Merge branch 'main' into main

packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/extension-interfaces.ts

@@ -1,7 +1,7 @@
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as cdk from '@aws-cdk/core';
-import { Service, ConnectToProps } from '../service';
 import { Construct } from 'constructs';
+import { Service, ConnectToProps } from '../service';
 
 /**
  * The types of capacity that are supported. These capacity types may change the

packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/injecter.ts

@@ -1,13 +1,10 @@
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as sns from '@aws-cdk/aws-sns';
+import { Construct } from 'constructs';
 import { Service } from '../service';
 import { Container } from './container';
 import { ContainerMutatingHook, ServiceExtension } from './extension-interfaces';
 
-// Keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
-import { Construct } from 'constructs';
-
 /**
  * An interface that will be implemented by all the resources that can be published events or written data to.
  */

packages/@aws-cdk-containers/ecs-service-extensions/lib/service.ts

@@ -1,14 +1,11 @@
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as iam from '@aws-cdk/aws-iam';
+import { Construct } from 'constructs';
 import { IEnvironment } from './environment';
 import { EnvironmentCapacityType, ServiceBuild } from './extensions/extension-interfaces';
 import { ServiceDescription } from './service-description';
 
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
-import { Construct } from 'constructs';
-
 /**
  * connectToProps will have all the extra parameters which are required for connecting services.
  */

packages/@aws-cdk/assets/lib/staging.ts

@@ -1,11 +1,8 @@
 import { AssetStaging } from '@aws-cdk/core';
+import { Construct } from 'constructs';
 import { toSymlinkFollow } from './compat';
 import { FingerprintOptions } from './fs/options';
 
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
-import { Construct } from 'constructs';
-
 /**
  * Deprecated
  * @deprecated use `core.AssetStagingProps`

packages/@aws-cdk/aws-apigateway/lib/api-definition.ts

@@ -1,8 +1,5 @@
 import * as s3 from '@aws-cdk/aws-s3';
 import * as s3_assets from '@aws-cdk/aws-s3-assets';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import * as cxapi from '@aws-cdk/cx-api';
 import { Construct, Node } from 'constructs';
 import { CfnRestApi } from './apigateway.generated';

packages/@aws-cdk/aws-apigateway/test/api-definition.test.ts

@@ -1,5 +1,5 @@
-import { Template } from '@aws-cdk/assertions';
 import * as path from 'path';
+import { Template } from '@aws-cdk/assertions';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';

packages/@aws-cdk/aws-apigateway/test/usage-plan.test.ts

@@ -1,7 +1,7 @@
 import { Template } from '@aws-cdk/assertions';
+import { testFutureBehavior } from '@aws-cdk/cdk-build-tools/lib/feature-flag';
 import * as cdk from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';
-import { testFutureBehavior } from '@aws-cdk/cdk-build-tools/lib/feature-flag';
 import * as apigateway from '../lib';
 
 const RESOURCE_TYPE = 'AWS::ApiGateway::UsagePlan';

packages/@aws-cdk/aws-appmesh/lib/health-checks.ts

@@ -1,11 +1,8 @@
 import * as cdk from '@aws-cdk/core';
+import { Construct } from 'constructs';
 import { CfnVirtualGateway, CfnVirtualNode } from './appmesh.generated';
 import { Protocol } from './shared-interfaces';
 
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
-import { Construct } from 'constructs';
-
 /**
  * Properties used to define healthchecks.
  */

packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts

@@ -167,11 +167,6 @@ export interface OpenIdConnectConfig {
 export interface LambdaAuthorizerConfig {
   /**
    * The authorizer lambda function.
-   * Note: This Lambda function must have the following resource-based policy assigned to it.
-   * When configuring Lambda authorizers in the console, this is done for you.
-   * To do so with the AWS CLI, run the following:
-   *
-   * `aws lambda add-permission --function-name "arn:aws:lambda:us-east-2:111122223333:function:my-function" --statement-id "appsync" --principal appsync.amazonaws.com --action lambda:InvokeFunction`
    *
    * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appsync-graphqlapi-lambdaauthorizerconfig.html
    */
@@ -519,6 +514,17 @@ export class GraphqlApi extends GraphqlApiBase {
       this.apiKeyResource.addDependsOn(this.schemaResource);
       this.apiKey = this.apiKeyResource.attrApiKey;
     }
+
+    if (modes.some((mode) => mode.authorizationType === AuthorizationType.LAMBDA)) {
+      const config = modes.find((mode: AuthorizationMode) => {
+        return mode.authorizationType === AuthorizationType.LAMBDA && mode.lambdaAuthorizerConfig;
+      })?.lambdaAuthorizerConfig;
+      config?.handler.addPermission('appsync', {
+        principal: new ServicePrincipal('appsync.amazonaws.com'),
+        action: 'lambda:InvokeFunction',
+      });
+    }
+
   }
 
   /**

packages/@aws-cdk/aws-appsync/test/appsync-auth.test.ts

@@ -669,6 +669,18 @@ describe('AppSync Lambda Authorization', () => {
         },
       },
     });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
+      Action: 'lambda:InvokeFunction',
+      FunctionName: {
+        'Fn::GetAtt': [
+          'authfunction96361832',
+          'Arn',
+        ],
+      },
+    });
+
+
   });
 
   test('Lambda authorization configurable in default authorization', () => {
@@ -702,6 +714,15 @@ describe('AppSync Lambda Authorization', () => {
         IdentityValidationExpression: 'custom-.*',
       },
     });
+    Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
+      Action: 'lambda:InvokeFunction',
+      FunctionName: {
+        'Fn::GetAtt': [
+          'authfunction96361832',
+          'Arn',
+        ],
+      },
+    });
   });
 
   test('Lambda authorization configurable in additional authorization has default configuration', () => {
@@ -733,6 +754,15 @@ describe('AppSync Lambda Authorization', () => {
         },
       }],
     });
+    Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
+      Action: 'lambda:InvokeFunction',
+      FunctionName: {
+        'Fn::GetAtt': [
+          'authfunction96361832',
+          'Arn',
+        ],
+      },
+    });
   });
 
   test('Lambda authorization configurable in additional authorization', () => {
@@ -768,6 +798,15 @@ describe('AppSync Lambda Authorization', () => {
         },
       }],
     });
+    Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
+      Action: 'lambda:InvokeFunction',
+      FunctionName: {
+        'Fn::GetAtt': [
+          'authfunction96361832',
+          'Arn',
+        ],
+      },
+    });
   });
 
   test('Lambda authorization throws with multiple lambda authorization', () => {

packages/@aws-cdk/aws-autoscaling-hooktargets/lib/common.ts

@@ -1,8 +1,5 @@
 // eslint-disable-next-line import/order
 import * as iam from '@aws-cdk/aws-iam';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import * as constructs from 'constructs';
 
 export function createRole(scope: constructs.Construct, _role?: iam.IRole) {

packages/@aws-cdk/aws-autoscaling-hooktargets/lib/lambda-hook.ts

@@ -3,14 +3,10 @@ import * as kms from '@aws-cdk/aws-kms';
 import * as lambda from '@aws-cdk/aws-lambda';
 import * as sns from '@aws-cdk/aws-sns';
 import * as subs from '@aws-cdk/aws-sns-subscriptions';
-
+import { Construct } from 'constructs';
 import { createRole } from './common';
 import { TopicHook } from './topic-hook';
 
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
-import { Construct } from 'constructs';
-
 /**
  * Use a Lambda Function as a hook target
  *

packages/@aws-cdk/aws-autoscaling-hooktargets/lib/queue-hook.ts

@@ -1,10 +1,7 @@
 import * as autoscaling from '@aws-cdk/aws-autoscaling';
 import * as sqs from '@aws-cdk/aws-sqs';
-import { createRole } from './common';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
+import { createRole } from './common';
 
 /**
  * Use an SQS queue as a hook target

packages/@aws-cdk/aws-autoscaling-hooktargets/lib/topic-hook.ts

@@ -1,10 +1,7 @@
 import * as autoscaling from '@aws-cdk/aws-autoscaling';
 import * as sns from '@aws-cdk/aws-sns';
-import { createRole } from './common';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
+import { createRole } from './common';
 
 /**
  * Use an SNS topic as a hook target

packages/@aws-cdk/aws-autoscaling/lib/lifecycle-hook-target.ts

@@ -1,9 +1,6 @@
 // eslint-disable-next-line import/order
 import { LifecycleHook } from './lifecycle-hook';
 import * as iam from '@aws-cdk/aws-iam';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import * as constructs from 'constructs';
 
 /**

packages/@aws-cdk/aws-cloudformation/test/integ.core-custom-resources.ts

@@ -8,9 +8,6 @@
  *   - GetAtt.Attribute2: 1234
  */
 import { App, CfnOutput, CustomResource, CustomResourceProvider, CustomResourceProviderRuntime, Stack, Token } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 /* eslint-disable @aws-cdk/no-core-construct */

packages/@aws-cdk/aws-cloudformation/test/integ.nested-stack.ts

@@ -3,9 +3,6 @@ import * as sns from '@aws-cdk/aws-sns';
 import * as sns_subscriptions from '@aws-cdk/aws-sns-subscriptions';
 import * as sqs from '@aws-cdk/aws-sqs';
 import { App, CfnParameter, NestedStack, Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 /* eslint-disable @aws-cdk/no-core-construct */

packages/@aws-cdk/aws-cloudformation/test/integ.nested-stacks-assets.ts

@@ -2,9 +2,6 @@
 import * as path from 'path';
 import * as lambda from '@aws-cdk/aws-lambda';
 import { App, NestedStack, Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 /* eslint-disable @aws-cdk/no-core-construct */

packages/@aws-cdk/aws-cloudformation/test/integ.nested-stacks-multi.ts

@@ -1,9 +1,6 @@
 /// !cdk-integ pragma:ignore-assets
 import * as sns from '@aws-cdk/aws-sns';
 import { App, NestedStack, Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 /* eslint-disable @aws-cdk/no-core-construct */

packages/@aws-cdk/aws-cloudformation/test/integ.nested-stacks-refs1.ts

@@ -2,13 +2,8 @@
 
 // nested stack references a resource from a non-nested non-parent stack
 
-/* eslint-disable @aws-cdk/no-core-construct */
-
 import * as sns from '@aws-cdk/aws-sns';
 import { App, NestedStack, Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 class ConsumerNestedStack extends NestedStack {

packages/@aws-cdk/aws-cloudformation/test/integ.nested-stacks-refs2.ts

@@ -1,9 +1,6 @@
 /// !cdk-integ *
 import * as sns from '@aws-cdk/aws-sns';
 import { App, Fn, NestedStack, Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 // non-nested non-parent stack consumes a resource from a nested stack

packages/@aws-cdk/aws-cloudformation/test/integ.nested-stacks-refs3.ts

@@ -1,9 +1,6 @@
 /// !cdk-integ *
 import * as sns from '@aws-cdk/aws-sns';
 import { App, Fn, NestedStack, Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 // references between siblings

packages/@aws-cdk/aws-cloudformation/test/nested-stack.test.ts

@@ -6,11 +6,8 @@ import * as sns from '@aws-cdk/aws-sns';
 import { describeDeprecated } from '@aws-cdk/cdk-build-tools';
 import { App, CfnParameter, CfnResource, ContextProvider, LegacyStackSynthesizer, Names, Stack } from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';
-import { NestedStack } from '../lib/nested-stack';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
+import { NestedStack } from '../lib/nested-stack';
 
 /* eslint-disable @aws-cdk/no-core-construct */
 /* eslint-disable max-len */

packages/@aws-cdk/aws-cloudformation/test/resource.test.ts

@@ -3,11 +3,8 @@ import * as lambda from '@aws-cdk/aws-lambda';
 import * as sns from '@aws-cdk/aws-sns';
 import { describeDeprecated, testDeprecated } from '@aws-cdk/cdk-build-tools';
 import * as cdk from '@aws-cdk/core';
-import { CustomResource, CustomResourceProvider } from '../lib';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
+import { CustomResource, CustomResourceProvider } from '../lib';
 
 /* eslint-disable @aws-cdk/no-core-construct */
 /* eslint-disable quote-props */

packages/@aws-cdk/aws-cloudfront/lib/origin.ts

@@ -1,9 +1,6 @@
 import { Duration, Token } from '@aws-cdk/core';
-import { CfnDistribution } from './cloudfront.generated';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
+import { CfnDistribution } from './cloudfront.generated';
 
 /**
  * The failover configuration used for Origin Groups,

packages/@aws-cdk/aws-cloudwatch-actions/lib/ec2.ts

@@ -1,8 +1,5 @@
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import { Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 /**

packages/@aws-cdk/aws-cloudwatch-actions/lib/ssm.ts

@@ -1,8 +1,5 @@
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import { Stack } from '@aws-cdk/core';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
 
 /**

packages/@aws-cdk/aws-cloudwatch/lib/alarm-action.ts

@@ -1,8 +1,5 @@
-import { IAlarm } from './alarm-base';
-
-// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
-// eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from 'constructs';
+import { IAlarm } from './alarm-base';
 
 /**
  * Interface for objects that can be the targets of CloudWatch alarm actions