Merge branch 'main' into fix/cluster-name-validation

packages/@aws-cdk/aws-ec2-alpha/lib/route.ts

@@ -329,7 +329,7 @@ export class VPNGatewayV2 extends Resource implements IRouteTarget {
   private readonly _attachment: CfnVPCGatewayAttachment;
 
   /**
-   * The VPN Gateway Route Propogation
+   * The VPN Gateway Route Propagation
    */
   private readonly _routePropagation: CfnVPNGatewayRoutePropagation;
 
@@ -696,7 +696,7 @@ export class Route extends Resource implements IRouteV2 {
   public readonly routeTable: IRouteTable;
 
   /**
-   * The type of router the route is targetting
+   * The type of router the route is targeting
    */
   public readonly targetRouterType: RouterType;
 

packages/@aws-cdk/aws-ec2-alpha/test/vpc-add-method.test.ts

@@ -365,7 +365,7 @@ describe('Vpc V2 with full control', () => {
     });
   });
 
-  test('Check vpngateway has routePropogation for input subnets', () => {
+  test('Check vpngateway has route Propagation for input subnets', () => {
     myVpc.enableVpnGatewayV2({
       type: VpnConnectionType.IPSEC_1,
       vpnRoutePropagation: [{ subnetType: SubnetType.PUBLIC }],
@@ -382,7 +382,7 @@ describe('Vpc V2 with full control', () => {
     });
   });
 
-  test('Throws error when no subnet identified for route propogation', () => {
+  test('Throws error when no subnet identified for route propagation', () => {
     expect(() => {
       myVpc.enableVpnGatewayV2({
         type: VpnConnectionType.IPSEC_1,

packages/@aws-cdk/aws-eks-v2-alpha/lib/addon.ts

@@ -28,7 +28,7 @@ export interface AddonProps {
    */
   readonly addonName: string;
   /**
-   * Version of the Add-On. You can check all available versions with describe-addon-versons.
+   * Version of the Add-On. You can check all available versions with describe-addon-versions.
    * For example, this lists all available versions for the `eks-pod-identity-agent` addon:
    * $ aws eks describe-addon-versions --addon-name eks-pod-identity-agent \
    * --query 'addons[*].addonVersions[*].addonVersion'

packages/@aws-cdk/aws-glue-alpha/lib/job-executable.ts

@@ -474,7 +474,7 @@ export interface JobExecutableConfig {
   readonly script: Code;
 
   /**
-   * The Scala class that serves as the entry point for the job. This applies only if your the job langauage is Scala.
+   * The Scala class that serves as the entry point for the job. This applies only if your the job language is Scala.
    * Equivalent to a job parameter `--class`.
    *
    * @default - no scala className specified

packages/@aws-cdk/aws-glue-alpha/lib/job.ts

@@ -427,7 +427,7 @@ export interface SparkUILoggingLocation {
  */
 export interface ContinuousLoggingProps {
   /**
-   * Enable continouous logging.
+   * Enable continuous logging.
    */
   readonly enabled: boolean;
 

packages/@aws-cdk/aws-glue-alpha/lib/schema.ts

@@ -13,7 +13,7 @@ export interface Column {
   readonly type: Type;
 
   /**
-   * Coment describing the column.
+   * Comment describing the column.
    *
    * @default none
    */

packages/@aws-cdk/aws-iot-actions-alpha/lib/firehose-put-record-action.ts

@@ -24,7 +24,7 @@ export enum FirehoseRecordSeparator {
   WINDOWS_NEWLINE = '\r\n',
 
   /**
-   * Separate by a commma
+   * Separate by a comma
    */
   COMMA = ',',
 }

packages/@aws-cdk/aws-iot-actions-alpha/lib/kinesis-put-record-action.ts

@@ -14,7 +14,7 @@ export interface KinesisPutRecordActionProps extends CommonActionProps {
    *
    * @see https://docs.aws.amazon.com/iot/latest/developerguide/iot-substitution-templates.html
    *
-   * You can use the expression '${newuuid()}' if your payload does not have a high cardinarity property.
+   * You can use the expression '${newuuid()}' if your payload does not have a high cardinality property.
    * If you use empty string, this action use no partition key and all records will put same one shard.
    *
    * @see https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecord.html#API_PutRecord_RequestParameters

packages/@aws-cdk/aws-iot-actions-alpha/lib/step-functions-state-machine-action.ts

@@ -28,7 +28,7 @@ export class StepFunctionsStateMachineAction implements iot.IAction {
   private readonly role?: iam.IRole;
 
   /**
-   * @param stateMachine The Step Functions Start Machine which shoud be executed.
+   * @param stateMachine The Step Functions Start Machine which should be executed.
    * @param props Optional properties to not use default
    */
   constructor(private readonly stateMachine: stepfunctions.IStateMachine, props?: StepFunctionsStateMachineActionProps) {

packages/@aws-cdk/aws-iot-actions-alpha/test/kinesis-firehose/firehose-put-record-action.test.ts

@@ -90,7 +90,7 @@ test('can set batchMode', () => {
   });
 });
 
-test('can set separotor', () => {
+test('can set separator', () => {
   // GIVEN
   const stack = new cdk.Stack();
   const topicRule = new iot.TopicRule(stack, 'MyTopicRule', {

packages/@aws-cdk/aws-scheduler-targets-alpha/README.md

@@ -34,6 +34,7 @@ The following targets are supported:
 9. `targets.KinesisDataFirehosePutRecord`: [Put a record to a Kinesis Data Firehose](#put-a-record-to-a-kinesis-data-firehose)
 10. `targets.CodePipelineStartPipelineExecution`: [Start a CodePipeline execution](#start-a-codepipeline-execution)
 11. `targets.SageMakerStartPipelineExecution`: [Start a SageMaker pipeline execution](#start-a-sagemaker-pipeline-execution)
+12. `targets.Universal`: [Invoke a wider set of AWS API](#invoke-a-wider-set-of-aws-api)
 
 ## Invoke a Lambda function
 
@@ -312,3 +313,52 @@ new Schedule(this, 'Schedule', {
   }),
 });
 ```
+
+## Invoke a wider set of AWS API
+
+Use the `Universal` target to invoke AWS API.
+
+The code snippet below creates an event rule with AWS API as the target which is
+called at midnight every day by EventBridge Scheduler.
+
+```ts
+new Schedule(this, 'Schedule', {
+  schedule: ScheduleExpression.cron({
+    minute: '0',
+    hour: '0',
+  }),
+  target: new targets.Universal({
+    service: 'rds',
+    action: 'stopDBCluster',
+    input: ScheduleTargetInput.fromObject({
+      DbClusterIdentifier: 'my-db',
+    }),
+  }),
+});
+```
+
+The `service` must be in lowercase and the `action` must be in camelCase.
+
+By default, an IAM policy for the Scheduler is extracted from the API call.
+
+You can control the IAM policy for the Scheduler by specifying the `policyStatements` property.
+
+```ts
+new Schedule(this, 'Schedule', {
+  schedule: ScheduleExpression.rate(Duration.minutes(60)),
+  target: new targets.Universal({
+    service: 'sqs',
+    action: 'sendMessage',
+    policyStatements: [
+      new iam.PolicyStatement({
+        actions: ['sqs:SendMessage'],
+        resources: ['arn:aws:sqs:us-east-1:123456789012:my_queue'],
+      }),
+      new iam.PolicyStatement({
+        actions: ['kms:Decrypt', 'kms:GenerateDataKey*'],
+        resources: ['arn:aws:kms:us-east-1:123456789012:key/0987dcba-09fe-87dc-65ba-ab0987654321'],
+      }),
+    ],
+  }),
+});
+```

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/index.ts

@@ -10,3 +10,4 @@ export * from './sns-publish';
 export * from './sqs-send-message';
 export * from './stepfunctions-start-execution';
 export * from './target';
+export * from './universal';

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/universal.ts

@@ -0,0 +1,109 @@
+import { IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha';
+import { Aws, Token } from 'aws-cdk-lib';
+import { IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { awsSdkToIamAction } from 'aws-cdk-lib/custom-resources/lib/helpers-internal';
+import { ScheduleTargetBase, ScheduleTargetBaseProps } from './target';
+
+/**
+ * AWS read-only API action name prefixes that are not supported by EventBridge Scheduler.
+ *
+ * @see https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html
+ */
+const NOT_SUPPORTED_ACTION_PREFIX = [
+  'get',
+  'describe',
+  'list',
+  'poll',
+  'receive',
+  'search',
+  'scan',
+  'query',
+  'select',
+  'read',
+  'lookup',
+  'discover',
+  'validate',
+  'batchGet',
+  'batchDescribe',
+  'batchRead',
+  'transactGet',
+  'adminGet',
+  'adminList',
+  'testMigration',
+  'retrieve',
+  'testConnection',
+  'translateDocument',
+  'isAuthorized',
+  'invokeModel',
+];
+
+/**
+ * Properties for a Universal Target
+ */
+export interface UniversalTargetProps extends ScheduleTargetBaseProps {
+  /**
+   * The AWS service to call.
+   *
+   * This must be in lowercase.
+   */
+  readonly service: string;
+
+  /**
+   * The API action to call. Must be camelCase.
+   *
+   * You cannot use read-only API actions such as common GET operations.
+   *
+   * @see https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html#unsupported-api-actions
+   */
+  readonly action: string;
+
+  /**
+   * The IAM policy statements needed to invoke the target. These statements are attached to the Scheduler's role.
+   *
+   * Note that the default may not be the correct actions as not all AWS services follows the same IAM action pattern, or there may be more actions needed to invoke the target.
+   *
+   * @default - Policy with `service:action` action only.
+   */
+  readonly policyStatements?: PolicyStatement[];
+}
+
+/**
+ * Use a wider set of AWS API as a target for AWS EventBridge Scheduler.
+ *
+ * @see https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html
+ */
+export class Universal extends ScheduleTargetBase implements IScheduleTarget {
+  constructor(
+    private readonly props: UniversalTargetProps,
+  ) {
+    const service = props.service;
+    const action = props.action;
+
+    if (!Token.isUnresolved(service) && service !== service.toLowerCase()) {
+      throw new Error(`API service must be lowercase, got: ${service}`);
+    }
+    if (!Token.isUnresolved(action) && !action.startsWith(action[0]?.toLowerCase())) {
+      throw new Error(`API action must be camelCase, got: ${action}`);
+    }
+    if (!Token.isUnresolved(action) && NOT_SUPPORTED_ACTION_PREFIX.some(prefix => action.startsWith(prefix))) {
+      throw new Error(`Read-only API action is not supported by EventBridge Scheduler: ${service}:${action}`);
+    }
+
+    const arn = `arn:${Aws.PARTITION}:scheduler:::aws-sdk:${service}:${action}`;
+    super(props, arn);
+  }
+
+  protected addTargetActionToRole(role: IRole): void {
+    if (!this.props.policyStatements?.length) {
+      role.addToPrincipalPolicy(new PolicyStatement({
+        actions: [awsSdkToIamAction(this.props.service, this.props.action)],
+        resources: ['*'],
+      }));
+      return;
+    }
+
+    for (const statement of this.props.policyStatements) {
+      role.addToPrincipalPolicy(statement);
+    }
+  }
+}