Merge branch 'master' into corymhall/fix-python-win-bundling

.github/workflows/cr-checklist.yml

@@ -9,7 +9,7 @@ jobs:
     name: Creates a checklist for PRs that contain changes to custom resources
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Dynamic checklist action
         uses: vishalsinha21/dynamic-checklist@v1
         with:

.github/workflows/pr-linter.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Install & Build prlint
         run: yarn install --frozen-lockfile && cd tools/@aws-cdk/prlint && yarn build+test

.github/workflows/v2-pull-request.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           branch: ${{ github.event.pull_request.head.ref }}
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/yarn-upgrade.yml

@@ -15,10 +15,10 @@ jobs:
     steps:
 
       - name: Check Out
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Set up Node
-        uses: actions/setup-node@v2.5.1
+        uses: actions/setup-node@v3
         with:
           node-version: 12
 
@@ -87,7 +87,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check Out
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Download patch
         uses: actions/download-artifact@v2

.mergify.yml

@@ -10,7 +10,7 @@ pull_request_rules:
       label:
         add: [ contribution/core ]
     conditions:
-      - author~=^(eladb|RomainMuller|garnaat|nija-at|skinny85|rix0rrr|NGL321|Jerry-AWS|MrArnoldPalmer|NetaNir|iliapolo|njlynch|ericzbeard|ccfife|fulghum|pkandasamy91|SoManyHs|uttarasridhar|otaviomacedo|BenChaimberg|madeline-k|BryanPan342|kaizen3031593|comcalvi|Chriscbr|corymhall|peterwoodworth|ryparker)$
+      - author~=^(eladb|RomainMuller|garnaat|nija-at|skinny85|rix0rrr|NGL321|Jerry-AWS|MrArnoldPalmer|NetaNir|iliapolo|njlynch|ericzbeard|ccfife|fulghum|pkandasamy91|SoManyHs|uttarasridhar|otaviomacedo|BenChaimberg|madeline-k|BryanPan342|kaizen3031593|comcalvi|Chriscbr|corymhall|peterwoodworth|ryparker|TheRealAmazonKendra)$
       - -label~="contribution/core"
   - name: automatic merge
     actions:

package.json

@@ -27,6 +27,7 @@
     "jsii-rosetta": "^1.54.0",
     "lerna": "^4.0.0",
     "patch-package": "^6.4.7",
+    "semver": "^6.3.0",
     "standard-version": "^9.3.2",
     "typescript": "~3.9.10"
   },

packages/@aws-cdk-containers/ecs-service-extensions/package.json

@@ -37,7 +37,7 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@types/jest": "^27.4.0",
+    "@types/jest": "^27.4.1",
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/cdk-integ-tools": "0.0.0",
     "@aws-cdk/aws-autoscaling": "0.0.0",

packages/@aws-cdk-containers/ecs-service-extensions/test/integ.assign-public-ip.expected.json

@@ -766,7 +766,8 @@
                 "dynamodb:BatchWriteItem",
                 "dynamodb:PutItem",
                 "dynamodb:UpdateItem",
-                "dynamodb:DeleteItem"
+                "dynamodb:DeleteItem",
+                "dynamodb:DescribeTable"
               ],
               "Effect": "Allow",
               "Resource": [

packages/@aws-cdk/alexa-ask/package.json

@@ -84,7 +84,7 @@
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/cfn2ts": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0"
+    "@types/jest": "^27.4.1"
   },
   "dependencies": {
     "@aws-cdk/core": "0.0.0",

packages/@aws-cdk/app-delivery/package.json

@@ -72,7 +72,7 @@
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/cdk-integ-tools": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0",
+    "@types/jest": "^27.4.1",
     "fast-check": "^2.22.0",
     "jest": "^27.5.1"
   },

packages/@aws-cdk/assert-internal/package.json

@@ -26,7 +26,7 @@
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0",
+    "@types/jest": "^27.4.1",
     "jest": "^27.5.1",
     "ts-jest": "^27.1.3"
   },

packages/@aws-cdk/assert/package.json

@@ -37,7 +37,7 @@
     "@aws-cdk/assert-internal": "0.0.0",
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0",
+    "@types/jest": "^27.4.1",
     "aws-cdk-migration": "0.0.0",
     "constructs": "^3.3.69",
     "jest": "^27.3.1",

packages/@aws-cdk/assertions/lib/private/cyclic.ts

@@ -70,11 +70,16 @@ function findExpressionDependencies(obj: any): Set<string> {
       } else if (keys.length === 1 && keys[0] === 'Fn::Sub') {
         const argument = x[keys[0]];
         const pattern = Array.isArray(argument) ? argument[0] : argument;
-        for (const logId of logicalIdsInSubString(pattern)) {
-          ret.add(logId);
+
+        // pattern should always be a string, but we've encountered some cases in which
+        // it isn't. Better safeguard.
+        if (typeof pattern === 'string') {
+          for (const logId of logicalIdsInSubString(pattern)) {
+            ret.add(logId);
+          }
         }
         const contextDict = Array.isArray(argument) ? argument[1] : undefined;
-        if (contextDict) {
+        if (contextDict && typeof contextDict === 'object') {
           Object.values(contextDict).forEach(recurse);
         }
       } else {

packages/@aws-cdk/assertions/lib/private/messages.ts

@@ -10,7 +10,6 @@ export function findMessage(messages: Messages, constructPath: string, props: an
     return {};
   }
 
-  Object.values(result.matches).forEach((m) => handleTrace(m));
   return result.matches;
 }
 

packages/@aws-cdk/assertions/package.json

@@ -65,7 +65,7 @@
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
     "@types/fs-extra": "^9.0.13",
-    "@types/jest": "^27.4.0",
+    "@types/jest": "^27.4.1",
     "constructs": "^3.3.69",
     "jest": "^27.5.1",
     "ts-jest": "^27.1.3"

packages/@aws-cdk/assertions/test/annotations.test.ts

@@ -7,13 +7,12 @@ describe('Messages', () => {
   let annotations: _Annotations;
   beforeAll(() => {
     stack = new Stack();
-    const foo = new CfnResource(stack, 'Foo', {
+    new CfnResource(stack, 'Foo', {
       type: 'Foo::Bar',
       properties: {
         Fred: 'Thud',
       },
     });
-    foo.node.setContext('disable-stack-trace', false);
 
     new CfnResource(stack, 'Bar', {
       type: 'Foo::Bar',
@@ -61,11 +60,6 @@ describe('Messages', () => {
       const result = annotations.findError('*', 'no message looks like this');
       expect(result.length).toEqual(0);
     });
-
-    test('trace is redacted', () => {
-      const result = annotations.findError('/Default/Foo', Match.anyValue());
-      expect(result[0].entry.trace).toEqual('redacted');
-    });
   });
 
   describe('hasWarning', () => {
@@ -165,15 +159,7 @@ describe('Multiple Messages on the Resource', () => {
     const result2 = annotations.findError('/Default/Bar', Match.stringLikeRegexp('error:.*'));
     expect(result2.length).toEqual(2);
     const result3 = annotations.findWarning('/Default/Bar', 'warning: Foo::Bar is deprecated');
-    expect(result3).toEqual([{
-      level: 'warning',
-      entry: {
-        type: 'aws:cdk:warning',
-        data: 'warning: Foo::Bar is deprecated',
-        trace: 'redacted',
-      },
-      id: '/Default/Bar',
-    }]);
+    expect(result3[0].entry.data).toEqual('warning: Foo::Bar is deprecated');
   });
 });
 class MyAspect implements IAspect {

packages/@aws-cdk/assets/package.json

@@ -80,7 +80,7 @@
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/cdk-integ-tools": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0",
+    "@types/jest": "^27.4.1",
     "@types/sinon": "^9.0.11",
     "aws-cdk": "0.0.0",
     "jest": "^27.5.1",

packages/@aws-cdk/aws-accessanalyzer/package.json

@@ -85,7 +85,7 @@
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/cfn2ts": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0"
+    "@types/jest": "^27.4.1"
   },
   "dependencies": {
     "@aws-cdk/core": "0.0.0",

packages/@aws-cdk/aws-acmpca/package.json

@@ -85,7 +85,7 @@
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/cfn2ts": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0"
+    "@types/jest": "^27.4.1"
   },
   "dependencies": {
     "@aws-cdk/core": "0.0.0",

packages/@aws-cdk/aws-amazonmq/package.json

@@ -84,7 +84,7 @@
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "@aws-cdk/cfn2ts": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0"
+    "@types/jest": "^27.4.1"
   },
   "dependencies": {
     "@aws-cdk/core": "0.0.0",

packages/@aws-cdk/aws-amplify/package.json

@@ -86,7 +86,7 @@
     "@aws-cdk/cdk-integ-tools": "0.0.0",
     "@aws-cdk/cfn2ts": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
-    "@types/jest": "^27.4.0",
+    "@types/jest": "^27.4.1",
     "@types/yaml": "1.9.6",
     "aws-sdk": "^2.848.0"
   },

packages/@aws-cdk/aws-apigateway/README.md

@@ -126,7 +126,7 @@ Other metadata such as billing details, AWS account ID and resource ARNs are not
 
 By default, a `prod` stage is provisioned.
 
-In order to reduce the payload size sent to AWS Step Functions, `headers` are not forwarded to the Step Functions execution input. It is possible to choose whether `headers`,  `requestContext`, `path` and `querystring` are included or not. By default, `headers` are excluded in all requests.
+In order to reduce the payload size sent to AWS Step Functions, `headers` are not forwarded to the Step Functions execution input. It is possible to choose whether `headers`,  `requestContext`, `path`, `querystring`, and `authorizer` are included or not. By default, `headers` are excluded in all requests.
 
 More details about AWS Step Functions payload limit can be found at https://docs.aws.amazon.com/step-functions/latest/dg/limits-overview.html#service-limits-task-executions.
 
@@ -184,7 +184,7 @@ AWS Step Functions will receive the following execution input:
 }
 ```
 
-Additional information around the request such as the request context and headers can be included as part of the input
+Additional information around the request such as the request context, authorizer context, and headers can be included as part of the input
 forwarded to the state machine. The following example enables headers to be included in the input but not query string.
 
 ```ts fixture=stepfunctions
@@ -193,6 +193,7 @@ new apigateway.StepFunctionsRestApi(this, 'StepFunctionsRestApi', {
   headers: true,
   path: false,
   querystring: false,
+  authorizer: false,
   requestContext: {
     caller: true,
     user: true,

packages/@aws-cdk/aws-apigateway/lib/integrations/stepfunctions.ts

@@ -68,6 +68,20 @@ export interface StepFunctionsExecutionIntegrationOptions extends IntegrationOpt
    * @default false
    */
   readonly headers?: boolean;
+
+  /**
+   * If the whole authorizer object, including custom context values should be in the execution input. The execution input will include a new key `authorizer`:
+   *
+   * {
+   *   "body": {},
+   *   "authorizer": {
+   *     "key": "value"
+   *   }
+   * }
+   *
+   * @default false
+   */
+  readonly authorizer?: boolean;
 }
 
 /**
@@ -189,7 +203,7 @@ function integrationResponse() {
           '#if($input.path(\'$.status\').toString().equals("FAILED"))', 
             '#set($context.responseOverride.status = 500)', 
             '{',
-              '"error": "$input.path(\'$.error\')"',
+              '"error": "$input.path(\'$.error\')",',
               '"cause": "$input.path(\'$.cause\')"',
             '}',
           '#else',
@@ -241,6 +255,7 @@ function templateString(
   const includeHeader = options.headers?? false;
   const includeQueryString = options.querystring?? true;
   const includePath = options.path?? true;
+  const includeAuthorizer = options.authorizer ?? false;
 
   if (options.requestContext && Object.keys(options.requestContext).length > 0) {
     requestContextStr = requestContext(options.requestContext);
@@ -251,6 +266,7 @@ function templateString(
   templateStr = templateStr.replace('%INCLUDE_HEADERS%', String(includeHeader));
   templateStr = templateStr.replace('%INCLUDE_QUERYSTRING%', String(includeQueryString));
   templateStr = templateStr.replace('%INCLUDE_PATH%', String(includePath));
+  templateStr = templateStr.replace('%INCLUDE_AUTHORIZER%', String(includeAuthorizer));
   templateStr = templateStr.replace('%REQUESTCONTEXT%', requestContextStr);
 
   return templateStr;

packages/@aws-cdk/aws-apigateway/lib/integrations/stepfunctions.vtl

@@ -9,6 +9,7 @@
 #set($includeHeaders = %INCLUDE_HEADERS%)
 #set($includeQueryString = %INCLUDE_QUERYSTRING%)
 #set($includePath = %INCLUDE_PATH%)
+#set($includeAuthorizer = %INCLUDE_AUTHORIZER%)
 #set($allParams = $input.params())
 {
     "stateMachineArn": "%STATEMACHINE%",
@@ -49,6 +50,17 @@
         #set($inputString = "$inputString }")
     #end
 
+    #if ($includeAuthorizer)
+        #set($inputString = "$inputString, @@authorizer@@:{")
+        #foreach($paramName in $context.authorizer.keySet())
+            #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($context.authorizer.get($paramName))@@")
+            #if($foreach.hasNext)
+                #set($inputString = "$inputString,")
+            #end
+        #end
+        #set($inputString = "$inputString }")
+    #end
+
     #set($requestContext = "%REQUESTCONTEXT%")
     ## Check if the request context should be included as part of the execution input
     #if($requestContext && !$requestContext.empty)

packages/@aws-cdk/aws-apigateway/lib/resource.ts

@@ -311,8 +311,8 @@ export abstract class ResourceBase extends ResourceConstruct implements IResourc
 
       const template = new Array<string>();
 
-      template.push('#set($origin = $input.params("Origin"))');
-      template.push('#if($origin == "") #set($origin = $input.params("origin")) #end');
+      template.push('#set($origin = $input.params().header.get("Origin"))');
+      template.push('#if($origin == "") #set($origin = $input.params().header.get("origin")) #end');
 
       const condition = origins.map(o => `$origin.matches("${o}")`).join(' || ');