Package: aws-cdk.cx-api
Cloud Executable APIThis module is part of theAWS Cloud Development Kitproject.V2 Feature Flags@aws-cdk/aws-s3:createDefaultLoggingPolicyEnable this feature flag to create an S3 bucket policy by default in cases where
an AWS service would automatically create the Policy if one does not exist.For example, in order to send VPC flow logs to an S3 bucket, there is a specific Bucket Policy
that needs to be attached to the bucket. If you create the bucket without a policy and then add the
bucket as the flow log destination, the service will automatically create the bucket policy with the
necessary permissions. If you were to then try and add your own bucket policy CloudFormation will throw
and error indicating that a bucket policy already exists.In cases where we know what the required policy is we can go ahead and create the policy so we can
remain in control of it.https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-logs-infrastructure-S3cdk.json{"context":{"@aws-cdk/aws-s3:createDefaultLoggingPolicy":true}}@aws-cdk/aws-sns-subscriptions:restrictSqsDescryptionEnable this feature flag to restrict the decryption of a SQS queue, which is subscribed to a SNS topic, to
only the topic which it is subscribed to and not the whole SNS service of an account.Previously the decryption was only restricted to the SNS service principal. To make the SQS subscription more
secure, it is a good practice to restrict the decryption further and only allow the connected SNS topic to decryption
the subscribed queue.cdk.json{"context":{"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption":true}}@aws-cdk/aws-apigateway:disableCloudWatchRoleEnable this feature flag to change the default behavior for aws-apigateway.RestApi and aws-apigateway.SpecRestApi
tonotcreate a CloudWatch role and Account. There is only a single ApiGateway account per AWS
environment which means that each time you create a RestApi in your account the ApiGateway account
is overwritten. If at some point the newest RestApi is deleted, the ApiGateway Account and CloudWatch
role will also be deleted, breaking any existing ApiGateways that were depending on them.When this flag is enabled you should either create the ApiGateway account and CloudWatch role
separatelyoronly enable the cloudWatchRole on a single RestApi.cdk.json{"context":{"@aws-cdk/aws-apigateway:disableCloudWatchRole":true}}@aws-cdk/core:enablePartitionLiteralsEnable this feature flag to haveStack.partitionreturn a literal string for a stack's partition
when the stack has a known region configured.  If the region is undefined, or set to an unknown value, theStack.partitionwill be the CloudFormation intrinsic valueAWS::Partition.  Without this feature flag,Stack.partitionalways returns the CloudFormation intrinsic valueAWS::Partition.This feature will often simplify ARN strings in CDK generated templates, for example:Principal:AWS:Fn::Join:-""--"arn:"-Ref:AWS::Partition-:iam::123456789876:rootbecomes:Principal:AWS:"arn:aws:iam::123456789876:root"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreakerEnable this feature flag to avoid setting the "ECS" deployment controller when adding a circuit breaker to an
ECS Service, as this will trigger a full replacement which fails to deploy when using set service names.
This does not change any behaviour as the default deployment controller when it is not defined is ECS.cdk.json{"context":{"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker":true}}@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicyEnable this feature flag to use S3 Bucket Policy for granting permission fo Server Access Logging
rather than using the cannedLogDeliveryWriteACL. ACLs do not work when Object Ownership is
enabled on the bucket.This flag uses a Bucket Policy statement to allow Server Access Log delivery, following best
practices for S3.https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html{"context":{"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy":true}}@aws-cdk/aws-rds:databaseProxyUniqueResourceNameEnable this feature flag to use unique resource names for eachDatabaseProxy.Previously, the default behavior forDatabaseProxywas to useidof the constructor fordbProxyName.
In this case, users couldn't deployDatabaseProxys that have the sameidin the same region.This is a feature flag as the old behavior was technically incorrect, but users may have come to depend on it.{"context":{"@aws-cdk/aws-rds:databaseProxyUniqueResourceName":true}}@aws-cdk/aws-redshift:columnIdEnable this feature flag to allow the CDK to track changes in Redshift columns through theiridattribute. This is a breaking change, as thenameattribute was currently being used to track changes to Redshift columns.Enabling this feature flag comes at a risk for existing Redshift columns, as thenameattribute of a redshift column was currently being used. Therefore, to change a Redshift columns'namewill essentially create a new column and delete the old one. This will cause data loss. If you choose to enable this flag, ensure that upon intial deployment (the first deployment after setting this feature flag), thenameattribute of every column is not changed. After the intial deployment, you can freely change thenameattribute of a column.cdk.json{"context":{"@aws-cdk/aws-redshift:columnId":true}}@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2Enable this feature flag to use theAmazonEMRServicePolicy_v2managed policies for the EMR service role.This is a feature flag as the old behavior will be deprecated, but some resources may require manual
intervention since they might not have the appropriate tags propagated automatically.https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.htmlcdk.json{"context":{"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2":true}}@aws-cdk/core:includePrefixInUniqueNameGenerationEnable this feature flag to include the stack's prefixes to the name generation process.Not doing so can cause the name of stack to exceed 128 characters:The name generation ensures it doesn't exceed 128 charactersWithout this feature flag, the prefix is prepended to the generated name, which result can exceed 128 charactersThis is a feature flag as it changes the name generated for stacks. Any CDK application deployed prior this fix will
most likely be generated with a new name, causing the stack to be recreated with the new name, and then deleting the old one.
For applications running on production environments this can be unmanageable.cdk.json{"context":{"@aws-cdk/core:includePrefixInUniqueNameGeneration":true}}@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersionEnable this feature flag to automatically use the latest available NodeJS version in the aws-lambda-nodejse.Function construct.This allows creation of new functions using a version that will automatically stay up to date without breaking bundling of existing functions that externalize packages included in their environemnt such asaws-sdk.Functions defined previously will continue to function correctly as long as they pass an explicit runtime version, or do not exclude packages during bundling.cdk.json{"context":{"@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion":true}}@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSourceEnable this feature flag to update the default branch for CodeCommit source actions tomain.Previously, the default branch for CodeCommit source actions was set tomaster.
However, this convention is no longer supported, and repositories created after March 2021 now havemainas
their default branch.cdk.json{"context":{"@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource":true}}@aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaActionEnable this feature flag to change the logical ID of theLambdaPermissionfor theLambdaActionto include an alarm ID.Previously, only one alarm with theLambdaActioncould be created per Lambda.
This flag allows multiple alarms with theLambdaActionfor the same Lambda to be created.cdk.json{"context":{"@aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaAction":true}}@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalseEnables Pipeline to set the default value forcrossAccountKeysto false.When this feature flag is enabled, and thecrossAccountKeysproperty is not provided in aPipelineconstruct, the construct automatically defaults the value of this property to false.cdk.json{"context":{"@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse":true}}