chore(release): 2.217.0

CHANGELOG.v2.alpha.md

@@ -2,6 +2,8 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.217.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.216.0-alpha.0...v2.217.0-alpha.0) (2025-09-25)
+
 ## [2.216.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.215.0-alpha.0...v2.216.0-alpha.0) (2025-09-22)
 
 ## [2.215.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.214.0-alpha.0...v2.215.0-alpha.0) (2025-09-15)

CHANGELOG.v2.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.217.0](https://github.com/aws/aws-cdk/compare/v2.216.0...v2.217.0) (2025-09-25)
+
+
+### Features
+
+* update L1 CloudFormation resource definitions ([#35491](https://github.com/aws/aws-cdk/issues/35491)) ([d095f68](https://github.com/aws/aws-cdk/commit/d095f687e77bed7d064dc30938a69f51d8b2c6a8))
+* update L1 CloudFormation resource definitions ([#35567](https://github.com/aws/aws-cdk/issues/35567)) ([b0ccf81](https://github.com/aws/aws-cdk/commit/b0ccf819277bd65057de87de8a43fbc8f09a03f7))
+
+
+### Bug Fixes
+
+* **cloudfront:** `Function` ARN reference changed from GetAtt to Ref ([#35547](https://github.com/aws/aws-cdk/issues/35547)) ([8a26869](https://github.com/aws/aws-cdk/commit/8a26869586e56e85994822815a21596aecf68453)), closes [#35531](https://github.com/aws/aws-cdk/issues/35531)
+* **core:** negated gitignore patterns inside subdirectories are not including matched files ([#35511](https://github.com/aws/aws-cdk/issues/35511)) ([44781ef](https://github.com/aws/aws-cdk/commit/44781efe38113a7f7b86d74c605274fecbaca546)), closes [#9146](https://github.com/aws/aws-cdk/issues/9146) [#22002](https://github.com/aws/aws-cdk/issues/22002)
+* **kms:** `Alias` reference incorrectly resolves to underlying `Key` ([#35545](https://github.com/aws/aws-cdk/issues/35545)) ([43ffcff](https://github.com/aws/aws-cdk/commit/43ffcff6a5092b9ec5030ba020c366ca7d6a8820)), closes [#35543](https://github.com/aws/aws-cdk/issues/35543)
+* **lambda:** function.latestVersion points to wrong ARN ([#35546](https://github.com/aws/aws-cdk/issues/35546)) ([761dde2](https://github.com/aws/aws-cdk/commit/761dde288dce01cca60cbfd44e79b9bab9e0faf3)), closes [#35545](https://github.com/aws/aws-cdk/issues/35545)
+* **rds:** cannot use connections in rds.DatabaseInstance.fromLookup ([#35193](https://github.com/aws/aws-cdk/issues/35193)) ([973d234](https://github.com/aws/aws-cdk/commit/973d23460787d3dc2eb1883eddb120a67cb8688f)), closes [#35192](https://github.com/aws/aws-cdk/issues/35192)
+
+
+### Reverts
+
+* **dynamodb:** use keyId instead of keyArn for TableV2 replica encryption ([#35568](https://github.com/aws/aws-cdk/issues/35568)) ([b1f7f78](https://github.com/aws/aws-cdk/commit/b1f7f78ebc3ebdb5995bfb8b500e4b2ccd505afa)), closes [aws/aws-cdk#35144](https://github.com/aws/aws-cdk/issues/35144) [#35144](https://github.com/aws/aws-cdk/issues/35144) [#35551](https://github.com/aws/aws-cdk/issues/35551)
+
 ## [2.216.0](https://github.com/aws/aws-cdk/compare/v2.215.0...v2.216.0) (2025-09-22)
 
 

packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-function-runtime.js.snapshot/integ-distribution-function.template.json

@@ -35,13 +35,19 @@
        {
         "EventType": "viewer-request",
         "FunctionARN": {
-         "Ref": "FunctionRequest95528B2F"
+         "Fn::GetAtt": [
+          "FunctionRequest95528B2F",
+          "FunctionARN"
+         ]
         }
        },
        {
         "EventType": "viewer-response",
         "FunctionARN": {
-         "Ref": "FunctionResponse4EF2D1D3"
+         "Fn::GetAtt": [
+          "FunctionResponse4EF2D1D3",
+          "FunctionARN"
+         ]
         }
        }
       ],

packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-function.js.snapshot/integ-distribution-function.template.json

@@ -23,7 +23,10 @@
        {
         "EventType": "viewer-request",
         "FunctionARN": {
-         "Ref": "Function76856677"
+         "Fn::GetAtt": [
+          "Function76856677",
+          "FunctionARN"
+         ]
         }
        }
       ],

packages/aws-cdk-lib/aws-bedrockagentcore/.jsiirc.json

@@ -0,0 +1,13 @@
+{
+  "targets": {
+    "java": {
+      "package": "software.amazon.awscdk.services.bedrockagentcore"
+    },
+    "dotnet": {
+      "package": "Amazon.CDK.AWS.BedrockAgentCore"
+    },
+    "python": {
+      "module": "aws_cdk.aws_bedrockagentcore"
+    }
+  }
+}

packages/aws-cdk-lib/aws-bedrockagentcore/README.md

@@ -0,0 +1,39 @@
+# AWS::BedrockAgentCore Construct Library
+<!--BEGIN STABILITY BANNER-->
+
+---
+
+![cfn-resources: Stable](https://img.shields.io/badge/cfn--resources-stable-success.svg?style=for-the-badge)
+
+> All classes with the `Cfn` prefix in this module ([CFN Resources]) are always stable and safe to use.
+>
+> [CFN Resources]: https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib
+
+---
+
+<!--END STABILITY BANNER-->
+
+This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
+
+```ts nofixture
+import * as bedrockagentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+```
+
+<!--BEGIN CFNONLY DISCLAIMER-->
+
+There are no official hand-written ([L2](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib)) constructs for this service yet. Here are some suggestions on how to proceed:
+
+- Search [Construct Hub for BedrockAgentCore construct libraries](https://constructs.dev/search?q=bedrockagentcore)
+- Use the automatically generated [L1](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_l1_using) constructs, in the same way you would use [the CloudFormation AWS::BedrockAgentCore resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_BedrockAgentCore.html) directly.
+
+
+<!--BEGIN CFNONLY DISCLAIMER-->
+
+There are no hand-written ([L2](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib)) constructs for this service yet. 
+However, you can still use the automatically generated [L1](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_l1_using) constructs, and use this service exactly as you would using CloudFormation directly.
+
+For more information on the resources and properties available for this service, see the [CloudFormation documentation for AWS::BedrockAgentCore](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_BedrockAgentCore.html).
+
+(Read the [CDK Contributing Guide](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and submit an RFC if you are interested in contributing to this construct library.)
+
+<!--END CFNONLY DISCLAIMER-->

packages/aws-cdk-lib/aws-bedrockagentcore/index.ts

@@ -0,0 +1 @@
+export * from './lib';

packages/aws-cdk-lib/aws-bedrockagentcore/lib/index.ts

@@ -0,0 +1,2 @@
+// AWS::BedrockAgentCore Cloudformation Resources
+export * from './bedrockagentcore.generated';

packages/aws-cdk-lib/aws-cloudfront/lib/function.ts

@@ -223,9 +223,11 @@ export class Function extends Resource implements IFunction {
       name: this.functionName,
     });
 
-    this.functionRef = resource.functionRef;
     this.functionArn = resource.attrFunctionArn;
     this.functionStage = resource.attrStage;
+    this.functionRef = {
+      functionArn: this.functionArn,
+    };
   }
 
   private generateName(): string {

packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts

@@ -920,7 +920,10 @@ describe('with CloudFront functions', () => {
             {
               EventType: 'viewer-request',
               FunctionARN: {
-                Ref: 'TestFunction22AD90FC',
+                'Fn::GetAtt': [
+                  'TestFunction22AD90FC',
+                  'FunctionARN',
+                ],
               },
             },
           ],

packages/aws-cdk-lib/aws-cloudfront/test/function.test.ts

@@ -292,5 +292,24 @@ describe('CloudFront Function', () => {
         },
       });
     });
+
+    test('CloudFront FunctionRef uses GetAtt, not Ref', () => {
+      // Both GetAtt and Ref are valid ways to satisfy the contract, but only
+      // GetAtt is backwards compatible.
+      const stack = new Stack();
+
+      const fn = new Function(stack, 'TestFn', {
+        code: FunctionCode.fromInline('code'),
+        runtime: FunctionRuntime.JS_2_0,
+        keyValueStore: undefined,
+      });
+
+      expect(stack.resolve(fn.functionRef.functionArn)).toEqual({
+        'Fn::GetAtt': [
+          'TestFn04335C60',
+          'FunctionARN',
+        ],
+      });
+    });
   });
 });

packages/aws-cdk-lib/aws-cloudfront/test/web-distribution.test.ts

@@ -810,7 +810,10 @@ added the ellipsis so a user would know there was more to r...`,
             {
               'EventType': 'viewer-request',
               'FunctionARN': {
-                'Ref': 'TestFunction22AD90FC',
+                'Fn::GetAtt': [
+                  'TestFunction22AD90FC',
+                  'FunctionARN',
+                ],
               },
             },
           ],

packages/aws-cdk-lib/aws-dynamodb/lib/encryption.ts

@@ -70,7 +70,7 @@ export abstract class TableEncryptionV2 {
 
         if (replicaRegion === stackRegion) {
           return {
-            kmsMasterKeyId: tableKey.keyId,
+            kmsMasterKeyId: tableKey.keyArn,
           } satisfies CfnGlobalTable.ReplicaSSESpecificationProperty;
         }
 

packages/aws-cdk-lib/aws-dynamodb/test/encryption.test.ts

@@ -98,20 +98,10 @@ describe('customer managed keys', () => {
   test('can render replica SSE specification in deployment region', () => {
     // WHEN / THEN
     expect(encryption._renderReplicaSseSpecification(stack, stack.region)).toEqual({
-      kmsMasterKeyId: tableKey.keyId,
+      kmsMasterKeyId: tableKey.keyArn,
     });
   });
 
-  test('replica SSE specification uses key ID format not ARN format', () => {
-    // WHEN
-    const result = encryption._renderReplicaSseSpecification(stack, stack.region);
-
-    // THEN
-    expect(result.kmsMasterKeyId).toBe(tableKey.keyId);
-    expect(result.kmsMasterKeyId).not.toBe(tableKey.keyArn);
-    expect(result.kmsMasterKeyId).not.toContain('arn:aws:kms');
-  });
-
   test('can render replica SSE specification in replica region', () => {
     // WHEN / THEN
     expect(encryption._renderReplicaSseSpecification(stack, 'us-east-1')).toEqual({

packages/aws-cdk-lib/aws-dynamodb/test/table-v2.test.ts

@@ -928,7 +928,10 @@ describe('table', () => {
           Region: 'us-west-2',
           SSESpecification: {
             KMSMasterKeyId: {
-              Ref: 'Key961B73FD',
+              'Fn::GetAtt': [
+                'Key961B73FD',
+                'Arn',
+              ],
             },
           },
           TableClass: 'STANDARD_INFREQUENT_ACCESS',

packages/aws-cdk-lib/aws-ec2/lib/instance-types.ts

@@ -492,6 +492,16 @@ export enum InstanceClass {
    */
   R8GD = 'r8gd',
 
+  /**
+   * Memory optimized instances, 8th generation with Graviton4 processors and high network bandwidth capabilities
+   */
+  MEMORY8_GRAVITON4_HIGH_NETWORK_BANDWIDTH = 'memory8-graviton4-high-network-bandwidth',
+
+  /**
+   * Memory optimized instances, 8th generation with Graviton4 processors and high network bandwidth capabilities
+   */
+  R8GN = 'r8gn',
+
   /**
    * Compute optimized instances, 3rd generation
    */
@@ -1849,6 +1859,8 @@ export class InstanceType {
       [InstanceClass.R8G]: 'r8g',
       [InstanceClass.MEMORY8_GRAVITON4_NVME_DRIVE]: 'r8gd',
       [InstanceClass.R8GD]: 'r8gd',
+      [InstanceClass.MEMORY8_GRAVITON4_HIGH_NETWORK_BANDWIDTH]: 'r8gn',
+      [InstanceClass.R8GN]: 'r8gn',
       [InstanceClass.MEMORY8_INTEL_BASE]: 'r8i',
       [InstanceClass.R8I]: 'r8i',
       [InstanceClass.MEMORY8_INTEL_FLEX]: 'r8i-flex',

packages/aws-cdk-lib/aws-kms/lib/alias.ts

@@ -69,7 +69,13 @@ abstract class AliasBase extends Resource implements IAlias {
   }
 
   public get keyRef(): KeyReference {
-    return this.aliasTargetKey.keyRef;
+    // Not actually referering to the key: `IKeyRef` here is being used as a
+    // hypothetical `IKeyLikeRef`, and we need to return the Alias values using
+    // the Key interface.
+    return {
+      keyArn: this.aliasArn,
+      keyId: this.keyId,
+    };
   }
 
   /**

packages/aws-cdk-lib/aws-kms/lib/key.ts

@@ -26,6 +26,9 @@ import * as cxapi from '../../cx-api';
 
 /**
  * A KMS Key, either managed by this CDK app, or imported.
+ *
+ * This interface does double duty: it represents an actual KMS keys, but it
+ * also represents things that can behave like KMS keys, like a key alias.
  */
 export interface IKey extends IResource, IKeyRef {
   /**

packages/aws-cdk-lib/aws-kms/test/alias.test.ts

@@ -911,6 +911,19 @@ test('aliasArn should be a valid ARN', () => {
   }, stack));
 });
 
+test('Alias keyRef should reference the Alias, not the underlying key', () => {
+  // GIVEN
+  const app = new App();
+  const stack = new Stack(app, 'Test');
+  const key = new Key(stack, 'Key');
+
+  // WHEN
+  const alias = key.addAlias('alias/foo');
+
+  // THEN
+  expect(alias.keyRef.keyArn).toEqual(alias.aliasArn);
+});
+
 class AliasOutputsConstruct extends Construct {
   constructor(scope: Construct, id: string, key: IKey) {
     super(scope, id);

packages/aws-cdk-lib/aws-lambda/lib/function-base.ts

@@ -866,12 +866,15 @@ class LatestVersion extends FunctionBase implements IVersion {
 
   public get versionRef(): VersionReference {
     return {
-      functionArn: this.functionRef.functionArn,
+      functionArn: this.functionArn,
     };
   }
 
-  public get functionRef() {
-    return this.lambda.functionRef;
+  public get functionRef(): FunctionReference {
+    return {
+      functionArn: this.functionArn,
+      functionName: this.functionName,
+    };
   }
 
   public get functionArn() {

packages/aws-cdk-lib/aws-lambda/test/alias.test.ts

@@ -657,4 +657,24 @@ describe('alias', () => {
       Qualifier: aliasName,
     });
   });
+
+  test('alias\' implementation of IFunctionRef should point to the alias', () => {
+    // GIVEN
+    const stack = new Stack();
+    const fn = new lambda.Function(stack, 'MyLambda', {
+      code: new lambda.InlineCode('hello()'),
+      handler: 'index.hello',
+      runtime: lambda.Runtime.NODEJS_LATEST,
+    });
+    const aliasName = 'prod';
+
+    // WHEN
+    const alias = new lambda.Alias(stack, 'Alias', {
+      aliasName,
+      version: fn.currentVersion,
+    });
+
+    // THEN
+    expect(alias.functionRef.functionArn).toEqual(alias.functionArn);
+  });
 });

packages/aws-cdk-lib/aws-lambda/test/function.test.ts

@@ -2764,6 +2764,21 @@ describe('function', () => {
     expect(stack.resolve(version2.functionArn)).toEqual(expectedArn);
   });
 
+  test('latestVersion functionRef ARN is the version ARN, not the plain ARN', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    const fn = new lambda.Function(stack, 'MyLambda', {
+      code: new lambda.InlineCode('hello()'),
+      handler: 'index.hello',
+      runtime: lambda.Runtime.NODEJS_LATEST,
+    });
+
+    // THEN
+    expect(fn.latestVersion.functionRef.functionArn).toEqual(fn.latestVersion.functionArn);
+  });
+
   test('default function with kmsKeyArn, environmentEncryption passed as props', () => {
     // GIVEN
     const stack = new cdk.Stack();

packages/aws-cdk-lib/aws-lambda/test/lambda-version.test.ts

@@ -229,4 +229,22 @@ describe('lambda version', () => {
       version.addFunctionUrl();
     }).toThrow(/FunctionUrl cannot be used with a Version/);
   });
+
+  test('version\'s implementation of IFunctionRef should point to the version', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const fn = new lambda.Function(stack, 'MyLambda', {
+      code: new lambda.InlineCode('hello()'),
+      handler: 'index.hello',
+      runtime: lambda.Runtime.NODEJS_LATEST,
+    });
+
+    // WHEN
+    const ver = new lambda.Version(stack, 'Version', {
+      lambda: fn,
+    });
+
+    // THEN
+    expect(ver.functionRef.functionArn).toEqual(ver.functionArn);
+  });
 });