v2.172.0

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• apigateway: We will be removing deprecated APIGatewayV2 constructs from aws-apigateway module.

Features

• aspects: priority-ordered aspect invocation (#32097) (8ccdff4), closes #21341
• cognito: new cloudFrontEndpoint method for user pool domain without custom resource (#31402) (deeb2ad), closes #31342
• cognito: support for ALLOW_USER_AUTH explicit auth flow (#32273) (c5bcfdc)
• elasticloadbalancingv2: ip address type for both network and application target group (#32189) (7cc5f30)
• events: add filter rules for prefixEqualsIgnoreCase, suffixEqualsIgnoreCase, wildcard, and anythingBut* matches (#32063) (0ce71fc), closes #28462
• lambda-nodejs: add bun support (#31770) (aed8ad1), closes #31753 #31753
• rds: limitless database cluster (#32151) (f4c19c7)
• ses: add support to disable account-level suppression list (#32168) (bb50c1a), closes #32149
• update L1 CloudFormation resource definitions (#32272) (421d327)
• update L1 CloudFormation resource definitions (#32356) (9e6bb24)
• route53-targets: add AppSync route53 target (#31976) (dc7574a), closes #26109

Bug Fixes

• apigateway: remove deprecated apigatewayv2 from aws-apigateway module (#32297) (4db9565)
• appsync: appsync.HttpDataSourceProps erroneously extends BaseDataSourceProps (#32065) (4e7f5c4), closes #29689
• cli: assume role calls are skipping the proxy (#32291) (6c0f74e)
• cli: lambda hotswap fails if lambda:GetFunctionConfiguration action is not allowed (#32301) (be000a2), closes #32219
• cli: mfa code is not requested when $AWS_PROFILE is used (#32313) (6458439), closes #32312
• cli: remove source maps (#32317) (512cf95), closes #19930 #19930
• cli: short-lived credentials are not refreshed (#32354) (058a0bf)
• cli: warns about missing --no-rollback flag that is present (#32309) (559d676), closes #32295
• cloudformation-include: drops unknown policy attributes (#32321) (20edc7f)
• cloudfront: propagate originAccessControlId CloudFront Origin property to CloudFormation templates (#32020) (f9708a6), closes #32018
• iam: Role.addManagedPolicy() does not work for imported roles IRole (#31212) (c78ef1b), closes #8307

---

Alpha modules (2.172.0-alpha.0)

Features

• ec2: default BastionHostLinux to use Amazon Linux 2023 (under feature flag) (#31996) (bf77e51), closes #29493 #29493
• ec2: instance support passing IAM instance profile (#32073) (cf89d0f), closes #8348
• neptune: auto minor version upgrade for an instance (#31988) (d95db49)
• pipes: add LogDestination implementation (#31672) (af5345e), closes #31671
• pipes-targets: add API Gateway (#31954) (c77536f)
• redshift: execute resource action (#31995) (40835a0)

Bug Fixes

• scheduler-targets-alpha: incorrect validation of maximumEventAge (#32284) (2eebc59)

v2.171.1

Bug Fixes

• cli: lambda hotswap fails if lambda:GetFunctionConfiguration action is not allowed (#32301) (a073e93), closes /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdatedV2.ts#L10 /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdated.ts#L13

---

Alpha modules (2.171.1-alpha.0)

v2.171.0

Features

• rds: enhanced monitoring configuration at the cluster level (#32157) (01f2dcd), closes #32151
• rds: support zero ACU for Aurora Serverless V2 (#32231) (d1b07d9)

Bug Fixes

• cli: sso with proxy fails (#32261) (bedcf16)

---

Alpha modules (2.171.0-alpha.0)

v2.170.0

Features

• lambda: support for Provisioned Pollers (#32205) (68b969e)
• vpcv2: vpc peering connection construct (#31645) (e1195f9), closes RFC#507 1#L252

Bug Fixes

• cli: sts retry options are ignored (#32227) (193ab8c)

Reverts

• "fix(ecr): allow creating repository uri to use tokens like cfn params" (#32241) (b3e39a9), closes #32238

---

Alpha modules (2.170.0-alpha.0)

v2.169.0

Features

• cloudfront: add attachWebAclId method for Distribution (#30567) (cbe2bec)
• update L1 CloudFormation resource definitions (#32223) (5d61a1b)
• sns: add delivery policy to sns subscriptions (#30830) (27babe6), closes #17576

Bug Fixes

• cli: cannot assume a doubly-chained role (#32216) (8746e44)
• cli: proxy is not configured correctly (#32213) (ec58c77)
• s3: key rotation is not enabled while creating KMS encrypted S3 buckets (#32064) (e3024fc), closes #31982

---

Alpha modules (2.169.0-alpha.0)

Features

• location: support Map (#30648) (98b801c), closes #30647
• scheduler: scheduler and scheduler-targets modules are now in Developer Preview (#32207) (8776832), closes #31785

Bug Fixes

• location: underscores are not allowed in the name (#32046) (f6ad9c9)

v2.168.0

Features

• cloudfront: function URL origin access control L2 construct (#31339) (b8f47c8), closes #31629
• elasticloadbalancingv2: support target group level cross-zone settings for ALB and NLB (#31814) (6b0b1e1), closes #31790
• lambda: add NodeJS 22.x support (#32104) (baa8561)
• lambda: support observability for ESM ( DDB, Kinesis, SQS) (#32204) (6317a2a)
• lambda-destinations: support Lambda async S3 destination (#31709) (e1a2f68)
• ses: maximum delivery time for emails (#32102) (771eeff)
• update L1 CloudFormation resource definitions (#32175) (6820c62)
• rds: support 8.0.40 engine version for RDS for MySQL (#32117) (dcb5cf1)
• stepfunctions-tasks: create scheduler (#29458) (d14a01c), closes #29351

Bug Fixes

• cdk: remove source-map-support from typescript init templates (#32113) (d5c0aa2), closes #20754 #30231
• cdk: use built-in source map support (#32115) (5d499dc)
• cli: cdk diff always falls back to template only diff (#32165) (089e9d8)
• cli: excessive stack event polling during deployment (#32196) (a8bc46d), closes /github.com/aws/aws-cdk/blob/7bb9203eb95fe894c0d40942ff49c782a9fec251/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts#L73-L74
• cli: externally managed stack notification arns are deleted on deploy (#32163) (9966f57)
• cli: failure to get credentials when session token is not set (#32134) (9ef4e72)
• cli: region specified in ~/.aws/credentials is ignored (#32133) (d1b3c81), closes #32130
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#32164) (f75dc72)
• eks: eks.AccessEntryType.STANDARD maps to a wrong value (#31147) (1bbb456)

---

Alpha modules (2.168.0-alpha.0)

Bug Fixes

• scheduler-targets-alpha: imported target resources as schedule target throws synth error (#32105) (1a8306f), closes #31785 /github.com/aws/aws-cdk/pull/29615#issuecomment-2417858246
• scheduler-targets-alpha: kinesis data firehose target uses l1 instead of l2 (#32150) (11384f0), closes #31785
• scheduler-targets-alpha: scope down permissions for sqs and kinesis stream targets (#32122) (6bb142e), closes #31785

v2.167.2

Bug Fixes

• cli: cdk diff always falls back to template only diff (#32165) (3fd9699)
• cli: externally managed stack notification arns are deleted on deploy (#32163) (465da31)
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#32164) (a0b47c5)

---

Alpha modules (2.167.2-alpha.0)

v2.167.1

Bug Fixes

• cli: failure to get credentials when session token is not set (#32134) (425efbc), closes #32120
• cli: region specified in ~/.aws/credentials is ignored (#32133) (9859f33), closes #32130

---

Alpha modules (2.167.1-alpha.0)

v2.167.0

Features

• cli: upgrade aws-sdk to sdkv3 (#31702) (5bc0662), closes #25870 #26292 #20956 #24744 #27265
• elasticloadbalancingv2: enable zonal shift for network load balancer (#31990) (497abdc), closes #31983
• kms: support KEY_AGREEMENT for keyUsage (#30993) (2323877), closes #30989
• lambda: add Python 3.13 runtime (#32054) (e0ebcfe)
• lambda: add supportsSnapStart config to dotnet8 and python 3.12 (#32112) (53f4713)
• lambda: support for customer managed encryption (CMCMK) (#32072) (2f16415)
• update L1 CloudFormation resource definitions (#32090) (6303b72)
• rds: support minor engine versions for oracle (#32058) (3d72b63)
• rds: support minor versions for RDS for SQL Server (#32055) (8c80bf8)
• service-catalog: allow Product Stack to override analytics reporting and stack descriptions (#31985) (d8ad02a), closes #31924

Bug Fixes

• ecr: allow creating repository uri to use tokens like cfn params (#32053) (5648199), closes #31860

---

Alpha modules (2.167.0-alpha.0)

Features

• ivs: support recording configuration for channel (#31899) (8a3734d), closes #31780
• redshift: relocating a cluster (#31993) (b763d86)

Bug Fixes

• scheduler-targets-alpha: add dlq policy to execution role instead of queue policy (#32032) (b953b2a), closes #31785

v2.166.0

Features

• cli: automatically roll back stacks if necessary (#31920) (2f9fb1e), closes #30546
• kinesis: support resource policy for a data stream (#31909) (18fbd6d), closes #28814
• rds: configure autoMinorVersionUpgrade for a database cluster (#31962) (0fb6106)
• route53: support HTTPS, SSHFP, SVCB, and TLSA DNS resource record (#31955) (afc2b0d), closes /docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-route53-recordset.html#cfn-route53
• synthetics: add artifactS3Encryption property to the Canary Construct. (#30197) (1f39cb9), closes #30190
• update L1 CloudFormation resource definitions (#32007) (be6a964)

Bug Fixes

• deploy-time stack tags cause synthesis to fail (#32041) (18c19fd), closes #32040
• aws_route53: cannot use CfnParameter.valueAsNumber for L2 RecordSet weight (#31823) (14561ac), closes #31810
• cli: asset uploads fail if Object Lock is enabled on access bucket (#31937) (ab1e91d)
• dynamoDB: make TableV2 taggable (#31867) (796c6d1), closes #30631
• opensearch: add I4G to list of OpenSearch nodes not requiring EBS volumes (#31948) (73378f2)

---

Alpha modules (2.166.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• scheduler-targets-alpha: Schedule Target will reuse role if target is re-used across schedules. This change triggered replacement of existing roles for Schedule as logical ID of the roles are changed.

Features

• glue-alpha: add job run queuing to Glue job (#31830) (5fca268), closes #31826

Bug Fixes

• scheduler-targets-alpha: create a role per target instead of singleton schedule target role (#31895) (aee1b30), closes #31785