63185d8..b86e28a98e270 100644
--- a/packages/@aws-cdk/aws-securityhub/package.json
+++ b/packages/@aws-cdk/aws-securityhub/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-servicecatalog/package.json b/packages/@aws-cdk/aws-servicecatalog/package.json
index 5ef00dcabb7a7..1902aabcf8f42 100644
--- a/packages/@aws-cdk/aws-servicecatalog/package.json
+++ b/packages/@aws-cdk/aws-servicecatalog/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-servicediscovery/package.json b/packages/@aws-cdk/aws-servicediscovery/package.json
index 015947a58bb1d..307eb32d53ff2 100644
--- a/packages/@aws-cdk/aws-servicediscovery/package.json
+++ b/packages/@aws-cdk/aws-servicediscovery/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-ses-actions/package.json b/packages/@aws-cdk/aws-ses-actions/package.json
index e4df395348e5f..bd2b2192c3d06 100644
--- a/packages/@aws-cdk/aws-ses-actions/package.json
+++ b/packages/@aws-cdk/aws-ses-actions/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-ses/package.json b/packages/@aws-cdk/aws-ses/package.json
index f29ccc17ef855..1b0015e46581c 100644
--- a/packages/@aws-cdk/aws-ses/package.json
+++ b/packages/@aws-cdk/aws-ses/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-signer/package.json b/packages/@aws-cdk/aws-signer/package.json
index bb5c296cadd90..a0ea5cc0b1502 100644
--- a/packages/@aws-cdk/aws-signer/package.json
+++ b/packages/@aws-cdk/aws-signer/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-sns-subscriptions/package.json b/packages/@aws-cdk/aws-sns-subscriptions/package.json
index b85a01df97cff..4eccef7cdece3 100644
--- a/packages/@aws-cdk/aws-sns-subscriptions/package.json
+++ b/packages/@aws-cdk/aws-sns-subscriptions/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-sns/package.json b/packages/@aws-cdk/aws-sns/package.json
index 78cfb62f21572..26e2cd8b2676d 100644
--- a/packages/@aws-cdk/aws-sns/package.json
+++ b/packages/@aws-cdk/aws-sns/package.json
@@ -50,8 +50,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-sqs/package.json b/packages/@aws-cdk/aws-sqs/package.json
index a434141cd88bf..df347c5711cdb 100644
--- a/packages/@aws-cdk/aws-sqs/package.json
+++ b/packages/@aws-cdk/aws-sqs/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -75,7 +75,7 @@
     "@aws-cdk/assert": "0.0.0",
     "@aws-cdk/aws-s3": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/aws-ssm/package.json b/packages/@aws-cdk/aws-ssm/package.json
index fb09f06f706ea..449b33b312a75 100644
--- a/packages/@aws-cdk/aws-ssm/package.json
+++ b/packages/@aws-cdk/aws-ssm/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-sso/package.json b/packages/@aws-cdk/aws-sso/package.json
index 4f76a5ae2eebf..4719e337623fc 100644
--- a/packages/@aws-cdk/aws-sso/package.json
+++ b/packages/@aws-cdk/aws-sso/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/package.json b/packages/@aws-cdk/aws-stepfunctions-tasks/package.json
index f75318aaa786e..7dc4c3cd59fa9 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/package.json
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-stepfunctions/lib/state-machine-fragment.ts b/packages/@aws-cdk/aws-stepfunctions/lib/state-machine-fragment.ts
index 929aed5b22219..0103ceb735499 100644
--- a/packages/@aws-cdk/aws-stepfunctions/lib/state-machine-fragment.ts
+++ b/packages/@aws-cdk/aws-stepfunctions/lib/state-machine-fragment.ts
@@ -1,13 +1,16 @@
-import * as cdk from '@aws-cdk/core';
 import { Chain } from './chain';
 import { Parallel, ParallelProps } from './states/parallel';
 import { State } from './states/state';
 import { IChainable, INextable } from './types';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 /**
  * Base class for reusable state machine fragments
  */
-export abstract class StateMachineFragment extends cdk.Construct implements IChainable {
+export abstract class StateMachineFragment extends Construct implements IChainable {
   /**
    * The start state of this state machine fragment
    */
diff --git a/packages/@aws-cdk/aws-stepfunctions/lib/states/state.ts b/packages/@aws-cdk/aws-stepfunctions/lib/states/state.ts
index c43a7bec159a8..02cceb6e64ed2 100644
--- a/packages/@aws-cdk/aws-stepfunctions/lib/states/state.ts
+++ b/packages/@aws-cdk/aws-stepfunctions/lib/states/state.ts
@@ -1,10 +1,13 @@
-import * as cdk from '@aws-cdk/core';
 import { IConstruct, Construct, Node } from 'constructs';
 import { Condition } from '../condition';
 import { JsonPath } from '../fields';
 import { StateGraph } from '../state-graph';
 import { CatchProps, Errors, IChainable, INextable, RetryProps } from '../types';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Properties shared by all states
  */
@@ -60,7 +63,7 @@ export interface StateProps {
 /**
  * Base class for all other state classes
  */
-export abstract class State extends cdk.Construct implements IChainable {
+export abstract class State extends CoreConstruct implements IChainable {
   /**
    * Add a prefix to the stateId of all States found in a construct tree
    */
diff --git a/packages/@aws-cdk/aws-stepfunctions/package.json b/packages/@aws-cdk/aws-stepfunctions/package.json
index 99ee2dc7cd54b..b0a08b54972bb 100644
--- a/packages/@aws-cdk/aws-stepfunctions/package.json
+++ b/packages/@aws-cdk/aws-stepfunctions/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-synthetics/package.json b/packages/@aws-cdk/aws-synthetics/package.json
index 8bc88c9255af5..e88fbe186cbd5 100644
--- a/packages/@aws-cdk/aws-synthetics/package.json
+++ b/packages/@aws-cdk/aws-synthetics/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-timestream/package.json b/packages/@aws-cdk/aws-timestream/package.json
index ff6007132dde1..8eeb152afe4e0 100644
--- a/packages/@aws-cdk/aws-timestream/package.json
+++ b/packages/@aws-cdk/aws-timestream/package.json
@@ -48,8 +48,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-transfer/package.json b/packages/@aws-cdk/aws-transfer/package.json
index 5a0bcb7f1af22..3cdc3f206a1ac 100644
--- a/packages/@aws-cdk/aws-transfer/package.json
+++ b/packages/@aws-cdk/aws-transfer/package.json
@@ -48,8 +48,8 @@
     "test": "cdk-test",
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-waf/package.json b/packages/@aws-cdk/aws-waf/package.json
index da6a5bc924640..52f325e4f8f5f 100644
--- a/packages/@aws-cdk/aws-waf/package.json
+++ b/packages/@aws-cdk/aws-waf/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-wafregional/package.json b/packages/@aws-cdk/aws-wafregional/package.json
index 2998384321b50..3c735b980022a 100644
--- a/packages/@aws-cdk/aws-wafregional/package.json
+++ b/packages/@aws-cdk/aws-wafregional/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/aws-wafv2/package.json b/packages/@aws-cdk/aws-wafv2/package.json
index 5b56ccc49ed01..12c7ab0666082 100644
--- a/packages/@aws-cdk/aws-wafv2/package.json
+++ b/packages/@aws-cdk/aws-wafv2/package.json
@@ -49,8 +49,8 @@
     "watch": "cdk-watch",
     "cfn2ts": "cfn2ts",
     "compat": "cdk-compat",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/aws-workspaces/package.json b/packages/@aws-cdk/aws-workspaces/package.json
index 0aeb68a97a6bf..84a9dd5d532f6 100644
--- a/packages/@aws-cdk/aws-workspaces/package.json
+++ b/packages/@aws-cdk/aws-workspaces/package.json
@@ -47,8 +47,8 @@
     "package": "cdk-package",
     "awslint": "cdk-awslint",
     "cfn2ts": "cfn2ts",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
diff --git a/packages/@aws-cdk/cdk-assets-schema/package.json b/packages/@aws-cdk/cdk-assets-schema/package.json
index 8945cd066da2c..feb799a8228bf 100644
--- a/packages/@aws-cdk/cdk-assets-schema/package.json
+++ b/packages/@aws-cdk/cdk-assets-schema/package.json
@@ -40,8 +40,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/cloud-assembly-schema/package.json b/packages/@aws-cdk/cloud-assembly-schema/package.json
index f14d8ad679b71..01228556bc97d 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/package.json
+++ b/packages/@aws-cdk/cloud-assembly-schema/package.json
@@ -47,8 +47,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "update-schema": "bash scripts/update-schema.sh",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -66,7 +66,7 @@
     "jest": "^26.6.3",
     "mock-fs": "^4.13.0",
     "pkglint": "0.0.0",
-    "typescript-json-schema": "^0.46.0"
+    "typescript-json-schema": "^0.47.0"
   },
   "repository": {
     "url": "https://github.com/aws/aws-cdk.git",
diff --git a/packages/@aws-cdk/cloudformation-diff/package.json b/packages/@aws-cdk/cloudformation-diff/package.json
index 7179ae4210672..089a802613048 100644
--- a/packages/@aws-cdk/cloudformation-diff/package.json
+++ b/packages/@aws-cdk/cloudformation-diff/package.json
@@ -11,8 +11,8 @@
     "test": "cdk-test",
     "pkglint": "pkglint -f",
     "package": "cdk-package",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test"
   },
   "author": {
     "name": "Amazon Web Services",
diff --git a/packages/@aws-cdk/cloudformation-include/package.json b/packages/@aws-cdk/cloudformation-include/package.json
index f147414a93354..d78fc778b3fa5 100644
--- a/packages/@aws-cdk/cloudformation-include/package.json
+++ b/packages/@aws-cdk/cloudformation-include/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/core/lib/cfn-fn.ts b/packages/@aws-cdk/core/lib/cfn-fn.ts
index 27cadbc99cc51..d8a871ca478e1 100644
--- a/packages/@aws-cdk/core/lib/cfn-fn.ts
+++ b/packages/@aws-cdk/core/lib/cfn-fn.ts
@@ -55,22 +55,69 @@ export class Fn {
   }
 
   /**
-   * To split a string into a list of string values so that you can select an element from the
-   * resulting string list, use the ``Fn::Split`` intrinsic function. Specify the location of splits
-   * with a delimiter, such as , (a comma). After you split a string, use the ``Fn::Select`` function
-   * to pick a specific element.
+   * Split a string token into a token list of string values.
+   *
+   * Specify the location of splits with a delimiter such as ',' (a comma).
+   * Renders to the `Fn::Split` intrinsic function.
+   *
+   * Lists with unknown lengths (default)
+   * -------------------------------------
+   *
+   * Since this function is used to work with deploy-time values, if `assumedLength`
+   * is not given the CDK cannot know the length of the resulting list at synthesis time.
+   * This brings the following restrictions:
+   *
+   * - You must use `Fn.select(i, list)` to pick elements out of the list (you must not use
+   *   `list[i]`).
+   * - You cannot add elements to the list, remove elements from the list,
+   *   combine two such lists together, or take a slice of the list.
+   * - You cannot pass the list to constructs that do any of the above.
+   *
+   * The only valid operation with such a tokenized list is to pass it unmodified to a
+   * CloudFormation Resource construct.
+   *
+   * Lists with assumed lengths
+   * --------------------------
+   *
+   * Pass `assumedLength` if you know the length of the list that will be
+   * produced by splitting. The actual list length at deploy time may be
+   * *longer* than the number you pass, but not *shorter*.
+   *
+   * The returned list will look like:
+   *
+   * ```
+   * [Fn.select(0, split), Fn.select(1, split), Fn.select(2, split), ...]
+   * ```
+   *
+   * The restrictions from the section "Lists with unknown lengths" will now be lifted,
+   * at the expense of having to know and fix the length of the list.
+   *
    * @param delimiter A string value that determines where the source string is divided.
    * @param source The string value that you want to split.
+   * @param assumedLength The length of the list that will be produced by splitting
    * @returns a token represented as a string array
    */
-  public static split(delimiter: string, source: string): string[] {
-
+  public static split(delimiter: string, source: string, assumedLength?: number): string[] {
     // short-circut if source is not a token
     if (!Token.isUnresolved(source)) {
       return source.split(delimiter);
     }
 
-    return Token.asList(new FnSplit(delimiter, source));
+    if (Token.isUnresolved(delimiter)) {
+      // Limitation of CloudFormation
+      throw new Error('Fn.split: \'delimiter\' may not be a token value');
+    }
+
+    const split = Token.asList(new FnSplit(delimiter, source));
+    if (assumedLength === undefined) {
+      return split;
+    }
+
+    if (Token.isUnresolved(assumedLength)) {
+      throw new Error('Fn.split: \'assumedLength\' may not be a token value');
+    }
+
+    return range(assumedLength).map(i => Fn.select(i, split));
   }
 
   /**
@@ -167,6 +214,21 @@ export class Fn {
     return new FnImportValue(sharedValueToImport).toString();
   }
 
+  /**
+   * Like `Fn.importValue`, but import a list with a known length
+   *
+   * If you explicitly want a list with an unknown length, call `Fn.split(',',
+   * Fn.importValue(exportName))`. See the documentation of `Fn.split` to read
+   * more about the limitations of using lists of unknown length.
+   *
+   * `Fn.importListValue(exportName, assumedLength)` is the same as
+   * `Fn.split(',', Fn.importValue(exportName), assumedLength)`,
+   * but easier to read and impossible to forget to pass `assumedLength`.
+   */
+  public static importListValue(sharedValueToImport: string, assumedLength: number, delimiter = ','): string[] {
+    return Fn.split(delimiter, Fn.importValue(sharedValueToImport), assumedLength);
+  }
+
   /**
    * The intrinsic function ``Fn::FindInMap`` returns the value corresponding to
    * keys in a two-level map that is declared in the Mappings section.
@@ -773,3 +835,11 @@ function _inGroupsOf<T>(array: T[], maxGroup: number): T[][] {
   }
   return result;
 }
+
+function range(n: number): number[] {
+  const ret = [];
+  for (let i = 0; i < n; i++) {
+    ret.push(i);
+  }
+  return ret;
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/core/package.json b/packages/@aws-cdk/core/package.json
index c380e97f5d6c8..9c6ba7fb8f5ee 100644
--- a/packages/@aws-cdk/core/package.json
+++ b/packages/@aws-cdk/core/package.json
@@ -139,8 +139,8 @@
     "cfn2ts": "cfn2ts",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cfn2ts",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -176,9 +176,9 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@types/lodash": "^4.14.167",
+    "@types/lodash": "^4.14.168",
     "@types/minimatch": "^3.0.3",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "@types/sinon": "^9.0.9",
     "cdk-build-tools": "0.0.0",
     "cfn2ts": "0.0.0",
diff --git a/packages/@aws-cdk/core/test/fn.test.ts b/packages/@aws-cdk/core/test/fn.test.ts
index 66828aceba543..4168f7d6daada 100644
--- a/packages/@aws-cdk/core/test/fn.test.ts
+++ b/packages/@aws-cdk/core/test/fn.test.ts
@@ -213,6 +213,42 @@ nodeunitShim({
   },
 });
 
+test('Fn.split with an unknown length resolves to simple {Fn::Split}', () => {
+  const stack = new Stack();
+
+  const splittableToken = Token.asString({ ThisIsASplittable: 'list' });
+  const splitToken: string[] = Fn.split(',', splittableToken);
+
+  expect(stack.resolve(splitToken)).toEqual({ 'Fn::Split': [',', { ThisIsASplittable: 'list' }] });
+});
+
+test('Fn.split with an assumed length resolves to a list of {Fn::Select}s', () => {
+  const stack = new Stack();
+
+  const splittableToken = Token.asString({ ThisIsASplittable: 'list' });
+  const splitToken: string[] = Fn.split(',', splittableToken, 3);
+
+  const splitValue = { 'Fn::Split': [',', { ThisIsASplittable: 'list' }] };
+  expect(stack.resolve(splitToken)).toEqual([
+    { 'Fn::Select': [0, splitValue] },
+    { 'Fn::Select': [1, splitValue] },
+    { 'Fn::Select': [2, splitValue] },
+  ]);
+});
+
+test('Fn.importListValue produces lists of known length', () => {
+  const stack = new Stack();
+
+  const splitToken: string[] = Fn.importListValue('ExportName', 3);
+
+  const splitValue = { 'Fn::Split': [',', { 'Fn::ImportValue': 'ExportName' }] };
+  expect(stack.resolve(splitToken)).toEqual([
+    { 'Fn::Select': [0, splitValue] },
+    { 'Fn::Select': [1, splitValue] },
+    { 'Fn::Select': [2, splitValue] },
+  ]);
+});
+
 function stringListToken(o: any): string[] {
   return Token.asList(new Intrinsic(o));
 }
diff --git a/packages/@aws-cdk/core/test/stack.test.ts b/packages/@aws-cdk/core/test/stack.test.ts
index 581f4ed003895..6a54b682108ad 100644
--- a/packages/@aws-cdk/core/test/stack.test.ts
+++ b/packages/@aws-cdk/core/test/stack.test.ts
@@ -1,5 +1,4 @@
 import * as cxapi from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import {
   App, CfnCondition, CfnInclude, CfnOutput, CfnParameter,
   CfnResource, Construct, Lazy, ScopedAws, Stack, validateString, ISynthesisSession, Tags, LegacyStackSynthesizer, DefaultStackSynthesizer,
@@ -9,43 +8,42 @@ import { resolveReferences } from '../lib/private/refs';
 import { PostResolveToken } from '../lib/util';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'a stack can be serialized into a CloudFormation template, initially it\'s empty'(test: Test) {
+describe('stack', () => {
+  test('a stack can be serialized into a CloudFormation template, initially it\'s empty', () => {
     const stack = new Stack();
-    test.deepEqual(toCloudFormation(stack), { });
-    test.done();
-  },
+    expect(toCloudFormation(stack)).toEqual({ });
+  });
 
-  'stack objects have some template-level propeties, such as Description, Version, Transform'(test: Test) {
+  test('stack objects have some template-level propeties, such as Description, Version, Transform', () => {
     const stack = new Stack();
     stack.templateOptions.templateFormatVersion = 'MyTemplateVersion';
     stack.templateOptions.description = 'This is my description';
     stack.templateOptions.transforms = ['SAMy'];
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Description: 'This is my description',
       AWSTemplateFormatVersion: 'MyTemplateVersion',
       Transform: 'SAMy',
     });
-    test.done();
-  },
 
-  'Stack.isStack indicates that a construct is a stack'(test: Test) {
+  });
+
+  test('Stack.isStack indicates that a construct is a stack', () => {
     const stack = new Stack();
     const c = new Construct(stack, 'Construct');
-    test.ok(Stack.isStack(stack));
-    test.ok(!Stack.isStack(c));
-    test.done();
-  },
+    expect(Stack.isStack(stack)).toBeDefined();
+    expect(!Stack.isStack(c)).toBeDefined();
+
+  });
 
-  'stack.id is not included in the logical identities of resources within it'(test: Test) {
+  test('stack.id is not included in the logical identities of resources within it', () => {
     const stack = new Stack(undefined, 'MyStack');
     new CfnResource(stack, 'MyResource', { type: 'MyResourceType' });
 
-    test.deepEqual(toCloudFormation(stack), { Resources: { MyResource: { Type: 'MyResourceType' } } });
-    test.done();
-  },
+    expect(toCloudFormation(stack)).toEqual({ Resources: { MyResource: { Type: 'MyResourceType' } } });
 
-  'when stackResourceLimit is default, should give error'(test: Test) {
+  });
+
+  test('when stackResourceLimit is default, should give error', () => {
     // GIVEN
     const app = new App({});
 
@@ -56,14 +54,14 @@ nodeunitShim({
       new CfnResource(stack, `MyResource-${index}`, { type: 'MyResourceType' });
     }
 
-    test.throws(() => {
+    expect(() => {
       app.synth();
-    }, 'Number of resources: 1000 is greater than allowed maximum of 500');
+    }).toThrow('Number of resources: 1000 is greater than allowed maximum of 500');
+
 
-    test.done();
-  },
+  });
 
-  'when stackResourceLimit is defined, should give the proper error'(test: Test) {
+  test('when stackResourceLimit is defined, should give the proper error', () => {
     // GIVEN
     const app = new App({
       context: {
@@ -78,14 +76,14 @@ nodeunitShim({
       new CfnResource(stack, `MyResource-${index}`, { type: 'MyResourceType' });
     }
 
-    test.throws(() => {
+    expect(() => {
       app.synth();
-    }, 'Number of resources: 200 is greater than allowed maximum of 100');
+    }).toThrow('Number of resources: 200 is greater than allowed maximum of 100');
 
-    test.done();
-  },
 
-  'when stackResourceLimit is 0, should not give error'(test: Test) {
+  });
+
+  test('when stackResourceLimit is 0, should not give error', () => {
     // GIVEN
     const app = new App({
       context: {
@@ -100,14 +98,14 @@ nodeunitShim({
       new CfnResource(stack, `MyResource-${index}`, { type: 'MyResourceType' });
     }
 
-    test.doesNotThrow(() => {
+    expect(() => {
       app.synth();
-    });
+    }).not.toThrow();
 
-    test.done();
-  },
 
-  'stack.templateOptions can be used to set template-level options'(test: Test) {
+  });
+
+  test('stack.templateOptions can be used to set template-level options', () => {
     const stack = new Stack();
 
     stack.templateOptions.description = 'StackDescription';
@@ -118,47 +116,47 @@ nodeunitShim({
       MetadataKey: 'MetadataValue',
     };
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Description: 'StackDescription',
       Transform: ['Transform', 'DeprecatedField'],
       AWSTemplateFormatVersion: 'TemplateVersion',
       Metadata: { MetadataKey: 'MetadataValue' },
     });
 
-    test.done();
-  },
 
-  'stack.templateOptions.transforms removes duplicate values'(test: Test) {
+  });
+
+  test('stack.templateOptions.transforms removes duplicate values', () => {
     const stack = new Stack();
 
     stack.templateOptions.transforms = ['A', 'B', 'C', 'A'];
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Transform: ['A', 'B', 'C'],
     });
 
-    test.done();
-  },
 
-  'stack.addTransform() adds a transform'(test: Test) {
+  });
+
+  test('stack.addTransform() adds a transform', () => {
     const stack = new Stack();
 
     stack.addTransform('A');
     stack.addTransform('B');
     stack.addTransform('C');
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Transform: ['A', 'B', 'C'],
     });
 
-    test.done();
-  },
+
+  });
 
   // This approach will only apply to TypeScript code, but at least it's a temporary
   // workaround for people running into issues caused by SDK-3003.
   // We should come up with a proper solution that involved jsii callbacks (when they exist)
   // so this can be implemented by jsii languages as well.
-  'Overriding `Stack._toCloudFormation` allows arbitrary post-processing of the generated template during synthesis'(test: Test) {
+  test('Overriding `Stack._toCloudFormation` allows arbitrary post-processing of the generated template during synthesis', () => {
 
     const stack = new StackWithPostProcessor();
 
@@ -173,7 +171,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(stack._toCloudFormation(), {
+    expect(stack._toCloudFormation()).toEqual({
       Resources:
       {
         myResource:
@@ -189,10 +187,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'Stack.getByPath can be used to find any CloudFormation element (Parameter, Output, etc)'(test: Test) {
+  });
+
+  test('Stack.getByPath can be used to find any CloudFormation element (Parameter, Output, etc)', () => {
 
     const stack = new Stack();
 
@@ -200,30 +198,30 @@ nodeunitShim({
     const o = new CfnOutput(stack, 'MyOutput', { value: 'boom' });
     const c = new CfnCondition(stack, 'MyCondition');
 
-    test.equal(stack.node.findChild(p.node.id), p);
-    test.equal(stack.node.findChild(o.node.id), o);
-    test.equal(stack.node.findChild(c.node.id), c);
+    expect(stack.node.findChild(p.node.id)).toEqual(p);
+    expect(stack.node.findChild(o.node.id)).toEqual(o);
+    expect(stack.node.findChild(c.node.id)).toEqual(c);
+
 
-    test.done();
-  },
+  });
 
-  'Stack names can have hyphens in them'(test: Test) {
+  test('Stack names can have hyphens in them', () => {
     const root = new App();
 
     new Stack(root, 'Hello-World');
     // Did not throw
 
-    test.done();
-  },
 
-  'Stacks can have a description given to them'(test: Test) {
+  });
+
+  test('Stacks can have a description given to them', () => {
     const stack = new Stack(new App(), 'MyStack', { description: 'My stack, hands off!' });
     const output = toCloudFormation(stack);
-    test.equal(output.Description, 'My stack, hands off!');
-    test.done();
-  },
+    expect(output.Description).toEqual('My stack, hands off!');
+
+  });
 
-  'Stack descriptions have a limited length'(test: Test) {
+  test('Stack descriptions have a limited length', () => {
     const desc = `Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor
      incididunt ut labore et dolore magna aliqua. Consequat interdum varius sit amet mattis vulputate
      enim nulla aliquet. At imperdiet dui accumsan sit amet nulla facilisi morbi. Eget lorem dolor sed
@@ -236,11 +234,11 @@ nodeunitShim({
      morbi. Malesuada nunc vel risus commodo viverra maecenas accumsan lacus. Vulputate sapien nec sagittis
      aliquam malesuada bibendum arcu vitae. Augue neque gravida in fermentum et sollicitudin ac orci phasellus.
      Ultrices tincidunt arcu non sodales neque sodales.`;
-    test.throws(() => new Stack(new App(), 'MyStack', { description: desc }));
-    test.done();
-  },
+    expect(() => new Stack(new App(), 'MyStack', { description: desc }));
 
-  'Include should support non-hash top-level template elements like "Description"'(test: Test) {
+  });
+
+  test('Include should support non-hash top-level template elements like "Description"', () => {
     const stack = new Stack();
 
     const template = {
@@ -251,11 +249,11 @@ nodeunitShim({
 
     const output = toCloudFormation(stack);
 
-    test.equal(typeof output.Description, 'string');
-    test.done();
-  },
+    expect(typeof output.Description).toEqual('string');
+
+  });
 
-  'Pseudo values attached to one stack can be referenced in another stack'(test: Test) {
+  test('Pseudo values attached to one stack can be referenced in another stack', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1');
@@ -270,7 +268,7 @@ nodeunitShim({
     const template1 = assembly.getStackByName(stack1.stackName).template;
     const template2 = assembly.getStackByName(stack2.stackName).template;
 
-    test.deepEqual(template1, {
+    expect(template1).toEqual({
       Outputs: {
         ExportsOutputRefAWSAccountIdAD568057: {
           Value: { Ref: 'AWS::AccountId' },
@@ -279,7 +277,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(template2, {
+    expect(template2).toEqual({
       Parameters: {
         SomeParameter: {
           Type: 'String',
@@ -288,10 +286,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'Cross-stack references are detected in resource properties'(test: Test) {
+  });
+
+  test('Cross-stack references are detected in resource properties', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1');
@@ -310,7 +308,7 @@ nodeunitShim({
     const assembly = app.synth();
     const template2 = assembly.getStackByName(stack2.stackName).template;
 
-    test.deepEqual(template2, {
+    expect(template2).toEqual({
       Resources: {
         SomeResource: {
           Type: 'AWS::Some::Resource',
@@ -320,10 +318,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'Cross-stack export names account for stack name lengths'(test: Test) {
+  });
+
+  test('Cross-stack export names account for stack name lengths', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1', {
@@ -353,10 +351,10 @@ nodeunitShim({
 
     const theOutput = template1.Outputs[Object.keys(template1.Outputs)[0]];
     expect(theOutput.Export.Name.length).toEqual(255);
-    test.done();
-  },
 
-  'Cross-stack reference export names are relative to the stack (when the flag is set)'(test: Test) {
+  });
+
+  test('Cross-stack reference export names are relative to the stack (when the flag is set)', () => {
     // GIVEN
     const app = new App({
       context: {
@@ -383,7 +381,7 @@ nodeunitShim({
     const assembly = app.synth();
     const template2 = assembly.getStackByName(stack2.stackName).template;
 
-    test.deepEqual(template2, {
+    expect(template2).toEqual({
       Resources: {
         SomeResource: {
           Type: 'AWS::Some::Resource',
@@ -393,10 +391,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'cross-stack references in lazy tokens work'(test: Test) {
+  });
+
+  test('cross-stack references in lazy tokens work', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1');
@@ -411,7 +409,7 @@ nodeunitShim({
     const template2 = assembly.getStackByName(stack2.stackName).template;
 
     // THEN
-    test.deepEqual(template1, {
+    expect(template1).toEqual({
       Outputs: {
         ExportsOutputRefAWSAccountIdAD568057: {
           Value: { Ref: 'AWS::AccountId' },
@@ -420,7 +418,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(template2, {
+    expect(template2).toEqual({
       Parameters: {
         SomeParameter: {
           Type: 'String',
@@ -429,10 +427,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'Cross-stack use of Region and account returns nonscoped intrinsic because the two stacks must be in the same region anyway'(test: Test) {
+  });
+
+  test('Cross-stack use of Region and account returns nonscoped intrinsic because the two stacks must be in the same region anyway', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1');
@@ -446,7 +444,7 @@ nodeunitShim({
     const assembly = app.synth();
     const template2 = assembly.getStackByName(stack2.stackName).template;
 
-    test.deepEqual(template2, {
+    expect(template2).toEqual({
       Outputs: {
         DemOutput: {
           Value: { Ref: 'AWS::Region' },
@@ -457,10 +455,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'cross-stack references in strings work'(test: Test) {
+  });
+
+  test('cross-stack references in strings work', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1');
@@ -474,7 +472,7 @@ nodeunitShim({
     const template2 = assembly.getStackByName(stack2.stackName).template;
 
     // THEN
-    test.deepEqual(template2, {
+    expect(template2).toEqual({
       Parameters: {
         SomeParameter: {
           Type: 'String',
@@ -483,10 +481,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'cross stack references and dependencies work within child stacks (non-nested)'(test: Test) {
+  });
+
+  test('cross stack references and dependencies work within child stacks (non-nested)', () => {
     // GIVEN
     const app = new App();
     const parent = new Stack(app, 'Parent');
@@ -510,8 +508,8 @@ nodeunitShim({
     const child1Template = assembly.getStackArtifact(child1.artifactId).template;
     const child2Template = assembly.getStackArtifact(child2.artifactId).template;
 
-    test.deepEqual(parentTemplate, {});
-    test.deepEqual(child1Template, {
+    expect(parentTemplate).toEqual({});
+    expect(child1Template).toEqual({
       Resources: {
         ResourceA: { Type: 'RA' },
         ResourceB: { Type: 'RB' },
@@ -523,7 +521,7 @@ nodeunitShim({
         },
       },
     });
-    test.deepEqual(child2Template, {
+    expect(child2Template).toEqual({
       Resources: {
         Resource1: {
           Type: 'R2',
@@ -534,12 +532,12 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(assembly.getStackArtifact(child1.artifactId).dependencies.map(x => x.id), []);
-    test.deepEqual(assembly.getStackArtifact(child2.artifactId).dependencies.map(x => x.id), ['ParentChild18FAEF419']);
-    test.done();
-  },
+    expect(assembly.getStackArtifact(child1.artifactId).dependencies.map((x: { id: any; }) => x.id)).toEqual([]);
+    expect(assembly.getStackArtifact(child2.artifactId).dependencies.map((x: { id: any; }) => x.id)).toEqual(['ParentChild18FAEF419']);
+
+  });
 
-  'CfnSynthesisError is ignored when preparing cross references'(test: Test) {
+  test('CfnSynthesisError is ignored when preparing cross references', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'my-stack');
@@ -560,10 +558,10 @@ nodeunitShim({
     // THEN
     resolveReferences(app);
 
-    test.done();
-  },
 
-  'Stacks can be children of other stacks (substack) and they will be synthesized separately'(test: Test) {
+  });
+
+  test('Stacks can be children of other stacks (substack) and they will be synthesized separately', () => {
     // GIVEN
     const app = new App();
 
@@ -575,12 +573,12 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.deepEqual(assembly.getStackByName(parentStack.stackName).template, { Resources: { MyParentResource: { Type: 'Resource::Parent' } } });
-    test.deepEqual(assembly.getStackByName(childStack.stackName).template, { Resources: { MyChildResource: { Type: 'Resource::Child' } } });
-    test.done();
-  },
+    expect(assembly.getStackByName(parentStack.stackName).template).toEqual({ Resources: { MyParentResource: { Type: 'Resource::Parent' } } });
+    expect(assembly.getStackByName(childStack.stackName).template).toEqual({ Resources: { MyChildResource: { Type: 'Resource::Child' } } });
+
+  });
 
-  'cross-stack reference (substack references parent stack)'(test: Test) {
+  test('cross-stack reference (substack references parent stack)', () => {
     // GIVEN
     const app = new App();
     const parentStack = new Stack(app, 'parent');
@@ -597,7 +595,7 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.deepEqual(assembly.getStackByName(parentStack.stackName).template, {
+    expect(assembly.getStackByName(parentStack.stackName).template).toEqual({
       Resources: { MyParentResource: { Type: 'Resource::Parent' } },
       Outputs: {
         ExportsOutputFnGetAttMyParentResourceAttOfParentResourceC2D0BB9E: {
@@ -606,7 +604,7 @@ nodeunitShim({
         },
       },
     });
-    test.deepEqual(assembly.getStackByName(childStack.stackName).template, {
+    expect(assembly.getStackByName(childStack.stackName).template).toEqual({
       Resources: {
         MyChildResource: {
           Type: 'Resource::Child',
@@ -618,10 +616,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'cross-stack reference (parent stack references substack)'(test: Test) {
+  });
+
+  test('cross-stack reference (parent stack references substack)', () => {
     // GIVEN
     const app = new App();
     const parentStack = new Stack(app, 'parent');
@@ -638,7 +636,7 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.deepEqual(assembly.getStackByName(parentStack.stackName).template, {
+    expect(assembly.getStackByName(parentStack.stackName).template).toEqual({
       Resources: {
         MyParentResource: {
           Type: 'Resource::Parent',
@@ -649,7 +647,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(assembly.getStackByName(childStack.stackName).template, {
+    expect(assembly.getStackByName(childStack.stackName).template).toEqual({
       Resources: { MyChildResource: { Type: 'Resource::Child' } },
       Outputs: {
         ExportsOutputFnGetAttMyChildResourceAttributeOfChildResource52813264: {
@@ -658,10 +656,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'cannot create cyclic reference between stacks'(test: Test) {
+  });
+
+  test('cannot create cyclic reference between stacks', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1');
@@ -673,15 +671,15 @@ nodeunitShim({
     new CfnParameter(stack2, 'SomeParameter', { type: 'String', default: account1 });
     new CfnParameter(stack1, 'SomeParameter', { type: 'String', default: account2 });
 
-    test.throws(() => {
+    expect(() => {
       app.synth();
       // eslint-disable-next-line max-len
-    }, "'Stack1' depends on 'Stack2' (Stack1 -> Stack2.AWS::AccountId). Adding this dependency (Stack2 -> Stack1.AWS::AccountId) would create a cyclic reference.");
+    }).toThrow("'Stack1' depends on 'Stack2' (Stack1 -> Stack2.AWS::AccountId). Adding this dependency (Stack2 -> Stack1.AWS::AccountId) would create a cyclic reference.");
 
-    test.done();
-  },
 
-  'stacks know about their dependencies'(test: Test) {
+  });
+
+  test('stacks know about their dependencies', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1');
@@ -694,12 +692,12 @@ nodeunitShim({
     app.synth();
 
     // THEN
-    test.deepEqual(stack2.dependencies.map(s => s.node.id), ['Stack1']);
+    expect(stack2.dependencies.map(s => s.node.id)).toEqual(['Stack1']);
+
 
-    test.done();
-  },
+  });
 
-  'cannot create references to stacks in other regions/accounts'(test: Test) {
+  test('cannot create references to stacks in other regions/accounts', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1', { env: { account: '123456789012', region: 'es-norst-1' } });
@@ -709,14 +707,14 @@ nodeunitShim({
     // WHEN
     new CfnParameter(stack2, 'SomeParameter', { type: 'String', default: account1 });
 
-    test.throws(() => {
+    expect(() => {
       app.synth();
-    }, /Stack "Stack2" cannot consume a cross reference from stack "Stack1"/);
+    }).toThrow(/Stack "Stack2" cannot consume a cross reference from stack "Stack1"/);
 
-    test.done();
-  },
 
-  'urlSuffix does not imply a stack dependency'(test: Test) {
+  });
+
+  test('urlSuffix does not imply a stack dependency', () => {
     // GIVEN
     const app = new App();
     const first = new Stack(app, 'First');
@@ -730,23 +728,23 @@ nodeunitShim({
     // THEN
     app.synth();
 
-    test.equal(second.dependencies.length, 0);
+    expect(second.dependencies.length).toEqual(0);
+
 
-    test.done();
-  },
+  });
 
-  'stack with region supplied via props returns literal value'(test: Test) {
+  test('stack with region supplied via props returns literal value', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'Stack1', { env: { account: '123456789012', region: 'es-norst-1' } });
 
     // THEN
-    test.equal(stack.resolve(stack.region), 'es-norst-1');
+    expect(stack.resolve(stack.region)).toEqual('es-norst-1');
 
-    test.done();
-  },
 
-  'overrideLogicalId(id) can be used to override the logical ID of a resource'(test: Test) {
+  });
+
+  test('overrideLogicalId(id) can be used to override the logical ID of a resource', () => {
     // GIVEN
     const stack = new Stack();
     const bonjour = new CfnResource(stack, 'BonjourResource', { type: 'Resource::Type' });
@@ -763,7 +761,7 @@ nodeunitShim({
     bonjour.overrideLogicalId('BOOM');
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources:
       {
         BOOM: { Type: 'Resource::Type' },
@@ -778,32 +776,32 @@ nodeunitShim({
          },
       },
     });
-    test.done();
-  },
 
-  'Stack name can be overridden via properties'(test: Test) {
+  });
+
+  test('Stack name can be overridden via properties', () => {
     // WHEN
     const stack = new Stack(undefined, 'Stack', { stackName: 'otherName' });
 
     // THEN
-    test.deepEqual(stack.stackName, 'otherName');
+    expect(stack.stackName).toEqual('otherName');
 
-    test.done();
-  },
 
-  'Stack name is inherited from App name if available'(test: Test) {
+  });
+
+  test('Stack name is inherited from App name if available', () => {
     // WHEN
     const root = new App();
     const app = new Construct(root, 'Prod');
     const stack = new Stack(app, 'Stack');
 
     // THEN
-    test.deepEqual(stack.stackName, 'ProdStackD5279B22');
+    expect(stack.stackName).toEqual('ProdStackD5279B22');
+
 
-    test.done();
-  },
+  });
 
-  'stack construct id does not go through stack name validation if there is an explicit stack name'(test: Test) {
+  test('stack construct id does not go through stack name validation if there is an explicit stack name', () => {
     // GIVEN
     const app = new App();
 
@@ -814,39 +812,39 @@ nodeunitShim({
 
     // THEN
     const session = app.synth();
-    test.deepEqual(stack.stackName, 'valid-stack-name');
-    test.ok(session.tryGetArtifact(stack.artifactId));
-    test.done();
-  },
+    expect(stack.stackName).toEqual('valid-stack-name');
+    expect(session.tryGetArtifact(stack.artifactId)).toBeDefined();
 
-  'stack validation is performed on explicit stack name'(test: Test) {
+  });
+
+  test('stack validation is performed on explicit stack name', () => {
     // GIVEN
     const app = new App();
 
     // THEN
-    test.throws(() => new Stack(app, 'boom', { stackName: 'invalid:stack:name' }),
-      /Stack name must match the regular expression/);
+    expect(() => new Stack(app, 'boom', { stackName: 'invalid:stack:name' }))
+      .toThrow(/Stack name must match the regular expression/);
+
 
-    test.done();
-  },
+  });
 
-  'Stack.of(stack) returns the correct stack'(test: Test) {
+  test('Stack.of(stack) returns the correct stack', () => {
     const stack = new Stack();
-    test.same(Stack.of(stack), stack);
+    expect(Stack.of(stack)).toBe(stack);
     const parent = new Construct(stack, 'Parent');
     const construct = new Construct(parent, 'Construct');
-    test.same(Stack.of(construct), stack);
-    test.done();
-  },
+    expect(Stack.of(construct)).toBe(stack);
 
-  'Stack.of() throws when there is no parent Stack'(test: Test) {
+  });
+
+  test('Stack.of() throws when there is no parent Stack', () => {
     const root = new Construct(undefined as any, 'Root');
     const construct = new Construct(root, 'Construct');
-    test.throws(() => Stack.of(construct), /should be created in the scope of a Stack, but no Stack found/);
-    test.done();
-  },
+    expect(() => Stack.of(construct)).toThrow(/should be created in the scope of a Stack, but no Stack found/);
+
+  });
 
-  'Stack.of() works for substacks'(test: Test) {
+  test('Stack.of() works for substacks', () => {
     // GIVEN
     const app = new App();
 
@@ -859,14 +857,14 @@ nodeunitShim({
     const childResource = new CfnResource(childStack, 'ChildResource', { type: 'child::resource' });
 
     // THEN
-    test.same(Stack.of(parentStack), parentStack);
-    test.same(Stack.of(parentResource), parentStack);
-    test.same(Stack.of(childStack), childStack);
-    test.same(Stack.of(childResource), childStack);
-    test.done();
-  },
-
-  'stack.availabilityZones falls back to Fn::GetAZ[0],[2] if region is not specified'(test: Test) {
+    expect(Stack.of(parentStack)).toBe(parentStack);
+    expect(Stack.of(parentResource)).toBe(parentStack);
+    expect(Stack.of(childStack)).toBe(childStack);
+    expect(Stack.of(childResource)).toBe(childStack);
+
+  });
+
+  test('stack.availabilityZones falls back to Fn::GetAZ[0],[2] if region is not specified', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'MyStack');
@@ -875,14 +873,14 @@ nodeunitShim({
     const azs = stack.availabilityZones;
 
     // THEN
-    test.deepEqual(stack.resolve(azs), [
+    expect(stack.resolve(azs)).toEqual([
       { 'Fn::Select': [0, { 'Fn::GetAZs': '' }] },
       { 'Fn::Select': [1, { 'Fn::GetAZs': '' }] },
     ]);
-    test.done();
-  },
 
-  'stack.templateFile is the name of the template file emitted to the cloud assembly (default is to use the stack name)'(test: Test) {
+  });
+
+  test('stack.templateFile is the name of the template file emitted to the cloud assembly (default is to use the stack name)', () => {
     // GIVEN
     const app = new App();
 
@@ -891,12 +889,12 @@ nodeunitShim({
     const stack2 = new Stack(app, 'MyStack2', { stackName: 'MyRealStack2' });
 
     // THEN
-    test.deepEqual(stack1.templateFile, 'MyStack1.template.json');
-    test.deepEqual(stack2.templateFile, 'MyRealStack2.template.json');
-    test.done();
-  },
+    expect(stack1.templateFile).toEqual('MyStack1.template.json');
+    expect(stack2.templateFile).toEqual('MyRealStack2.template.json');
+
+  });
 
-  'when feature flag is enabled we will use the artifact id as the template name'(test: Test) {
+  test('when feature flag is enabled we will use the artifact id as the template name', () => {
     // GIVEN
     const app = new App({
       context: {
@@ -909,16 +907,16 @@ nodeunitShim({
     const stack2 = new Stack(app, 'MyStack2', { stackName: 'MyRealStack2' });
 
     // THEN
-    test.deepEqual(stack1.templateFile, 'MyStack1.template.json');
-    test.deepEqual(stack2.templateFile, 'MyStack2.template.json');
-    test.done();
-  },
+    expect(stack1.templateFile).toEqual('MyStack1.template.json');
+    expect(stack2.templateFile).toEqual('MyStack2.template.json');
 
-  '@aws-cdk/core:enableStackNameDuplicates': {
+  });
 
-    'disabled (default)': {
+  describe('@aws-cdk/core:enableStackNameDuplicates', () => {
 
-      'artifactId and templateFile use the stack name'(test: Test) {
+    describe('disabled (default)', () => {
+
+      test('artifactId and templateFile use the stack name', () => {
         // GIVEN
         const app = new App();
 
@@ -927,15 +925,15 @@ nodeunitShim({
         const assembly = app.synth();
 
         // THEN
-        test.deepEqual(stack1.artifactId, 'thestack');
-        test.deepEqual(stack1.templateFile, 'thestack.template.json');
-        test.deepEqual(assembly.getStackArtifact(stack1.artifactId).templateFile, 'thestack.template.json');
-        test.done();
-      },
-    },
+        expect(stack1.artifactId).toEqual('thestack');
+        expect(stack1.templateFile).toEqual('thestack.template.json');
+        expect(assembly.getStackArtifact(stack1.artifactId).templateFile).toEqual('thestack.template.json');
+
+      });
+    });
 
-    'enabled': {
-      'allows using the same stack name for two stacks (i.e. in different regions)'(test: Test) {
+    describe('enabled', () => {
+      test('allows using the same stack name for two stacks (i.e. in different regions)', () => {
         // GIVEN
         const app = new App({ context: { [cxapi.ENABLE_STACK_NAME_DUPLICATES_CONTEXT]: 'true' } });
 
@@ -945,14 +943,14 @@ nodeunitShim({
         const assembly = app.synth();
 
         // THEN
-        test.deepEqual(assembly.getStackArtifact(stack1.artifactId).templateFile, 'MyStack1.template.json');
-        test.deepEqual(assembly.getStackArtifact(stack2.artifactId).templateFile, 'MyStack2.template.json');
-        test.deepEqual(stack1.templateFile, 'MyStack1.template.json');
-        test.deepEqual(stack2.templateFile, 'MyStack2.template.json');
-        test.done();
-      },
+        expect(assembly.getStackArtifact(stack1.artifactId).templateFile).toEqual('MyStack1.template.json');
+        expect(assembly.getStackArtifact(stack2.artifactId).templateFile).toEqual('MyStack2.template.json');
+        expect(stack1.templateFile).toEqual('MyStack1.template.json');
+        expect(stack2.templateFile).toEqual('MyStack2.template.json');
+
+      });
 
-      'artifactId and templateFile use the unique id and not the stack name'(test: Test) {
+      test('artifactId and templateFile use the unique id and not the stack name', () => {
         // GIVEN
         const app = new App({ context: { [cxapi.ENABLE_STACK_NAME_DUPLICATES_CONTEXT]: 'true' } });
 
@@ -961,16 +959,16 @@ nodeunitShim({
         const assembly = app.synth();
 
         // THEN
-        test.deepEqual(stack1.artifactId, 'MyStack1');
-        test.deepEqual(stack1.templateFile, 'MyStack1.template.json');
-        test.deepEqual(assembly.getStackArtifact(stack1.artifactId).templateFile, 'MyStack1.template.json');
-        test.done();
-      },
-    },
+        expect(stack1.artifactId).toEqual('MyStack1');
+        expect(stack1.templateFile).toEqual('MyStack1.template.json');
+        expect(assembly.getStackArtifact(stack1.artifactId).templateFile).toEqual('MyStack1.template.json');
+
+      });
+    });
 
-  },
+  });
 
-  'metadata is collected at the stack boundary'(test: Test) {
+  test('metadata is collected at the stack boundary', () => {
     // GIVEN
     const app = new App({
       context: {
@@ -985,14 +983,14 @@ nodeunitShim({
 
     // THEN
     const asm = app.synth();
-    test.deepEqual(asm.getStackByName(parent.stackName).findMetadataByType('foo'), []);
-    test.deepEqual(asm.getStackByName(child.stackName).findMetadataByType('foo'), [
+    expect(asm.getStackByName(parent.stackName).findMetadataByType('foo')).toEqual([]);
+    expect(asm.getStackByName(child.stackName).findMetadataByType('foo')).toEqual([
       { path: '/parent/child', type: 'foo', data: 'bar' },
     ]);
-    test.done();
-  },
 
-  'stack tags are reflected in the stack cloud assembly artifact metadata'(test: Test) {
+  });
+
+  test('stack tags are reflected in the stack cloud assembly artifact metadata', () => {
     // GIVEN
     const app = new App({ stackTraces: false });
     const stack1 = new Stack(app, 'stack1');
@@ -1010,12 +1008,12 @@ nodeunitShim({
       },
     ];
 
-    test.deepEqual(asm.getStackArtifact(stack1.artifactId).manifest.metadata, { '/stack1': expected });
-    test.deepEqual(asm.getStackArtifact(stack2.artifactId).manifest.metadata, { '/stack1/stack2': expected });
-    test.done();
-  },
+    expect(asm.getStackArtifact(stack1.artifactId).manifest.metadata).toEqual({ '/stack1': expected });
+    expect(asm.getStackArtifact(stack2.artifactId).manifest.metadata).toEqual({ '/stack1/stack2': expected });
 
-  'stack tags are reflected in the stack artifact properties'(test: Test) {
+  });
+
+  test('stack tags are reflected in the stack artifact properties', () => {
     // GIVEN
     const app = new App({ stackTraces: false });
     const stack1 = new Stack(app, 'stack1');
@@ -1028,12 +1026,12 @@ nodeunitShim({
     const asm = app.synth();
     const expected = { foo: 'bar' };
 
-    test.deepEqual(asm.getStackArtifact(stack1.artifactId).tags, expected);
-    test.deepEqual(asm.getStackArtifact(stack2.artifactId).tags, expected);
-    test.done();
-  },
+    expect(asm.getStackArtifact(stack1.artifactId).tags).toEqual(expected);
+    expect(asm.getStackArtifact(stack2.artifactId).tags).toEqual(expected);
+
+  });
 
-  'Termination Protection is reflected in Cloud Assembly artifact'(test: Test) {
+  test('Termination Protection is reflected in Cloud Assembly artifact', () => {
     // if the root is an app, invoke "synth" to avoid double synthesis
     const app = new App();
     const stack = new Stack(app, 'Stack', { terminationProtection: true });
@@ -1041,19 +1039,19 @@ nodeunitShim({
     const assembly = app.synth();
     const artifact = assembly.getStackArtifact(stack.artifactId);
 
-    test.equals(artifact.terminationProtection, true);
+    expect(artifact.terminationProtection).toEqual(true);
 
-    test.done();
-  },
 
-  'users can (still) override "synthesize()" in stack'(test: Test) {
+  });
+
+  test('users can (still) override "synthesize()" in stack', () => {
     let called = false;
 
     class MyStack extends Stack {
       synthesize(session: ISynthesisSession) {
         called = true;
-        test.ok(session.outdir);
-        test.equal(session.assembly.outdir, session.outdir);
+        expect(session.outdir).toBeDefined();
+        expect(session.assembly.outdir).toEqual(session.outdir);
       }
     }
 
@@ -1061,11 +1059,11 @@ nodeunitShim({
     new MyStack(app, 'my-stack');
 
     app.synth();
-    test.ok(called, 'synthesize() not called for Stack');
-    test.done();
-  },
+    expect(called).toEqual(true);
+
+  });
 
-  'context can be set on a stack using a LegacySynthesizer'(test: Test) {
+  test('context can be set on a stack using a LegacySynthesizer', () => {
     // WHEN
     const stack = new Stack(undefined, undefined, {
       synthesizer: new LegacyStackSynthesizer(),
@@ -1074,10 +1072,10 @@ nodeunitShim({
 
     // THEN: no exception
 
-    test.done();
-  },
 
-  'context can be set on a stack using a DefaultSynthesizer'(test: Test) {
+  });
+
+  test('context can be set on a stack using a DefaultSynthesizer', () => {
     // WHEN
     const stack = new Stack(undefined, undefined, {
       synthesizer: new DefaultStackSynthesizer(),
@@ -1086,26 +1084,26 @@ nodeunitShim({
 
     // THEN: no exception
 
-    test.done();
-  },
 
-  'version reporting can be configured on the app'(test: Test) {
+  });
+
+  test('version reporting can be configured on the app', () => {
     const app = new App({ analyticsReporting: true });
-    test.ok(new Stack(app, 'Stack')._versionReportingEnabled);
-    test.done();
-  },
+    expect(new Stack(app, 'Stack')._versionReportingEnabled).toBeDefined();
 
-  'version reporting can be configured with context'(test: Test) {
+  });
+
+  test('version reporting can be configured with context', () => {
     const app = new App({ context: { 'aws:cdk:version-reporting': true } });
-    test.ok(new Stack(app, 'Stack')._versionReportingEnabled);
-    test.done();
-  },
+    expect(new Stack(app, 'Stack')._versionReportingEnabled).toBeDefined();
+
+  });
 
-  'version reporting can be configured on the stack'(test: Test) {
+  test('version reporting can be configured on the stack', () => {
     const app = new App();
-    test.ok(new Stack(app, 'Stack', { analyticsReporting: true })._versionReportingEnabled);
-    test.done();
-  },
+    expect(new Stack(app, 'Stack', { analyticsReporting: true })._versionReportingEnabled).toBeDefined();
+
+  });
 });
 
 class StackWithPostProcessor extends Stack {
diff --git a/packages/@aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts b/packages/@aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts
index 7a6e48a583d69..3a92062b779cb 100644
--- a/packages/@aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts
+++ b/packages/@aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts
@@ -7,6 +7,10 @@ import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { PHYSICAL_RESOURCE_ID_REFERENCE, flatten } from './runtime';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
 /**
  * Reference to the physical resource id that can be passed to the AWS operation as a parameter.
  */
@@ -274,7 +278,7 @@ export interface AwsCustomResourceProps {
  * You can specify exactly which calls are invoked for the 'CREATE', 'UPDATE' and 'DELETE' life cycle events.
  *
  */
-export class AwsCustomResource extends cdk.Construct implements iam.IGrantable {
+export class AwsCustomResource extends CoreConstruct implements iam.IGrantable {
 
   private static breakIgnoreErrorsCircuit(sdkCalls: Array<AwsSdkCall | undefined>, caller: string) {
 
diff --git a/packages/@aws-cdk/custom-resources/package.json b/packages/@aws-cdk/custom-resources/package.json
index ab2f3cad05299..0278c7a6874fe 100644
--- a/packages/@aws-cdk/custom-resources/package.json
+++ b/packages/@aws-cdk/custom-resources/package.json
@@ -46,8 +46,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "gen": "cp -f $(node -p 'require.resolve(\"aws-sdk/apis/metadata.json\")') lib/aws-custom-resource/sdk-api-metadata.json && rm -rf test/aws-custom-resource/cdk.out",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -80,7 +80,7 @@
     "@types/aws-lambda": "^8.10.64",
     "@types/fs-extra": "^8.1.1",
     "@types/sinon": "^9.0.9",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "aws-sdk-mock": "^5.1.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
diff --git a/packages/@aws-cdk/cx-api/package.json b/packages/@aws-cdk/cx-api/package.json
index e21884db8398c..a14b96de38782 100644
--- a/packages/@aws-cdk/cx-api/package.json
+++ b/packages/@aws-cdk/cx-api/package.json
@@ -47,8 +47,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/example-construct-library/package.json b/packages/@aws-cdk/example-construct-library/package.json
index f234c7f43c21c..b14670ad2b90d 100644
--- a/packages/@aws-cdk/example-construct-library/package.json
+++ b/packages/@aws-cdk/example-construct-library/package.json
@@ -47,8 +47,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/lambda-layer-awscli/package.json b/packages/@aws-cdk/lambda-layer-awscli/package.json
index 344ffc2e43521..f642e3101b4df 100644
--- a/packages/@aws-cdk/lambda-layer-awscli/package.json
+++ b/packages/@aws-cdk/lambda-layer-awscli/package.json
@@ -47,8 +47,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/lambda-layer-kubectl/README.md b/packages/@aws-cdk/lambda-layer-kubectl/README.md
index ae6460fae09d3..d2c0343807369 100644
--- a/packages/@aws-cdk/lambda-layer-kubectl/README.md
+++ b/packages/@aws-cdk/lambda-layer-kubectl/README.md
@@ -1,4 +1,4 @@
-# AWS Lambda Layer with AWS CLI
+# AWS Lambda Layer with kubectl (and helm)
 <!--BEGIN STABILITY BANNER-->
 
 ---
@@ -16,13 +16,16 @@
 <!--END STABILITY BANNER-->
 
 
-This module exports a single class called `AwsCliLayer` which is a `lambda.Layer` that bundles the AWS CLI.
+This module exports a single class called `KubectlLayer` which is a `lambda.Layer` that bundles the [`kubectl`](https://kubernetes.io/docs/reference/kubectl/kubectl/) and the [`helm`](https://helm.sh/) command line.
+
+> - Helm Version: 1.20.0
+> - Kubectl Version: 3.4.2
 
 Usage:
 
 ```ts
 const fn = new lambda.Function(...);
-fn.addLayers(new AwsCliLayer(stack, 'AwsCliLayer'));
+fn.addLayers(new KubectlLayer(stack, 'KubectlLayer'));
 ```
 
-The CLI will be installed under `/opt/awscli/aws`.
+`kubectl` will be installed under `/opt/kubectl/kubectl`, and `helm` will be installed under `/opt/helm/helm`.
diff --git a/packages/@aws-cdk/lambda-layer-kubectl/package.json b/packages/@aws-cdk/lambda-layer-kubectl/package.json
index 8a6c18ac0e9c4..19edef01e1dc2 100644
--- a/packages/@aws-cdk/lambda-layer-kubectl/package.json
+++ b/packages/@aws-cdk/lambda-layer-kubectl/package.json
@@ -47,8 +47,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/pipelines/package.json b/packages/@aws-cdk/pipelines/package.json
index 303d18410dcca..2502aaad45dd8 100644
--- a/packages/@aws-cdk/pipelines/package.json
+++ b/packages/@aws-cdk/pipelines/package.json
@@ -19,8 +19,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/region-info/package.json b/packages/@aws-cdk/region-info/package.json
index 9db12073061e5..d6ea0b13674da 100644
--- a/packages/@aws-cdk/region-info/package.json
+++ b/packages/@aws-cdk/region-info/package.json
@@ -44,8 +44,8 @@
     "pkglint": "pkglint -f",
     "awslint": "cdk-awslint",
     "package": "cdk-package",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@aws-cdk/yaml-cfn/package.json b/packages/@aws-cdk/yaml-cfn/package.json
index 873f32ac59a96..616eabe83edd6 100644
--- a/packages/@aws-cdk/yaml-cfn/package.json
+++ b/packages/@aws-cdk/yaml-cfn/package.json
@@ -59,8 +59,8 @@
     "pkglint": "pkglint -f",
     "package": "cdk-package",
     "awslint": "cdk-awslint",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
   },
diff --git a/packages/@monocdk-experiment/assert/package.json b/packages/@monocdk-experiment/assert/package.json
index 92c854ef290a7..ed98d3c1ccab4 100644
--- a/packages/@monocdk-experiment/assert/package.json
+++ b/packages/@monocdk-experiment/assert/package.json
@@ -11,8 +11,8 @@
     "test": "cdk-test",
     "pkglint": "pkglint -f",
     "package": "cdk-package",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test"
   },
   "cdk-build": {
     "jest": true,
@@ -35,7 +35,7 @@
   "devDependencies": {
     "@monocdk-experiment/rewrite-imports": "0.0.0",
     "@types/jest": "^26.0.15",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "cdk-build-tools": "0.0.0",
     "constructs": "^3.2.0",
     "jest": "^26.6.3",
diff --git a/packages/@monocdk-experiment/rewrite-imports/package.json b/packages/@monocdk-experiment/rewrite-imports/package.json
index ee88c8d1f9074..18f0a6053f092 100644
--- a/packages/@monocdk-experiment/rewrite-imports/package.json
+++ b/packages/@monocdk-experiment/rewrite-imports/package.json
@@ -14,8 +14,8 @@
     "lint": "cdk-lint",
     "pkglint": "pkglint -f",
     "package": "cdk-package",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test"
   },
   "cdk-build": {
     "jest": true
@@ -38,7 +38,7 @@
   "devDependencies": {
     "@types/glob": "^7.1.3",
     "@types/jest": "^26.0.15",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "cdk-build-tools": "0.0.0",
     "pkglint": "0.0.0"
   },
diff --git a/packages/aws-cdk-lib/package.json b/packages/aws-cdk-lib/package.json
index f0a41a593db93..8c6cc2378b683 100644
--- a/packages/aws-cdk-lib/package.json
+++ b/packages/aws-cdk-lib/package.json
@@ -19,8 +19,8 @@
     "test": "echo done",
     "package": "cdk-package",
     "pkglint": "pkglint -f",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "watch": "cdk-watch",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -279,7 +279,7 @@
     "@aws-cdk/region-info": "0.0.0",
     "@aws-cdk/yaml-cfn": "0.0.0",
     "@types/fs-extra": "^8.1.1",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "cdk-build-tools": "0.0.0",
     "constructs": "^3.2.0",
     "fs-extra": "^9.0.1",
diff --git a/packages/aws-cdk/package.json b/packages/aws-cdk/package.json
index c33e690bacc8c..0cb2dbfc300e8 100644
--- a/packages/aws-cdk/package.json
+++ b/packages/aws-cdk/package.json
@@ -15,8 +15,8 @@
     "test": "cdk-test",
     "integ": "jest --testMatch '**/?(*.)+(integ-test).js'",
     "package": "cdk-package",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "integ-cli": "npm run integ-cli-regression && npm run integ-cli-no-regression",
     "integ-cli-regression": "npm run integ-cli-regression-latest-release && npm run integ-cli-regression-latest-code",
     "integ-cli-regression-latest-release": "test/integ/run-against-dist test/integ/test-cli-regression-against-latest-release.sh",
@@ -46,7 +46,7 @@
     "@types/jest": "^26.0.15",
     "@types/minimatch": "^3.0.3",
     "@types/mockery": "^1.4.29",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "@types/promptly": "^3.0.1",
     "@types/semver": "^7.3.4",
     "@types/sinon": "^9.0.9",
@@ -73,7 +73,7 @@
     "@aws-cdk/region-info": "0.0.0",
     "@aws-cdk/yaml-cfn": "0.0.0",
     "archiver": "^5.2.0",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "camelcase": "^6.2.0",
     "cdk-assets": "0.0.0",
     "colors": "^1.4.0",
diff --git a/packages/aws-cdk/test/integ/helpers/cdk.ts b/packages/aws-cdk/test/integ/helpers/cdk.ts
index 81a656c83e023..bff3357d5d12e 100644
--- a/packages/aws-cdk/test/integ/helpers/cdk.ts
+++ b/packages/aws-cdk/test/integ/helpers/cdk.ts
@@ -3,6 +3,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { outputFromStack, AwsClients } from './aws';
+import { findYarnPackages } from './monorepo';
 import { ResourcePool } from './resource-pool';
 import { TestContext } from './test-helpers';
 
@@ -61,20 +62,17 @@ export function withCdkApp<A extends TestContext & AwsContext>(block: (context:
 
     let success = true;
     try {
-      let modules = [
-        '@aws-cdk/core',
-        '@aws-cdk/aws-sns',
-        '@aws-cdk/aws-iam',
-        '@aws-cdk/aws-lambda',
-        '@aws-cdk/aws-ssm',
-        '@aws-cdk/aws-ecr-assets',
-        '@aws-cdk/aws-cloudformation',
-        '@aws-cdk/aws-ec2',
-      ];
-      if (FRAMEWORK_VERSION) {
-        modules = modules.map(module => `${module}@${FRAMEWORK_VERSION}`);
-      }
-      await fixture.shell(['npm', 'install', ...modules]);
+      const version = FRAMEWORK_VERSION ?? '*';
+      await installNpmPackages(fixture, {
+        '@aws-cdk/core': version,
+        '@aws-cdk/aws-sns': version,
+        '@aws-cdk/aws-iam': version,
+        '@aws-cdk/aws-lambda': version,
+        '@aws-cdk/aws-ssm': version,
+        '@aws-cdk/aws-ecr-assets': version,
+        '@aws-cdk/aws-cloudformation': version,
+        '@aws-cdk/aws-ec2': version,
+      });
 
       await ensureBootstrapped(fixture);
 
@@ -117,11 +115,9 @@ export function withMonolithicCfnIncludeCdkApp<A extends TestContext>(block: (co
 
     let success = true;
     try {
-      let module = uberPackage;
-      if (FRAMEWORK_VERSION) {
-        module = `${module}@${FRAMEWORK_VERSION}`;
-      }
-      await fixture.shell(['npm', 'install', 'constructs', module]);
+      await installNpmPackages(fixture, {
+        [uberPackage]: FRAMEWORK_VERSION ?? '*',
+      });
 
       await block(fixture);
     } catch (e) {
@@ -454,3 +450,70 @@ export function randomString() {
   // Crazy
   return Math.random().toString(36).replace(/[^a-z0-9]+/g, '');
 }
+
+/**
+ * Install the given NPM packages, identified by their names and versions
+ *
+ * Works by writing the packages to a `package.json` file, and
+ * then running NPM7's "install" on it. The use of NPM7 will automatically
+ * install required peerDependencies.
+ *
+ * If we're running in REPO mode and we find the package in the set of local
+ * packages in the repository, we'll write the directory name to `package.json`
+ * so that NPM will create a symlink (this allows running tests against
+ * built-but-unpackaged modules, and saves dev cycle time).
+ *
+ * Be aware you MUST install all the packages you directly depend upon! In the case
+ * of a repo/symlinking install, transitive dependencies WILL NOT be installed in the
+ * current directory's `node_modules` directory, because they will already have been
+ * symlinked from the TARGET directory's `node_modules` directory (which is sufficient
+ * for Node's dependency lookup mechanism).
+ */
+async function installNpmPackages(fixture: TestFixture, packages: Record<string, string>) {
+  if (process.env.REPO_ROOT) {
+    const monoRepo = await findYarnPackages(process.env.REPO_ROOT);
+
+    // Replace the install target with the physical location of this package
+    for (const key of Object.keys(packages)) {
+      if (key in monoRepo) {
+        packages[key] = monoRepo[key];
+      }
+    }
+  }
+
+  fs.writeFileSync(path.join(fixture.integTestDir, 'package.json'), JSON.stringify({
+    name: 'cdk-integ-tests',
+    private: true,
+    version: '0.0.1',
+    devDependencies: packages,
+  }, undefined, 2), { encoding: 'utf-8' });
+
+  // Now install that `package.json` using NPM7
+  const npm7 = await installNpm7(fixture.output);
+  await fixture.shell([npm7, 'install']);
+}
+
+/**
+ * Install NPM7 somewhere on the machine and return the path to its binary.
+ *
+ * - We install NPM7 explicitly so we don't have to depend on the environment.
+ * - The install is cached so we don't have to install it over and over again
+ *   for every test.
+ */
+async function installNpm7(output?: NodeJS.WritableStream): Promise<string> {
+  if (NPM7_INSTALL_LOCATION === undefined) {
+    const installDir = path.join(os.tmpdir(), 'cdk-integ-npm7');
+    await shell(['rm', '-rf', installDir], { output });
+    await shell(['mkdir', '-p', installDir], { output });
+
+    await shell(['npm', 'install',
+      '--prefix', installDir,
+      'npm@7'], { output });
+
+    NPM7_INSTALL_LOCATION = path.join(installDir, 'node_modules', '.bin', 'npm');
+  }
+
+  return NPM7_INSTALL_LOCATION;
+}
+
+let NPM7_INSTALL_LOCATION: string | undefined;
diff --git a/packages/aws-cdk/test/integ/helpers/monorepo.ts b/packages/aws-cdk/test/integ/helpers/monorepo.ts
new file mode 100644
index 0000000000000..f89c64b96df15
--- /dev/null
+++ b/packages/aws-cdk/test/integ/helpers/monorepo.ts
@@ -0,0 +1,30 @@
+import * as path from 'path';
+import { shell } from './cdk';
+
+/**
+ * Cache monorepo discovery results, we only want to do this once per run
+ */
+const YARN_MONOREPO_CACHE: Record<string, any> = {};
+
+/**
+ * Return a { name -> directory } packages found in a Yarn monorepo
+ *
+ * Cached in YARN_MONOREPO_CACHE.
+ */
+export async function findYarnPackages(root: string): Promise<Record<string, string>> {
+  if (!(root in YARN_MONOREPO_CACHE)) {
+    const output: YarnWorkspacesOutput = JSON.parse(await shell(['yarn', 'workspaces', 'info', '--silent'], {
+      captureStderr: false,
+      cwd: root,
+    }));
+
+    const ret: Record<string, string> = {};
+    for (const [k, v] of Object.entries(output)) {
+      ret[k] = path.join(root, v.location);
+    }
+    YARN_MONOREPO_CACHE[root] = ret;
+  }
+  return YARN_MONOREPO_CACHE[root];
+}
+
+type YarnWorkspacesOutput = Record<string, { location: string }>;
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/run-wrappers/repo/npm b/packages/aws-cdk/test/integ/run-wrappers/repo/npm
deleted file mode 100755
index 4a49bd85621b5..0000000000000
--- a/packages/aws-cdk/test/integ/run-wrappers/repo/npm
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/bash
-# Wrapper for 'npm' which will symlink packages from the monorepo.
-set -eu
-command=$1
-
-lerna=$REPO_ROOT/node_modules/.bin/lerna
-
-if [[ "$command" == "install" || "$command" == "i" ]]; then
-  npmargs="install"
-  shift
-
-  while [[ "${1:-}" != "" ]]; do
-    packageloc=$(cd $REPO_ROOT && npx lerna ls --loglevel silent -p --scope $1) && {
-      # Symlink that location into node_modules
-      dir=$(dirname node_modules/$1)
-      mkdir -p $dir
-      echo "$dir/$1 -> $packageloc" >&2
-      ln -s $packageloc $dir/
-    } || {
-      npmargs="$npmargs $1"
-    }
-    shift
-  done
-
-  if [[ "$npmargs" == "install" ]]; then
-    # No rewrites
-    exit 0
-  fi
-
-  exec $ORIGINAL_NPM $npmargs
-fi
-
-exec $ORIGINAL_NPM "$@"
\ No newline at end of file
diff --git a/packages/awslint/package.json b/packages/awslint/package.json
index 7e9ed60a7b4b3..d2950a68bfbcc 100644
--- a/packages/awslint/package.json
+++ b/packages/awslint/package.json
@@ -8,8 +8,8 @@
     "test": "echo ok",
     "watch": "tsc -b -w",
     "package": "mkdir -p dist/js && mv $( npm pack ) dist/js/",
-    "build+test+package": "npm run build+test && npm run package",
-    "build+test": "npm run build && npm test",
+    "build+test+package": "yarn build+test && yarn package",
+    "build+test": "yarn build && yarn test",
     "pkglint": "pkglint -f"
   },
   "bin": {
diff --git a/packages/cdk-assets/package.json b/packages/cdk-assets/package.json
index dda6f1ce2cb64..0d30bbcf4e3b0 100644
--- a/packages/cdk-assets/package.json
+++ b/packages/cdk-assets/package.json
@@ -16,8 +16,8 @@
     "pkglint": "pkglint -f",
     "test": "cdk-test",
     "watch": "cdk-watch",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "compat": "cdk-compat"
   },
   "cdk-build": {
@@ -35,7 +35,7 @@
     "@types/jest": "^26.0.15",
     "@types/jszip": "^3.4.1",
     "@types/mock-fs": "^4.13.0",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "@types/yargs": "^15.0.10",
     "cdk-build-tools": "0.0.0",
     "jest": "^26.6.3",
@@ -47,7 +47,7 @@
     "@aws-cdk/cloud-assembly-schema": "0.0.0",
     "@aws-cdk/cx-api": "0.0.0",
     "archiver": "^5.2.0",
-    "aws-sdk": "^2.827.0",
+    "aws-sdk": "^2.828.0",
     "glob": "^7.1.6",
     "yargs": "^16.2.0"
   },
diff --git a/packages/monocdk/package.json b/packages/monocdk/package.json
index 9b5c9e5580d99..dd3596721c5d0 100644
--- a/packages/monocdk/package.json
+++ b/packages/monocdk/package.json
@@ -18,8 +18,8 @@
     "test": "echo done",
     "package": "cdk-package",
     "pkglint": "pkglint -f",
-    "build+test": "npm run build && npm test",
-    "build+test+package": "npm run build+test && npm run package",
+    "build+test": "yarn build && yarn test",
+    "build+test+package": "yarn build+test && yarn package",
     "watch": "cdk-watch",
     "compat": "cdk-compat",
     "rosetta:extract": "yarn --silent jsii-rosetta extract"
@@ -277,10 +277,8 @@
     "@aws-cdk/pipelines": "0.0.0",
     "@aws-cdk/region-info": "0.0.0",
     "@aws-cdk/yaml-cfn": "0.0.0",
-    "@aws-cdk/lambda-layer-awscli": "0.0.0",
-    "@aws-cdk/lambda-layer-kubectl": "0.0.0",
     "@types/fs-extra": "^8.1.1",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "cdk-build-tools": "0.0.0",
     "constructs": "^3.2.0",
     "fs-extra": "^9.0.1",
diff --git a/release.json b/release.json
index 318d5d9a12072..bbd42d0c80ea6 100644
--- a/release.json
+++ b/release.json
@@ -1,4 +1,5 @@
 {
   "majorVersion": 1,
-  "releaseType": "stable"
+  "releaseType": "stable",
+  "distTag": "latest"
 }
diff --git a/scripts/check-api-compatibility.sh b/scripts/check-api-compatibility.sh
index e49d684e8b98c..ece902e7130f9 100755
--- a/scripts/check-api-compatibility.sh
+++ b/scripts/check-api-compatibility.sh
@@ -55,15 +55,19 @@ if ! ${SKIP_DOWNLOAD:-false}; then
     existing_names=$(echo "$jsii_package_dirs" | xargs -n1 -P4 -I {} bash -c 'dirs_to_existing_names "$@"' _ {})
     echo " Done." >&2
 
-    current_version=$(node -p 'require("./lerna.json").version')
-    echo "Current version in lerna.json is $current_version"
-    if ! ${DOWNLOAD_LATEST:-false} && package_exists_on_npm aws-cdk $current_version; then
-        echo "Using package version ${current_version} as baseline"
-        existing_names=$(echo "$existing_names" | sed -e "s/$/@$current_version/")
-    else
-        echo "However, using the latest version from NPM as the baseline"
+    echo "Determining baseline version..." >&2
+    version=$(node -p 'require("./scripts/resolve-version.js").version')
+    disttag=$(node -p 'require("./scripts/resolve-version.js").npmDistTag')
+    echo "  Current version is $version." >&2
+
+    if ! package_exists_on_npm aws-cdk $version; then
+      echo "  Version $version does not exist in npm. Falling back to resolved dist tag '$disttag'" >&2
+      version=$disttag
     fi
 
+    echo "Using version '$version' as the baseline..."
+    existing_names=$(echo "$existing_names" | sed -e "s/$/@$version/")
+
     rm -rf $tmpdir
     mkdir -p $tmpdir
 
diff --git a/scripts/resolve-version-lib.js b/scripts/resolve-version-lib.js
index 1be5dc06d6876..63d54f33c4a70 100755
--- a/scripts/resolve-version-lib.js
+++ b/scripts/resolve-version-lib.js
@@ -17,6 +17,7 @@ function resolveVersion(rootdir) {
   const releaseConfig = require(releaseFile);
   const majorVersion = releaseConfig.majorVersion;
   const releaseType = releaseConfig.releaseType;
+  const distTag = releaseConfig.distTag;
   if (!majorVersion) { throw new Error(`"majorVersion"" must be defined in ${releaseFile}`); }
   if (!releaseType) { throw new Error(`"releaseType" must be defined in ${releaseFile}`); }
   if (typeof(majorVersion) !== 'number') { throw new Error(`majorVersion=${majorVersion} must be a number`); }
@@ -69,6 +70,7 @@ function resolveVersion(rootdir) {
     changelogFile: changelogFile,
     prerelease: releaseType !== 'stable' ? releaseType : undefined,
     marker: '0.0.0',
+    ...(distTag ? { npmDistTag: distTag } : {}),
   };
 }
 
diff --git a/scripts/script-tests/resolve-version.test.js b/scripts/script-tests/resolve-version.test.js
index f1b6f596a82d2..57e72019245d8 100644
--- a/scripts/script-tests/resolve-version.test.js
+++ b/scripts/script-tests/resolve-version.test.js
@@ -80,6 +80,23 @@ happy({
   }
 });
 
+happy({
+  name: 'dist tag is correctly shown',
+  inputs: { 
+    'release.json': { majorVersion: 2, releaseType: 'alpha', distTag: 'v2-preview' },
+    'version.v2.json': { version: '2.0.0-alpha.5' }
+  },
+  expected: {
+    changelogFile: 'CHANGELOG.v2.md',
+    marker: '0.0.0',
+    prerelease: 'alpha',
+    version: '2.0.0-alpha.5',
+    versionFile: 'version.v2.json',
+    npmDistTag: 'v2-preview',
+  }
+});
+
+
 failure({
   name: 'invalid release type',
   inputs: { 'release.json': { majorVersion: 2, releaseType: 'build' } },
diff --git a/tools/cdk-build-tools/bin/cdk-build.ts b/tools/cdk-build-tools/bin/cdk-build.ts
index d745de50aa2be..b4a5b38542292 100644
--- a/tools/cdk-build-tools/bin/cdk-build.ts
+++ b/tools/cdk-build-tools/bin/cdk-build.ts
@@ -26,9 +26,14 @@ async function main() {
     })
     .option('gen', {
       type: 'boolean',
-      desc: 'execute gen script',
+      desc: 'Execute gen script',
       default: true,
     })
+    .option('fix', {
+      type: 'boolean',
+      desc: 'Fix linter errors',
+      default: false,
+    })
     .argv;
 
   const options = cdkBuildOptions();
@@ -46,7 +51,7 @@ async function main() {
 
   const overrides: CompilerOverrides = { eslint: args.eslint, jsii: args.jsii, tsc: args.tsc };
   await compileCurrentPackage(options, timers, overrides);
-  await lintCurrentPackage(options, overrides);
+  await lintCurrentPackage(options, { ...overrides, fix: args.fix });
 
   if (options.post) {
     await shell(options.post, { timers, env });
diff --git a/tools/cdk-build-tools/config/eslintrc.js b/tools/cdk-build-tools/config/eslintrc.js
index 63608e69161a3..446af2c2e2ff4 100644
--- a/tools/cdk-build-tools/config/eslintrc.js
+++ b/tools/cdk-build-tools/config/eslintrc.js
@@ -42,6 +42,7 @@ module.exports = {
   ignorePatterns: ['*.js', '*.d.ts', 'node_modules/', '*.generated.ts'],
   rules: {
     'cdk/no-core-construct': [ 'error' ],
+    'cdk/no-qualified-construct': [ 'error' ],
     // Require use of the `import { foo } from 'bar';` form instead of `import foo = require('bar');`
     '@typescript-eslint/no-require-imports': ['error'],
     '@typescript-eslint/indent': ['error', 2],
diff --git a/tools/cdk-build-tools/package.json b/tools/cdk-build-tools/package.json
index 226ba63a75b81..eef61beb1ca93 100644
--- a/tools/cdk-build-tools/package.json
+++ b/tools/cdk-build-tools/package.json
@@ -23,8 +23,8 @@
     "watch": "tsc -b -w",
     "pkglint": "pkglint -f",
     "test": "echo success",
-    "build+test+package": "npm run build+test",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test",
+    "build+test": "yarn build && yarn test"
   },
   "author": {
     "name": "Amazon Web Services",
@@ -39,7 +39,7 @@
     "pkglint": "0.0.0"
   },
   "dependencies": {
-    "@typescript-eslint/eslint-plugin": "^4.12.0",
+    "@typescript-eslint/eslint-plugin": "^4.14.0",
     "@typescript-eslint/parser": "^4.7.0",
     "awslint": "0.0.0",
     "colors": "^1.4.0",
diff --git a/tools/cdk-integ-tools/package.json b/tools/cdk-integ-tools/package.json
index 8685d8435f8dc..91278a54760ef 100644
--- a/tools/cdk-integ-tools/package.json
+++ b/tools/cdk-integ-tools/package.json
@@ -19,8 +19,8 @@
     "lint": "cdk-lint",
     "test": "cdk-test",
     "pkglint": "pkglint -f",
-    "build+test+package": "npm run build+test",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test",
+    "build+test": "yarn build && yarn test"
   },
   "author": {
     "name": "Amazon Web Services",
diff --git a/tools/cfn2ts/package.json b/tools/cfn2ts/package.json
index 785d1a52c18b0..de5bd0d87bc6f 100644
--- a/tools/cfn2ts/package.json
+++ b/tools/cfn2ts/package.json
@@ -19,8 +19,8 @@
     "lint": "cdk-lint",
     "test": "cdk-test",
     "pkglint": "pkglint -f",
-    "build+test+package": "npm run build+test",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test",
+    "build+test": "yarn build && yarn test"
   },
   "author": {
     "name": "Amazon Web Services",
diff --git a/tools/eslint-plugin-cdk/lib/index.ts b/tools/eslint-plugin-cdk/lib/index.ts
index aae510df35d54..94eef4dd8f57f 100644
--- a/tools/eslint-plugin-cdk/lib/index.ts
+++ b/tools/eslint-plugin-cdk/lib/index.ts
@@ -1,3 +1,4 @@
 export const rules = {
   'no-core-construct': require('./rules/no-core-construct'),
+  'no-qualified-construct': require('./rules/no-qualified-construct'),
 };
diff --git a/tools/eslint-plugin-cdk/lib/private/import-cache.ts b/tools/eslint-plugin-cdk/lib/private/import-cache.ts
index 7d78b2a421e93..04325645fdb5d 100644
--- a/tools/eslint-plugin-cdk/lib/private/import-cache.ts
+++ b/tools/eslint-plugin-cdk/lib/private/import-cache.ts
@@ -29,6 +29,10 @@ export class ImportCache {
   public find(key: ImportCacheKey): ImportCacheRecord | undefined {
     return this.records[hashed(key)];
   }
+
+  public get imports(): ImportCacheRecord[] {
+    return Object.values(this.records);
+  }
 }
 
 function hashed(key: {}): string {
diff --git a/tools/eslint-plugin-cdk/lib/rules/no-qualified-construct.ts b/tools/eslint-plugin-cdk/lib/rules/no-qualified-construct.ts
new file mode 100644
index 0000000000000..eb8a418cab58e
--- /dev/null
+++ b/tools/eslint-plugin-cdk/lib/rules/no-qualified-construct.ts
@@ -0,0 +1,134 @@
+//
+// This rule ensures that the `@aws-cdk/core.Construct` class is always
+// referenced without a namespace qualifier (`Construct` instead of
+// `xxx.Construct`). The fixer will automatically add an `import` statement
+// separated from the main import group to reduce the chance for merge conflicts
+// with v2-main. 
+//
+// If there is already an import of `constructs.Construct` under the name
+// `Construct`, we will import `core.Construct` as the alias `CoreConstruct`
+// instead.
+//
+
+import { AST, Rule } from 'eslint';
+import { ImportCache } from '../private/import-cache';
+
+const importCache = new ImportCache();
+
+export function create(context: Rule.RuleContext): Rule.NodeListener {
+  // skip core
+  if (context.getFilename().includes('@aws-cdk/core')) {
+    return {};
+  }
+
+  return {
+    // collect all "import" statements. we will later use them to determine
+    // exactly how to import `core.Construct`.
+    ImportDeclaration: node => {
+      for (const s of node.specifiers) {
+        const typeName = () => {
+          switch (s.type) {
+            case 'ImportSpecifier': return s.imported.name;
+            case 'ImportDefaultSpecifier': return s.local.name;
+            case 'ImportNamespaceSpecifier': return s.local.name;
+          }
+        };
+
+        importCache.record({
+          fileName: context.getFilename(),
+          typeName: typeName(),
+          importNode: node,
+          localName: `${node.source.value}.${s.local.name}`
+        });
+      }
+    },
+
+    // this captures `class X extends xxx.Construct`
+    ClassDeclaration: node => {
+      if (node.superClass?.type === 'MemberExpression') {
+        const sc = node.superClass;
+        // const qualifier = sc.object.type === 'Identifier' ? sc.object.name : undefined;
+        const baseClass = sc.property.type === 'Identifier' ? sc.property.name : undefined;
+        if (baseClass === 'Construct' && sc.range) {
+          report(context, node, sc.range);
+        }
+      }
+    },
+
+    // this captures using `xxx.Construct` as an identifier
+    Identifier: node => {
+      const typeAnnotation = (node as any).typeAnnotation?.typeAnnotation;
+      const type = typeAnnotation?.typeName;
+      if (type?.type === 'TSQualifiedName' && type?.right.name === 'Construct' && type?.left.name !== 'constructs') {
+        report(context, node, typeAnnotation.range);
+      }
+    },
+  }
+}
+
+/**
+ * Reports an error indicating that we found `xxx.Construct` usage, and apply
+ * the appropriate fix.
+ * @param context Rule context
+ * @param node Rule node (for the report)
+ * @param replaceRange Text range to replace
+ */
+function report(context: Rule.RuleContext, node: Rule.Node, replaceRange: AST.Range) {
+  context.report({
+    message: 'To avoid merge conflicts with the v2-main branch, the "Construct" type must be referenced without a qualifier (e.g. "Construct" instead of "CoreConstruct")',
+    node,
+    fix: fixer => {
+      const imports = importCache.imports.filter(x => x.fileName === context.getFilename());
+      const findImport = (x: string) => imports.find(i => i.localName === x);
+
+      const coreConstruct = findImport('@aws-cdk/core.Construct')
+      const coreCoreConstruct = findImport('@aws-cdk/core.CoreConstruct');
+      const constructsConstruct = findImport('constructs.Construct');
+
+      // determines whether we will replace with `Construct` or `CoreConstruct`
+      // based on whether this file already imported `constructs.Construct`.
+      let replaceBy: string | undefined;
+
+      // determines whether an "import" statement should be added and it's
+      // contents.
+      let addImport: string | undefined;
+
+      if (coreConstruct) {
+        // we already import `core.Construct` as `Construct`
+        replaceBy = 'Construct';
+      } else if (coreCoreConstruct) {
+        // we already import `core.Construct` as `CoreConstruct`
+        replaceBy = 'CoreConstruct'
+      } else if (constructsConstruct) {
+        // we import `constructs.Construct`, so import and replace
+        // `core.Construct` with `CoreConstruct`
+        replaceBy = 'CoreConstruct';
+        addImport = `import { Construct as ${replaceBy} } from '@aws-cdk/core';`;
+      } else {
+        // import `core.Construct` as `Construct` and replace
+        replaceBy = 'Construct';
+        addImport = `import { ${replaceBy} } from '@aws-cdk/core';`;
+      }
+
+      const fixes: Rule.Fix[] = [
+        fixer.replaceTextRange(replaceRange, replaceBy)
+      ];
+
+      if (addImport) {
+        // find the last import statement in the file and add our import immediately after
+        const lastImport = imports[imports.length - 1];
+        if (lastImport) {
+          fixes.push(fixer.insertTextAfter(lastImport.importNode, [
+            "",
+            "",
+            "// keep this import separate from other imports to reduce chance for merge conflicts with v2-main",
+            "// eslint-disable-next-line no-duplicate-imports, import/order",
+            addImport,
+          ].join('\n')));
+        }
+      }
+
+      return fixes;
+    },
+  });
+}
\ No newline at end of file
diff --git a/tools/eslint-plugin-cdk/package.json b/tools/eslint-plugin-cdk/package.json
index fa6a38426ec20..7d2466ff653a7 100644
--- a/tools/eslint-plugin-cdk/package.json
+++ b/tools/eslint-plugin-cdk/package.json
@@ -15,7 +15,7 @@
     "@types/eslint": "^7.2.6",
     "@types/fs-extra": "^8.1.1",
     "@types/jest": "^26.0.15",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "eslint-plugin-rulesdir": "^0.1.0",
     "jest": "^26.6.3",
     "typescript": "~3.9.7"
diff --git a/tools/nodeunit-shim/package.json b/tools/nodeunit-shim/package.json
index c0a9838437477..3aa95f20e3dfc 100644
--- a/tools/nodeunit-shim/package.json
+++ b/tools/nodeunit-shim/package.json
@@ -13,7 +13,7 @@
   },
   "devDependencies": {
     "@types/jest": "^26.0.15",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "typescript": "~3.9.7"
   },
   "dependencies": {
diff --git a/tools/pkglint/lib/rules.ts b/tools/pkglint/lib/rules.ts
index 88688249729a6..f6d6f82dd76e6 100644
--- a/tools/pkglint/lib/rules.ts
+++ b/tools/pkglint/lib/rules.ts
@@ -284,8 +284,32 @@ export class MaturitySetting extends ValidationRule {
       maturity = 'deprecated';
     }
 
+    const packageLevels = this.determinePackageLevels(pkg);
+
+    const hasL1s = packageLevels.some(level => level === 'l1');
+    const hasL2s = packageLevels.some(level => level === 'l2');
+    if (hasL2s) {
+      // validate that a package that contains L2s does not declare a 'cfn-only' maturity
+      if (maturity === 'cfn-only') {
+        pkg.report({
+          ruleName: this.name,
+          message: "Package that contains any L2s cannot declare a 'cfn-only' maturity",
+          fix: () => pkg.json.maturity = 'experimental',
+        });
+      }
+    } else if (hasL1s) {
+      // validate that a package that contains only L1s declares a 'cfn-only' maturity
+      if (maturity !== 'cfn-only') {
+        pkg.report({
+          ruleName: this.name,
+          message: "Package that contains only L1s cannot declare a maturity other than 'cfn-only'",
+          fix: () => pkg.json.maturity = 'cfn-only',
+        });
+      }
+    }
+
     if (maturity) {
-      this.validateReadmeHasBanner(pkg, maturity, this.determinePackageLevels(pkg));
+      this.validateReadmeHasBanner(pkg, maturity, packageLevels);
     }
   }
 
@@ -342,7 +366,9 @@ export class MaturitySetting extends ValidationRule {
     // to see if this package has L1s.
     const hasL1 = !!pkg.json['cdk-build']?.cloudformation;
 
-    const libFiles = glob.sync('lib/*.ts');
+    const libFiles = glob.sync('lib/**/*.ts', {
+      ignore: 'lib/**/*.d.ts', // ignore the generated TS declaration files
+    });
     const hasL2 = libFiles.some(f => !f.endsWith('.generated.ts') && !f.endsWith('index.ts'));
 
     return [
@@ -1079,7 +1105,11 @@ export class MustHaveNodeEnginesDeclaration extends ValidationRule {
   public readonly name = 'package-info/engines';
 
   public validate(pkg: PackageJson): void {
-    expectJSON(this.name, pkg, 'engines.node', '>= 10.13.0 <13 || >=13.7.0');
+    if (cdkMajorVersion() === 2) {
+      expectJSON(this.name, pkg, 'engines.node', '>= 14.15.0');
+    } else {
+      expectJSON(this.name, pkg, 'engines.node', '>= 10.13.0 <13 || >=13.7.0');
+    }
   }
 }
 
@@ -1310,11 +1340,11 @@ export class FastFailingBuildScripts extends ValidationRule {
     const hasTest = 'test' in scripts;
     const hasPack = 'package' in scripts;
 
-    const cmdBuild = 'npm run build';
-    expectJSON(this.name, pkg, 'scripts.build+test', hasTest ? [cmdBuild, 'npm test'].join(' && ') : cmdBuild);
+    const cmdBuild = 'yarn build';
+    expectJSON(this.name, pkg, 'scripts.build+test', hasTest ? [cmdBuild, 'yarn test'].join(' && ') : cmdBuild);
 
-    const cmdBuildTest = 'npm run build+test';
-    expectJSON(this.name, pkg, 'scripts.build+test+package', hasPack ? [cmdBuildTest, 'npm run package'].join(' && ') : cmdBuildTest);
+    const cmdBuildTest = 'yarn build+test';
+    expectJSON(this.name, pkg, 'scripts.build+test+package', hasPack ? [cmdBuildTest, 'yarn package'].join(' && ') : cmdBuildTest);
   }
 }
 
@@ -1508,9 +1538,7 @@ export class UbergenPackageVisibility extends ValidationRule {
   ];
 
   public validate(pkg: PackageJson): void {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const releaseJson = require(`${__dirname}/../../../release.json`);
-    if (releaseJson.majorVersion === 2) {
+    if (cdkMajorVersion() === 2) {
       // Only packages in the publicPackages list should be "public". Everything else should be private.
       if (this.publicPackages.includes(pkg.json.name) && pkg.json.private === true) {
         pkg.report({
@@ -1613,3 +1641,9 @@ function toRegExp(str: string): RegExp {
 function readBannerFile(file: string): string {
   return fs.readFileSync(path.join(__dirname, 'banners', file), { encoding: 'utf-8' }).trim();
 }
+
+function cdkMajorVersion() {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const releaseJson = require(`${__dirname}/../../../release.json`);
+  return releaseJson.majorVersion as number;
+}
diff --git a/tools/pkgtools/package.json b/tools/pkgtools/package.json
index d5255e81d465d..e9e23f3d9d35b 100644
--- a/tools/pkgtools/package.json
+++ b/tools/pkgtools/package.json
@@ -19,8 +19,8 @@
     "lint": "cdk-lint",
     "pkglint": "pkglint -f",
     "test": "cdk-test",
-    "build+test+package": "npm run build+test",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test",
+    "build+test": "yarn build && yarn test"
   },
   "author": {
     "name": "Amazon Web Services",
diff --git a/tools/ubergen/package.json b/tools/ubergen/package.json
index 483d7ecfa4dfa..99bb6c29345a5 100644
--- a/tools/ubergen/package.json
+++ b/tools/ubergen/package.json
@@ -17,8 +17,8 @@
     "lint": "cdk-lint",
     "pkglint": "pkglint -f",
     "test": "echo success",
-    "build+test+package": "npm run build+test",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test",
+    "build+test": "yarn build && yarn test"
   },
   "author": {
     "name": "Amazon Web Services",
diff --git a/tools/yarn-cling/package.json b/tools/yarn-cling/package.json
index aefba13ff8ee0..421d3314e0400 100644
--- a/tools/yarn-cling/package.json
+++ b/tools/yarn-cling/package.json
@@ -17,8 +17,8 @@
     "watch": "tsc -w",
     "pkglint": "pkglint -f",
     "test": "ln -sf ../../package2 test/test-fixture/package1/node_modules/ && jest",
-    "build+test+package": "npm run build+test",
-    "build+test": "npm run build && npm test"
+    "build+test+package": "yarn build+test",
+    "build+test": "yarn build && yarn test"
   },
   "cdk-build": {
     "jest": true
@@ -39,7 +39,7 @@
   },
   "devDependencies": {
     "@types/jest": "^26.0.15",
-    "@types/node": "^10.17.48",
+    "@types/node": "^10.17.51",
     "@types/yarnpkg__lockfile": "^1.1.4",
     "jest": "^26.6.3",
     "pkglint": "0.0.0",
diff --git a/version.v1.json b/version.v1.json
index 5ccb440326d66..e9e06b8086b92 100644
--- a/version.v1.json
+++ b/version.v1.json
@@ -1,3 +1,3 @@
 {
-  "version": "1.84.0"
+  "version": "1.85.0"
 }
diff --git a/yarn.lock b/yarn.lock
index f93eb67abe0e5..235af16d97bbd 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1616,10 +1616,10 @@
   dependencies:
     jszip "*"
 
-"@types/lodash@^4.14.167":
-  version "4.14.167"
-  resolved "https://registry.yarnpkg.com/@types/lodash/-/lodash-4.14.167.tgz#ce7d78553e3c886d4ea643c37ec7edc20f16765e"
-  integrity sha512-w7tQPjARrvdeBkX/Rwg95S592JwxqOjmms3zWQ0XZgSyxSLdzWaYH3vErBhdVS/lRBX7F8aBYcYJYTr5TMGOzw==
+"@types/lodash@^4.14.168":
+  version "4.14.168"
+  resolved "https://registry.yarnpkg.com/@types/lodash/-/lodash-4.14.168.tgz#fe24632e79b7ade3f132891afff86caa5e5ce008"
+  integrity sha512-oVfRvqHV/V6D1yifJbVRU3TMp8OT6o6BG+U9MkwuJ3U8/CsDHvalRpsxBqivn71ztOFZBTfJMvETbqHiaNSj7Q==
 
 "@types/md5@^2.2.1":
   version "2.2.1"
@@ -1655,10 +1655,10 @@
   resolved "https://registry.yarnpkg.com/@types/node/-/node-14.14.7.tgz#8ea1e8f8eae2430cf440564b98c6dfce1ec5945d"
   integrity sha512-Zw1vhUSQZYw+7u5dAwNbIA9TuTotpzY/OF7sJM9FqPOF3SPjKnxrjoTktXDZgUjybf4cWVBP7O8wvKdSaGHweg==
 
-"@types/node@^10.17.48":
-  version "10.17.48"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-10.17.48.tgz#726e7f25d00bf58d79c8f00dd586dd9a10d06a4f"
-  integrity sha512-Agl6xbYP6FOMDeAsr3QVZ+g7Yzg0uhPHWx0j5g4LFdUBHVtqtU+gH660k/lCEe506jJLOGbEzsnqPDTZGJQLag==
+"@types/node@^10.17.51":
+  version "10.17.51"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-10.17.51.tgz#639538575befbcf3d3861f95c41de8e47124d674"
+  integrity sha512-KANw+MkL626tq90l++hGelbl67irOJzGhUJk6a1Bt8QHOeh9tztJx+L0AqttraWKinmZn7Qi5lJZJzx45Gq0dg==
 
 "@types/nodeunit@^0.0.31":
   version "0.0.31"
@@ -1774,28 +1774,29 @@
   resolved "https://registry.yarnpkg.com/@types/yarnpkg__lockfile/-/yarnpkg__lockfile-1.1.4.tgz#445251eb00bd9c1e751f82c7c6bf4f714edfd464"
   integrity sha512-/emrKCfQMQmFCqRqqBJ0JueHBT06jBRM3e8OgnvDUcvuExONujIk2hFA5dNsN9Nt41ljGVDdChvCydATZ+KOZw==
 
-"@typescript-eslint/eslint-plugin@^4.12.0":
-  version "4.12.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.12.0.tgz#00d1b23b40b58031e6d7c04a5bc6c1a30a2e834a"
-  integrity sha512-wHKj6q8s70sO5i39H2g1gtpCXCvjVszzj6FFygneNFyIAxRvNSVz9GML7XpqrB9t7hNutXw+MHnLN/Ih6uyB8Q==
+"@typescript-eslint/eslint-plugin@^4.14.0":
+  version "4.14.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.14.0.tgz#92db8e7c357ed7d69632d6843ca70b71be3a721d"
+  integrity sha512-IJ5e2W7uFNfg4qh9eHkHRUCbgZ8VKtGwD07kannJvM5t/GU8P8+24NX8gi3Hf5jST5oWPY8kyV1s/WtfiZ4+Ww==
   dependencies:
-    "@typescript-eslint/experimental-utils" "4.12.0"
-    "@typescript-eslint/scope-manager" "4.12.0"
+    "@typescript-eslint/experimental-utils" "4.14.0"
+    "@typescript-eslint/scope-manager" "4.14.0"
     debug "^4.1.1"
     functional-red-black-tree "^1.0.1"
+    lodash "^4.17.15"
     regexpp "^3.0.0"
     semver "^7.3.2"
     tsutils "^3.17.1"
 
-"@typescript-eslint/experimental-utils@4.12.0", "@typescript-eslint/experimental-utils@^4.0.1":
-  version "4.12.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/experimental-utils/-/experimental-utils-4.12.0.tgz#372838e76db76c9a56959217b768a19f7129546b"
-  integrity sha512-MpXZXUAvHt99c9ScXijx7i061o5HEjXltO+sbYfZAAHxv3XankQkPaNi5myy0Yh0Tyea3Hdq1pi7Vsh0GJb0fA==
+"@typescript-eslint/experimental-utils@4.14.0", "@typescript-eslint/experimental-utils@^4.0.1":
+  version "4.14.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/experimental-utils/-/experimental-utils-4.14.0.tgz#5aa7b006736634f588a69ee343ca959cd09988df"
+  integrity sha512-6i6eAoiPlXMKRbXzvoQD5Yn9L7k9ezzGRvzC/x1V3650rUk3c3AOjQyGYyF9BDxQQDK2ElmKOZRD0CbtdkMzQQ==
   dependencies:
     "@types/json-schema" "^7.0.3"
-    "@typescript-eslint/scope-manager" "4.12.0"
-    "@typescript-eslint/types" "4.12.0"
-    "@typescript-eslint/typescript-estree" "4.12.0"
+    "@typescript-eslint/scope-manager" "4.14.0"
+    "@typescript-eslint/types" "4.14.0"
+    "@typescript-eslint/typescript-estree" "4.14.0"
     eslint-scope "^5.0.0"
     eslint-utils "^2.0.0"
 
@@ -1809,13 +1810,13 @@
     "@typescript-eslint/typescript-estree" "4.7.0"
     debug "^4.1.1"
 
-"@typescript-eslint/scope-manager@4.12.0":
-  version "4.12.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-4.12.0.tgz#beeb8beca895a07b10c593185a5612f1085ef279"
-  integrity sha512-QVf9oCSVLte/8jvOsxmgBdOaoe2J0wtEmBr13Yz0rkBNkl5D8bfnf6G4Vhox9qqMIoG7QQoVwd2eG9DM/ge4Qg==
+"@typescript-eslint/scope-manager@4.14.0":
+  version "4.14.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-4.14.0.tgz#55a4743095d684e1f7b7180c4bac2a0a3727f517"
+  integrity sha512-/J+LlRMdbPh4RdL4hfP1eCwHN5bAhFAGOTsvE6SxsrM/47XQiPSgF5MDgLyp/i9kbZV9Lx80DW0OpPkzL+uf8Q==
   dependencies:
-    "@typescript-eslint/types" "4.12.0"
-    "@typescript-eslint/visitor-keys" "4.12.0"
+    "@typescript-eslint/types" "4.14.0"
+    "@typescript-eslint/visitor-keys" "4.14.0"
 
 "@typescript-eslint/scope-manager@4.7.0":
   version "4.7.0"
@@ -1825,23 +1826,23 @@
     "@typescript-eslint/types" "4.7.0"
     "@typescript-eslint/visitor-keys" "4.7.0"
 
-"@typescript-eslint/types@4.12.0":
-  version "4.12.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-4.12.0.tgz#fb891fe7ccc9ea8b2bbd2780e36da45d0dc055e5"
-  integrity sha512-N2RhGeheVLGtyy+CxRmxdsniB7sMSCfsnbh8K/+RUIXYYq3Ub5+sukRCjVE80QerrUBvuEvs4fDhz5AW/pcL6g==
+"@typescript-eslint/types@4.14.0":
+  version "4.14.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-4.14.0.tgz#d8a8202d9b58831d6fd9cee2ba12f8a5a5dd44b6"
+  integrity sha512-VsQE4VvpldHrTFuVPY1ZnHn/Txw6cZGjL48e+iBxTi2ksa9DmebKjAeFmTVAYoSkTk7gjA7UqJ7pIsyifTsI4A==
 
 "@typescript-eslint/types@4.7.0":
   version "4.7.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-4.7.0.tgz#5e95ef5c740f43d942542b35811f87b62fccca69"
   integrity sha512-uLszFe0wExJc+I7q0Z/+BnP7wao/kzX0hB5vJn4LIgrfrMLgnB2UXoReV19lkJQS1a1mHWGGODSxnBx6JQC3Sg==
 
-"@typescript-eslint/typescript-estree@4.12.0":
-  version "4.12.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-4.12.0.tgz#3963418c850f564bdab3882ae23795d115d6d32e"
-  integrity sha512-gZkFcmmp/CnzqD2RKMich2/FjBTsYopjiwJCroxqHZIY11IIoN0l5lKqcgoAPKHt33H2mAkSfvzj8i44Jm7F4w==
+"@typescript-eslint/typescript-estree@4.14.0":
+  version "4.14.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-4.14.0.tgz#4bcd67486e9acafc3d0c982b23a9ab8ac8911ed7"
+  integrity sha512-wRjZ5qLao+bvS2F7pX4qi2oLcOONIB+ru8RGBieDptq/SudYwshveORwCVU4/yMAd4GK7Fsf8Uq1tjV838erag==
   dependencies:
-    "@typescript-eslint/types" "4.12.0"
-    "@typescript-eslint/visitor-keys" "4.12.0"
+    "@typescript-eslint/types" "4.14.0"
+    "@typescript-eslint/visitor-keys" "4.14.0"
     debug "^4.1.1"
     globby "^11.0.1"
     is-glob "^4.0.1"
@@ -1863,12 +1864,12 @@
     semver "^7.3.2"
     tsutils "^3.17.1"
 
-"@typescript-eslint/visitor-keys@4.12.0":
-  version "4.12.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-4.12.0.tgz#a470a79be6958075fa91c725371a83baf428a67a"
-  integrity sha512-hVpsLARbDh4B9TKYz5cLbcdMIOAoBYgFPCSP9FFS/liSF+b33gVNq8JHY3QGhHNVz85hObvL7BEYLlgx553WCw==
+"@typescript-eslint/visitor-keys@4.14.0":
+  version "4.14.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-4.14.0.tgz#b1090d9d2955b044b2ea2904a22496849acbdf54"
+  integrity sha512-MeHHzUyRI50DuiPgV9+LxcM52FCJFYjJiWHtXlbyC27b80mfOwKeiKI+MHOTEpcpfmoPFm/vvQS88bYIx6PZTA==
   dependencies:
-    "@typescript-eslint/types" "4.12.0"
+    "@typescript-eslint/types" "4.14.0"
     eslint-visitor-keys "^2.0.0"
 
 "@typescript-eslint/visitor-keys@4.7.0":
@@ -2309,10 +2310,10 @@ aws-sdk-mock@^5.1.0:
     sinon "^9.0.1"
     traverse "^0.6.6"
 
-aws-sdk@^2.637.0, aws-sdk@^2.827.0:
-  version "2.827.0"
-  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.827.0.tgz#372e37cabf0e8351de6d8f07a8f519bfaaeeae2a"
-  integrity sha512-71PWS1dqJ65/SeNgDQWEgbJ6oKCuB+Ypq30TM3EyzbAHaxl69WjQRK71oJ2bjhdIHfGQJtOV0G9wg4zpge4Erg==
+aws-sdk@^2.637.0, aws-sdk@^2.828.0:
+  version "2.828.0"
+  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.828.0.tgz#6aa599c3582f219568f41fb287eb65753e4a9234"
+  integrity sha512-JoDujGdncSIF9ka+XFZjop/7G+fNGucwPwYj7OHYMmFIOV5p7YmqomdbVmH/vIzd988YZz8oLOinWc4jM6vvhg==
   dependencies:
     buffer "4.9.2"
     events "1.1.1"
@@ -3943,10 +3944,10 @@ es6-promisify@^5.0.0:
   dependencies:
     es6-promise "^4.0.3"
 
-esbuild@^0.8.32:
-  version "0.8.32"
-  resolved "https://registry.yarnpkg.com/esbuild/-/esbuild-0.8.32.tgz#d3d679ea417925f7afaab37555e52070df317355"
-  integrity sha512-5IzQapMW/wFy5oxziHCJzawk26K3xeyrIAQPnPN3c0Q84hqRw6IfGDGfGWOdJNw5tAx77yvwqZ4r1QMpo6emJA==
+esbuild@^0.8.33:
+  version "0.8.33"
+  resolved "https://registry.yarnpkg.com/esbuild/-/esbuild-0.8.33.tgz#4e24ab4e780b08ff5527171bf5a684594c8b56e9"
+  integrity sha512-2ms/P6Y9zJfopR9dKo2vHzhXKfGSNlquVVoVOF8YnhjuzZVrvManMVBPadBsR/t7jzIkRnwqvxrs7d4f3C3eyg==
 
 escalade@^3.1.1:
   version "3.1.1"
@@ -9923,10 +9924,10 @@ typedarray@^0.0.6:
   resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777"
   integrity sha1-hnrHTjhkGHsdPUfZlqeOxciDB3c=
 
-typescript-json-schema@^0.46.0:
-  version "0.46.0"
-  resolved "https://registry.yarnpkg.com/typescript-json-schema/-/typescript-json-schema-0.46.0.tgz#45204ba80915db3608d01de5b839c470c053e716"
-  integrity sha512-9ktZr69Yh6iGTWVa3Ln0J+H6RyAoED9e68tz8k+0lIiCR+UZLvpvs9PqsSsE7aZ7Olvg0p161ls7JHldlA0Ocg==
+typescript-json-schema@^0.47.0:
+  version "0.47.0"
+  resolved "https://registry.yarnpkg.com/typescript-json-schema/-/typescript-json-schema-0.47.0.tgz#84dde5460b127c6774da81bf70b23c7e04857b13"
+  integrity sha512-A6NVwSOTSsNDHfaqDcDeKwwyXEeKqBHoAr20jcetnYj4e8C6zVFofAVhAuwsBXCRYiWEE/lyHrcxpsSpbIk0Mg==
   dependencies:
     "@types/json-schema" "^7.0.6"
     glob "^7.1.6"