Generated by running `scripts/bump-cfnspec.sh`. Wanted to speed up the additions required for #17290 .

Feel free to close if this is supposed to be created by a bot like #17223 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Apparently Microsoft stopped shipping `wmic.exe` in certain situations
(modern systems?). We rely on this to detect whether we are on an EC2
instance, so that we do or do not configure the IMDS credential
provider (we try to avoid the IMDS credential provider if unnecessary,
because in certain network setups it may hang for a long time failing to
connect to `169.254.169.254`).

If calling `wmic` fails, just assume we're not on an EC2 instance
and proceed.

Fixes #16419.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

The rendering of `additionalInputs` was using a bashism that is not
supported by CodeBuild by default.

Turn

```
[[ ! -d "directory" ]]
```

into

```
[ ! -d "directory" ]
```

Fixes #17224


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Follow up on #17337 to fix regression suites.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

#16917)

when the same trigger is added twice to the Cognito userpool, 
```ts
const fn = lambda.Function.fromFunctionArn(stack, 'Trigger', 'arn:aws:lambda:us-east-1:123456789012:function:CognitoFunction')

const userpool = new cognito.UserPool(stack, 'Userpool', { lambdaTriggers: { customMessage: fn } })

userpool.addTrigger(cognito.UserPoolOperation.CUSTOM_MESSAGE, fn)
```
throws error message:

`Error: A trigger for the operation [object Object] already exists.`

This PR fixes it as:

` Error: A trigger for the operation customMessage already exists.`

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This PR improves the error message when a lambda-nodejs function fails to bundle.

I'm working on moving a client's repository from a "makeshift monorepo" to a real `yarn`/`lerna` driven monorepo. They make heavy use of `NodejsFunction`, so I'm moving them to the newer [reference project architecture](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-nodejs-readme.html#reference-project-architecture) with a single lockfile at the root of the repository.

While working through this issue, I kept running into this error message:

```
> yarn cdk diff
Bundling asset SomeLambdaHandler/SomeSubLambda/Lambda/Code/Stage...
Usage Error: Couldn't find a script named "esbuild".

$ yarn run [--inspect] [--inspect-brk] <scriptName> ...
Failed to bundle asset SomeLambdaHandler/SomeSubLambda/Lambda/Code/Stage, bundle output is located at /Users/blimmer/code/client/project/packages/some-workspace/cdk.out/bundling-temp-2f3ffba54d828547eb851ebe672a601943e153ec31fdc5e45f8e80ed976da6d3-error: Error: bash exited with status 1
Subprocess exited with error 1
```

This was confusing to me because I have `esbuild` installed in both sub-packages that require it. The error message just tells me that `bash` failed to run, which isn't very helpful.

However, when I set an interactive breakpoint, I got a lot more information about the failure. By digging into these arguments https://github.com/aws/aws-cdk/blob/507769aa034ba3d8daa497953be629408072baed/packages/%40aws-cdk/aws-lambda-nodejs/lib/util.ts#L56-L57 I can actually see what's being run and which directory it's run in.

| argument | contents | comments |
| -------- | -------- | -------- |
| `cmd`    | `bash`   | this doesn't really tell me anything about what's happening |
| `args`   | [ `-c`, `"yarn run esbuild --bundle \"/Users/blimmer/code/client/project/packages/some-workspace/lib/some-sub-lambda/lambda/index.ts\" --target=node14 --platform=node --outfile=\"/Users/blimmer/code/client/project/packages/some-workspace/cdk.out/bundling-temp-2f3ffba54d828547eb851ebe672a601943e153ec31fdc5e45f8e80ed976da6d3/index.js\" --external:aws-sdk"` ] | the second argument of this array actually represents the command being run - this is way more useful than just `bash` |
| `options` | `{ ...lotsOfOtherStuff, cwd: '/Users/blimmer/code/client/project' }` | `cwd` was actually crucial for me to fix this problem. because I see this is running in the root of the monorepo, it shows that I need to install `esbuild` there, instead of in the workspaces. |

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…p is created if one is not provided. (#17364)

Closes #15365


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add the `--no-immutable` flag when running `yarn`.

Closes #17082


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Avail ourselves of the new build cache feature in cdklabs/cdk-ops#1776.
Adds two new things:

**A persistently cached directory**

The directory `$HOME/.s3buildcache` will be stored and restored in the
S3 bucket, if configured. The build can assume that files it puts in
there will be availble on the next build (and on the corresponding
PR build).

**Cache rosetta tablet**

If there is a file in the persistent cache directory for Rosetta,
pass it to `jsii-rosetta` as an input.

Afterwards, store whatever tablet the build produced back into the
cache directory.

The latter will only impact the persistent cache if done on a build
that is actually configured to store the cache back, which is only
the main pipeline build.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

The test was still using the old `lambci` image and this makes the integ test fail
apparently. **This currently blocks the build of the repo**.

Adapted Dockerfile now that go is not installed in `/go` anymore.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Included in this PR:
- chore(ssm): make examples compile
- chore(synthetics): make examples compile

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…et rotation (#17363)

Add options to configure vpc subnet placement and Secrets Manager API
endpoint for the rotation Lambda function.

This is required in some VPC configurations where the database is placed
in subnets without internet connectivity.

Closes #17265


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

There are two problems.

### Python

The `app` template doesn't define any tests (it does, but they are commented out), this makes `pytest` fail during our integ tests:

```console
============================= test session starts ==============================
970 | platform linux -- Python 3.7.3, pytest-6.2.5, py-1.11.0, pluggy-1.0.0
971 | rootdir: /tmp/cdk-init-test
972 | collected 0 items
973 |  
974 | ============================ no tests ran in 0.01s =============================
975 | + run_traps
976 | + for cmd in "${TRAPS[@]}"
977 | + echo 'cleanup: kill 121'
978 | cleanup: kill 121
979 | + eval 'kill 121'
980 | ++ kill 121
981 | + for cmd in "${TRAPS[@]}"
982 | + echo 'cleanup: clean_up_nuget_config'
983 | cleanup: clean_up_nuget_config
984 | + eval clean_up_nuget_config
985 | ++ clean_up_nuget_config
986 | ++ log 'Restoring NuGet configuration'
987 | ++ echo '\| Restoring NuGet configuration'
988 | \| Restoring NuGet configuration
989 | ++ '[' -f /root/.nuget/NuGet/NuGet.Config.bak ']'
990 | ++ log '-> Removing /root/.nuget/NuGet/NuGet.Config'
991 | ++ echo '\| -> Removing /root/.nuget/NuGet/NuGet.Config'
992 | \| -> Removing /root/.nuget/NuGet/NuGet.Config
993 | ++ rm -f /root/.nuget/NuGet/NuGet.Config
994 |  
995 | [Container] 2021/11/05 05:05:43 Command did not exit successfully /bin/bash /tmp/scriptdir/cdk/init-templates/dispatch.sh exit status 5
996 | [Container] 2021/11/05 05:05:43 Phase complete: BUILD State: FAILED
997 | [Container] 2021/11/05 05:05:43 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: /bin/bash /tmp/scriptdir/cdk/init-templates/dispatch.sh. Reason: exit status 5
998 | [Container] 2021/11/05 05:05:43 Entering phase POST_BUILD
999 | [Container] 2021/11/05 05:05:43 Phase complete: POST_BUILD State: SUCCEEDED
1000 | [Container] 2021/11/05 05:05:43 Phase context status code:  Message:
1001

<br class="Apple-interchange-newline">
```

Solution is to uncomment the test method signature and making it an empty test, just like we do with typescript. 

### Java

`Map.of` doesn't exist in Java 8 and we are getting complication errors during `mvn package`:

```console
[INFO] -------------------------------------------------------------
--
1018 | [ERROR] COMPILATION ERROR :
1019 | [INFO] -------------------------------------------------------------
1020 | [ERROR] /tmp/cdk-init-test/src/test/java/com/myorg/CdkInitTestStackTest.java:[21,62] cannot find symbol
1021 | symbol:   method of(java.lang.String,int)
1022 | location: interface java.util.Map
1023 | [INFO] 1 error
```

Solution is to replace `Map.of` with `new HashMap` that is supported everywhere. 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…tensions (#17101)

----
This PR adds `desiredCount`, `targetCpuUtilization` and `targetMemoryUtilization` to the service construct. It also adds `requestsPerTarget` to the `HttpLoadBalancerExtension` props to allow adding target tracking policy based on the ALB request count.

It will be followed by another PR to configure queue auto scaling for the SQS Queues in the `QueueExtension`.

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…lients per HttpUserPoolAuthorizer (#16903)

closes #15431

BREAKING CHANGE: `userPoolClient` property in `UserPoolAuthorizerProps`
is now renamed to `userPoolClients`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ns.LambdaDestination (#16896)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*