This PR updates the `integ-runner` to _not_ set `@aws-cdk/core:newStyleStackSynthesis: false` by default. 
Previously this was done to cut down on the merge conflicts when the forward-merge was done 
between v1 and v2, but since we are now only committing to v2 it makes sense to test with 
`newStyleStackSynthesis` enabled.

This change required re-running _all_ integration tests since using this flag changes the template. I've separated out some of the important changes into their own commits to make it easier to review.

- `chore(integ-runner): use newStyleSynthesis by default` - this contains the actual change to the `integ-runner`
- `integ test shapshot updates` - this contains the snapshot updates for most of the tests
- The commits that mention a specific module contain fixes for broken integration tests

----

### All Submissions:

* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.40.0/CHANGELOG.md)

Patches cfnspec to allow `CfnStateMachine.DefinitionSubstitutions` to synthesize again

fixes: #21653 

----

### All Submissions:

* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…tiating them (#21826)

### Description

Similar to `addEnvironment()`, an `addSecret()` method is useful to add secrets to ECS Containers after instantiating them via the constructor.

### Use Case

The most important use-case is when writing Task Definition Extensions or Aspects to augment ECS services. For example, setting environment variables and secrets for a logging or monitoring solution.

Right now, this can be done only using Escape Hatches and there is no higher level functionality to obtain this behaviour.

### Proposed Solution

```typescript
const container = taskDefinition.addContainer('nginx', {
  image: ecs.ContainerImage.fromRegistry('nginx'),
});

container.addSecret('SECRET_1', ecs.Secret.fromSecretsManager(secret));
container.addSecret('SECRET_2', ecs.Secret.fromSecretsManager(secretField, 'password'));
```

closes #18959

----

### All Submissions:

* [X] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [X] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [X] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This is part of the Reduce Module Size [project](https://github.com/aws/aws-cdk/projects/15). Most of the heavy lifting is done in jsii, this PR simply turns on the feature.

I have tested this in our test pipeline and can confirm that the build output from there can be successfully ingested by contruct hub with transliterated examples in every language. Afaik, the tablet file included in the `aws-cdk-lib` package is _only_ for construct hub, because reproducing the tablet file would take ~3 hours.

Title is a `feat` so that it shows up in the changelog; there are no unit or integ tests that can be run to demonstrate it is working.

----

### All Submissions:

* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…esource properties (#21707)

This PR adds the `Template.resourcePropertiesCountIs()` method for counting the number of resources of a specified type whose `Properties` section matches given properties.

Implements: #21706

----

### All Submissions:

* [X] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Closes: #21740 

Add support for propagateTags to the CDK construct.

----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

----

Closes: #21697 and might close #21699

Not all private subnets need to have a NAT gateway for egress; an example would be when using Transit Gateway.

I have incorporated the idea expressed in #21189 to add a more generic `PRIVATE_WITH_EGRESS` subnet type.

This PR is largely a rename and a small logic change in `determineNatGatewayCount`


### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…onnection (#21857)

Fixes: #21855

While creating a Eventbridge connection to make api calls to an external api one sometimes have to add additional header parameters like `Content-Type = application/json` 
These additional headers can be either be a secret value or a plaintext value specified at deploy time. 
The connection class provides a HttpParameter class that alows you to set a static/unsecure/plaintext value for a header key
 
```javascript
const connection = new Connection(this, "connection", {
  authorization: Authorization.apiKey( "authorization", secret.secretValue),
  headerParameters: {
    "Content-Type": HttpParameter.fromString("application/json"),
  },
});
```

This should lead to api calls made with the connection have a Header present with key/value `"Content-Type": "application/json"`,

The actual behavior was prior to this Fix that the header wasn't present in the api calls made with this connection. 

While debugging the issue I used the following aws cli commands to check what has been deployed by cdk/cloudformation

`aws events describe-connection --name <name-of-the-connection> `

which result was similair to this 

```JSON
{
    "ConnectionArn": "arn:aws:events:eu-west-1:XXXXXXX:connection/SomeConnection/0848ec46-413a-4d40-8834-XXXXXX",
    "Name": "SomeConnection",
    "ConnectionState": "AUTHORIZED",
    "AuthorizationType": "API_KEY",
    "SecretArn": "arn:aws:secretsmanager:eu-west-1:XXXXXXX:secret:events!connection/SomeSecret/1e74cbb0-dfc6-4b77-a49f-b204e6b74a46-XXXXXX",
    "AuthParameters": {
        "ApiKeyAuthParameters": {
            "ApiKeyName": "authorization"
        },
        "InvocationHttpParameters": {
            "HeaderParameters": [
                {
                    "Key": "Content-Type",
                    "IsValueSecret": true
                }
            ]
        }
    },
    "CreationTime": "2022-08-29T16:57:35+02:00",
    "LastModifiedTime": "2022-08-29T16:57:35+02:00",
    "LastAuthorizedTime": "2022-08-29T16:57:35+02:00"
}
```

Which indicates that the header value is not set because it is treated as secret value and needs to be provided by the referenced secret. 

Then i checked the Cloudformation spec 
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-connection-parameter.html
There it is indicated that there is the property `isValueSecret` which indicates if the value is a secret or not. 

The next step was to check why cdk generates a template that doesn't work and thereby checked the HttpParameter class. 
This class is responsible for generating the `AWS::Events::Connection Parameter` properties. 
I noticed that only the `HttpParameter.fromSecret()` sets the `isValueSecret` flag. 
But it seems to be the case that for this property the default value is true by cloudformation, so omiting this attribute in the _render function results to `isValueSecret: true` at deploy time. 
  
After that i explicity set the value to false for the case the user specifies a plaintext value throught the `HttpParameter.fromString()` method. 

To make sure the correct values are deployed by cloudformation I added a integration test including an assertion that the deployed connection has the correct isValueSecret flag set and the value for the header is set.
 
----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

)

Currently, it is not possible to set 0 retry attempts for any of the EventBridge targets that support a retry policy as 0 is falsy value and hence the following conditional doesn't evaluate to true - 
https://github.com/aws/aws-cdk/blob/c607ca51be1042f091b4e4419f20bec75863055c/packages/%40aws-cdk/aws-events-targets/lib/util.ts#L54-L59
Changed the conditional logic to allow 0 retry attempts for all supported targets along with unit tests.

fixes [#21864 ](#21864)

----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…21357)

This will allow for users with a need for all Lambda functions to be
placed in a VPC to more easily adopt the use of `AwsCustomResource`.
This is implemented by accepting a `vpc` and `vpcSubnets` property and
passing those up to the created `SingletonFunction`. Then tests are
added to ensure that it builds correctly and that errors are thrown in
the expected circumstances (in the same situations that
`lambda.Function` does).

This mimics the setup already used by `Provider` in the same package.

----

### All Submissions:

* [X] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [X] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This PR is to resolve #21190.
I add an example of `Connection` with RDS secret to the documentation.
This PR will help RDS customers understand how to create more secure `Connections`.

----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

I noticed that the links on https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_core.Duration.html and https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.Duration.html took me to the French-language version the ISO site, https://www.iso.org/fr/standard/70907.html, which surprised me.

This changes that to remove `/fr` from the URL. (I haven't tested, but this might default to the right language for a user's browser, or always show English, but I think either of those are less surprising, given the rest of the CDK's docs are in English.)

----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…rs (#18703)

Add support to `MaxSwap ` and `Swappiness` attributes in the `LinuxParameters` construct.

Closes #18460

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This PR adds SageMaker Studio as one of the enum-like members for [`InterfaceVpcEndpointAwsService`](https://github.com/aws/aws-cdk/blob/17c94eb62ade60c707895afbacea582d42c7e286/packages/%40aws-cdk/aws-ec2/lib/vpc-endpoint.ts#L260-L323).

This is particularly useful for SageMaker Studio as its prefix is `aws.sagemaker`, which can be considered a corner case that wouldn't fit [`InterfaceVpcEndpointAwsService.getDefaultEndpointPrefix`](https://github.com/aws/aws-cdk/blob/17c94eb62ade60c707895afbacea582d42c7e286/packages/%40aws-cdk/aws-ec2/lib/vpc-endpoint.ts#L374-L395).

See: `aws ec2 describe-vpc-endpoint-services --query 'ServiceDetails[].ServiceName'`

----

### All Submissions:

* [X] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This PR adds the capability to specify the consumerGroupId in the event-source-mapping when connection to Kafka.
Adds the feature described in issue #21734

This features allows you to specify the consumerGroupId while connecting to a Kafka cluster. This feature was recently annouced https://aws.amazon.com/blogs/compute/using-custom-consumer-group-id-support-for-the-aws-lambda-event-sources-for-msk-and-self-managed-kafka/ and wasn't part of the cdk Kafka construct before.

Things done: 
* Added missing attributes to class EventSourceMapping
  * amazonManagedKafkaEventSourceConfig
  * selfManagedKafkaEventSourceConfig
* Added validation for the consumerGroupId value based in [CfnSpec](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig.html)
* Added a common api `consumerGroupId` for adding the consumerGroupId independant if selfManaged or awsManaged
* Updated existing integration test for SelfManagesKafkaConfig
  * The ManagedKafka Config is not integration tested because it requires a ManagedKafkaCluster which is not possible to deploy right now via cdk
* Added Tests for consumerGroupId validation
* Added Tests for template synth for SelfManagedKafka and AwsManagedKafka

----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

In v1 we used to record construct stack traces; those have disappeared
in v2 because the defaults in the underlying `constructs` library
changed.

Re-add them when `--debug` is passed.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add ECR account of `ap-southeast-3` for AWS App Mesh.

`ap-southeast-3` is an opt-in region, so we have to manually add the new ECR account.

----

### All Submissions:

* [Y] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [Y] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [N] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

It looks like something was changed in the base image and there is no longer write access to the `/tmp` directory which causes bundling with poetry to fail (see linked issue). This PR updates the Dockerfile to create a new cache location for both `pip` and `poetry` and switches to using a virtualenv for python so that it is no longer using root.

To test this I executed the `integ.function.poetry` integration test both before (to reproduce the error) and after the fix. I'm actually not sure why our integration tests didn't start failing in the pipeline. The only thing I can think of is that we are caching the docker images and it just hasn't pulled down a newer one that has this issue.

fixes #21867


----

### All Submissions:

* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

For some reason when using the `python3.7` docker image the `useradd` command fails `/bin/sh: /sbin/useradd: No such file or directory`.

I'm not sure why it works on 3.8 & 3.9 and not 3.7, but since that is not necessary I'm just removing it.

I've added python3.7 to the integration test to confirm that it works for 3.7, 3.8, & 3.9


----

### All Submissions:

* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…21949)

testLegacyBehavior only runs tests in v1 and skips them in v2, so none of these tests were running anyway. testFutureBehavior just runs the tests with the feature-flag as true, which is the default to these in v2 anyway. I'm removing these functions and their uses so that contributors aren't mislead to think they should use them.

I also fixed some spacing issues in test packages. The diff on this is kind of hard to follow but the summary of the change is this:
- all testLegacyBehavior tests have been deleted
- all testFutureBehavior tests have been updated to be standard tests
- describe blocks were removed where they wrapped around legacy or future sets of tests
- spacing fixed


----

### All Submissions:

* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*