Skip to content

Commit 5a3fc87

Browse files
mergify[bot]mergify[bot]
authored
chore(release): 2.227.0 (#36135)
See [CHANGELOG](https://github.com/aws/aws-cdk/blob/bump/2.227.0/CHANGELOG.md)
2 parents 73ea0c1 + f1da67f commit 5a3fc87

File tree

590 files changed

+101983
-9434
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

590 files changed

+101983
-9434
lines changed

‎.github/workflows/codebuild-pr-build.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,3 +89,20 @@ jobs:
8989
path: |
9090
~/.docker-images.tar
9191
key: docker-cache-${{ runner.os }}
92+
93+
- name: Save PR info for PR Linter
94+
if: github.event_name == 'pull_request'
95+
env:
96+
PR_NUMBER: ${{ github.event.pull_request.number }}
97+
PR_SHA: ${{ github.event.pull_request.head.sha }}
98+
run: |
99+
mkdir -p ./pr
100+
echo $PR_NUMBER > ./pr/pr_number
101+
echo $PR_SHA > ./pr/pr_sha
102+
103+
- name: Upload PR info artifact
104+
if: github.event_name == 'pull_request'
105+
uses: actions/upload-artifact@v5
106+
with:
107+
name: pr_info
108+
path: pr/

‎CHANGELOG.v2.alpha.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,28 @@
22

33
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
44

5+
## [2.227.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.226.0-alpha.0...v2.227.0-alpha.0) (2025-11-20)
6+
7+
8+
### Features
9+
10+
* **bedrock-agentcore-alpha:** agentcore gateway L2 construct ([#35771](https://github.com/aws/aws-cdk/issues/35771)) ([07c4a0d](https://github.com/aws/aws-cdk/commit/07c4a0dfd4f26519f433ec3dc19b4c294ae8d56e))
11+
* **imagebuilder-alpha:** add support for Component Construct ([#36006](https://github.com/aws/aws-cdk/issues/36006)) ([5ebf07d](https://github.com/aws/aws-cdk/commit/5ebf07d095005f29b5e7205df750bc81cb879aa4)), closes [aws/aws-cdk-rfcs#789](https://github.com/aws/aws-cdk-rfcs/issues/789) [aws/aws-cdk-rfcs#789](https://github.com/aws/aws-cdk-rfcs/issues/789)
12+
* **imagebuilder-alpha:** add support for Component Construct ([#36107](https://github.com/aws/aws-cdk/issues/36107)) ([93a76e4](https://github.com/aws/aws-cdk/commit/93a76e481e79bb7e0df1aabcb158cc9b064345bf)), closes [#36006](https://github.com/aws/aws-cdk/issues/36006) [#36104](https://github.com/aws/aws-cdk/issues/36104)
13+
* **imagebuilder-alpha:** add support for Distribution Configuration Construct ([#36005](https://github.com/aws/aws-cdk/issues/36005)) ([c36f43d](https://github.com/aws/aws-cdk/commit/c36f43d88adefb3473dbd729e7bec58e7f06c8cf)), closes [aws/aws-cdk-rfcs#789](https://github.com/aws/aws-cdk-rfcs/issues/789) [aws/aws-cdk-rfcs#789](https://github.com/aws/aws-cdk-rfcs/issues/789)
14+
* **imagebuilder-alpha:** add support for Distribution Configuration Construct ([#36108](https://github.com/aws/aws-cdk/issues/36108)) ([6051039](https://github.com/aws/aws-cdk/commit/605103939894a785062422f04ee31f5460b18d6f)), closes [#36005](https://github.com/aws/aws-cdk/issues/36005)
15+
16+
17+
### Bug Fixes
18+
19+
* **bedrock-agentcore-alpha:** fix unexpected validation error when properties are Token ([#35978](https://github.com/aws/aws-cdk/issues/35978)) ([084b736](https://github.com/aws/aws-cdk/commit/084b736f80959ee17a28c2d9c355b0dcf1faa393))
20+
21+
22+
### Reverts
23+
24+
* **imagebuilder-alpha:** add support for Component Construct ([#36104](https://github.com/aws/aws-cdk/issues/36104)) ([689ad05](https://github.com/aws/aws-cdk/commit/689ad05b20a1332c5113b2084737e95a16bbd9ed)), closes [aws/aws-cdk#36006](https://github.com/aws/aws-cdk/issues/36006)
25+
* **imagebuilder-alpha:** add support for Distribution Configuration Construct ([#36103](https://github.com/aws/aws-cdk/issues/36103)) ([8d6867a](https://github.com/aws/aws-cdk/commit/8d6867ab94d1efe0835e922f28c9d3ac4aebcbf2)), closes [aws/aws-cdk#36005](https://github.com/aws/aws-cdk/issues/36005)
26+
527
## [2.226.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.225.0-alpha.0...v2.226.0-alpha.0) (2025-11-20)
628

729
## [2.225.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.224.0-alpha.0...v2.225.0-alpha.0) (2025-11-17)

‎CHANGELOG.v2.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,21 @@
22

33
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
44

5+
## [2.227.0](https://github.com/aws/aws-cdk/compare/v2.226.0...v2.227.0) (2025-11-20)
6+
7+
**CHANGES TO L1 RESOURCES:** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:
8+
- **aws-backup**: AWS::Backup::LogicallyAirGappedBackupVault: EncryptionKeyArn attribute removed.
9+
10+
### Features
11+
12+
* update L1 CloudFormation resource definitions ([#36122](https://github.com/aws/aws-cdk/issues/36122)) ([51d805e](https://github.com/aws/aws-cdk/commit/51d805e8b06ff6c22097fe10f6cf71f84af119e0))
13+
* **core:** cfn constructs (L1s) can now accept constructs as parameters for known resource relationships ([#35838](https://github.com/aws/aws-cdk/issues/35838)) ([6be7b4b](https://github.com/aws/aws-cdk/commit/6be7b4bdad74fe2889bb0b7b33e9d5ad7ef2e415))
14+
* factory methods for Grants made public ([#36123](https://github.com/aws/aws-cdk/issues/36123)) ([f9a894f](https://github.com/aws/aws-cdk/commit/f9a894fe4dc35415405295ae60f713b8c32de375))
15+
* **dynamodb:** add `TableGrants` and `StreamGrants` ([#36093](https://github.com/aws/aws-cdk/issues/36093)) ([d0b074a](https://github.com/aws/aws-cdk/commit/d0b074a1bcc7ba54f809d7423bf744792dbaa690))
16+
* **rds:** support instance and iam-db-auth-error CloudWatch log exports ([#35058](https://github.com/aws/aws-cdk/issues/35058)) ([e71a8b1](https://github.com/aws/aws-cdk/commit/e71a8b1d167d2ba70472305b5a004b992f79fcc1)), closes [#35018](https://github.com/aws/aws-cdk/issues/35018)
17+
* **s3:** add `BucketGrants` ([#36102](https://github.com/aws/aws-cdk/issues/36102)) ([5891172](https://github.com/aws/aws-cdk/commit/58911727be529afa9d743492bebc1d8e7478a1d6))
18+
* grants are now available through a separate class ([#35782](https://github.com/aws/aws-cdk/issues/35782)) ([21fd959](https://github.com/aws/aws-cdk/commit/21fd9593c1d451d68b0f3825c47286a41fa5ea37))
19+
520
## [2.226.0](https://github.com/aws/aws-cdk/compare/v2.225.0...v2.226.0) (2025-11-20)
621

722

‎docs/DESIGN_GUIDELINES.md‎

Lines changed: 28 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1048,53 +1048,49 @@ Grants are one of the most powerful concepts in the AWS Construct Library. They
10481048
offer a higher level, intent-based, API for managing IAM permissions for AWS
10491049
resources.
10501050

1051-
**Despite the fact that they may be mutating**, grants should be exposed on the
1052-
construct interface, and not on the concrete class
1053-
_[awslint:grants-on-interface]_. See discussion above about mutability for
1054-
reasoning.
1055-
1056-
Grants are represented as a set of methods with the “**grant**” prefix.
1057-
1058-
All constructs that represent AWS resources must have at least one grant method
1059-
called “**grant**” which can be used to grant a grantee (such as an IAM
1060-
principal) permission to perform a set of actions on the resource with the
1061-
following signature. This method is defined as an abstract method on the
1062-
**Resource** base class (and the **IResource** interface)
1063-
_[awslint:grants-grant-method]_:
1051+
Grants for a given resource class are implemented in an accompanying class. For
1052+
example, **sns.Topic** has a corresponding **sns.TopicGrants** class. To get an
1053+
instance of the Grants class for a given resource, use the static **from<Resource>()**:
10641054

10651055
```ts
1066-
grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
1056+
const role = new iam.Role(/*...*/);
1057+
1058+
const topic = new sns.Topic(/*...*/);
1059+
const grants = TopicGrants.fromTopic(topic);
10671060
```
10681061

1069-
The **iam.Grant** class has a rich API for implementing grants which implements
1070-
the desired behavior.
1062+
The `fromTopic()` method accepts the resource reference interface (`sns.ITopicRef`),
1063+
which allows you to use the same class for both L1 and L2 constructs:
10711064

1072-
Furthermore, resources should also include a set of grant methods for common use
1073-
cases. For example, **dynamodb.Table.grantPutItem**,
1074-
**s3.Bucket.grantReadWrite**, etc. In such cases, the signature of the grant
1075-
method should adhere to the following rules _[awslint:grant-signature]_:
1065+
```ts
1066+
const topic = new sns.CfnTopic(/*...*/);
1067+
const grants = TopicGrants.fromTopic(topic);
1068+
```
10761069

1077-
1. Name should have a “grant” prefix
1078-
2. Returns an **iam.Grant** object
1079-
3. First argument must be **grantee: iam.IGrantable**
1070+
The instance methods of the Grants classes can be used to grant a grantee
1071+
(such as an IAM principal) permission to perform a set of actions on the resource:
10801072

10811073
```ts
1082-
grantXxx(grantee: iam.IGrantable): iam.Grant;
1074+
// Allow the role to publish and subscribe to the topic
1075+
topicGrants.publish(role);
1076+
topicGrants.subscribe(role);
10831077
```
10841078

1085-
It makes sense for some AWS resources to also expose grant methods on all
1086-
resources in the account. To support such use cases, expose a set of static
1087-
grant methods on the construct class. For example,
1088-
**dynamodb.Table.grantAllListStreams**. The signature of static grants should be
1089-
similar _[awslint:grants-static-all]_.
1079+
For every resource that has an accompanying Grants class, the construct interface should
1080+
include a public **grants** property that returns an instance of the Grants class:
10901081

10911082
```ts
1092-
export class Table {
1093-
public static grantAll(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
1094-
public static grantAllListStreams(grantee: iam.IGrantable): iam.Grant;
1083+
export abstract class TopicBase extends Resource implements ITopic, IEncryptedResource {
1084+
...
1085+
public readonly grants: TopicGrants = TopicGrants.fromTopic(this);
1086+
...
10951087
}
10961088
```
10971089

1090+
The `TopicGrants` class, and many others, are generated automatically. But if there
1091+
is no auto-generated grants class for a resource, you can implement it manually,
1092+
following the same patterns.
1093+
10981094
### Metrics
10991095

11001096
Almost all AWS resources emit CloudWatch metrics, which can be used with alarms

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigatewayv2-integrations/test/websocket/integ.lambda-connect-disconnect-trigger.js.snapshot/integ-apigwv2-lambda-connect-integration.template.json‎

Lines changed: 14 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -52,17 +52,12 @@
5252
"dynamodb:UpdateItem"
5353
],
5454
"Effect": "Allow",
55-
"Resource": [
56-
{
57-
"Fn::GetAtt": [
58-
"WebSocketLogTable7F74AAC5",
59-
"Arn"
60-
]
61-
},
62-
{
63-
"Ref": "AWS::NoValue"
64-
}
65-
]
55+
"Resource": {
56+
"Fn::GetAtt": [
57+
"WebSocketLogTable7F74AAC5",
58+
"Arn"
59+
]
60+
}
6661
}
6762
],
6863
"Version": "2012-10-17"
@@ -97,7 +92,7 @@
9792
"Arn"
9893
]
9994
},
100-
"Runtime": "nodejs14.x",
95+
"Runtime": "nodejs22.x",
10196
"Timeout": 5
10297
},
10398
"DependsOn": [
@@ -157,17 +152,12 @@
157152
"dynamodb:UpdateItem"
158153
],
159154
"Effect": "Allow",
160-
"Resource": [
161-
{
162-
"Fn::GetAtt": [
163-
"WebSocketLogTable7F74AAC5",
164-
"Arn"
165-
]
166-
},
167-
{
168-
"Ref": "AWS::NoValue"
169-
}
170-
]
155+
"Resource": {
156+
"Fn::GetAtt": [
157+
"WebSocketLogTable7F74AAC5",
158+
"Arn"
159+
]
160+
}
171161
}
172162
],
173163
"Version": "2012-10-17"
@@ -202,7 +192,7 @@
202192
"Arn"
203193
]
204194
},
205-
"Runtime": "nodejs14.x",
195+
"Runtime": "nodejs22.x",
206196
"Timeout": 5
207197
},
208198
"DependsOn": [

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigatewayv2-integrations/test/websocket/integ.lambda-connect-disconnect-trigger.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ const webSocketTableName = 'WebSocketConnections';
1717

1818
const connectFunction = new lambda.Function(stack, 'Connect Function', {
1919
functionName: 'process_connect_requests',
20-
runtime: lambda.Runtime.NODEJS_14_X,
20+
runtime: lambda.Runtime.NODEJS_22_X,
2121
handler: 'index.handler',
2222
code: lambda.Code.fromAsset(path.join(__dirname, 'lambdas', 'connect')),
2323
timeout: cdk.Duration.seconds(5),
@@ -31,7 +31,7 @@ const disconnectFunction = new lambda.Function(
3131
'Disconnect Function',
3232
{
3333
functionName: 'process_disconnect_requests',
34-
runtime: lambda.Runtime.NODEJS_14_X,
34+
runtime: lambda.Runtime.NODEJS_22_X,
3535
handler: 'index.handler',
3636
code: lambda.Code.fromAsset(
3737
path.join(__dirname, 'lambdas', 'disconnect'),

‎packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.appsync-eventapi-dynamodb.js.snapshot/EventApiDynamoDBStack.template.json‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -77,17 +77,12 @@
7777
"dynamodb:UpdateItem"
7878
],
7979
"Effect": "Allow",
80-
"Resource": [
81-
{
82-
"Fn::GetAtt": [
83-
"table8235A42E",
84-
"Arn"
85-
]
86-
},
87-
{
88-
"Ref": "AWS::NoValue"
89-
}
90-
]
80+
"Resource": {
81+
"Fn::GetAtt": [
82+
"table8235A42E",
83+
"Arn"
84+
]
85+
}
9186
}
9287
],
9388
"Version": "2012-10-17"

‎packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.auth-apikey.js.snapshot/aws-appsync-integ.assets.json‎

Lines changed: 5 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.auth-apikey.js.snapshot/aws-appsync-integ.template.json‎

Lines changed: 21 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -71,17 +71,12 @@
7171
"dynamodb:UpdateItem"
7272
],
7373
"Effect": "Allow",
74-
"Resource": [
75-
{
76-
"Fn::GetAtt": [
77-
"TestTable5769773A",
78-
"Arn"
79-
]
80-
},
81-
{
82-
"Ref": "AWS::NoValue"
83-
}
84-
]
74+
"Resource": {
75+
"Fn::GetAtt": [
76+
"TestTable5769773A",
77+
"Arn"
78+
]
79+
}
8580
}
8681
],
8782
"Version": "2012-10-17"
@@ -103,8 +98,6 @@
10398
"ApiId"
10499
]
105100
},
106-
"Name": "testDataSource",
107-
"Type": "AMAZON_DYNAMODB",
108101
"DynamoDBConfig": {
109102
"AwsRegion": {
110103
"Ref": "AWS::Region"
@@ -113,12 +106,14 @@
113106
"Ref": "TestTable5769773A"
114107
}
115108
},
109+
"Name": "testDataSource",
116110
"ServiceRoleArn": {
117111
"Fn::GetAtt": [
118112
"ApitestDataSourceServiceRoleACBC3F3D",
119113
"Arn"
120114
]
121-
}
115+
},
116+
"Type": "AMAZON_DYNAMODB"
122117
}
123118
},
124119
"ApiQueryGetTestsF8C40170": {
@@ -130,12 +125,12 @@
130125
"ApiId"
131126
]
132127
},
133-
"FieldName": "getTests",
134-
"TypeName": "Query",
135128
"DataSourceName": "testDataSource",
129+
"FieldName": "getTests",
136130
"Kind": "UNIT",
137131
"RequestMappingTemplate": "{\"version\" : \"2017-02-28\", \"operation\" : \"Scan\", \"consistentRead\": false}",
138-
"ResponseMappingTemplate": "$util.toJson($ctx.result.items)"
132+
"ResponseMappingTemplate": "$util.toJson($ctx.result.items)",
133+
"TypeName": "Query"
139134
},
140135
"DependsOn": [
141136
"ApiSchema510EECD7",
@@ -151,12 +146,12 @@
151146
"ApiId"
152147
]
153148
},
154-
"FieldName": "addTest",
155-
"TypeName": "Mutation",
156149
"DataSourceName": "testDataSource",
150+
"FieldName": "addTest",
157151
"Kind": "UNIT",
158152
"RequestMappingTemplate": "\n #set($input = $ctx.args.test)\n \n {\n \"version\": \"2017-02-28\",\n \"operation\": \"PutItem\",\n \"key\" : {\n \"id\" : $util.dynamodb.toDynamoDBJson($util.autoId())\n },\n \"attributeValues\": $util.dynamodb.toMapValuesJson($input)\n }",
159-
"ResponseMappingTemplate": "$util.toJson($ctx.result)"
153+
"ResponseMappingTemplate": "$util.toJson($ctx.result)",
154+
"TypeName": "Mutation"
160155
},
161156
"DependsOn": [
162157
"ApiSchema510EECD7",
@@ -166,19 +161,19 @@
166161
"TestTable5769773A": {
167162
"Type": "AWS::DynamoDB::Table",
168163
"Properties": {
169-
"KeySchema": [
164+
"AttributeDefinitions": [
170165
{
171166
"AttributeName": "id",
172-
"KeyType": "HASH"
167+
"AttributeType": "S"
173168
}
174169
],
175-
"AttributeDefinitions": [
170+
"BillingMode": "PAY_PER_REQUEST",
171+
"KeySchema": [
176172
{
177173
"AttributeName": "id",
178-
"AttributeType": "S"
174+
"KeyType": "HASH"
179175
}
180-
],
181-
"BillingMode": "PAY_PER_REQUEST"
176+
]
182177
},
183178
"UpdateReplacePolicy": "Delete",
184179
"DeletionPolicy": "Delete"

‎packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.auth-apikey.js.snapshot/cdk.out‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)