### Install Project Dependencies

Source: https://github.com/pulumi/pulumi-aws/blob/master/examples/ecr-image/README.md

Install the required npm packages for the Pulumi project.

```sh
npm install
```

--------------------------------

### Install Pulumi AWS Provider

Source: https://github.com/pulumi/pulumi-aws/blob/master/sdk/python/README.md

Commands to install the Pulumi AWS SDK across different supported programming environments using standard package managers.

```bash
npm install @pulumi/aws
```

```bash
yarn add @pulumi/aws
```

```bash
pip install pulumi_aws
```

```bash
go get github.com/pulumi/pulumi-aws/sdk/v7
```

```bash
dotnet add package Pulumi.Aws
```

--------------------------------

### S3 Bucket Replication Configuration

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

This example demonstrates how to configure S3 bucket replication using the aws.s3.BucketReplicationConfig resource. It includes enabling versioning on both source and destination buckets and setting up replication rules.

```APIDOC
## aws.s3.BucketReplicationConfig

### Description
Configures replication settings for an S3 bucket, allowing data to be copied to a destination bucket. Requires bucket versioning to be enabled on both source and destination buckets.

### Method
Create/Update

### Endpoint
N/A (Resource configuration)

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **bucket** (string) - Required - The name of the source S3 bucket.
- **role** (string) - Required - The ARN of the IAM role that grants permissions for replication.
- **rules** (array) - Required - A list of replication rules.
  - **id** (string) - Required - A unique identifier for the replication rule.
  - **status** (string) - Required - The status of the replication rule ('Enabled' or 'Disabled').
  - **filter** (object) - Optional - A filter to specify which objects to replicate.
    - **prefix** (string) - Optional - Replicates objects matching the specified prefix.
  - **destination** (object) - Required - The destination bucket for replication.
    - **bucket** (string) - Required - The ARN of the destination S3 bucket.
    - **storageClass** (string) - Optional - The storage class to use for objects in the destination bucket (e.g., 'STANDARD', 'INTELLIGENT_TIERING').

### Request Example
```json
{
  "bucket": "my-source-bucket",
  "role": "arn:aws:iam::123456789012:role/ReplicationRole",
  "rules": [
    {
      "id": "example-rule",
      "status": "Enabled",
      "filter": {
        "prefix": "logs/"
      },
      "destination": {
        "bucket": "arn:aws:s3:::my-destination-bucket",
        "storageClass": "STANDARD"
      }
    }
  ]
}
```

### Response
#### Success Response (200)
- **id** (string) - The ID of the replication configuration.
- **bucket** (string) - The name of the source bucket.
- **role** (string) - The ARN of the replication role.
- **rules** (array) - The replication rules.

#### Response Example
```json
{
  "id": "replication-config-id",
  "bucket": "my-source-bucket",
  "role": "arn:aws:iam::123456789012:role/ReplicationRole",
  "rules": [
    {
      "id": "example-rule",
      "status": "Enabled",
      "filter": {
        "prefix": "logs/"
      },
      "destination": {
        "bucket": "arn:aws:s3:::my-destination-bucket",
        "storageClass": "STANDARD"
      }
    }
  ]
}
```
```

--------------------------------

### Basic Lambda Function Example (TypeScript)

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

A simple AWS Lambda function written in TypeScript using Pulumi. This function fetches the content of the Pulumi website's robots.txt file and logs its HTTP status code. It demonstrates a basic Pulumi Lambda setup.

```typescript
import * as aws from "@pulumi/aws";

// Create an AWS Lambda function that fetches the Pulumi website and returns the HTTP status
const lambda = new aws.lambda.CallbackFunction("fetcher", {
    callback: async(event) => {
        try {
            const res = await fetch("https://www.pulumi.com/robots.txt");
            console.info("status", res.status);
            return res.status;
        }
        catch (e) {
            console.error(e);
            return 500;
        }
    },
});
```

--------------------------------

### Manage VPC in Specific Region with Pulumi AWS

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

This example demonstrates how to create an AWS VPC in a region different from the provider's default configuration using the new `region` argument. This avoids the need for a separate provider configuration for each region.

```typescript
import * as aws from "@pulumi/aws";

const peer = new aws.ec2.Vpc("peer", {
    region: "us-west-2",
    cidrBlock: "10.1.0.0/16",
});
```

--------------------------------

### GitHub Actions Workflow for AWS Credentials (YAML)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

An example GitHub Actions workflow snippet that uses the `configure-aws-credentials` action to authenticate with AWS using OIDC. This automates the process of assuming an IAM role for your Pulumi deployments running on GitHub.

```yaml
uses: aws-actions/configure-aws-credentials@v4
with:
  aws-region: ${{ env.AWS_REGION }}
  role-session-name: <NAME>
  role-to-assume: arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>
```

--------------------------------

### Import Resource in Specific Region with Pulumi CLI

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

This example shows how to import an existing AWS resource into Pulumi state, specifying the target region by appending `@<region>` to the resource's import ID. This is useful when migrating resources managed outside of Pulumi.

```bash
pulumi import aws:ec2/vpc:Vpc test_vpc vpc-a01106c2@eu-west-1
```

--------------------------------

### Cross-Region VPC Peering with Pulumi AWS

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

Sets up VPC peering between two AWS regions. The example shows the configuration before v7.0.0, which required explicit provider configuration for each region, and the updated approach in v7.0.0+ where a single provider can manage resources across multiple regions.

```typescript
import * as aws from "@pulumi/aws";

// Configure the default provider for us-east-1
const awsProvider = new aws.Provider("aws", {
    region: "us-east-1",
});

// Configure an additional provider for us-west-2
const awsPeerProvider = new aws.Provider("aws-peer", {
    region: "us-west-2",
});

const main = new aws.ec2.Vpc("main", {
    cidrBlock: "10.0.0.0/16",
}, { provider: awsProvider });

const peer = new aws.ec2.Vpc("peer", {
    cidrBlock: "10.1.0.0/16",
}, { provider: awsPeerProvider });

const peerIdentity = aws.getCallerIdentity({}, { provider: awsPeerProvider });

// Requester's side of the connection.
const peerConnection = new aws.ec2.VpcPeeringConnection("peer", {
    vpcId: main.id,
    peerVpcId: peer.id,
    peerOwnerId: peerIdentity.then(identity => identity.accountId),
    peerRegion: "us-west-2",
    autoAccept: false,
}, { provider: awsProvider });

// Accepter's side of the connection.
const peerAccepter = new aws.ec2.VpcPeeringConnectionAccepter("peer", {
    vpcPeeringConnectionId: peerConnection.id,
    autoAccept: true,
}, { provider: awsPeerProvider });
```

```typescript
import * as aws from "@pulumi/aws";

// Configure the provider for us-east-1
const awsProvider = new aws.Provider("aws", {
    region: "us-east-1",
});

const main = new aws.ec2.Vpc("main", {
    cidrBlock: "10.0.0.0/16",
}, { provider: awsProvider });

const peer = new aws.ec2.Vpc("peer", {
    region: "us-west-2",
    cidrBlock: "10.1.0.0/16",
}, { provider: awsProvider });

// Requester's side of the connection.
const peerConnection = new aws.ec2.VpcPeeringConnection("peer", {
    vpcId: main.id,
    peerVpcId: peer.id,
    peerRegion: "us-west-2",
    autoAccept: false,
}, { provider: awsProvider });

// Accepter's side of the connection.
const peerAccepter = new aws.ec2.VpcPeeringConnectionAccepter("peer", {
    region: "us-west-2",
    vpcPeeringConnectionId: peerConnection.id,
    autoAccept: true,
}, { provider: awsProvider });
```

--------------------------------

### Disabling EC2 Instance Metadata API Check (Python)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Provides a Python example for disabling the EC2 instance metadata API check when instantiating a Pulumi AWS provider. This setting is important for environments where EC2 metadata is not used for authentication.

```python
provider = pulumi_aws.Provider('named-provider', skip_metadata_api_check=False)
```

--------------------------------

### Update aws.elbv2.getListenerRule actions and conditions

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

Several arguments within `aws.elbv2.getListenerRule` actions and conditions are now treated as lists of objects instead of single objects. You must include an index when referencing them. For example, update `action[0].authenticateCognito.scope` to `action[0].authenticateCognito[0].scope`.

```typescript
// Example: Update referencing from object to list
// Before: action.authenticateCognito.scope
// After: action[0].authenticateCognito[0].scope
```

--------------------------------

### Configure S3 Bucket Replication (Pre-v7.0.0)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

Demonstrates setting up S3 replication using multiple providers for different regions. Requires explicit versioning and IAM role configuration.

```typescript
import * as aws from "@pulumi/aws";
const awsProvider = new aws.Provider("aws", { region: "eu-west-1" });
const awsCentralProvider = new aws.Provider("aws-central", { region: "eu-central-1" });
const assumeRoleDocument = aws.iam.getPolicyDocument({ statements: [{ effect: "Allow", principals: [{ type: "Service", identifiers: ["s3.amazonaws.com"] }], actions: ["sts:AssumeRole"] }] });
const replicationRole = new aws.iam.Role("replication", { assumeRolePolicy: assumeRoleDocument.then(doc => doc.json) }, { provider: awsProvider });
const destination = new aws.s3.Bucket("destination", {}, { provider: awsProvider });
const source = new aws.s3.Bucket("source", {}, { provider: awsCentralProvider });
const replicationPolicyDocument = aws.iam.getPolicyDocument({ statements: [{ effect: "Allow", actions: ["s3:GetReplicationConfiguration", "s3:ListBucket"], resources: [source.arn] }, { effect: "Allow", actions: ["s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging"], resources: [source.arn.apply(arn => `${arn}/*`)] }, { effect: "Allow", actions: ["s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags"], resources: [destination.arn.apply(arn => `${arn}/*`)] }] });
const replicationPolicy = new aws.iam.Policy("replication", { policy: replicationPolicyDocument.then(doc => doc.json) }, { provider: awsProvider });
const replicationPolicyAttachment = new aws.iam.RolePolicyAttachment("replication", { role: replicationRole.name, policyArn: replicationPolicy.arn }, { provider: awsProvider });
const destinationVersioning = new aws.s3.BucketVersioningV2("destination", { bucket: destination.id, versioningConfiguration: { status: "Enabled" } }, { provider: awsProvider });
const sourceBucketAcl = new aws.s3.BucketAclV2("source-bucket-acl", { bucket: source.id, acl: "private" }, { provider: awsCentralProvider });
const sourceVersioning = new aws.s3.BucketVersioningV2("source", { bucket: source.id, versioningConfiguration: { status: "Enabled" } }, { provider: awsCentralProvider });
const replication = new aws.s3.BucketReplicationConfig("replication", { dependsOn: [sourceVersioning], role: replicationRole.arn, bucket: source.id, rules: [{ id: "examplerule", filter: { prefix: "example" }, status: "Enabled", destination: { bucket: destination.arn, storageClass: "STANDARD" } }] }, { provider: awsCentralProvider });
```

--------------------------------

### KMS Replica Key Creation with Pulumi AWS

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

Demonstrates the creation of a multi-region KMS replica key. It contrasts the pre-v7.0.0 approach requiring separate providers for primary and replica keys with the v7.0.0+ method, which simplifies provider management.

```typescript
import * as aws from "@pulumi/aws";

// Configure primary provider for us-east-1
const awsPrimaryProvider = new aws.Provider("aws-primary", {
    region: "us-east-1",
});

// Configure default provider for us-west-2
const awsProvider = new aws.Provider("aws", {
    region: "us-west-2",
});

const primary = new aws.kms.Key("primary", {
    description: "Multi-Region primary key",
    deletionWindowInDays: 30,
    multiRegion: true,
}, { provider: awsPrimaryProvider });

const replica = new aws.kms.ReplicaKey("replica", {
    description: "Multi-Region replica key",
    deletionWindowInDays: 7,
    primaryKeyArn: primary.arn,
}, { provider: awsProvider });
```

```typescript

import * as aws from "@pulumi/aws";

// Configure provider for us-west-2
const awsProvider = new aws.Provider("aws", {
    region: "us-west-2",
});

const primary = new aws.kms.Key("primary", {
    region: "us-east-1",
    description: "Multi-Region primary key",
    deletionWindowInDays: 30,
    multiRegion: true,
}, { provider: awsProvider });

const replica = new aws.kms.ReplicaKey("replica", {
    description: "Multi-Region replica key",
    deletionWindowInDays: 7,
    primaryKeyArn: primary.arn,
}, { provider: awsProvider });
```

--------------------------------

### Deploy Pulumi Infrastructure

Source: https://github.com/pulumi/pulumi-aws/blob/master/examples/ecr-image/README.md

Execute the Pulumi program to provision the ECR repository and push the Docker image.

```sh
pulumi up
```

--------------------------------

### Package Folder as Lambda Layer (TypeScript)

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

This snippet demonstrates how to package a local folder as a Lambda Layer using Pulumi's AssetArchive. The layer's contents are accessible at runtime within the Lambda function's filesystem under the /opt directory. This is useful for sharing configuration files or other assets.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as fs from "fs";

// Create a Lambda layer containing some shared configuration.
const configLayer = new aws.lambda.LayerVersion("config-layer", {
    layerName: "my-config-layer",

    // Use a Pulumi AssetArchive to zip up the contents of the folder.
    code: new pulumi.asset.AssetArchive({
        "config": new pulumi.asset.FileArchive("./config"),
    }),
});

const lambda = new aws.lambda.CallbackFunction("docsHandlerFunc", {
    callback: async(event: aws.s3.BucketEvent) => {
        // ...
    },

    // Attach the config layer to the function.
    layers: [
        configLayer.arn,
    ],
});
```

--------------------------------

### Configure AWS Lambda Memory Size with CallbackFunction

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

Demonstrates how to instantiate an aws.lambda.CallbackFunction while customizing the memory allocation to 256MB.

```typescript
import * as aws from "@pulumi/aws";

// Create an AWS Lambda function with 256MB RAM
const lambda = new aws.lambda.CallbackFunction("docsHandlerFunc", {
    callback: async(event: aws.s3.BucketEvent) => {
        // ...
    },

    memorySize: 256 /* MB */,
});
```

--------------------------------

### Upgrade Pulumi AWS Provider using CLI

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

Shows the command to run for upgrading the Pulumi AWS provider to v7.0.0 and performing a refresh with the new version.

```bash
pulumi up --refresh --run-program
```

--------------------------------

### Migrating aws.apigateway.Deployment

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

Explains the migration from implicit stages to explicit aws.apigateway.Stage resources in API Gateway deployments.

```APIDOC
## Resource aws.apigateway.Deployment

### Description
Deployment configurations now require explicit management of stages. Properties like `stageName`, `stageDescription`, and `canarySettings` have been removed from the Deployment resource and should be moved to the `aws.apigateway.Stage` resource.

### Migration Pattern
- Remove `stageName` and related settings from `aws.apigateway.Deployment`.
- Create a new `aws.apigateway.Stage` resource.
- Reference the `deployment.id` in the new Stage resource.

### Request Example (After)
```typescript
const exampleDeployment = new aws.apigateway.Deployment("example", {
    restApi: exampleRestApi.id,
});

const prodStage = new aws.apigateway.Stage("prod", {
    stageName: "prod",
    restApi: exampleRestApi.id,
    deployment: exampleDeployment.id,
});
```
```

--------------------------------

### Configure S3 Bucket Replication (v7.0.0+)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

Updated pattern for S3 replication using the v7.0.0+ Pulumi AWS provider. Simplifies provider usage for cross-region configurations.

```typescript
import * as aws from "@pulumi/aws";
const awsProvider = new aws.Provider("aws", { region: "eu-west-1" });
const assumeRoleDocument = aws.iam.getPolicyDocument({ statements: [{ effect: "Allow", principals: [{ type: "Service", identifiers: ["s3.amazonaws.com"] }], actions: ["sts:AssumeRole"] }] });
const replicationRole = new aws.iam.Role("replication", { assumeRolePolicy: assumeRoleDocument.then(doc => doc.json) }, { provider: awsProvider });
const destination = new aws.s3.Bucket("destination", {}, { provider: awsProvider });
const source = new aws.s3.Bucket("source", { region: "eu-central-1" }, { provider: awsProvider });
const replicationPolicyDocument = aws.iam.getPolicyDocument({ statements: [{ effect: "Allow", actions: ["s3:GetReplicationConfiguration", "s3:ListBucket"], resources: [source.arn] }, { effect: "Allow", actions: ["s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging"], resources: [source.arn.apply(arn => `${arn}/*`)] }, { effect: "Allow", actions: ["s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags"], resources: [destination.arn.apply(arn => `${arn}/*`)] }] });
const replicationPolicy = new aws.iam.Policy("replication", { policy: replicationPolicyDocument.then(doc => doc.json) }, { provider: awsProvider });
```

--------------------------------

### Provision an S3 Bucket with Pulumi AWS

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/_index.md

This snippet demonstrates how to create an Amazon S3 bucket using the Pulumi AWS provider. It is available in multiple languages including TypeScript, Python, Go, C#, Java, and YAML.

```typescript
const aws = require("@pulumi/aws");

const bucket = new aws.s3.Bucket("mybucket");
```

```python
import pulumi
import pulumi_aws as aws

bucket = aws.s3.Bucket("bucket")
```

```go
package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := s3.NewBucket(ctx, "bucket", &s3.BucketArgs{})
		if err != nil {
			return err
		}
		return nil
	})
}
```

```csharp
using Pulumi;
using Aws = Pulumi.Aws;

await Deployment.RunAsync(() =>
{
    var bucket = new Aws.S3.Bucket("bucket");
});
```

```java
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.aws.s3.Bucket;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    private static void stack(Context ctx) {
        final var bucket = new Bucket("my-bucket");
        ctx.export("bucketName", bucket.name());
  }
}
```

```yaml
resources:
  mybucket:
    type: aws:s3:Bucket
outputs:
  bucketName: ${mybucket.name}
```

--------------------------------

### Resource Migration Summary

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

A collection of common migration patterns and property updates for various AWS resources.

```APIDOC
## Resource Migration Guide

### Overview
This guide provides instructions for updating resource configurations due to breaking changes in the Pulumi AWS provider.

### Key Resource Updates

#### aws.ec2.Instance
- **userData**: No longer hashes values. Use `userDataBase64` for encoded data. Do not store sensitive info in plaintext.
- **cpuCoreCount/cpuThreadsPerCore**: Removed. Use `cpuOptions` block with `coreCount` and `threadsPerCore`.

#### aws.rds.Instance
- **name**: Deprecated in v6, removed in v7. Use `dbName` instead.
- **characterSetName**: Invalid when used with `replicateSourceDb`, `restoreToPointInTime`, `s3Import`, or `snapshotIdentifier`.

#### aws.eks.Addon
- **resolveConflicts**: Removed. Use `resolveConflictsOnCreate` and `resolveConflictsOnUpdate`.

#### aws.kinesis.AnalyticsApplication
- **Status**: Deprecated. Migrate to `aws.kinesisanalyticsv2.Application` before January 27, 2026.

### General Deprecation Pattern
- **Deprecated Fields**: Always check the documentation for the replacement field (e.g., `region` -> `connectionRegion`).
- **Removed Fields**: These must be removed from your Pulumi code to prevent deployment errors.
```

--------------------------------

### Adding/Removing Files from Function Bundle

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

Explains how to use `codePathOptions` to customize the contents of the Lambda function bundle, including adding extra files or excluding packages.

```APIDOC
## Adding/Removing Files from Function Bundle

### Description
Customize the contents of the Lambda function bundle before it is uploaded to AWS Lambda using the `codePathOptions` property. This allows you to include additional files or exclude specific Node.js modules.

### Method
Use the `codePathOptions` object within the `aws.lambda.CallbackFunction` resource, specifying `extraIncludePaths` and `extraExcludePackages`.

### Code Example

This example adds a local directory `./config` to the bundle and excludes the `mime` package.

```typescript
import * as aws from "@pulumi/aws";
import * as fs from "fs";

const lambda = new aws.lambda.CallbackFunction("customBundleLambda", {
    callback: async(event: aws.s3.BucketEvent) => {
        // Function logic
        console.log("Lambda executed with custom bundle.");
        // Example: Accessing a file from the included config directory
        // const configData = fs.readFileSync('./config/settings.json', 'utf-8');
        // console.log(configData);
    },
    codePathOptions: {
        // Add local files or folders to the Lambda function bundle.
        extraIncludePaths: [
            "./config", // Includes the 'config' directory and its contents
        ],

        // Remove unneeded Node.js packages from the bundle.
        extraExcludePackages: [
            "mime", // Excludes the 'mime' package
        ],
    },
});
```

### `extraIncludePaths`
A list of file paths or directory paths to include in the Lambda function bundle.

### `extraExcludePackages`
A list of Node.js package names to exclude from the Lambda function bundle.
```

--------------------------------

### Customize Lambda Function Bundle Contents

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

Shows how to use codePathOptions to include additional local directories and exclude specific Node.js modules from the Lambda deployment package.

```typescript
import * as aws from "@pulumi/aws";
import * as fs from "fs";

const lambda = new aws.lambda.CallbackFunction("docsHandlerFunc", {
    callback: async(event: aws.s3.BucketEvent) => {
        // ...
    },

    codePathOptions: {

        // Add local files or folders to the Lambda function bundle.
        extraIncludePaths: [
            "./config",
        ],

        // Remove unneeded Node.js packages from the bundle.
        extraExcludePackages: [
            "mime",
        ],
    },
});
```

--------------------------------

### Customizing Lambda Function Attributes

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

Demonstrates how to customize underlying AWS Lambda settings, such as memory allocation, using the `aws.lambda.CallbackFunction` resource.

```APIDOC
## Customizing Lambda Function Attributes

### Description
The `aws.lambda.CallbackFunction` resource provides defaults for common Lambda configurations. You can override these defaults to customize settings like memory, CPU, logging, and more.

### Example: Increasing Memory Size
This example shows how to increase the available RAM for your Lambda function to 256MB.

### Method
Set the `memorySize` property in the `aws.lambda.CallbackFunction` resource.

### Code Example

```typescript
import * as aws from "@pulumi/aws";

// Create an AWS Lambda function with 256MB RAM
const lambda = new aws.lambda.CallbackFunction("customMemoryLambda", {
    callback: async(event: aws.s3.BucketEvent) => {
        // Function logic
        console.log("Lambda executed with custom memory.");
    },
    memorySize: 256, // Memory in MB
    timeout: 300,    // Timeout in seconds (optional)
    runtime: "nodejs18.x", // Specify runtime (optional)
});
```
```

--------------------------------

### Configure Assume Role with Structured Configuration

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Set up IAM role assumption using structured configuration for nested properties like `roleArn` and `durationSeconds`. This enhances security by allowing Pulumi to assume specific roles.

```bash
pulumi config set --path aws:assumeRoles[0].roleArn arn:aws:iam::058111598222:role/OrganizationAccountAccessRole
```

```bash
pulumi config set --path aws:assumeRoles[0].durationSeconds 3600
```

--------------------------------

### Configure Assume Role with Web Identity

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Configure assuming an IAM role using web identity or OIDC. This allows Pulumi to authenticate using external identity providers.

```bash
pulumi config set --path aws:assumeRoleWithWebIdentity.roleArn arn:aws:iam::058111598222:role/OrganizationAccountAccessRole
```

```bash
pulumi config set --path aws:assumeRoleWithWebIdentity.webIdentityToken YOUR_WEB_IDENTITY_TOKEN
```

--------------------------------

### Configuring AWS Provider

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Details on how to configure the AWS provider, including required region settings and optional authentication/IAM role configurations.

```APIDOC
## CONFIGURATION aws:Provider

### Description
Configures the AWS provider instance. This allows setting the target region, authentication credentials, and advanced security policies like IAM role assumption or account ID restrictions.

### Method
N/A (Configuration Object)

### Endpoint
aws:Provider

### Parameters
#### Request Body
- **region** (string) - Required - The AWS region (e.g., us-east-1).
- **accessKey** (string) - Optional - AWS access key for API operations.
- **allowedAccountIds** (list) - Optional - List of allowed AWS account IDs.
- **forbiddenAccountIds** (list) - Optional - List of forbidden AWS account IDs.
- **assumeRoles** (list) - Optional - List of objects for IAM role assumption (roleArn, durationSeconds, etc.).
- **assumeRoleWithWebIdentity** (object) - Optional - Configuration for OIDC/Web Identity role assumption.
- **defaultTags** (object) - Optional - Global tags applied to all managed resources.
- **ignoreTags** (object) - Optional - Configuration to ignore specific tag keys or prefixes.

### Request Example
{
  "aws:region": "us-west-2",
  "aws:accessKey": "AKIA...",
  "aws:assumeRoles": [{
    "roleArn": "arn:aws:iam::123456789012:role/MyRole",
    "sessionName": "PulumiSession"
  }]
}

### Response
#### Success Response (N/A)
- **status** (string) - Provider initialized successfully.
```

--------------------------------

### List Handling in `aws.elbv2.getListenerRule`

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

Several fields within `aws.elbv2.getListenerRule` now expect lists of objects instead of single objects. This requires adding an index when referencing these fields.

```APIDOC
## Function `aws.elbv2.getListenerRule` List Handling

Treat the following as lists of objects instead of objects:

- `action.authenticateCognito`
- `action.authenticateOidc`
- `action.fixedResponse`
- `action.forward`
- `action.forward.stickiness`
- `action.redirect`
- `condition.hostHeader`
- `condition.httpHeader`
- `condition.httpRequest_method`
- `condition.pathPattern`
- `condition.queryString`
- `condition.sourceIp`

**Example:** Update `action[0].authenticateCognito.scope` to `action[0].authenticateCognito[0].scope`.
```

--------------------------------

### List Handling in `aws.opensearchserverless.getSecurityConfig`

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

The `samlOptions` field in `aws.opensearchserverless.getSecurityConfig` now expects a list of nested objects instead of a single object. This requires adding an index when referencing it.

```APIDOC
## Function `aws.opensearchserverless.getSecurityConfig` List Handling

Treat `samlOptions` as a list of nested objects instead of an object. Include an index when referencing it. For example, update `samlOptions.sessionTimeout` to `samlOptions[0].sessionTimeout`.
```

--------------------------------

### Configure Ignored Resource Tag Keys

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Specify a list of exact tag keys to ignore across all resources handled by the provider. This prevents Pulumi from managing or displaying diffs for these tags.

```bash
pulumi config set aws:ignoreTags:keys "[\"CostCenter\", \"ProjectID\"]"
```

--------------------------------

### Configure Ignored Resource Tag Key Prefixes

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Specify a list of tag key prefixes to ignore across all resources handled by the provider. This prevents Pulumi from managing or displaying diffs for tags with these prefixes.

```bash
pulumi config set aws:ignoreTags:keyPrefixes "[\"automation-\", \"internal-\"]"
```

--------------------------------

### Configure S3 Bucket Replication and Versioning with Pulumi

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/enhanced-region-support.md

This Pulumi code configures S3 bucket replication and versioning. It sets up a replication role, attaches a policy, enables versioning on source and destination buckets, and defines replication rules including filters and destination storage class. It depends on the source bucket versioning being enabled first.

```typescript
const replicationPolicyAttachment = new aws.iam.RolePolicyAttachment("replication", {
    role: replicationRole.name,
    policyArn: replicationPolicy.arn,
}, { provider: awsProvider });

const destinationVersioning = new aws.s3.BucketVersioning("destination", {
    bucket: destination.id,
    versioningConfiguration: {
        status: "Enabled",
    },
}, { provider: awsProvider });

const sourceBucketAcl = new aws.s3.BucketAcl("source-bucket-acl", {
    region: "eu-central-1",
    bucket: source.id,
    acl: "private",
}, { provider: awsProvider });

const sourceVersioning = new aws.s3.BucketVersioning("source", {
    region: "eu-central-1",
    bucket: source.id,
    versioningConfiguration: {
        status: "Enabled",
    },
}, { provider: awsProvider });

const replication = new aws.s3.BucketReplicationConfig("replication", {
    region: "eu-central-1",
    // Must have bucket versioning enabled first
    dependsOn: [sourceVersioning],
    role: replicationRole.arn,
    bucket: source.id,
    rules: [{
        id: "examplerule",
        filter: {
            prefix: "example",
        },
        status: "Enabled",
        destination: {
            bucket: destination.arn,
            storageClass: "STANDARD",
        },
    }],
}, { provider: awsProvider });
```

--------------------------------

### Migrate aws.apigateway.Deployment to aws.apigateway.Stage

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

Demonstrates migrating from an implicit stage in aws.apigateway.Deployment to an explicit aws.apigateway.Stage resource. This change is necessary for configurations using stage-specific settings like `stageName`, `stageDescription`, or `canarySettings`, and for accessing `invokeUrl` and `executionArn` which are now part of the Stage resource.

```typescript
import * as aws from "@pulumi/aws";

const exampleDeployment = new aws.apigateway.Deployment("example", {
    restApi: exampleRestApi.id,
    stageName: "prod", // This is deprecated in newer versions
});

export const invokeUrl = exampleDeployment.invokeUrl;
export const executionArn = exampleDeployment.executionArn;
```

```typescript
import * as aws from "@pulumi/aws";

const exampleDeployment = new aws.apigateway.Deployment("example", {
    restApi: exampleRestApi.id,
});

const prodStage = new aws.apigateway.Stage("prod", {
    stageName: "prod",
    restApi: exampleRestApi.id,
    deployment: exampleDeployment.id,
});

export const invokeUrl = prodStage.invokeUrl;
export const executionArn = prodStage.executionArn;
```

--------------------------------

### Import ESC Environment into Pulumi Stack Settings

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

This YAML snippet shows how to configure a Pulumi stack settings file (`Pulumi.<stack-name>.yaml`) to import an external Pulumi ESC environment. This action makes the variables and configurations defined in the specified ESC environment available to the Pulumi project.

```yaml
environment:
  - <your-environment-name>
```

--------------------------------

### Removed `tagsAll` from `aws.quicksight.getDataSet`

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

The `tagsAll` field has been removed from the `aws.quicksight.getDataSet` function as it is no longer supported.

```APIDOC
## Function `aws.quicksight.getDataSet` Update

Remove `tagsAll`—it is no longer supported.
```

--------------------------------

### Setting AWS Profile via Environment Variable (Bash)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Shows how to set the AWS_PROFILE environment variable using bash. This is a common method to specify which profile from the shared credentials file should be used by applications, including Pulumi.

```bash
export AWS_PROFILE=<YOUR_PROFILE_NAME>
```

--------------------------------

### Setting AWS Profile via Pulumi Config (YAML)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Illustrates how to configure the AWS profile directly within your Pulumi project's configuration file (Pulumi.yaml). This allows Pulumi to use a specific AWS profile without relying on environment variables.

```yaml
config:
  aws:profile: <profilename>
```

--------------------------------

### Removed Resources: SimpleDB and WorkLink

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

The `aws.simpledb.Domain` resource and the `aws.worklink.Fleet` and `aws.worklink.WebsiteCertificateAuthorityAssociation` resources have been removed due to dropped support in the AWS SDK for Go v2.

```APIDOC
## Removed Resources

### SimpleDB Support Removed

The `aws.simpledb.Domain` resource has been removed.

### WorkLink Support Removed

The following resources have been removed:
- `aws.worklink.Fleet`
- `aws.worklink.WebsiteCertificateAuthorityAssociation`
```

--------------------------------

### Removed Fields from `aws.launch.getTemplate`

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

The `elasticGpuSpecifications` and `elasticInferenceAccelerator` fields have been removed from `aws.launch.getTemplate` due to the end of life for Amazon Elastic Graphics and Amazon Elastic Inference.

```APIDOC
## Function `aws.launch.getTemplate` Update

Remove the following fields as they are no longer supported:

- `elasticGpuSpecifications`: Amazon Elastic Graphics reached end of life in January 2024.
- `elasticInferenceAccelerator`: Amazon Elastic Inference reached end of life in April 2024.
```

--------------------------------

### Remove tagsAll from aws.quicksight.getDataSet

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

The `tagsAll` argument is no longer supported for `aws.quicksight.getDataSet`.

```typescript
// Remove the following line if present:
// tagsAll: {...}
```

--------------------------------

### Lambda Function Handler Options

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

Defines how to specify the JavaScript function for the Lambda handler using either the `callback` or `callbackFactory` input property.

```APIDOC
## Lambda Function Handler

### Description
Specify the JavaScript function that serves as the entrypoint for your AWS Lambda.
You can use either the `callback` property for a direct function or `callbackFactory` for functions requiring initialization.

### Method
Set either `callback` or `callbackFactory` in the `aws.lambda.CallbackFunction` resource.

### `callback` Property
Provide the JavaScript function directly.

```typescript
import * as aws from "@pulumi/aws";

const lambda = new aws.lambda.CallbackFunction("myLambda", {
    callback: async (event, context) => {
        // Your Lambda function logic here
        return "Hello from Lambda!";
    },
});
```

### `callbackFactory` Property
Provide a JavaScript function that returns the actual handler function. Useful for expensive initialization.

```typescript
import * as aws from "@pulumi/aws";

const lambda = new aws.lambda.CallbackFunction("myLambdaWithFactory", {
    callbackFactory: async () => {
        // Perform expensive initialization here (e.g., load models, connect to DB)
        console.log("Initializing Lambda factory...");
        const initializedData = await initializeExpensiveStuff();

        // Return the actual handler function
        return async (event, context) => {
            // Use initializedData in your handler logic
            console.log("Data:", initializedData);
            return "Hello from factory-initialized Lambda!";
        };
    },
});

async function initializeExpensiveStuff() {
    // Simulate initialization
    return new Promise(resolve => setTimeout(() => resolve({ message: "initialized" }), 1000));
}
```

### Recommendation
Use an `async` function for your handler to ensure proper execution and avoid issues with the event loop. Refer to [Define Lambda function handler in Node.js](https://docs.aws.amazon.com/lambda/latest/dg/nodejs-handler.html) for more details.
```

--------------------------------

### Configure Default Resource Tags

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Apply a set of default tags to all resources managed by the AWS provider. These tags can be overridden at the individual resource level.

```bash
pulumi config set --json aws:defaultTags '{"environment": "dev", "managedBy": "Pulumi"}'
```

--------------------------------

### AWS Provider Configuration Options

Source: https://github.com/pulumi/pulumi-aws/blob/master/sdk/python/README.md

This section outlines the available configuration points for the AWS provider, which control how Pulumi interacts with AWS services.

```APIDOC
## AWS Provider Configuration

This document outlines the configuration options available for the AWS provider in Pulumi.

### Configuration Points

- **`aws:region`** (Required) - Specifies the AWS region to use for resources.

- **`aws:accessKey`** (Optional) - The AWS access key. Can also be sourced from the `AWS_ACCESS_KEY_ID` environment variable or a shared credentials file if `aws:profile` is specified.

- **`aws:secretKey`** (Optional) - The AWS secret key. Can also be sourced from the `AWS_SECRET_ACCESS_KEY` environment variable or a shared credentials file if `aws:profile` is specified.

- **`aws:profile`** (Optional) - The AWS profile name as set in the shared credentials file.

- **`aws:sharedCredentialsFiles`** (Optional) - A list of paths to the shared credentials file. Defaults to `~/.aws/credentials` if not set and a profile is used. Can also be set with the `AWS_SHARED_CREDENTIALS_FILE` environment variable.

- **`aws:token`** (Optional) - Session token for validating temporary credentials. Typically provided after successful identity federation or MFA login. Can also be sourced from the `AWS_SESSION_TOKEN` environment variable.

- **`aws:maxRetries`** (Optional) - The maximum number of times an API call is retried due to throttling or transient failures. Defaults to `25`.

- **`aws:allowedAccountIds`** (Optional) - A list of allowed AWS account IDs to prevent accidental usage of incorrect accounts. Conflicts with `aws:forbiddenAccountIds`.

- **`aws:endpoints`** (Optional) - Configuration block for customizing service endpoints. See the Custom Service Endpoints Guide for more information.

- **`aws:forbiddenAccountIds`** (Optional) - A list of forbidden AWS account IDs to prevent accidental usage of incorrect accounts. Conflicts with `aws:allowedAccountIds`.

- **`aws:assumeRole`** (Optional) - Configuration block for assuming an IAM role. Supports the following arguments:
  - `durationSections` (Number) - Number of seconds to restrict the assume role session duration.
  - `externalId` (String) - External identifier to use when assuming the role.
  - `policy` (String) - IAM Policy JSON describing further restricting permissions for the IAM Role.
  - `policyArns` (List) - ARNs of IAM Policies describing further restricting permissions for the role.
  - `roleArn` (String) - ARN of the IAM Role to assume.
  - `sessionName` (String) - Session name to use when assuming the role.
  - `tags` (Map) - Map of assume role session tags.

- **`aws:insecure`** (Optional) - Explicitly allow insecure SSL requests. Defaults to `false`.

- **`aws:skipCredentialsValidation`** (Optional) - Skip the credentials validation via the STS API. Defaults to `false`. Can be set via the `AWS_SKIP_CREDENTIALS_VALIDATION` environment variable.

- **`aws:skipRegionValidation`** (Optional) - Skip validation of provided region name. Defaults to `true`.

- **`aws:skipRequestionAccountId`** (Optional) - Skip requesting the account ID. Defaults to `false`. When specified, the use of ARNs is compromised.

- **`aws:skipMetadataApiCheck`** (Optional) - Skip the AWS Metadata API check. Can be set via the `AWS_SKIP_METADATA_API_CHECK` environment variable.

- **`aws:s3UsePathStyle`** (Optional) - Set to `true` to force path-style S3 addressing (e.g., `http://s3.amazonaws.com/BUCKET/KEY`). Defaults to `false`.

- **`aws:useFipsEndpoint`** (Optional) - Force the provider to resolve endpoints with FIPS capability. Can also be set with the `AWS_USE_FIPS_ENDPOINT` environment variable.

```

--------------------------------

### Configuring Assume Role with Web Identity (YAML)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Shows how to configure Pulumi to assume an AWS role using a web identity token (OIDC). This is typically used in CI/CD pipelines on platforms like GitHub, GitLab, or Azure DevOps to authenticate with AWS without storing static credentials.

```yaml
config:
  aws:assumeRoleWithWebIdentity:
    roleArn: arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>
    # Define either webIdentityToken or webIdentityTokenFile
    webIdentityToken: <your-web-identity-token>
    webIdentityTokenFile: webidentitytokenfile.txt
```

--------------------------------

### POST /aws/lambda/LayerVersion

Source: https://github.com/pulumi/pulumi-aws/blob/master/provider/pkg/overlays/examples/callbackFunction.md

Creates a new Lambda Layer version to share assets or dependencies across multiple Lambda functions.

```APIDOC
## POST /aws/lambda/LayerVersion

### Description
Creates a new Lambda Layer version. This resource allows you to package code, configuration, or Node.js dependencies into a layer that can be attached to one or more Lambda functions.

### Method
POST

### Endpoint
aws.lambda.LayerVersion

### Parameters
#### Request Body
- **layerName** (string) - Required - The name of the Lambda layer.
- **code** (AssetArchive) - Required - The archive containing the layer contents (e.g., folder structure for Node.js modules).

### Request Example
{
  "layerName": "my-config-layer",
  "code": "pulumi.asset.AssetArchive({ 'config': new pulumi.asset.FileArchive('./config') })"
}

### Response
#### Success Response (200)
- **arn** (string) - The Amazon Resource Name (ARN) of the created layer version.

#### Response Example
{
  "arn": "arn:aws:lambda:us-east-1:123456789012:layer:my-config-layer:1"
}
```

--------------------------------

### Update aws.batch.JobQueue compute environment configuration

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

Illustrates the change in aws.batch.JobQueue from using `computeEnvironments` to `computeEnvironmentOrders`. The `computeEnvironmentOrders` property requires an array of objects, each specifying the `computeEnvironment` ARN and its `order` within the queue. Pulumi will automatically upgrade states using the older `computeEnvironments` property.

```typescript
const example = new aws.batch.JobQueue("example", {
    computeEnvironments: [exampleComputeEnvironment.arn],
    name: "patagonia",
    priority: 1,
    state: "ENABLED",
});
```

```typescript
const example = new aws.batch.JobQueue("example", {
    computeEnvironmentOrders: [{
        computeEnvironment: exampleComputeEnvironment.arn,
        order: 0,
    }],
    name: "patagonia",
    priority: 1,
    state: "ENABLED",
});
```

--------------------------------

### AWS Shared Credentials File Configuration (INI)

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/installation-configuration.md

Demonstrates how to manually create or update the AWS shared credentials file to manage multiple AWS profiles. This file is used by the AWS SDK and Pulumi to identify which credentials to use for AWS API calls.

```ini
[default]
aws_access_key_id = <YOUR_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_ACCESS_KEY_ID>

[test-account]
aws_access_key_id = <YOUR_TEST_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_TEST_SECRET_ACCESS_KEY>

[prod-account]
aws_access_key_id = <YOUR_PROD_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_PROD_SECRET_ACCESS_KEY>
```

--------------------------------

### Output-Only `id` in `aws.globalaccelerator.getAccelerator`

Source: https://github.com/pulumi/pulumi-aws/blob/master/docs/version-7-upgrade.md

The `id` field in `aws.globalaccelerator.getAccelerator` is now output-only and cannot be set manually. Configurations attempting to set `id` must be updated.

```APIDOC
## Function `aws.globalaccelerator.getAccelerator` Update

`id` is now **output only** and can no longer be set manually. Remove any explicit attempts to set a value for `id`.
```