Co-authored-by: AWS CDK Team <aws-cdk@amazon.com>

We have a dependency chain of:

```
build-tools -> markdownlint-cli -> markdownlint -> markdown-it
                  ^^^ straggler                      ^^^ CVE
```

Override the dependency to get rid of a CVE warning.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Whether creating a Table with a custom KMS key succeeds depends
on the permissions on the key. The default permissions are correct,
but only if the appropriate feature flag is set.

Without changing code yet, add the caveat on proper configuration
to the documentation.

Fixes #18616

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…licitly given and does not exist (#18714)

Currently if `subnetGroupNameTag` is provided in `Vpc.fromLookup()` and
a tag with that key does not exist, the error that is returned is very
generic and just indicates that the VPC could not be found. This makes
it very hard to troubleshoot what the real issue is (invalid
subnetGroupNameTag).

Now if the user provides a `subnetGroupNameTag` and a tag with that Key
does not exist an error is thrown indicating that an invalid
`subnetGroupNameTag` was provided

fixes #13962


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ion with `userDataCausesReplacement` (#18726)

If both `addSignalOnExitCommand` _and_ `userDataCausesReplacement` are
 used it results in an invalid logicalId being used in the
`cfn-signal` call. This is due to `addSignalOnExitCommand` getting the
logicalID from `Stack.getLogicalId` which does not take into
consideration logicalId overrides which `userDataCausesReplacement`
uses.

This updates `addSignalOnExitCommand` to use the `logicalId` of the
resource which is evaluated lazily and happens after all overrides.

fixes #12749


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

When no version is specified, the `:` at the end is not allowed.

Closes #18729.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Amazon RDS for PostgreSQL supports now a major version 14.

https://aws.amazon.com/about-aws/whats-new/2022/01/amazon-rds-postgresql-14-outposts/

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

#18661)

resolve #17701

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Fixes #18677.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

`assert-internal` is [about to be] deprecated, so we are migrating all cdk modules to assertions.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Move all of njlynch's ownership areas to other team members, as agreed
internally.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ZONE_ID (#18110)

prev: #10915, #17024, hashicorp/terraform-provider-aws#22295, #18300
https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_region


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

fixes #15400

With this request you will be able to configure the encryption of your ECR Repository.

Before this patch you need to use a L1-Construct and add it via:

Python:
```python
repo = ecr.Repository(stack, 'Repo')
cfn_repo = repo.node.default_child
cfn_repo.encryption_configuration = CfnRepository.EncryptionConfigurationProperty(encryption_type="KMS")
```
Now this becomes:
```python
repo = ecr.Repository(stack, 'Repo', encryption_type=ecr.RepositoryEncryption.KMS)
```

When using a KMS Key, the `encryption_type` is set automatically to `KMS`.
```python
kms_key = kms.Key(stack, 'Key')
ecr.Repository(stack, 'Repo', encryption_key=kms_key)
```

Similar to #15571

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

When adding a container to a task definition it is currently impossible to retrieve
its image name because it's the container definition that is responsible for binding
the `AssetImage`.

Expose the `imageName` so that it's possible to reference it in another construct
that needs to use/depend on the asset hash. Example: a custom resource running
a Fargate task that needs to rerun if the underlying container image changes but
not necessarily when the task definition changes.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Reflect correct case of ecs.NetworkMode constants. No functional change,
documentation only.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

> If the package.json for your package is not in the root directory (for example if it is part of a monorepo), you can specify the directory in which it lives:
> ```json
> "repository": {
>   "type" : "git",
>   "url" : "https://github.com/facebook/react.git",
>   "directory": "packages/react-dom"
> }
> ```
> — https://docs.npmjs.com/cli/v6/configuring-npm/package-json#repository

I use a lot https://njt.vercel.app/ to jump to different packages information,
and with this PR we can know exactly what package in what folder lives

Made the changes with a script to make it easier 🙂

https://gist.github.com/iamandrewluca/5cc85b56a595056f0099d04ed6dd8a79


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Various pieces in the build system relied in `decdk` as a package that took a dependency on all modules. We removed `decdk` so we need to break this dependency and use `aws-cdk-lib` instead.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Co-authored-by: AWS CDK Team <aws-cdk@amazon.com>

Co-authored-by: AWS CDK Team <aws-cdk@amazon.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

…ces and launch templates (#18326)

This pullrequest will add the optional ```kmsKeyId``` property to the ```EbsDeviceOptions``` Interface. Whit this, it will be possible to specify the kmsKeyId used for encrypting the ebs volumes when launching instances. At the moment I already use this via an escape hatch in my projects, but it's not that handy as the block device mapping is an array.

I don't like to only specify a kmsKeyId (= ARN) but accepting an ```kms.IKey``` in the properties would be a bigger change.

fixes: #18309
*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

… s3 loggingBucket (#18264)" (#18772)

#18271 resulted in the definition of a new bucket policy, which broke existing users that already had an implicit bucket policy created by AWS (see [docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-logs-infrastructure-S3)).

Reverts commit ad7374a in the meantime until we figure out the longer term solution.

Fixes #18676

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

#18271 resulted in the definition of a new bucket policy, which broke existing users that already had an implicit bucket policy created by AWS (see [docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-logs-infrastructure-S3)).

Reverts commit 0ed5e85 in the meantime until we figure out the longer term solution.

Fixes #18676


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…#16923)

This small PR will add SSM OpsItem action to cloudwatch alarm.
The arn format was taken from the alarm UI (in view source) and with all the parameters (severity and category)

closes #16861 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Support already exists in CloudFormation, but hasn't been implemented in CDK.

Closes #18718

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add support for [performance mode](https://docs.aws.amazon.com/amplify/latest/userguide/ttl.html#Performance-mode
) in Amplify branches.

Performance mode optimizes for faster hosting performance by keeping content cached at the edge for a longer interval.

Closes #18557.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…18626)

FSx Lustre released support for a new deployment type "Persistent_2" at re:Invent 2021.
It provides long term storage with higher throughput tiers (125, 250, 500, 1000 MiB/s/TiB).
See https://docs.aws.amazon.com/fsx/latest/LustreGuide/using-fsx-lustre.html for more details.
As part of this commit, we want to add support for this new deployment type in LustreDeploymentType enum.
This will allow customers to create FSx Lustre file systems by specifying this new deployment type.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*