This will be used by a change in `tools/individual-pkg-gen/copy-files-removing-deps.ts` on the `v2-main` branch, so that the `transform` step can correctly set the `version` key and the version for each dependency in each alpha module's `package.json` file.

See #16322 for usage. 

Part of #15591 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

The tests for `yarn-cling` currently reference what were imaginary package names
as placeholders; those package names have now been registered. While this has no
practical impact, switching the package names to be ones we own just so there's
no ambiguity.

An `npm install` is never done on these directories, so the packages chosen really
doesn't matter. Just picked two of our favorites at random. :)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

----

This PR adds a new service extension, `SubscribeExtension`. This extension can be added to a service to create SQS Queues which can subscribe to the SNS Topics provided by the user. 

It creates a default SQS Queue called `eventsQueue` . It also supports creation of topic-specific queues and sets up the SNS subscriptions accordingly. The created topic-queue subscriptions can be accessed using `subscriptions` field of the extension and the default queue for this service can be accessed using the `eventsQueue` getter method. (This PR does not include autoscaling, will be adding it in a separate PR)
 
*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

)

Closes #16171.

The expression is missing a right parentheses, and it is just as clear anyway as a new sentence.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…CodeBuildStep (#16294)

fix(pipelines): Fix documentation regarding rolePolicyStatements of CodeBuildStep

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

----

Revisiting [#9445](#9445) but looking to see if running on linux with selinux enabled.

This PR aims to allow for asset bundling on linux os with selinux enabled

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This is the first PR implementing the ["Accelerated personal deployments" RFC](https://github.com/aws/aws-cdk-rfcs/blob/master/text/0001-cdk-update.md).

It adds a (boolean) `--hotswap` flag to the `deploy` command that attempts to perform a short-circuit deployment, updating the resource directly, and skipping CloudFormation.
If we detect that the current change cannot be short-circuited
(because it contains an infrastructure change to the CDK code, most likely),
we fall back on performing a full CloudFormation deployment,
same as if `cdk deploy` was called without the `--hotswap` flag.

In this PR, the new switch supports only Lambda functions. Later PRs will add support for new resource types.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…to tasks.EvaluateExpression (#16290)

Currently the way `EvaluateExpression` is set up, if you pass an async expression to it, it never waits for the execution to complete. By adding an `await` before the `eval()` call, async ops can be passed in. This also works for sync ops same as before (await works with sync code as well).

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…#16348)

Early on in the CDK history, a decision was made to delineate between subnets
with Internet access (i.e., those with a NAT) and those without. The convention
chosen at that time was to label the subnets as `PRIVATE` and `ISOLATED`,
respectively. The intent was to make it clear that subnets without a NAT were
completely isolated from the broader Internet (unless connected through another
subnet).

However, this introduction of a new subnet type that does not match EC2
documentation and naming conventions can cause confusion. Most critically, a
user may select a `PRIVATE` subnet without realizing that it automatically
requires one (or more) NAT gateways. As NAT gateways are not free, this can
lead to unintended charges.

To realign to the EC2 terminology -- while retaining the existing logic
surrounding SubnetTypes -- the existing types of `PRIVATE` and `ISOLATED` are
being renamed to `PRIVATE_WITH_NAT` and `PRIVATE_ISOLATED`, respectively.

fixes #15929


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…5652)

Add method `fromLookup` in KMS key which provides the option to get a KMS key including its key id by an alias name.
In some cases, aliases can't be used because access to the underlying key id is necessary. In this case, the `fromLookup` method can be used.

The following packages were changed:
- @aws-cdk/aws-kms: introduce new `fromLookup` method
- @aws-cdk/cx-api: new KeyContextResponse
- @aws-cdk/cloud-assembly-schema: new ContextProvider KEY_PROVIDER and KeyContextQuery
- aws-cdk: implementation of key ContextProvider

Closes #8822 

-----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add Python 3.9 to the list of supported runtimes.

closes: #16144 , #16355


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

… params (#16121)

Resolves #16004 

When using CloudformationInit, can opt to include the `--role` and `--url` argument to `cfn-init` and `cfn-signal` ([ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html#cfn-init-Syntax)).

User can do this by including [InitOptions](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.ApplyCloudFormationInitOptions.html) that include `includeUrl` and `includeRole`

```typescript
ec2.Instance(this, 'MyInstance', {
  init: // init config,
  initOptions: {
    includeUrl: true,
    includeRole: true,
  }
}
```

It's possible to _always_ include these added arguments, but not sure whether that would cause regressions.

Open to any suggestions on a better way to implement

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Adds a static instance of InterfaceVpcEndpointAwsService for the AWS
Keyspaces service so that users do not need to define it manually.
Keyspaces uses a custom TCP port (9142), so this avoids confusion.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…15956)

Allow specifying the ALPN Policy
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…le without casting it to `IHttpStage` (#15607)

----

Closes #14787. Changes the defaultStage to an IHttpStage.

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ecutionContext even when object is empty (#16141)

fixes: #16133

As described in #16133, the empty  `QueryExecutionContext`, which was included before this fix, leads to an error.
To mitigate this, I implemented a check to exclude the  `QueryExecutionContext`when both params are empty.
This way, it behaves like a truly optional parameter.

Additionally I integrated an easier way to merge an OutputLocation if provided.
This means less redundancy than the original solution, which returned an object that was only different in one key in each branch.

The unittest is based on the default unittest, but a bit "stripped down". It proofs that no empty `QueryExecutionContext` object is present.

In my tests, this fixes the 
```
{
  "resourceType": "athena",
  "resource": "startQueryExecution.sync",
  "error": "Athena.InvalidRequestException",
  "cause": "Both queryExecutionContext.catalog and queryExecutionContext.database are null or empty (Service: AmazonAthena; Status Code: 400; Error Code: InvalidRequestException; Request ID: [Censored]; Proxy: null)"
}
```
error.


This solution turned out to be a bit different than I envisioned in the issue.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Migrate remaining module to pure jest.

Remove the module `nodeunit-shim`. Any modules still using nodeunit
must migrate directly to jest.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…mbly root directory (#16094)

Runs the executable command of container assets in the cloud assembly root directory and not the current directory.

Could be a breaking change.

fixes #15721
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…on value (#16028)

Remove value IO2 from enum EbsDeviceVolumeType because it is not supported in CloudFormation.

Fixes #16027.

Please double-check before approving: Value from enum is removed which could potentially be a breaking change. However, it's an invalid value. Therefore, it should be correct to remove it.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…16154)

Using `instanceof` does not seem to work in all scenarios. Instead, use the `CfnResource.isCfnResource` method to find the L1 constructs.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

> Currently [ManagedRuleIdentifiers](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-config.ManagedRuleIdentifiers.html) doesn't support identifier for ec2-instance-profile-attached managed rule (EC2_INSTANCE_PROFILE_ATTACHED). The documentation for this rule is [here](https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-profile-attached.html).

Copied from: #15898

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…erimental modules (#16401)

Bringing the changes from `v2-main` to `master` related to the experimental modules. These changes were made directly in `v2-main` because the version of the `@aws-cdk/assert` library compatible with `aws-cdk-lib` only existed in `v2-main`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ns (#16333)

Now they do. Closes #16331. 

I have also modified the comment to explain `returnData: entry.tag ? undefined : false` but I endeavor to explain even more here. Only 1 metric within an expression can have `returnData = true`; the rest must be `false`. Cloudformation also defaults an undefined return data to `true` as long as the rest are set to `false`, which is why this ternary operation works. The idea behind this line is that `entry.tag` is defined (with a default of `true`) for the top level expression only and thus every other metric within the expression has `returnData = false`. 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add a `blockRecoveryPointDeletion` prop that add statements to
the vault access policy that prevents recovery point deletions.

Converted test to use `assertions` while in there.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…n stack name (#16150)

**second attempt as last PR failed integration tests**

Currently, `cdk deploy` and `cdk diff` on stacks that do not exist return no output on the command line. This PR introduces a descriptive error message for those cases so it is easier to understand what happened.

The behavior of the error is that **if** you specify a stack or stacks, the CLI expects to match at least one known stack. If the CLI cannot find a matching stack, the error is thrown. However, if you specify multiple stacks (i.e. `cdk deploy ThisStackExists ThisStackDoesnt`) and one of those stacks do not match, the CLI will silently ignore the request to deploy `ThisStackDoesnt` without throwing an error.

closes #15866 while adding the same idea to `diff` as well as `deploy`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…93/aws-cdk into assertions-hasoutput

fix(assertions): output and mapping assertions do not accept logical id