chore(merge-back): 1.106.0

…ance (#14837)

This PR is intended to cover a small bug that is produced when you create a RDS instance with both Multi-AZ and Availability Zone properties defined, which are incompatible.

That can cause RDS replace if Multi-AZ is setup after to an existing stack with AZ defined previously, because CDK removes AZ setup without any notice to the developer.

This contribution will give the developer visibility of this incompatibility so is not possible to apply both parameters at the same time.

More details in issue [#10949](#10949)

Closes [#10949](#10949)
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Notes

* Customers can now extend the base`ecs.TaskDefinition` and  `ecs.BaseService` constructs to provision resources for ECS Anywhere, a sample below.

* I will follow up with another PR to introduce two new constructs for ECS anywhere tasks and services (like `ExternalTaskDefinition` & `ExternalService`) so we can directly use these new constructs for provisioning ECS anywhere resources

----

**Sample Task:**

```typescript
export class ExternalTaskDefinition extends ecs.TaskDefinition implements ecs.ITaskDefinition {
  constructor(scope: Construct, id: string, props: ecs.CommonTaskDefinitionProps = {}) {
    super(scope, id, {
      ...props,
      compatibility: ecs.Compatibility.EXTERNAL
    });
  }
}
```

**Sample Service:**

```typescript
export interface ExternalServiceProps extends ecs.BaseServiceOptions {
  readonly taskDefinition: ecs.TaskDefinition;
}

export class ExternalService extends ecs.BaseService implements ecs.IService {
  constructor(scope: Construct, id: string, props: ExternalServiceProps) {

    super(scope, id, {
      ...props,
      desiredCount: 1,
      launchType: ecs.LaunchType.EXTERNAL,
    },
    {
      cluster: props.cluster.clusterName,
      taskDefinition: props.taskDefinition.taskDefinitionArn
    }, props.taskDefinition);
  }
}
```


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

#14869)

…tation Lambda (#14471)"

This reverts commit 85e00fa

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Co-authored-by: AWS CDK Team <aws-cdk@amazon.com>

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/1.106.1/CHANGELOG.md)

Fixed a small typo in aws-iam docs.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This is the second part of the series for [issue#12733](#12733).
For the breakdown on series, please refer to
[this comment](#14782 (comment)).

#### Collaborators

@alexbrjo and @dfezzie. Thank you!

#### Design notes

- Adding `TlsListener` interface above `TlsCertificate` in order to use `TlsCertificate` for `TlsClientPolicy` ([example](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-appmesh-virtualnode-clientpolicytls.html)) 
- Updating TLS certificate abstraction by removing `tlsMode` property since `tlsMode` is part `TlsListener` property. In addition, this update is also required because `TlsClientPolicy` does NOT have `tlsMode` property.

BREAKING CHANGE: the creation property `tlsCertificate` in `VirtualNode` has been renamed to `tls`, and its type changed to `TlsListener`
- **appmesh**: the creation property `tlsCertificate` in `VirtualGatewayListener` has been renamed to `tls`, and its type changed to `TlsListener`
- **appmesh**: the `tlsMode` property has been removed from the options when creating a `TlsCertificate`, moved to the new `TlsListener` interface, and renamed `mode`

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

The `scripts/check-api-compatibility.sh` script prevents breaking API
changes in stable CDK modules.
However, this does not prevent functional breaking changes. It is
infeasible to actually detect and prevent this.

The CDK must be more strict on preventing such changes and the impact
due to their perception.

A linter error when a 'BREAKING CHANGE' clause for a stable module is
encountered in the PR is a good way to communicate this information.

#14782)

This is the first part of the series for [issue#12733](#12733).
For the breakdown on series, please refer to
[this comment](#14782 (comment)).

#### Collaborators
@alexbrjo and @dfezzie. Thank you!

#### REV:
- Adding `TlsValidation` abstract class with factory methods for available certificate sources.
- Converting client policy into an interface. In addition, it is renamed to `TlsClientPolicy` to better reflect its representation.

#### Design Note:
- Adding `TlsValidation` abstract class since it became a common property for TLS client policy and TLS listener after mTLS feature support.

BREAKING CHANGE: the creation property `clientPolicy` in `VirtualNode` has been renamed to `tlsClientPolicy`, and its type changed to `TlsClientPolicy`
- **appmesh**: the creation property `clientPolicy` in `VirtualGateway` has been renamed to `tlsClientPolicy`, and its type changed to `TlsClientPolicy`
- **appmesh**: to create `TlsClientPolicy`, `validation` property must be defined.

---
*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

* Change servicecatalog ownership

* Add owners for missing modules

* Update .github/workflows/issue-label-assign.yml

Co-authored-by: Adam Ruka <adamruka85@gmail.com>

* Remove empty line

* Adding new team members to auto assignment

Co-authored-by: Adam Ruka <adamruka85@gmail.com>

…e with a NodejsFunction (#14914)

#14739 changed how `esbuild` is run. It now uses the package manager.

When consuming a node module with a `NodejsFunction` we need to run
`esbuild` from the directory containing the lock file. This is where
we have `node_modules\.bin`. If we run it from the directory containing
the entry file the package manager doesn't "see" `node_modules\.bin`.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Closes #14823


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ed assets (#13803)

This PR refactors the Asset Stage of the CDK pipeline so that only one FileAsset and one DockerAsset Action are created that are uploading all assets of the respective type.

The main benefit of this is improved performance as uploading in parallel does not save enough time to compensate slower startups of multiple CodeBuilds.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…3981)

Specify the source of the error when an invalid http route path is detected

The error currently indicates an issue with 'path' which is unfortunately unhelpful when working with large stacks various paths (files/assets/etc...).

I spent a while triple checking lambda asset paths before searching the codebase to find the source of this error. I think the additional context might help someone find the source of the error more quickly. 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add support for CloudFront functions

/cc @njlynch 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Having this check in the prebuild is causing issues with the way we set up
GitPod integration. Our build step actually does install as well, so our build
is really a build+install, so it makes sense to do the check here anyway.

fixes #14896


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…storage (#14894)

According to https://aws.amazon.com/elasticsearch-service/pricing/ it's now supported .

Fixes #14773


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

base issue : #14851

I think "screencast.gif" at project root directory is not used (I thinks it already deprecated)
So I think it's possible to delete this file.

Support KubernetesVersion 1.20

Fixes: #14756 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…e log group (#14947)

This PR adds a public method `logGroupPhysicalName()` to access the physical name of a log group which is a private property of the `Resource` class.

This change is needed to enable using KMS keys with log groups for use with ECS exec.
Related: #13618

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Bumps [actions/cache](https://github.com/actions/cache) from 2.1.5 to 2.1.6.
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](actions/cache@v2.1.5...v2.1.6)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>