v2.264.0

⚠ BREAKING CHANGES

• bedrockagentcore: Gateway metric helpers now emit corrected CloudWatch dimensions per-gateway
  metrics use { Operation, Protocol, Resource } (was { Resource }). Alarms/dashboards built on the
  old dimensions must be updated.
• bedrockagentcore: RuntimeBase metric helpers now emit corrected CloudWatch dimensions per-resource metrics use { Operation, Name, Resource } (was { Resource }) and aggregated metrics use { AggregateOperation } (was { Resource: 'All' }). Alarms/dashboards built on the old dimensions must be updated.

Features

• update L1 CloudFormation resource definitions (#38526) (b5693cb)
• cloudwatch: support alarm mute rules (#37504) (c3540bb), closes #37502
• update L1 CloudFormation resource definitions (#38479) (279340d)

Bug Fixes

• bedrockagentcore: gateway metrics emit correct CloudWatch dimension (#38487) (5a7d360)
• bedrockagentcore: runtime metrics emit correct CloudWatch dimensions (#38486) (4e44f24)
• cloudfront: warn when minimumProtocolVersion is set without a certificate (#37250) (52ec5f7), closes #35404
• ec2: allow EBS gp3 and io2 volumes up to 64 TiB (#37049) (10711ba), closes #37045
• stepfunctions-tasks: call-rest-api CallApiGatewayRestApiEndpoint does not support JsonATA for api_path (#37738) (9f0afdc), closes #37728 /github.com/aws/aws-cdk/blob/e207b76cc2503701b3c4e2c87023617b485b2fde/packages/aws-cdk-lib/aws-stepfunctions/lib/private/jsonata.ts#L1

---

Alpha modules (2.264.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: IDatabase.catalogArn and IDatabase.catalogId were removed in factor of a type
  safe ICatalog, which has catalogArn and catalogId. Consumers and implementations were updated
  accordingly.

Features

• glue-alpha: new Catalog L2 (#38443) (6a8ba8e)
• glue-alpha: strengthen data encryption for S3Table (#38501) (eb81d5e), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5

Bug Fixes

• glue-alpha: enable key rotation for security configuration encryption (#38512) (18560e0)
• mediaconnect-alpha: addOutput options and simplified VPC interface referencing (#38515) (3c71466), closes #38517

v2.263.0

Features

• autoscaling: add support for AutoScalingInstanceRefresh UpdatePolicy (#38277) (434157f), closes #38276
• docdb: support per-instance maintenance window on DatabaseCluster (#38315) (5390624), closes #30391
• ecs: add support for using existing Cloud Map namespaces in ECS clusters (#36812) (bda00bf), closes #26698
• eks: add Provisioned Control Plane support with controlPlaneScalingTier property (#36651) (5ea1054), closes #36650
• eks: add support for Kubernetes version 1.36 (#38441) (da27b6c), closes #38411
• lambda: add Java8AL2023, Java11AL2023 and Java17AL2023 runtime for Lambda #38418 (#38419) (1e55176)
• lambda: add logGroup and systemLogLevel to CapacityProvider (#38183) (61a2e2d), closes #38182
• lambda: add PropagateTags to CapacityProvider for tag propagation (#38180) (6f86f97), closes #38181

Bug Fixes

• core: upgrade cloudformation-validate library (#38444) (d26e507), closes #38412
• bump brace-expansion to 5.0.8 to address CVE-2026-14257 (#38410) (5aaa395), closes #38409 #38063

---

Alpha modules (2.263.0-alpha.0)

⚠ BREAKING CHANGES

• mediaconnect: removalPolicy prop removed from FlowProps, GatewayProps, and BridgeProps. These resources now follow CloudFormation's default deletion behaviour (Delete).

Bug Fixes

• glue-alpha: race condition when creating mutiple indices (#38016) (18b1947), closes #24813 #34 #34
• mediaconnect: jsdoc typo (#38434) (7fe6d3d)
• mediaconnect: remove default removal policy (#38437) (238193d)

v2.262.2

Bug Fixes

• revert "fix(core): stack.node.addDependency gets slower as stacks grow (#38314)" (#38417) (d97dd8d), closes #38406 #38406

---

Alpha modules (2.262.2-alpha.0)

v2.262.1

Bug Fixes

• core: bump @aws/cloudformation-validate to 1.5.1-beta to fix install on Node != 22.x (#38382) (d409b96), closes #38380
• core: env CDK_VALIDATION=false does not disable built-in template validation (#38379) (cc4208c), closes #38378

---

Alpha modules (2.262.1-alpha.0)

v2.262.0

Features

• ecs: add support ECS-optimized Amazon Linux 2023 (Neuron) AMI (#34689) (ad665c4)
• mediaconnect: l2 construct (#37945) (8e9e001)
• update L1 CloudFormation resource definitions (#38275) (2b1c632)
• apigateway: alb integration (#36247) (20dbdd9), closes #36184
• bedrockagentcore: support service/region in IAM credential provider for gateway targets (#37697) (08a2543), closes #37696
• cloudfront: add Managed-HostHeaderOnly origin request policy (#38236) (0e66e47), closes #38234
• core: templates are validated against a comprehensive default rule set (#38135) (023c5bf)

Bug Fixes

• cross-stack warnings are emitted for nested stacks (#38355) (db98909)
• apigateway: revert alb integration that breaks jsii go packaging (#38305) (18158a4), closes #36247 #36247 #36247 #36247
• aws-cdk-lib: fatal validations don't show plugin name (#38273) (a88d1ba)
• aws-cdk-lib: validation namespaces for annotations are inconsistent (#38256) (75893d9)
• backup: lifecycle and vault lock validations reject tokenized durations (#38264) (0ff20a3), closes #38263 #38246 #37751 #25943 #38246 #37751 #25943
• certificatemanager: use hasOwnProperty in apexDomain to prevent prototype collision (#37195) (ec38947), closes #37193
• cloudfront-origins: validate httpPort and httpsPort range in HttpOrigin (#37872) (8a62b58)
• core: stack-related validation has an empty construct path (#38350) (0af7c34)
• core: stack.node.addDependency gets slower as stacks grow (#38314) (0728618)
• core: synth crashes with EISDIR on a symlink-to-directory when a validation plugin is registered (#38299) (be0fdc4), closes #38295
• elasticloadbalancingv2: improve handling for dropInvalidHeaderFields in case of default or switching from true to false (#36483) (208b9db), closes #36409
• lambda: allow SnapStart for container image functions (#38265) (586dc4f), closes #30898
• lambda: validations reject tokenized provisioned concurrency and async invoke config values (#38246) (4aa7e78), closes #38245 #37197 #36275 #37197
• opensearchservice: allow gp3 ebs throughput up to 2000 MiB/s (#38001) (f0cfc5b), closes #38000 #36074
• spec2cdk: add IVS to event pattern method name prefixes (#38322) (d6d1e8d)
• validation: incorrectly relative paths in Cloud Assemblies (#38352) (3f9422f), closes #38333
• validation: validation reports are not self-contained (#38333) (5d11d70)

Reverts

• lambda: revert SnapStart for container image functions (#38265) (#38281) (3b92863)

---

Alpha modules (2.262.0-alpha.0)

Bug Fixes

• redshift-alpha: quote identifiers and escape literals containing special characters (#38269) (3cb6844)

v2.261.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-cloudwatch: AWS::CloudWatch::LogAlarm: QueryLanguage property has been removed from the ScheduledQueryConfiguration type.
• aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: Id attribute has been removed and the primary identifier is now LoadBalancerName.

Features

• update L1 CloudFormation resource definitions (#38189) (5aabd32)
• core: add git source metadata to CloudFormation templates (#37368) (765271b)
• rds: support native Secrets Manager integration for RDS Cluster and Instance (#35734) (07d5623), closes #29239

Bug Fixes

• improve internal path detection (#38205) (6a1934d)
• ecr-assets: tarball asset build command not escaped (#38171) (bad8a3a)
• print validation errors according to new style (#38166) (031aba8)

---

Alpha modules (2.261.0-alpha.0)

Features

• metrics-facade-alpha: generate metrics facades (#37334) (aa9beb0)

v2.260.0

Features

• update L1 CloudFormation resource definitions (#38151) (f266a47), closes /docs.aws.amazon.com/AmazonS3/latest/userguide/s3-files-prereq-policies.html#s3
• core: add external traces to ConstructError (#38131) (e360dd9)
• core: append external stack traces to metadata if available (#38124) (c77a08c)

Bug Fixes

• bundling: docker build can be skipped if already performed (#38134) (2f9ae95)
• core: stack traces contain decorator paths (#38130) (318f645)
• core: weak cross-stack references fail for list attributes (#37948) (6bb9d75), closes #37910
• lambda-nodejs: reuse posixShellEscape for Docker bundling file operations (#38133) (baa9e1d)

---

Alpha modules (2.260.0-alpha.0)

v2.259.0

⚠ BREAKING CHANGES

• lambda: Runtime.NODEJS_LATEST now resolves to nodejs24.x in every region. Customers who pin to a concrete runtime (Runtime.NODEJS_22_X, useLatestRuntimeVersion: false in aws-lambda-nodejs.NodejsFunction) are unaffected. Existing AWS::Lambda::Function resources synthesized with NODEJS_LATEST will see Runtime: nodejs22.x → Runtime: nodejs24.x on next deploy. Lambda accepts runtime updates in place.

  Customer-code compatibility — IMPORTANT: Node.js 24 removes support for callback-style asynchronous handlers ((event, context, callback) => {...}) per the launch blog. Customers whose Lambda code still uses callback-based handlers will see runtime errors after the bump. Customers should migrate to async (event, context) => {...} or pin to Runtime.NODEJS_22_X explicitly.

Features

• core: recommend the use of weak references if no choice has been made (#38070) (6e74e5e)
• ecs: add forceNewDeployment option for Fargate and EC2 services (#36797) (3d9c4df), closes #27762
• eks: use the recommended AL2023 instead of AL2 AMI type (under feature flag) (#37850) (6a2dcb7), closes #32211
• lambda: upgrade lambda and custom resource default runtime to nodejs24.x (#38031) (36c84c6)

Bug Fixes

• spec2cdk: sanitize hyphens in EventBridge event namespace names (#38088) (b8f41bf), closes 40aws-cdk/spec2cdk/lib/naming/conventions.ts#L195

Reverts

• "chore(bundling): check if docker image is cached before building" (#38116) (359f2fb), closes aws/aws-cdk#37951

---

Alpha modules (2.259.0-alpha.0)

v2.258.1

Reverts

• "chore(bundling): check if docker image is cached before building" (#38116) (8ec236c), closes aws/aws-cdk#37951

---

Alpha modules (2.258.1-alpha.0)

v2.258.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-pcaconnectorad: AWS::PCAConnectorAD::ServicePrincipalName: ConnectorArn property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::ServicePrincipalName: DirectoryRegistrationArn property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::TemplateGroupAccessControlEntry: GroupSecurityIdentifier property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::TemplateGroupAccessControlEntry: TemplateArn property is now required.

Features

• core: trace property assignments in CfnResource.addPropertyOverride (#38072) (a226372)
• update L1 CloudFormation resource definitions (#37993) (664a878)
• aws-cdk-lib: emits performance counters if synthesis is slow (#38004) (cb03794), closes #37919 #37843
• bedrockagentcore: expose default endpoint application log group on Runtime (#37812) (8e25d78), closes #37796
• core: add scope to IPolicyValidationContext (#38006) (cae7456)
• core: allow validation plugins to create new files in cloud assembly (#38007) (d9f38a9)
• core: fine-grained control over cross-stack reference strength (#37840) (bddcd44)
• core: include suppressed violations in validation-report.json (#38009) (f396892)
• core: new validation report schema (#37970) (4e09b52), closes aws/aws-cdk-cli#1515
• eks: add AlbControllerVersion support for v2.8.3 through v3.2.2 (#37752) (20abc6a), closes #37414
• eks: add deletionProtection property to Cluster construct (#36474) (5b19ac5), closes #36460
• elasticache: replace CacheEngine/UserEngine enums with enum-like classes (#37816) (6ad84b3), closes #37813

Bug Fixes

• autoscaling: use of ScheduledAction.endTime is dangerous (#38014) (109fae7)
• aws-cdk-lib: make token resolution ~25% faster (#37920) (87483dc)
• bedrockagentcore: relax allowlistedHeaders pattern to match CFN schema (#37969) (e0d6c8a), closes #37964
• cloudwatch: metric math validation reports quoted strings as unknown identifiers (#37977) (59bae38)
• core: cross-region SSM writer orphans parameters when resource is replaced during stack update (#38059) (f130388)
• core: handle string "false" for boolean context values in validation (#37989) (a26ed73)
• integ-tests: responseURL logged in onTimeout (#37972) (b9259dd)
• lambda-nodejs: bundling rejects entry paths containing ".." (#38022) (a7cc53c), closes #38017 #37572 #37572
• lambda-nodejs: perf counters e2e test uses incorrect filename (#38033) (d88637f)

---

Alpha modules (2.258.0-alpha.0)

Features

• integ-tests-alpha: add option to set the provider log level (#38005) (c634a79)

Bug Fixes

• custom-resource-handlers: deterministic asset hashes for generated lambdas (#37634) (6c3d5bc), closes #34307
• glue-alpha: deprecate Ray Jobs (#38055) (3fa428b)
• glue-alpha: restore notifyDelayAfter to PySpark and Scala Spark ETL jobs (#37815) (05be88a), closes #33839
• integ-tests-alpha: assertion failures print too much unnecessary information (#37974) (bc0de1d)
• mediapackagev2-alpha: cdnAuth on OriginEndpoint now generates the required policy (#38013) (1d56b46)