NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
NuGet · #2227 most downloaded on NuGet
AWS region information, such as service principal names (Stability: Stable)
Last release 3 days ago
30 Sep 2026
Ships on a steady schedule
a new release about every 2 weeks
Some releases are documented
notes for 15 of the last 60 stable releases
13 versions withdrawn
withdrawn after publishing
127 years old
624 releases · first in 1900
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
One column per quarter.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
aws-codepipeline-actions: use SecretValue
core: The deprecated app.run() has been removed (use app.synth()).
clusterName from Services (#2980) (a6e4f6a)onXxx() methods (#2921) (ea10f0d), closes #2913@aws-cdk/cdk module was renamed to @aws-cdk/core, python: aws_cdk.core, java: the artifact cdk in groupId software.amazon.awscdk was renamed to core@aws-cdk/cdk.Duration instead of number, and were renamed to exclude any unit indication.app.run() has been removed (use app.synth()).CfnResource.options property was renamed to CfnResource.cfnOptions to avoid conflicts with properties introduced by derived classes.CfnXxx.cfnResourceTypeName is now CFN_RESOURCE_TYPE_NAME in generated CFN resources.ContextProvider is no longer designed to be extended. Use ContextProvider.getValue and ContextProvider.getKey as utilities.Context.getSsmParameter has been removed. Use ssm.StringParameter.valueFromLookupContext.getAvailabilityZones has been removed. Use stack.availabilityZonesContext.getDefaultAccount and getDefaultRegion have been removed an no longer available. Use the environment variables CDK_DEFAULT_ACCOUNT and CDK_DEFAULT_REGION instead.StackProps.autoRun was renamed to StackProps.autoSynth.CfnElement.refAsString renamed to ref of string type. The IResolvable version have been removed.IStringValue renamed to IStringProducerInclude renamed to CfnIncludeCfn prefix was added to the following types: CfnCreationPolicy, CfnResourceAutoScalingCreationPolicy, CfnResourceAutoScalingCreationPolicy, CfnDeletionPolicy, CfnUpdatePolicy, CfnAutoScalingRollingUpdate, CfnAutoScalingReplacingUpdate, CfnAutoScalingScheduledAction, CfnCodeDeployLambdaAliasUpdate, CfnTag CfnRuleAssertion, CfnDynamicReferencePropsdeepMerge is no longer exported.CfnOutputProps.export was renamed to exportName.CfnOutput all properties are now privateStringListCfnOutput has been removedFn were made static, and the Fn constructor was made private.VpcNetworkProvider has been removed. Use Vpc.fromLookup.ec2.MachineImage will now resolve AMIs from SSM during deployment.ecs.EcsOptimizedAmi will now resolve AMis from SSM during deployment.hardwareType was STANDARD. Now it always defaults to Amazon Linux v2.service.clusterName has been replaced with .cluster.requiredTransform is now REQUIRED_TRANSFORM in generated code.AwsCustomResource class was moved to a new module called @aws-cdk/custom-resourcecapabilities property is now an array to support multiple capabilities.Pipeline.crossRegionScaffoldStacks has been renamed to crossRegionSupport, and its type changed from CrossRegionScaffoldStack to CrossRegionSupport.CodeCommitAction.pollForSourceChanges to trigger and make it an enum.trigger, and make it an enum.CloudFormationAction and CloudFormationDeployAction.HostedZoneProvider has been removed. Use HostedZone.fromLookup.cli: Move version check TTL file to home directory
cdk context (#2870) (b8a1c8e), closes #2854name in StageProps to stageName. (#2882) (be574a1)hwType to hardwareType (#2916) (1aa0589), closes #2896aws-sns-subscribers (#2804) (9ef899c)AssetProps.packaging has been removed and is now automatically discovered based on the file type.ZipDirectoryAsset has been removed, use aws-s3-assets.Asset.FileAsset has been removed, use aws-s3-assets.Asset.Code.directory and Code.file have been removed. Use Code.asset.hardwareType from hwType.TableOptions.pitrEnabled renamed to pointInTimeRecovery.TableOptions.sseEnabled renamed to serverSideEncryption.TableOptions.ttlAttributeName renamed to timeToLiveAttribute.TableOptions.streamSpecification renamed stream.ContainerImage.fromAsset() now takes only build directory
directly (no need to pass scope or id anymore).ISecret.secretJsonValue renamed to secretValueFromJson.ParameterStoreString has been removed. Use StringParameter.fromStringParameterAttributes.ParameterStoreSecureString has been removed. Use StringParameter.fromSecureStringParameterAttributes.ParameterOptions.name was renamed to parameterName.newStream renamed to addStream and doesn't need a scopenewSubscriptionFilter renamed to addSubscriptionFilter and doesn't need a scopenewMetricFilter renamed to addMetricFilter and doesn't need a scopeNewSubscriptionFilterProps renamed to SubscriptionPropsNewLogStreamProps renamed to LogStreamOptionsNewMetricFilterProps renamed to MetricFilterOptionsJSONPattern renamed to JsonPatternMethodOptions.authorizerId is now called authorizer and accepts an IAuthorizer which is a placeholder interface for the authorizer resource.restapi.executeApiArn renamed to arnForExecuteApi.restapi.latestDeployment and deploymentStage are now read-only.EventPattern.detail is now a map.scheduleExpression: string is now schedule: Schedule.cdk.RemovalPolicy
to configure the resource's removal policy.applyRemovalPolicy is now CfnResource.applyRemovalPolicy.RemovalPolicy.Orphan has been renamed to Retain.RemovalPolicy.Forbid has been removed, use Retain.RepositoryProps.retain is now removalPolicy, and defaults to Retain instead of remove since ECR is a stateful resourceKeyProps.retain is now removalPolicyLogGroupProps.retainLogGroup is now removalPolicyLogStreamProps.retainLogStream is now removalPolicyDatabaseClusterProps.deleteReplacePolicy is now removalPolicyDatabaseInstanceNewProps.deleteReplacePolicy is now removalPolicyattr instead of the resource type. For example, in S3 bucket.bucketArn is now bucket.attrArn.propertyOverrides has been removed from all "Cfn" resources, instead
users can now read/write resource properties directly on the resource class. For example, instead of lambda.propertyOverrides.runtime just use lambda.runtime.stageName instead of nameFunction.addLayer to addLayers and made it variadicIFunction.handler propertyIVersion.versionArn property (the value is at functionArn)SingletonLayerVersionLogRetentionPolicyStatement no longer has a fluid API, and accepts a
props object to be able to set the important fields.ImportedResourcePrincipal to UnknownPrincipal.managedPolicyArns renamed to managedPolicies, takes
return value from ManagedPolicy.fromAwsManagedPolicyName().PolicyDocument.postProcess() is now removed.PolicyDocument.addStatement() renamed to addStatements.PolicyStatement is no longer IResolvable, call .toStatementJson()
to retrieve the IAM policy statement JSON.AwsPrincipal has been removed, use ArnPrincipal instead.s3.StorageClass is now an enum-like class instead of a regular
enum. This means that you need to call .value in order to obtain it's value.s3.Coordinates renamed to s3.LocationArtifact.s3Coordinates renamed to Artifact.s3Location.BuildSpec object.lambda.Runtime.NodeJS* are now lambda.Runtime.Nodejs*Stack APIstack.name renamed to stack.stackNamestack.stackName will return the concrete stack name. Use Aws.stackName to indicate { Ref: "AWS::StackName" }.stack.account and stack.region will return the concrete account/region only if they are explicitly specified when the stack is defined (under the env prop). Otherwise, they will return a token that resolves to the AWS::AccountId and AWS::Region intrinsic references. Use Context.getDefaultAccount() and Context.getDefaultRegion() to obtain the defaults passed through the toolkit in case those are needed. Use Token.isUnresolved(v) to check if you have a concrete or intrinsic.stack.logicalId has been removed. Use stack.getLogicalId()stack.env has been removed, use stack.account, stack.region and stack.environment insteadstack.accountId renamed to stack.account (to allow treating account more abstractly)AvailabilityZoneProvider can now be accessed through Context.getAvailabilityZones()SSMParameterProvider can now be accessed through Context.getSsmParameter()parseArn is now Arn.parsearnFromComponents is now arn.formatnode.lock and node.unlock are now privatestack.requireRegion and requireAccountId have been removed. Use Token.unresolved(stack.region) insteadstack.parentApp have been removed. Use App.isApp(stack.node.root) instead.stack.missingContext is now privatestack.renameLogical have been renamed to stack.renameLogicalIdIAddressingScheme, HashedAddressingScheme and LogicalIDs are now internal. Override Stack.allocateLogicalId to customize how logical IDs are allocated to resources.--rename, and the stack
names are now immutable on the stack artifact.@aws-cdk/aws-sns-subscribers
package.roleName in RoleProps is now of type PhysicalNamebucketName in BucketProps is now of type PhysicalNameroleName in RoleProps is now of type PhysicalNamecore: App.run() was renamed to App.synth() (soft deprecation, it will be removed in the next release).
aws-cloudwatch-actions (#2688) (e3df21a)recordValue: string prop in route53.TxtRecord changed to values: string[]recordValue prop in route53.CnameRecord renamed to domainNameroute53.AliasRecord has been removed, use route53.ARecord or route53.AaaaRecord with the target prop.EncryptionKeyAlias class was renamed to Alias.
Associated types (such as EncryptionKeyAliasProps) were renamed in the
same way.App.run() was renamed to App.synth() (soft deprecation, it will be removed in the next release).node.stack is now Stack.of(construct) (fixes #2766)node.resolve has been moved to stack.resolve.node.stringifyJson has been moved to stack.stringifyJson.node.validateTree is now ConstructNode.validate(node)node.prepareTree is now ConstructNode.prepare(node)node.getContext is now node.tryGetContextnode.recordReference is now node.addReferencenode.apply is now node.applyAspectnode.ancestors() is now node.scopesnode.required has been removed.node.typename has been removed.node.addChild is now privatenode.findReferences() is now node.referencesnode.findDependencies() is now node.dependenciesstack.dependencies() is now stack.dependenciesCfnElement.stackPath has been removed.CloudFormationLang is now internal (use stack.toJsonString())@aws-cdk/aws-cloudwatch-actions
package.targets.EcsEc2Task renamed to targets.EcsTaskendpoint is now type string (previously any)result in the Pass state is now type map (previously any)@aws-cdk/applet-js, @aws-cdk/aws-autoscaling-api, @aws-cdk/aws-codedeploy-apiaddPropertyOverride should match in capitalization to the CloudFormation schema (normally pascal case). For example, addPropertyOverride('accessControl', 'xxx') should now be addPropertyOverride('AccessControl', 'xxx').rds.RotationSingleUser renamed to rds.SecretRotationrds.ClusterParameterGroup no longer has setParameter() and removeParameter() methods, use the parameters prop directly in the constructor instead.IMPORTANT: apps created with the CDK version 0.33.0 and above cannot be used with an older CLI version.
IMPORTANT: apps created with the CDK version 0.33.0 and above cannot be used with an older CLI version.
cdk docs open the new API reference (#2633) (6450758)dependencyRoots from public API (#2668) (2ba5ad2), closes #2348noUnusedLocals and noUnusedParameters from typescript templates (#2654) (b061826)@aws-cdk/aws-logs-destinations package.addPutJobResultPolicy property when creating LambdaInvokeAction.--interactive has been removed--numbered has been removed--staging is now a boolean flag that indicates whether assets should be copied to the --output directory or directly referenced (--no-staging is useful for e.g. local debugging with SAM CLI)SynthUtils.templateForStackName has been removed (use SynthUtils.synthesize(stack).template).cxapi.SynthesizedStack renamed to cxapi.CloudFormationStackArtifact with multiple API changes.cdk.App.run() now returns a cxapi.CloudAssembly instead of cdk.ISynthesisSession.@aws-cdk/aws-s3-notifications package.@aws-cdk/aws-autoscaling-hooktargets package.EcsQueueWorkerService, FargateQueueWorkerService, LoadBalancedEcsService, LoadBalancedFargateService and LoadBalancedFargateServiceApplets.leftAxisRange => leftYAxis, rightAxisRange => rightYAxis, rename YAxisRange => YAxisProps.lambda: deprecate old Lambda runtimes
@aws-cdk/aws-route53-targets package.IBucket.arnForObject method no longer
concatenates path fragments on your behalf. Pass the /-concatenated
key pattern instead.export methods from all AWS resources have been removed. CloudFormation Exports are now automatically created when attributes are referenced across stacks within the same app. To export resources manually, you can explicitly define a CfnOutput.kms.EncryptionKey renamed to kms.Keyec2.VpcNetwork renamed to ec2.Vpcec2.VpcSubnet renamed to ec2.Subnetcloudtrail.CloudTrail renamed to cloudtrail.Trail`XxxAttribute and XxxImportProps interfaces which were no longer in used after their corresponding export method was deleted and there was no use for them in imports.ecs.ClusterAttributes now accepts IVpc and ISecurityGroup instead of attributes. You can use their
corresponding fromXxx methods to import them as needed.servicediscovery.CnameInstance.instanceCname renamed to cname.glue.IDatabase.locationUrl is now only in glue.Database (not on the interface)ec2.TcpPortFromAttribute and UdpPortFromAttribute removed. Use TcpPort and UdpPort with new Token(x).toNumber instead.ec2.VpcNetwork.importFromContext renamed to ec2.Vpc.fromLookupiam.IRole.roleId has been removed from the interface, but Role.roleId is still available for owned resources.loadBalancer property in ServerDeploymentGroupProps has been changed.apigateway.ResourceBase.trackChild is now internal.cloudfront.S3OriginConfig.originAccessIdentity is now originAccessIdentityIdcodedeploy.LambdaDeploymentGroup.alarms is now cloudwatch.IAlarm[] (previously cloudwatch.Alarm[])codepipeline.crossRegionScaffoldingStacks renamed to crossRegionScaffoldingcodepipeline.CrossRegionScaffoldingStack renamed to codepipeline.CrossRegionScaffolding and cannot be instantiated (abstract)ec2.VpcSubnet.addDefaultRouteToNAT renamed to addDefaultNatRoute and made publicec2.VpcSubnet.addDefaultRouteToIGW renamed to addDefaultInternetRoute, made public and first argument is the gateway ID (string) and not the CFN L1 classecs.Ec2EventRuleTarget.taskDefinition is now ITaskDefinition (previously TaskDefinition)lambda.IEventSource.bind now accepts IFunction instead of FunctionBase. Use IFunction.addEventSourceMapping to add an event source mapping under the function.lambda.Layer.grantUsage renamed to lambda.layer.addPermission and returns voidstepfunctions.StateMachine.role is now iam.IRole (previously iam.Role)onXxx() CloudWatch Event methods now have the signature:resource.onEvent('SomeId', {
target: new SomeTarget(...),
// options
});
onAlarm was renamed to addAlarmActiononOk was renamed to addOkActiononInsufficientData was renamed to addInsufficientDataActiononLifecycleTransition was renamed to addLifecycleHookonPreHook was renamed to addPreHookonPostHook was renamed to addPostHookonXxx were renamed to addXxxTriggeronImagePushed was renamed to onCloudTrailImagePushedonEvent was renamed to addEventNotificationonObjectCreated was renamed to addObjectCreatedNotificationonObjectRemoved was renamed to addObjectRemovedNotificationonPutObject was renamed to onCloudTrailPutObjectaws-ecs: expose readonly service on LoadBalancedEc2Service (#2395) (52af870), closes #2378
Foo.import static methods are now Foo.fromFooAttributesFooImportProps structs are now called FooAttributesstepfunctions.StateMachine.export has been removed.ses.ReceiptRule.name is now ses.ReceiptRule.receiptRuleNameses.ReceiptRuleSet.name is now ses.ReceiptRuleSet.receiptRuleSetNamesecretsmanager.AttachedSecret is now called secretsmanager.SecretTargetAttachment to match service semanticsecr.Repository.export has been removeds3.Bucket.bucketUrl is now called s3.Bucket.bucketWebsiteUrllambda.Version.functionVersion is now called lambda.Version.versionec2.SecurityGroup.groupName is now ec2.SecurityGroup.securityGroupNamecognito.UserPoolClient.clientId is now cognito.UserPoolClient.userPoolClientIdapigateway.IRestApiResource is now apigateway.IResourceapigateway.IResource.resourcePath is now apigateway.IResource.pathapigateway.IResource.resourceApi is now apigateway.IResource.restApiawslint: construct-base-is-private, resource-attribute (#2349) (973b506), closes #2426 #2409
s3.Bucket.domainName renamed to s3.Bucket.bucketDomainName.codedeploy.IXxxDeploymentConfig.deploymentConfigArn is now a property and not a method.ec2.SecurityGroupBase is now privateec2.VpcNetworkBase is now privatekinesis.StreamBase is now privatekms.EncryptionKeyBase is now privatelogs.LogGroupBase is now privatessm.ParameterBase is now privateeks.ClusterBase is now privatecodebuild.ProjectBase is now privatecodecommit.RepositoryBase is now privatecodedeploy.ServerDeploymentGroupBase is now privateeks.ClusterBase is now privatelambda.LayerVersionBase is now privaterds.DatabaseClusterBase is now privatesecretsmanager.SecretBase is now privateses.ReceiptRuleSetBase is now privatepollForSourceChanges property in GitHubSourceAction has been renamed to trigger, and its type changed from a boolean to an enum.acm: enabled validation of certificates on the zone name
app.run() (#2300) (47ff448), closes #2289 awslabs/jsii#456Code, CfnParametersCode. (#2027) (4247966)MetricCustomization to MetricOptions.outputArtifact and outputArtifacts properties.inputArtifact(s) and additionalInputArtifacts properties were renamed to input(s) and extraInputs.outputArtifactName(s) and additionalOutputArtifactNames properties were renamed to output(s) and extraOutputs.CodeBuildBuildAction and CodeBuildTestAction were merged into one class CodeBuildAction.JenkinsBuildAction and JenkinsTestAction were merged into one class JenkinsAction.lambda.Function no longer implements IEventRuleTarget. Instead, use @aws-cdk/aws-events-targets.LambdaFunction.sns.Topic no longer implements IEventRuleTarget. Use @aws-cdk/aws-events-targets.SnsTopic instead.codebuild.Project no longer implements IEventRuleTarget. Use @aws-cdk/aws-events-targets.CodeBuildProject.cdk.Root construct has been removed. Use cdk.App instead.stepfunctions.WaitProps: the props seconds, timestamp, secondsPath and timestampPath are now duration of a union-like class WaitDuration (e.g. duration: WaitDuration.seconds(n))codedeploy.ServerDeploymentConfigProps: the props minHealthyHostCount and minHealthyHostPercentage are now minimumHealthyHosts of union-like class MinimumHealthyHosts (e.g. minimumHealthyHosts: MinimumHealthyHosts.percentage(50))cloudformation.CustomResourceProps: the props topicProvider and lambdaProvider are now provider of union-like class CustomResourceProvider (e.g. CustomResourceProvider.lambda(fn)cloudformation.CustomResource no longer extends CfnCustomResource.ssm.ParameterProps renamed to ssm.ParameterOptions.aws-ec2.InstanceSize.None was renamed to InstanceSize.Nanovpc.selectSubnetIds(...) has been replaced with vpc.selectSubnets(...).subnetIds.aws-ecs: use executionRole for event rule target (#2165) (aa6f7bc), closes #2015
aws-ecs: use executionRole for event rule target (#2165) (aa6f7bc), closes #2015
feat(aws-iam): refactor grants, add OrganizationPrincipal (#1623) (1bb8ca9), closes #1623 #236
bind method to take a Role separately from the Pipeline. (#2085) (ffe0046)newVersion method. (#2099) (6fc179a)secretsmanager.SecretString class has been removed in favor of cdk.SecretValue.secretsManager(id[, options])string to cdk.SecretValue: codepipeline-actions.AlexaSkillDeployAction.clientSecret, codepipeline-actions.AlexaSkillDeployAction.refreshToken, codepipeline-actions.GitHubSourceAction.oauthToken, iam.User.passwordsecretsmanager.Secret.stringValue and jsonFieldValue have been removed. Use secretsmanage.Secret.secretValue and secretJsonValue instead.secretsmanager.Secret.secretString have been removed. Use cdk.SecretValue.secretsManager() or secretsmanager.Secret.import(..).secretValue.cdk.Secret has been removed. Use cdk.SecretValue instead.cdk.DynamicReference is no longer a construct, and it's constructor signature was changed and was renamed cdk.CfnDynamicReference.grant(function.role) and grant(project.role) are now grant(function) and grant(role).cdk.Secret with secretsmanager.SecretString (preferred) or ssm.ParameterStoreSecureString.Make sure to go through the BREAKING CHANGES section below
npx cdknpx cdk (#2113) (32bca05)cloudWatchLogsRetentionTimeDays in @aws-cdk/aws-cloudtrail
now uses a logs.RetentionDays instead of a LogRetention.stack._toCloudFormation method is now unavailable and is replaced by @aws-cdk/assert.SynthUtils.toCloudFormation(stack).kmsKeyArn: string by kmsKey: kms.IEncryptionKey in DatabaseClusterPropsVpcNetwork.isPublicSubnet() has been renamed to
VpcNetwork.isPublicSubnetIds().aws-serverless to aws-samvpcPlacement has been renamed to vpcSubnets
on all objects, subnetsToUse has been renamed to subnetType.
natGatewayPlacement has been renamed to natGatewaySubnets.aws-cdk: fix VpcNetwork.importFromContext() (#2008) (e1a1a7b), closes #1998
_toCloudFormation) (#2047) (515868b), closes #2044 #2016Database and Table (#1988) (3117cd3)ContainerImage.fromDockerHub has been renamed to ContainerImage.fromRegistry.aws-cloudtrail: correct created log policy when sendToCloudWatchLogs is true
Your coding agent can read these notes before it upgrades. Set up the MCP server →