diff --git a/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts b/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
index e784850965d7a..d6b939196582e 100644
--- a/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
+++ b/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
@@ -140,7 +140,7 @@ export class PipelineDeployStackAction extends cdk.Construct {
     });
   }
 
-  public validate(): string[] {
+  protected validate(): string[] {
     const result = super.validate();
     const assets = this.stack.node.metadata.filter(md => md.type === cxapi.ASSET_METADATA);
     if (assets.length > 0) {
diff --git a/packages/@aws-cdk/aws-apigateway/lib/restapi.ts b/packages/@aws-cdk/aws-apigateway/lib/restapi.ts
index 36d8b114bea2e..743077d422bc7 100644
--- a/packages/@aws-cdk/aws-apigateway/lib/restapi.ts
+++ b/packages/@aws-cdk/aws-apigateway/lib/restapi.ts
@@ -312,7 +312,7 @@ export class RestApi extends cdk.Construct implements cdk.IDependable, IRestApi
   /**
    * Performs validation of the REST API.
    */
-  public validate() {
+  protected validate() {
     if (this.methods.length === 0) {
       return [ `The REST API doesn't contain any methods` ];
     }
diff --git a/packages/@aws-cdk/aws-codebuild/lib/project.ts b/packages/@aws-cdk/aws-codebuild/lib/project.ts
index adaa2bec62d0f..b598da915b22e 100644
--- a/packages/@aws-cdk/aws-codebuild/lib/project.ts
+++ b/packages/@aws-cdk/aws-codebuild/lib/project.ts
@@ -708,7 +708,7 @@ export class Project extends ProjectBase {
   /**
    * @override
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     const ret = new Array<string>();
     if (this.source.type === SourceType.CodePipeline) {
       if (this._secondarySources.length > 0) {
diff --git a/packages/@aws-cdk/aws-codepipeline-api/lib/action.ts b/packages/@aws-cdk/aws-codepipeline-api/lib/action.ts
index 5d6fdacf9fba8..f444635ba288b 100644
--- a/packages/@aws-cdk/aws-codepipeline-api/lib/action.ts
+++ b/packages/@aws-cdk/aws-codepipeline-api/lib/action.ts
@@ -239,7 +239,7 @@ export abstract class Action extends cdk.Construct {
     this.stage._internal._attachAction(this);
   }
 
-  public validate(): string[] {
+  protected validate(): string[] {
     return validation.validateArtifactBounds('input', this._actionInputArtifacts, this.artifactBounds.minInputs,
         this.artifactBounds.maxInputs, this.category, this.provider)
       .concat(validation.validateArtifactBounds('output', this._actionOutputArtifacts, this.artifactBounds.minOutputs,
diff --git a/packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts b/packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts
index 8a99849447de5..00c0d6fb93ad1 100644
--- a/packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts
+++ b/packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts
@@ -220,7 +220,7 @@ export class Pipeline extends cdk.Construct implements cpapi.IPipeline {
    * https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#pipeline-requirements
    * @override
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     return [
       ...this.validateHasStages(),
       ...this.validateSourceActionLocations()
diff --git a/packages/@aws-cdk/aws-codepipeline/lib/stage.ts b/packages/@aws-cdk/aws-codepipeline/lib/stage.ts
index ee51f5c5fa33b..8b947a47c96bd 100644
--- a/packages/@aws-cdk/aws-codepipeline/lib/stage.ts
+++ b/packages/@aws-cdk/aws-codepipeline/lib/stage.ts
@@ -105,7 +105,7 @@ export class Stage extends cdk.Construct implements cpapi.IStage, cpapi.IInterna
     return this._actions.slice();
   }
 
-  public validate(): string[] {
+  protected validate(): string[] {
     return this.validateHasActions();
   }
 
diff --git a/packages/@aws-cdk/aws-dynamodb/lib/table.ts b/packages/@aws-cdk/aws-dynamodb/lib/table.ts
index d54facfe611d9..cd8ebef7be464 100644
--- a/packages/@aws-cdk/aws-dynamodb/lib/table.ts
+++ b/packages/@aws-cdk/aws-dynamodb/lib/table.ts
@@ -474,7 +474,7 @@ export class Table extends Construct {
    *
    * @returns an array of validation error message
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     const errors = new Array<string>();
 
     if (!this.tablePartitionKey) {
diff --git a/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts b/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts
index 4c197604b76d2..42497d3e1ec3c 100644
--- a/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts
@@ -245,7 +245,7 @@ export class TaskDefinition extends cdk.Construct {
   /**
    * Validate this task definition
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     const ret = super.validate();
 
     if (isEc2Compatible(this.compatibility)) {
@@ -423,4 +423,4 @@ export interface ITaskDefinitionExtension {
    * Apply the extension to the given TaskDefinition
    */
   extend(taskDefinition: TaskDefinition): void;
-}
\ No newline at end of file
+}
diff --git a/packages/@aws-cdk/aws-ecs/lib/ec2/ec2-service.ts b/packages/@aws-cdk/aws-ecs/lib/ec2/ec2-service.ts
index 80e85bf387778..80628ad98ccb6 100644
--- a/packages/@aws-cdk/aws-ecs/lib/ec2/ec2-service.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/ec2/ec2-service.ts
@@ -231,7 +231,7 @@ export class Ec2Service extends BaseService implements elb.ILoadBalancerTarget {
   /**
    * Validate this Ec2Service
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     const ret = super.validate();
     if (!this.cluster.hasEc2Capacity) {
       ret.push('Cluster for this service needs Ec2 capacity. Call addXxxCapacity() on the cluster.');
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts
index cbe634e20b6c6..df53ed3f16daa 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.ts
@@ -112,7 +112,7 @@ export class ApplicationListenerRule extends cdk.Construct implements cdk.IDepen
   /**
    * Validate the rule
    */
-  public validate() {
+  protected validate() {
     if (this.actions.length === 0) {
       return ['Listener rule needs at least one action'];
     }
@@ -142,4 +142,4 @@ export class ApplicationListenerRule extends cdk.Construct implements cdk.IDepen
     }
     return ret;
   }
-}
\ No newline at end of file
+}
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener.ts
index 60c2033f1e153..45fe5083c841e 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener.ts
@@ -227,7 +227,7 @@ export class ApplicationListener extends BaseListener implements IApplicationLis
   /**
    * Validate this listener.
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     const errors = super.validate();
     if (this.protocol === ApplicationProtocol.Https && this.certificateArns.length === 0) {
       errors.push('HTTPS Listener needs at least one certificate (call addCertificateArns)');
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-listener.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-listener.ts
index a4043438529b8..44b8299d5cb9b 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-listener.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-listener.ts
@@ -25,7 +25,7 @@ export abstract class BaseListener extends cdk.Construct implements cdk.IDependa
   /**
    * Validate this listener
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     if (this.defaultActions.length === 0) {
       return ['Listener needs at least one default target group (call addTargetGroups)'];
     }
diff --git a/packages/@aws-cdk/aws-events/lib/rule.ts b/packages/@aws-cdk/aws-events/lib/rule.ts
index e7ff424d4f582..56b58e73c96c5 100644
--- a/packages/@aws-cdk/aws-events/lib/rule.ts
+++ b/packages/@aws-cdk/aws-events/lib/rule.ts
@@ -199,7 +199,7 @@ export class EventRule extends Construct implements IEventRule {
     mergeEventPattern(this.eventPattern, eventPattern);
   }
 
-  public validate() {
+  protected validate() {
     if (Object.keys(this.eventPattern).length === 0 && !this.scheduleExpression) {
       return [ `Either 'eventPattern' or 'scheduleExpression' must be defined` ];
     }
diff --git a/packages/@aws-cdk/aws-iam/lib/policy.ts b/packages/@aws-cdk/aws-iam/lib/policy.ts
index d3a5104a02b9e..6c5208a7b9dd9 100644
--- a/packages/@aws-cdk/aws-iam/lib/policy.ts
+++ b/packages/@aws-cdk/aws-iam/lib/policy.ts
@@ -171,7 +171,7 @@ export class Policy extends Construct implements IDependable {
     group.attachInlinePolicy(this);
   }
 
-  public validate(): string[] {
+  protected validate(): string[] {
     const result = new Array<string>();
 
     // validate that the policy document is not empty
diff --git a/packages/@aws-cdk/aws-rds/lib/cluster-parameter-group.ts b/packages/@aws-cdk/aws-rds/lib/cluster-parameter-group.ts
index 59d0c1afb2441..10a8e89c06524 100644
--- a/packages/@aws-cdk/aws-rds/lib/cluster-parameter-group.ts
+++ b/packages/@aws-cdk/aws-rds/lib/cluster-parameter-group.ts
@@ -105,7 +105,7 @@ export class ClusterParameterGroup extends cdk.Construct implements IClusterPara
   /**
    * Validate this construct
    */
-  public validate(): string[] {
+  protected validate(): string[] {
     if (Object.keys(this.parameters).length === 0) {
       return ['At least one parameter required, call setParameter().'];
     }
diff --git a/packages/@aws-cdk/aws-stepfunctions/lib/states/parallel.ts b/packages/@aws-cdk/aws-stepfunctions/lib/states/parallel.ts
index 1833dbf5988b5..d54a683547558 100644
--- a/packages/@aws-cdk/aws-stepfunctions/lib/states/parallel.ts
+++ b/packages/@aws-cdk/aws-stepfunctions/lib/states/parallel.ts
@@ -107,7 +107,7 @@ export class Parallel extends State implements INextable {
     /**
      * Validate this state
      */
-    public validate(): string[] {
+    protected validate(): string[] {
         if (this.branches.length === 0) {
             return ['Parallel must have at least one branch'];
         }
diff --git a/packages/@aws-cdk/cdk/test/core/test.construct.ts b/packages/@aws-cdk/cdk/test/core/test.construct.ts
index aa70c643d8e51..dc786b63b1288 100644
--- a/packages/@aws-cdk/cdk/test/core/test.construct.ts
+++ b/packages/@aws-cdk/cdk/test/core/test.construct.ts
@@ -307,13 +307,13 @@ export = {
   'construct.validate() can be implemented to perform validation, construct.validateTree() will return all errors from the subtree (DFS)'(test: Test) {
 
     class MyConstruct extends Construct {
-      public validate() {
+      protected validate() {
         return [ 'my-error1', 'my-error2' ];
       }
     }
 
     class YourConstruct extends Construct {
-      public validate() {
+      protected validate() {
         return [ 'your-error1' ];
       }
     }
@@ -325,7 +325,7 @@ export = {
         new YourConstruct(this, 'YourConstruct');
       }
 
-      public validate() {
+      protected validate() {
         return [ 'their-error' ];
       }
     }
@@ -338,7 +338,7 @@ export = {
         new TheirConstruct(this, 'TheirConstruct');
       }
 
-      public validate() {
+      protected validate() {
         return  [ 'stack-error' ];
       }
     }
diff --git a/packages/@aws-cdk/cdk/test/test.app.ts b/packages/@aws-cdk/cdk/test/test.app.ts
index 8c55bc8cc4d45..b0e5edff50db5 100644
--- a/packages/@aws-cdk/cdk/test/test.app.ts
+++ b/packages/@aws-cdk/cdk/test/test.app.ts
@@ -195,7 +195,7 @@ export = {
   'app.synthesizeStack(stack) performs validation first (app.validateAll()) and if there are errors, it returns the errors'(test: Test) {
 
     class Child extends Construct {
-      public validate() {
+      protected validate() {
         return [ `Error from ${this.node.id}` ];
       }
     }