NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
NuGet · #2199 most downloaded on NuGet
AWS region information, such as service principal names (Stability: Stable)
Last release 5 days ago
17 Sep 2026
Ships on a steady schedule
a new release about every 2 weeks
Rarely documented
notes for 13 of the last 60 stable releases
13 versions withdrawn
withdrawn after publishing
127 years old
622 releases · first in 1900
neptune: InstanceType changed from enum to enum-like static factory.
InstanceType changed from enum to enum-like static factory.One column per quarter.
appmesh: HTTP2 VirtualNodeListeners must be now created with Http2VirtualNodeListenerOptions
VirtualNodeListeners must be now created with Http2VirtualNodeListenerOptionsVirtualGatewayListeners must be now created with Http2VirtualGatewayListenerOptionsServiceCatalogDeployAction has been renamed to ServiceCatalogDeployActionBeta1ServiceCatalogDeployActionProps has been renamed to ServiceCatalogDeployActionBeta1PropsBatchJob integration now requires the arn and the Resource for the jobQueue and the jobDefinitioncluster was removed from ManagedKafkaEventSourceProps and replaced with clusterArnApiGatewayv2Domain was replaced with ApiGatewayv2DomainProperties which accepts regionalDomainName and regionalHostedZoneIdCallApiGatewayHttpApiEndpoint API now requires the apiId and it's containing StackBatchSubmitJob now accept jobDefinitionArn, jobQueueArn and their respective ResourceRunBatchJob now accept jobDefinitionArn, jobQueueArn and their respective ResourcetoJsonString() does not deal correctly with list tokens (#14138) (1a6d39f), closes #14088--output (#14211) (0f5c74f), closes #13303elasticloadbalancing: rename 'sslCertificateId' property of LB listener to 'sslCertificateArn'; deprecate sslCertificateId property (#13766) (1a30272)…
codepipeline-actions: introduce the CodeStarConnectionsSourceAction (#13781) (8782e67), closes #10632
elasticsearch: vpcOptions was removed. Use vpc, vpcSubnets and securityGroups instead.
vpcOptions was removed. Use vpc, vpcSubnets and securityGroups instead.secretsEncryptionKey in FargateCluster (#13866) (56c6f98)globalaccelerator: automatic naming algorithm has been changed: if you have existing Accelerators you will need to pass an explicit name to prevent th
addEndpoint() with a
target-specific class that can be found in @aws-cdk/aws-globalaccelerator-endpoints. The generated Security Group
is now looked up by calling endpointGroup.connectionsPeer().DatabaseClusterProps.instanceProps was hoisted and all its properties are now available one level up directly in DatabaseClusterProps.DatabaseInstanceProps.instanceClass renamed to DatabaseInstanceProps.instanceType.image property in BundlingOptions
is changed from BundlingDockerImage to DockerImage.DockerImage.fromBuild() API is
changed from BundlingDockerImage to DockerImage.tag-option in fargate platform version 1.4 (#13882) (e9d9299), closes #13881Upgrade a downstream dependency(pac-resolver) of the aws-cdk (the CDK CLI), to mitigate CVE-2021-28918 (13914)
codebuild: module fails to load with error "Cannot use import statement outside a module" (b1ffd33), closes #13699 #13699
lambda-nodejs: prepare code to reduce merge conflicts when deprecated APIs are stripped
image property in the
Bundling class is changed from BundlingDockerImage to
DockerImage.dockerImage property in
BundlingOptions is changed from BundlingDockerImage to
DockerImage.allowMethods property under corsPreflight
section is changed from HttpMethod to CorsHttpMethod.NodejsFunction is now Node.js 14.x if the environment from which it is deployed uses Node.js >= 14 and Node.js 12.x otherwise.apigatewayv2: error while configuring ANY as an allowed method in CORS (#13313) (34bb338), closes #13280 #13643
aws-ecs: drain hook lambda allows tasks to stop gracefully (#13559) (3e1148e), closes #13506
codebuild: Fixed build spec file format to return yaml (#13445) (fab93c6)
codedeploy: Use aws-cli instead of awscli for yum (#13655) (449ce12)
codepipeline-actions: BitBucketAction fails with S3 "Access denied" error (#13637) (77ce45d), closes #13557
core: toJsonString() cannot handle list intrinsics (#13544) (a5be042), closes #13465
events,applicationautoscaling: specifying a schedule rate in seconds results in an error (#13689) (5d62331), closes #13566
lambda: incorrect values for prop UntrustedArtifactOnDeployment (#13667) (0757686), closes #13586
neptune: create correct IAM statement in grantConnect() (#13641) (2e7f046), closes #13640
s3: Notifications fail to deploy due to incompatible node runtime (#13624) (aa32cf6)
lambda-nodejs: prepare code to reduce merge conflicts when deprecated APIs are stripped (#13738) (ca391b5)
s3: Notifications fail to deploy due to incompatible node runtime
appmesh: Backend, backend default and Virtual Service client policies structures are being altered
VirtualGateway.
The property name also changed from backendsDefaultClientPolicy to backendDefaultsVirtualNode,
(the property name also changed from backendsDefaultClientPolicy to backendDefaults),
and the Backend class to define a backendVirtualServiceamplify-domain: Added config for auto subdomain creation
EventBus.grantPutEventsTo method for granular grants (#13429) (122a232), closes #11228ecs-patterns: the desiredCount property stored on the above constructs will be optional, allowing them to be undefined. This is enabled through the @a
desiredCount property stored on the above constructs will be optional, allowing them to be undefined. This is enabled through the @aws-cdk/aws-ecs-patterns:removeDefaultDesiredCount feature flag. We would recommend all CDK users to set the @aws-cdk/aws-ecs-patterns:removeDefaultDesiredCount flag to true for all of their existing applications.HttpApiMapping (and related interfaces for Attributed and Props) has been renamed to ApiMappingCommonStageOptions has been renamed to StageOptionsHttpStage.fromStageName has been removed in favour of HttpStage.fromHttpStageAttributesDefaultDomainMappingOptions has been removed in favour of DomainMappingOptionsHttpApiProps.defaultDomainMapping has been changed from DefaultDomainMappingOptions to DomainMappingOptionsHttpApi.defaultStage has been changed from HttpStage to IStageIHttpApi.defaultStage has been removeddescription parameter in the CustomResourceProvider (#13275) (78831cf), closes #13277 #13276label not rendered into Alarms (#13070) (cbcc712)KubectlProvider creates un-necessary security group (#13178) (c5e8b6d)SageMakeUpdateEndpoint adds insufficient permissions (#13170) (6126e49), closes #11594aws-appsync: RdsDataSource now takes a ServerlessCluster instead of a DatabaseCluster
KubectlProvider creates un-necessary security group (#13178) (c5e8b6d)apigatewayv2: http api - jwt and cognito user pool authorizers (#10972) (dd90e54), closes #10534
exportValue() does not work with resource names (#13052) (46043e0), closes #13002 #12918cfnspec: cloudformation spec v26.0.0
ip is a Token (#12923) (953957a), closes #11633appmesh: the properties virtualRouter and virtualNode of VirtualServiceProps have been replaced with the union-like class VirtualServiceProvider
addVirtualService has been removed from IMeshstack.exportValue() can be used to solve "deadly embrace" (#12778) (3b66088), closes #7602 #2036apigateway: stack update fails to replace api key (38cbe62), closes #12698
s3-deployment: User metadata keys of bucket objects will change from x-amz-meta-x-amz-meta-x-amzn-meta-mykey to x-amz-meta-mykey.
x-amz-meta-x-amz-meta-x-amzn-meta-mykey to x-amz-meta-mykey.DefaultSynthesizer,
used by CDK Pipelines) must upgrade their bootstrap stacks. Run cdk bootstrap.enableBatchBuilds() to Project (#12531) (0568390)x-amz prefix (#12414) (6716181), closes #8459cfnspec: cloudformation spec v24.0.0 (#12615) (98ebe96), closes #12474
This is in prepartion of Lambda deprecation of the request module in boto, more details are available in AWS blog. Note, users of versions < 1.81.0 wi…
1.81.0 will not be impacted by this deprecation, but are still encouraged to upgrade to the latest version.grantWrite() and grantReadWrite() methods no longer add the s3:PutObject* permissions that included s3:PutObjectAcl,
which could be used to grant read/write object access to IAM principals in other accounts.
This change is gated behind the @aws-cdk/aws-s3:grantWriteWithoutAcl feature flag,
so make sure to set it to true in the context key of your cdk.json file when upgrading.
If you still need the principal to have s3:PutObjectAcl permissions after upgrading,
use the new grantPutAcl() method.apigatewayv2: subnets prop in VpcLink resource now takes SubnetSelection instead of ISubnet[]
subnets prop in VpcLink resource now takes SubnetSelection instead of ISubnet[]define bundling option (#12424) (581f6af), closes #12423--quiet does not print template in cdk synth (#12178) (74458a0), closes #11970aws-cloudfront: support minimum security protocol (#12231) (40976d9), closes #12199
eks: Existing self managed nodes may loose the ability to host additional services of type LoadBalancer . See https://github.com/aws/aws-cdk/pull/1226
LoadBalancer . See https://github.com/aws/aws-cdk/pull/12269#issuecomment-752161190 for possible mitigations.eks: the @aws-cdk/eks.KubectlLayer layer class has been moved to @aws-cdk/lambda-layer-kubectl.KubectlLayer.
@aws-cdk/eks.KubectlLayer layer class has been moved to @aws-cdk/lambda-layer-kubectl.KubectlLayer.webhookTriggersBatchBuild option to third-party Git sources (#11743) (d9353b7), closes #11663EnableVersionUpgrade update policy (#12239) (14f8b06), closes #12210executeBatchBuild: true (#12181) (5279f37)eks: Remove legacy and deprecated code
LegacyCluster was removed since it existed only for a transition period to allow gradual migration to the current cluster class.kubectlEnabled property was removed, all clusters now support kubectl.Lazy values are no longer
captured by default in order to speed up tests. Run with
CDK_DEBUG=true (or cdk --debug) to capture stack traces.apigatewayv2: HttpApi.fromApiId() has been replaced with HttpApi.fromHttpApiAttributes().
HttpApi.fromApiId() has been replaced with
HttpApi.fromHttpApiAttributes().ec2: 'encoded list token' error using Vpc imported from deploy-time lists (#12040) (0690da9)
ec2: fromInterfaceVpcEndpointAttributes: Security Groups should not be required (#11857) (86ae5d6), closes #11050
eks: failure to deploy cluster since aws-auth configmap exists (#12068) (dc8a98a), closes #12053
eks: k8s resources accidentally deleted due to logical ID change (#12053) (019852e), closes #10397 #10397
elasticsearch: Defining 2 domains with logging enabled in the same stack fails on construct id conflict (#12055) (ec3ce19), closes #12017
elasticsearch: log policies are overwritten when creating 2 domains which also results in a failure while destroying the stack (#12056) (889d089), closes #12016
stepfunctions-tasks: policies created for EMR tasks have ARNs that are not partition-aware (#11553) (1cf6713), closes #11503
apigatewayv2: apiEndpoint is elevated to the IHttpApi interface (#11988) (bc5b9b6)
cloudfront-origins: Default minimum origin SSL protocol for HttpOrigin and LoadBalancerOrigin changed from SSLv3 to TLSv1.2.
HttpOrigin and LoadBalancerOrigin changed from SSLv3 to TLSv1.2.domainName property under DomainName has been
renamed to name.dnsHostName and awsCloudMap of VirtualNodeProps have been replaced with the property serviceDiscoverymetricFailed uses Average instead of Sum by default (#11941) (3530e8c)apigatewayv2: The VpcLink.fromVpcLinkId() API has been replaced with VpcLink.fromVpcLinkAttributes().
VpcLink.fromVpcLinkId() API has been
replaced with VpcLink.fromVpcLinkAttributes().@aws-cdk/secretsmanager:parseOwnedSecretName flag.minify or sourceMap are now gathered under a new bundling prop.bundlingEnvironment is now bundling.environmentbundlingDockerImage is now bundling.dockerImageexecuteBatchBuild on CodeBuildAction (#11741) (3dcd1a8), closes #11662any but only works if a map is passed (#11768) (f85c08c), closes #11483### Features * lambda: container images
appmesh: renames gateway listener static methods to use shorter names
keyId property uses the ARN instead of the keyId to support cross-account encryption key usage. The filesystem will be replaced.esbuild to be installed.projectRoot has been replaced by depsLockFilePath. It should point to your dependency lock file (package-lock.json or yarn.lock)parcelEnvironment has been renamed to bundlingEnvironmentsourceMaps has been renamed to sourceMapIVirtualNode no longer has the addBackends() method. A backend can be added to VirtualNode using the addBackend() method which accepts a single IVirtualServiceIVirtualNode no longer has the addListeners() method. A listener can be added to VirtualNode using the addListener() method which accepts a single VirtualNodeListenerVirtualNode no longer has a default listener. It is valid to have a VirtualNode without any listenerslistener of VirtualNode has been renamed to listeners, and its type changed to an array of listenersVirtualNodeListener has been removed. To create Virtual Node listeners, use the static factory methods of the VirtualNodeListener class--no-lookups flag to disable context lookups (#11489) (0445a6e), closes #11461fromAccessPointAttributes() (#10712) (ec72c85)targetRequestsPerSecond is actually requests per minute (#11457) (39e277f), closes #11446extraRunOrderSpace (#11511) (9b72fc8)appmesh: IVirtualNode no longer has the addBackends() method. A backend can be added to VirtualNode using the addBackend() method which accepts a sing
IVirtualNode no longer has the addBackends() method. A backend can be added to VirtualNode using the addBackend() method which accepts a single IVirtualServiceIVirtualNode no longer has the addListeners() method. A listener can be added to VirtualNode using the addListener() method which accepts a single VirtualNodeListenerVirtualNode no longer has a default listener. It is valid to have a VirtualNode without any listenerslistener of VirtualNode has been renamed to listeners, and its type changed to an array of listenersVirtualNodeListener has been removed. To create Virtual Node listeners, use the static factory methods of the VirtualNodeListener classfromAccessPointAttributes() (#10712) (ec72c85)targetRequestsPerSecond is actually requests per minute (#11457) (39e277f), closes #11446apigatewayv2: LambdaProxyIntegration and HttpProxyIntegration classes have moved to the @aws-cdk/aws-apigatewayv2-integrations module.
LambdaProxyIntegration and HttpProxyIntegration
classes have moved to the @aws-cdk/aws-apigatewayv2-integrations module.VirtualNodeListener class to obtain instances of themfromResourceName() methods in the AppMesh module have been replaced with fromResourceAttributes()apigateway: api key not supported for SpecRestApi (#11235) (52da8cb), closes #11079
appsync: HttpDataSource extends BackedDataSource instead of BaseDataSource (#11185) (4b4d011), closes #11183
cfn-include: Fn::FindInMap cannot be used for boolean properties (#11323) (47b698e), closes #11300
cli: deployments are skipped if stack is in a _failed state (#10847) (4887ba6), closes #10784
cli: Python id parameter in init template conflicts with built-in (#10874) (37a149b)
cloudwatch: composite alarm ARN uses wrong separator (#11186) (3009490)
elasticsearch: use correct latency metric names (#11175) (7ab5ab8), closes #11174
rds: customizing secret results in unusable password and lost attachment (#11237) (a4567f5), closes #11040
apigatewayv2: move lambda and http proxy integrations to the 'integrations' module (#11339) (17611d6)
intro "Names.uniqueId()" instead of the deprecated "node.uniqueId" (#11166) (5e433b1), closes aws/constructs#314
enableHttpEndpoint renamed to enableDataApioutputLocation in the experimental Athena StartQueryExecution has been changed to s3.Location from stringEnvironment from attributes (#10932) (d395b5e), closes #10931--no-previous-parameters incorrectly skips updates (#11288) (1bfc649)synthetics: runtime is now a required property.
runtime is now a required property.Lazy values are no longer
captured by default. The CDK_DEBUG=true environment variable must be
set in order to capture stack traces (this is also achieved by using the
--debug option of the cdk CLI). Users should not need those stack
traces most of the time, and should only enable creation stack trace
captures when tyring to troubleshoot a resolution error that they are
otherwise unable to trace back.--all flag to select all stacks (#10745) (bcd9d0a), closes #3222.venv to comply with python recommendation (#10995) (a4a41b5), closes #9134credentials.fromSecret does not access secretsmanager.ISecret (#11033) (35ad608), closes #11015CfnInit cannot be used with custom constructs (#11167) (01c52c8)cognito: the UserPoolIdentityProviderBase abstract class has been removed. Use the UserPoolIdentityProvider* classes directly.
UserPoolIdentityProviderBase abstract class has been removed. Use the UserPoolIdentityProvider* classes directly.apigatewayv2: configure description for HttpApi
cdk context --reset <number> does not work (#10753) (2f3a167), closes #3033 #10619config: scopeToResource(), scopeToResources() and scopeToTag() APIs have been removed. Use the ruleScope property to restrict the scope of a Config ru
scopeToResource(), scopeToResources() and scopeToTag() APIs have been removed. Use the ruleScope property to restrict the scope of a Config rule. fromResource(), fromResources() and fromTag() can be used from the RuleScope class.Distribution behaviors now enable compression by defaultforwardQueryString and forwardQueryStringCacheKeys have been removed in favor of cachePolicy and the new CachePolicy construct.BundlingDockerImage now supports run() and cp() utilities (#9728) (37fdc94), closes #9329readme: deprecate Gitter in favor of cdk.dev Slack
monocdk. Note that monocdk is still experimental.. in the name (#10441) (063798b), closes #10109addExecuteFileCommand arguments cannot be omitted (#10692) (7178374), closes #10687InitCommand.shellCommand() renders an argv command instead (#10691) (de9d2f7), closes #10684cfnspec: cloudformation spec v18.4.0
rds: the unversioned Cluster engine constants are no longer deprecated
aws-appmesh: VirtualNode no longer has accessLog set to "/dev/stdout" by default
cognito: refreshToken property is now removed from
UserPoolClient. It will be included if any other authFlow is enabled.
synthetics: the default runtime is now syn-nodejs-2.0
eks: cluster.addChart renamed to cluster.addHelmChart
eks: NodegroupOptions.launchTemplate renamed to NodegroupOptions.launchTemplateSpec
eks: cluster.addAutoScalingGroup renamed to cluster.connectAutoScalingGroupCapacity
eks: cluster.addNodegroup renamed to cluster.addNoedgroupCapacity
eks: cluster.addCapacity renamed to cluster.addAutoScalingGroupCapacity
eks: CapacityOptions renamed to AutoScalingGroupCapacityOptions. Resolves #10364
rds: the default generated password exclude characters set for Instance, Cluster and DatabaseSecret is now " %+~`#$&*()|[]{}:;<>?!'/@\"\\"
rds: the default generated password exclude characters for addSingleUserRotation() and addMultiUserRotation() in Cluster and Instance is now " %+~`#$&*()|[]{}:;<>?!'/@\"\\"
rds: Instance.addSingleUserRotation() now takes options object as the first argument, instead of just Duration
rds: Cluster.addSingleUserRotation() now takes options object as the first argument, instead of just Duration
rds: SnapshotCredentials.fromGeneratedPassword() now takes an option object as the second argument, instead of just IKey
rds: DatabaseInstanceProps and DatabaseInstanceFromSnapshotProps -
masterUsername, masterUserPassword and masterUserPasswordEncryptionKey moved
to credentials as a new Credentials class.
rds: Login renamed to Credentials. Use Credentials.fromUsername to replace existing usage.
rds: DatabaseClusterProps masterUser renamed to credentials.
JobDefinition from name using fromJobDefinitionName (#10448) (7ce91e8), closes #7172encryptionKey cannot be disabled (#10474) (4aadaa7)eks: KubernetesPatch and FargateCluster creates a circular dependency and breaks deployment (#10536) (f0f8a63), closes #10528
codedeploy: the default policy for LambdaDeploymentGroup no longer contains sns:Publish on * permissions
codedeploy: the default policy for LambdaDeploymentGroup no longer contains sns:Publish on * permissions
cfn-include: the construction property 'nestedStacks' of class 'CfnInclude' has been renamed to 'loadNestedStacks'
rds: removed protected member subnetGroup from DatabaseCluster classes
rds: Cluster now has deletionProtection enabled if its removal policy is RETAIN
rds: Instance now has deletionProtection enabled by default only if its removal policy is RETAIN
eks: Clusters previously running k8s version other than 1.15 and bottlerocket AMI(aws-k8s-1.15 variant) will trigger AMI and node replacement.
--cloudformation-execution-policies not checked (#10337) (ad9a705)--profile is ignored if AWS_ variables are set (#10362) (957a12e)cdk synth fails if AWS_ credentials have expired (#10343) (406f665), closes #7849deepEqual may miss difference other than DependsOn (#10394) (9bcaf75), closes #10322InitFile does not work on Windows (#10450) (84b9d5e), closes #10390kubectlPrivateSubnets (#10459) (10d0a36)DockerVolumeConfiguration.labels changed from an array to a map. This was a long standing latent bug and in fact configuring labels in the old format would have resulted in the wrong behavior. (#10385)rds: deprecate OracleSE and OracleSE1 engine versions (#10241) (562f891), closes #9249
apiKeyConfig require a Expiration class instead of stringapiKeyConfig takes Expiration class instead of stringIStackSynthesizer
must now implement synthesize() instead of
synthesizeStackArtifacts().ComputeResources.computeResourcesTags from Tag to mapexpires prop in apiKeyConfig (#9122) (287f808), closes #8698computeResources tags are not configured properly (#10209) (40222ef), closes #7350eks: when importing EKS clusters using eks.Cluster.fromClusterAttributes, the clusterArn attribute is not supported anymore, and will always be derive
eks.Cluster.fromClusterAttributes, the clusterArn attribute is not supported anymore, and will always be derived from clusterName.eks.Cluster is allowed per CloudFormation stack.securityGroups attribute of ClusterAttributes is now securityGroupIds.--qualifier must be alphanumeric and not longer than 10 characters when bootstrapping using newStyleStackSynthesis.SimpleSynthAction takes array of build commands (#10152) (44fcb4e), closes #9357GraphQLApi.UserPoolConfig requires DefaultAction (#10031) (6114045), closes #10028cdk docs (#9549) (663913f), closes #2847ServiceAccount in a different stack than the Cluster creates circular dependency between the two stacks (#9701) (1e96ebc), closes 40aws-cdk/aws-eks/lib/service-account.ts#L81-L95 40aws-cdk/aws-eks/lib/cluster.ts#L914-L923 40aws-cdk/aws-eks/lib/cluster.ts#L907-L909cli: unable to upgrade new style bootstrap to version (#10030) (8d3e422), closes #10016
core: facility to warn when deprecated APIs are used
cloudfront: Distribution: .domains must be specified if certificate is provided.
.domains must be specified if certificate is provided.name and description props are now optional and in an DataSourceOptions interface.name and description in addXxxDataSource have been moved into new props options of type DataSourceOptionsDataSourceOptions.name defaults to idDataSourceOptions.description defaults to undefinedeks: cluster.addResource was renamed to cluster.addManifest and KubernetesResource was renamed to KubernetesManifest
cluster.addResource was renamed to cluster.addManifest and KubernetesResource was renamed to KubernetesManifestcloudwatch: alarm status widget
autoMinorVersionUpgrade property was not set to true by default as stated in the docstring (#9505) (e878f9c)Vpc.fromLookup (#9544) (dd0f4cb), closes #9542 #5383eks: deprecate "kubectlEnabled: false" (#9454) (2791017), closes #9332
bind() on
IHttpRouteIntegration has changed to accept one of type
HttpRouteIntegrationBindOptions. The previous parameter
IHttpRoute is now a property inside the new parameter under
the key route.eks.Cluster construct no longer supports setting kubectlEnabled: false. A temporary drop-in alternative is eks.LegacyCluster, but we have plans to completely remove support for it in an upcoming release since eks.Cluster has matured and should provide all the needed capabilities. Please comment on https://github.com/aws/aws-cdk/issues/9332 if there are use cases that are not supported by eks.Cluster.lambda.Version and apigateway.Deployment resources with auto-generated IDs will be replaced as we fixed a bug which ignored resource dependencies when generating these logical IDs.node.path of constructs within stacks created the root of the tree via new Stack() will now have a prefix Default/ which represents an implicit App root.Related: https://github.com/aws/aws-cdk-rfcs/issues/192
apigatewayv2: cyclic dependency between HttpApi and the lambda function (#9100) (7b29774), closes #9075
athena: WorkGroup tags corruption (#9085) (b688913), closes #6936
aws-lambda-python: use cp instead of rsync (#9355) (056bcaf), closes #9349
cfn-include: no longer concatenate elements of Fn::Join without tokens (#9476) (d038b61)
core: can't have multiple CfnRules in a Stack (#9500) (76a7bfd), closes #8251 #9485
core: docs for CfnMapping are not clear (#9451) (c1e3c57), closes #9432
dynamodb: allow using PhysicalName.GENERATE_IF_NEEDED as the Table name (#9377) (8ab7b10), closes #9374
ecs: Scope-down IAM permissions for ECS drain (#9502) (9fbeec3)
ecs: Scope-down IAM permissions on Cluster ASG (#9493) (1670289)
ecs-patterns: Adds missing option to secure ingress of ALB in Ap… (#9434) (ba1427f)
lambda: bundling docker image does not exist for Go runtime (#9465) (7666d9b), closes #9435
cloudfront: remove the originId property from OriginBase (#9380) (70b9f63)
do not use "synthesize" and "prepare" in the cdk (#9410) (e3ae645), closes /github.com/aws/aws-cdk/pull/9410#issuecomment-668552361
cloudfront: README updates and notes of breaking changes (#9356) (fbb0418), closes #9326
schemaDefinition no longer takes string, instead it is required to configure schema definition mode.SchemaDefinition.XXX to declare how schema will be configured
certificatemanager: DNS validation for wildcard certificates (#9291) (419278b), closes #9248
pipelines: reduce assets IAM policy size (#9333) (88d563f), closes #9316
appsync: strongly type schema definition mode (#9283) (b46aa99), closes #9301
cloudfront: README updates and notes of breaking changes (#9356) (fbb0418), closes #9326
cloudfront: small refactoring of the Origin API (#9281) (cbfdc15), closes #9109
lambda: the bundlingDockerImage prop of a Runtime now points to the AWS SAM build image (amazon/aws-sam-cli-build-image- ) instead of the LambCI build
bundlingDockerImage prop of a Runtime now points to the AWS SAM build image (amazon/aws-sam-cli-build-image-<runtime>) instead of the LambCI build image (lambci/lambda:build-<runtime>)pipelineConfig is now an array of string instead of CfnResolver.PipelineConfigProperty for usability.pipelineConfig parameter takes in string []autoscaling: enable group metrics collections
ec2: access a vpc's internet gateway (#7939) (cb5dad8), closes #5327
rds: the property 'version' has been changed from string to an engine-specific version class; use VersionClass.of() if you need to create a specific v
DatabaseProxyProps.secret => DatabaseProxyProps.secrets[]defaultMethodOptions, defaultCorsPreflightOptions
and defaultIntegration have been removed from SpecRestApiProps.
These can be specifed directly in the OpenAPI spec or via addMethod()
and addResource() APIs./dataDatabaseClusterEngine has been replaced with the interface IClusterEngine in the type of DatabaseClusterProps.engineDatabaseInstanceEngine has been replaced with the interface IInstanceEngine in the type of DatabaseInstanceSourceProps.engineDatabaseClusterProps.engineVersion has been removed; instead, create an IClusterEngine with a specific version using the static factory methods in DatabaseClusterEngineDatabaseInstanceSourceProps.engineVersion has been removed; instead, create an IInstanceEngine with a specific version using the static factory methods in DatabaseInstanceEnginemajorEngineVersion can no longer be passed when creating an OptionGroup; instead, create an IInstanceEngine with a specific version using the static factory methods in DatabaseInstanceEngineec2:DescribeVpcs permission (#9029) (4a714ee)cloudfront: Add connectionAttempts, connectionTimeout in origin configuration (#8573) (84b923f), closes #8572
eks: version is now a mandatory property
version is now a mandatory propertyapigateway: Lambda integration for imported functions (#8870) (c017f88), closes #8869
Your coding agent can read these notes before it upgrades. Set up the MCP server →