From 045821e927ebcc0f80ab1ee6c08c6bf76bb88414 Mon Sep 17 00:00:00 2001
From: Kaizen Conroy <zen.conroy@gmail.com>
Date: Fri, 11 Jul 2025 15:39:17 -0400
Subject: [PATCH 1/2] chore(cli): allow valid enum values in telemetry

---
 .../aws-cdk/lib/cli/telemetry/sanitation.ts   | 11 +++++++-
 .../test/cli/telemetry/sanitation.test.ts     | 27 +++++++++++++++++--
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/packages/aws-cdk/lib/cli/telemetry/sanitation.ts b/packages/aws-cdk/lib/cli/telemetry/sanitation.ts
index 783211975..592d26cbc 100644
--- a/packages/aws-cdk/lib/cli/telemetry/sanitation.ts
+++ b/packages/aws-cdk/lib/cli/telemetry/sanitation.ts
@@ -33,7 +33,7 @@ export function sanitizeCommandLineArguments(argv: any): { path: string[]; param
     if (argv[argName] === undefined || (!globalOptions.includes(argName) && !commandOptions.includes(argName))) {
       continue;
     }
-    if (isNumberOrBoolean(argv[argName])) {
+    if (isNumberOrBoolean(argv[argName]) || isKnownEnumValue(argName, argv[argName], command, config)) {
       parameters[argName] = argv[argName];
     } else {
       parameters[argName] = '<redacted>';
@@ -65,6 +65,15 @@ function isNumberOrBoolean(value: any): boolean {
   return typeof value === 'number' || typeof value === 'boolean';
 }
 
+function isKnownEnumValue(name: string, value: any, command: string, config: any): boolean {
+  const propertyDefiniton = config.globalOptions[name] ?? config.commands[command]?.options[name];
+  if (propertyDefiniton.type === 'string') {
+    // Even if the property has choices, only record if the value is a valid choice
+    return propertyDefiniton.choices?.includes(value);
+  }
+  return false;
+}
+
 function dropDuplicate(param: string): string {
   return param.endsWith('S') ? param.slice(0, param.length-1) : param;
 }
diff --git a/packages/aws-cdk/test/cli/telemetry/sanitation.test.ts b/packages/aws-cdk/test/cli/telemetry/sanitation.test.ts
index 81ce15431..8cbd94b12 100644
--- a/packages/aws-cdk/test/cli/telemetry/sanitation.test.ts
+++ b/packages/aws-cdk/test/cli/telemetry/sanitation.test.ts
@@ -76,12 +76,35 @@ describe(sanitizeCommandLineArguments, () => {
     const argv = {
       _: ['deploy'],
       STACKS: ['MyStack'],
-      ['require-approval']: 'broadening',
       ['build-exclude']: ['something'],
     };
     expect(sanitizeCommandLineArguments(argv)).toEqual({
       path: ['deploy', '$STACK1'],
-      parameters: { 'require-approval': '<redacted>', 'build-exclude': '<redacted>' },
+      parameters: { 'build-exclude': '<redacted>' },
+    });
+  });
+
+  test('enum options are allowed', () => {
+    const argv = {
+      _: ['deploy'],
+      STACKS: ['MyStack'],
+      ['require-approval']: 'broadening',
+    };
+    expect(sanitizeCommandLineArguments(argv)).toEqual({
+      path: ['deploy', '$STACK1'],
+      parameters: { 'require-approval': 'broadening' },
+    });
+  });
+
+  test('invalid enum options are redacted', () => {
+    const argv = {
+      _: ['deploy'],
+      STACKS: ['MyStack'],
+      ['require-approval']: 'invalid',
+    };
+    expect(sanitizeCommandLineArguments(argv)).toEqual({
+      path: ['deploy', '$STACK1'],
+      parameters: { 'require-approval': '<redacted>' },
     });
   });
 });

From bc26acbaf34e55fc5594e1b6be1fc1bada03321e Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Fri, 11 Jul 2025 19:47:55 +0000
Subject: [PATCH 2/2] chore: self mutation

Signed-off-by: github-actions <github-actions@github.com>
---
 .../synth/cdk-synth-telemetry-with-errors.integtest.ts          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/synth/cdk-synth-telemetry-with-errors.integtest.ts b/packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/synth/cdk-synth-telemetry-with-errors.integtest.ts
index 1da5bd78e..afe496e54 100644
--- a/packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/synth/cdk-synth-telemetry-with-errors.integtest.ts
+++ b/packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/synth/cdk-synth-telemetry-with-errors.integtest.ts
@@ -1,6 +1,6 @@
-import { integTest, withDefaultFixture } from '../../../lib';
 import * as path from 'path';
 import * as fs from 'fs-extra';
+import { integTest, withDefaultFixture } from '../../../lib';
 
 jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime