Update aws-cdk to v2.72.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aws-cdk	2.62.0 -> 2.72.0
aws-cdk-lib	2.62.0 -> 2.72.0

---

Release Notes

aws/aws-cdk

v2.72.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• cdk-lib: The return type of aws-cdk-lib.aws_ec2.SecurityGroup.determineRuleScope was changed from a tuple ([SecurityGroupBase, string]) to a struct with the same values, because tuple types are not supported over the jsii interoperability layer, but jsii@v1 was incorrectly allowing this to be represented as the JSON primitive type. This made the API unusable in non-JS languages. The type of the metadata property of aws-cdk-lib.aws_s3_deployment.BucketDeploymentProps was changed from an index-only struct to an inline map, because jsii@v1 silently ignored the index signature (which is otherwise un-supported), resulting in an empty object in non-JS/TS languages. As a consequence, the values of that map can no longer be undefined (as jsii does not currently support nullable elements in collections).

Features

• apprunner-alpha: support autoDeploymentsEnabled flag for Service (#​24612) (cf5a9c4), closes #​24529
• cfnspec: cloudformation spec v117.0.0 (#​24779) (1b94ea6)
• cfnspec: cloudformation spec v117.0.0 (#​24841) (84630e9)
• cloudfront-origins: allow custom originPath for apigateway.RestApi constructs (#​24023) (bc3db02)
• core: template validation after synthesis (#​23951) (20aeb0f)
• dynamodb: adds deletion protection for tables (#​24581) (6e400a9), closes #​24540
• ecs: support pseudo terminal allocation in container definition (#​24790) (3c0756a)
• efs: implement IResourceWithPolicy (#​24453) (5771d79), closes #​15805
• kms: Adds support for hmac and sm2 key spec (#​23866) (f2f3c21), closes #​23727
• s3: add allowedActionPatterns parameter to grantWrite (#​24211) (5b5c36f), closes #​24074
• s3-deployment: added Source.dataYaml helper function (#​24579) (d969ddf), closes #​24554
• added AllViewerExceptHostHeader as new OriginRequest policy (#​24562) (8dbca12), closes #​24552

Bug Fixes

• bootstrap: ECR repository produces Security Hub finding [ECR.3] because of missing lifecycle policy (#​24735) (cdfa970)
• cli: cdk deploy output hook failure reason if cloudformation failed by hook (#​24444) (9d4b66a)
• cli: pathMetadata and assetMetadata defaults cannot be configured in cdk.json (#​24533) (45bc57a), closes #​3573
• dynamodb: add missing iam permissions to custom resource for deleting dynamodb replica table (#​24682) (f35b70b), closes #​22069
• ec2: tokenised subnet.subnetId filtered by the SubnetIdSubnetFilter returns an empty array (#​24625) (d0912ca), closes #​24427
• ec2: VPC Flow Log record fields are not available (#​24812) (65fb7a6), closes #​24807
• ecs: cpu in container definition may be less than total cpu allocated to the container (#​24647) (dc064be), closes #​24629
• lambda-nodejs: pnpm no longer supports nodejs14.x (#​24821) (b1c9ab2)
• logs-destinations: missing dependency to Permission Policy created by LambdaDestination (#​24823) (72b3a95), closes #​21941 /github.com/aws/aws-cdk/pull/22100#issue-1377109110
• logs-destinations: missing dependency to Policy created by KinesisDestination (#​24811) (3c98d1e), closes #​21827 /github.com/aws/aws-cdk/issues/21827#issuecomment-1382128416
• s3-deployment: physical id not set during failure scenario (#​24428) (be4be99), closes #​22670
• stepfunctions-tasks: updated EMR service role to use AmazonEMRServicePolicy_v2 (under feature flag) (#​23985) (f3fd183), closes #​23915

Miscellaneous Chores

• cdk-lib: migrate to [email protected] / [email protected] (#​24425) (6d581d7)

---

Alpha modules (2.72.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• servicecatalogappregistry: This commit involves share replacement during the deployment of ApplicationAssociator due to share construct id update. After this change, frequent share replacements due to structural change in Application construct should be avoided. Application.shareApplication starts to require construct id (first argument) and share name (added in ShareOption) as input.
• ivs: Renamed ChannelProps.name to ChannelProps.channelName
• Renamed PlaybackKeyPairProps.name to PlaybackKeyPairProps.playbackKeyPairName
• Channel now generates a physical name if one is not provided
• PlaybackKeyPair now generates a physical name if one is not provided

Bug Fixes

• integ-runner: update workflow doesn't support resource replacement (#​24720) (07d3aa7)
• ivs: Not a standard physical name pattern (#​24706) (7d17fe3)
• servicecatalogappregistry: RAM Share is replaced on every change to Application (#​24760) (8977d0d)

v2.71.0

Compare Source

Features

• core: template validation after synthesis (#​23951) (91d6509)

Bug Fixes

• lambda-nodejs: pnpm no longer supports nodejs14.x (#​24821) (a8e9370)

---

Alpha modules (2.71.0-alpha.0)

v2.70.0

Compare Source

Features

• cfnspec: cloudformation spec v116.0.0 (#​24662) (e8158af)
• cloudwatch: added defaultInterval prop to cw-dashboard (#​24707) (d4717cf)
• ec2: CFN-init support for systemd (#​24683) (f3fe8e1)
• ec2: SSM sessions (#​24673) (9744a82)
• ecr: add option to auto delete images upon ECR repository removal (#​24572) (7de5b00), closes #​15932 #​12618 #​15932
• elasticloadbalancing: classic load balancer supports ec2 instances (#​24353) (25b6edd), closes #​23500
• servicecatalogappregistry-alpha: Introduce flag to control application sharing and association behavior for cross-account stacks (#​24408) (2167289), closes aws-cdk/aws-servicecatalogappregistry/lib/aspects/stack-associator.ts#L91-L95

Bug Fixes

• bootstrap: remove Security Hub finding KMS.2 (#​24588) (274c3d5), closes /docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-2
• cli: no change deployment prints "hotswap deployment skipped" without hotswap flag (#​24602) (79151fd)
• cli: user agent is reported as undefined/undefined (#​24663) (3e8d8d8)
• eks: fail to update cluster by disabling logging props (#​24688) (767cf93)
• sfn: stop replacing JsonPath.DISCARD with null (#​24717) (413b643), closes #​24593
• toolkit: RWLock.acquireRead is not re-entrant (#​24702) (3b7431b)
• WAFv2: add patch to revert struct names (#​24651) (dfa09d1), closes /github.com/aws/aws-cdk/commit/affe040c8443be074822254d1e75a28b264cd801#diff-827a2fd012e049c7ccedffa0360c12e7d967a173f36b8150de73ef6adc42ee4cL175-L357

---

Alpha modules (2.70.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• servicecatalogappregistry: This commit contains destructive changes to the RAM Share.
  Since the application RAM share name is calculated by the application construct, where one method is added. Integration test detects a breaking change where RAM share will be created. Integration test snapshot is updated to cater this destructive change.

Features

• servicecatalogappregistry: add attribute groups to an application (#​24672) (7baffa2)

v2.69.0

Compare Source

Features

• custom-resources: AwsCustomResource copy physicalResourceId from request when omit it in onUpdate (#​24194) (21ad7a7), closes #​23843
• docdb: added ability to enable performance insights (#​24039) (c897f44), closes #​24036
• ecr-assets: Support cache-from and cache-to flags (#​24024) (4e02566)
• eks: support for Kubernetes version 1.25 (#​24484) (70fd3e9), closes #​24282
• rds: add support for minor versions of PostgreSQL: 14.7, 13.10, 12.14, and 11.19 (#​24539) (15cb919)
• rds: PostgreSQL engine version 15.2 (#​24463) (59d795b), closes #​24462

Bug Fixes

• custom-resource: custom resources fail with data containing multi-byte utf8 chars (#​24501) (9bd5078), closes #​24491
• ecr-assets: prefix cache arguments correctly (#​24524) (d451b30)
• pipelines: Ubuntu 5 images will be slow, move to Ubuntu 6 (#​24544) (1f62c43)
• sfn: can't override toStateJson() from other languages (#​24593) (e955d18), closes #​14639

---

Alpha modules (2.69.0-alpha.0)

Features

• kinesisanalytics-flink: VPC support for Flink applications (#​24442) (7c7ad6d), closes 40aws-cdk/aws-lambda/lib/function.ts#L170 #​21104

v2.68.0

Compare Source

Bug Fixes

• apprunner-alpha: env vars and secrets can't solely be added via .add*() methods (#​24346) (45195b6), closes #​24345
• cli: cannot cdk import resources with multiple identifiers (#​24439) (a70ff1a), closes #​20895
• core: Fix dotnet version check to allow .NET 7.0 (#​24467) (a4856e9), closes #​24466
• lambda-nodejs: esbuild preCompilation tsconfig precedence is wrong (#​23871) (790a709)
• lambda-nodejs: Required auto prefix of handler with index. breaks custom non-index handler settings used by layers (#​24406) (d7a1c34), closes #​24403
• rds: add clusterResourceIdentifier property to database cluster (#​23605) (6bda4e5)

---

Alpha modules (2.68.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• servicecatalogappregistry: This commit contains destructive changes to the RAM Share.
  Since the application RAM share name is calculated by the application construct, where one property is removed. Integration test detects a breaking change where RAM share will be created. Integration test snapshot is updated to cater this destructive change.

Features

• msk: add Kafka version 3.3.2 (#​24440) (1b2014e), closes #​24432
• redshift: column compression encodings and comments can now be customised (#​24177) (1ca3e00), closes #​24165 #​23597 #​22506
• redshift: columns require an id attribute (under feature flag) (#​24272) (9a07ab0), closes #​24234

Bug Fixes

• servicecatalogappregistry: allow disabling automatic CfnOutput (#​24483) (3db1a0d), closes #​23779
• servicecatalogappregistry: Associate an application with attribute group (#​24378) (d1264c1)

v2.67.0

Compare Source

Features

• apigateway: minCompressionSize on SpecRestApi (#​24067) (2a81f0f), closes #​22926
• bootstrap: prevent accidental bootstrap overwrites (#​24302) (3b251a5)
• cli: update csharp & fsharp template to net6.0 (#​23926) (3bd611d), closes #​23921
• codebuild: adds file asset support to build-spec (#​24289) (7cda567), closes #​1138
• ecs: enable default capacity provider strategy (#​23955) (5a30ea6)
• eks: add helm flag --skip-crds (#​24213) (f68dbc2), closes #​24296
• sns: Add FilterPolicyScope support (#​23108) (d986e14)
• stepfunctions-tasks: add revision number (#​24226) (643042b), closes #​23491

Bug Fixes

• cdk-assets: Error when building Docker Image Assets with Podman (#​24003) (4b08e20), closes /github.com/aws/aws-cdk/issues/16209#issue-978267269 #​16209
• cloudwatch: math expressions incorrectly warn about search and metrics (#​24313) (f3596eb), closes #​20136
• ec2: userData in launchTemplate is created automatically when machineImege is provided (#​23593) (bb4311b), closes #​23592 /github.com/aws/aws-cdk/pull/12385#discussion_r564614928
• ecr-assets: fix repeated deploys of stacks with tar assets (#​23497) (c2296a8), closes #​18823 #​18822
• efs: support tagging for access point (#​24336) (f9af47f), closes #​20743
• eks: changing the subnets or securityGroupIds order causes an error (#​24163) (09c2c19), closes #​24162
• eks: fix helm deploy login for public ECR repositories (#​24104) (71ec6b6), closes #​23977
• eks: integ tests errors (#​24276) (07f2d7b)
• secretsmanager: secret resource policy already exists in stack (under feature flag) (#​24365) (7dd8b7e), closes #​24383
• servicecatalog: wrong asset path is generated in case outdir is absolute (#​24393) (0ebbf58), closes #​24392
• sns: sns subscription filter policy condition limit should be 150 (#​24269) (1e1131c)
• Correct SamlConsolePrincipal for non-China (#​24277) (e47646c), closes #​24243

---

Alpha modules (2.67.0-alpha.0)

Features

• msk: add Kafka versions 3.1.1, 3.2.0, and and 3.3.1 (#​23918) (53a1d5f), closes #​23899

Bug Fixes

• servicecatalogappregistry: applicationName can not be changed after deployment (#​24409) (6aa763f)

v2.66.1

Compare Source

Bug Fixes

• Correct SamlConsolePrincipal for non-China (#​24277) (d562871), closes #​24243

---

Alpha modules (2.66.1-alpha.0)

v2.66.0

Compare Source

Features

• cloudwatch: parse all metrics statistics and support long format (#​23095) (853e3d6), closes #​23074 40aws-cdk/aws-cloudwatch/lib/metric.ts#L295-L296
• core: Size.bytes() (#​24136) (9b2a45a), closes #​24106
• efs: support file system policy (#​24196) (5e0f44b), closes #​24042
• logs: Add support for multiple parse and filter statements in QueryString (#​24022) (75eb933)
• stepfunctions: removal policy for state machines (#​24105) (5f33a26)

Bug Fixes

• apigateway: rest api deployment does not depend on authorizers (#​23215) (12e13c1)
• cognito: changing installLatestAwsSdk breaks Client Secret reference (#​23798) (844d407), closes #​23796
• ecs: validate ecs healthcheck (#​24197) (89802a9)
• eks: nested OCI repository names for private ECR helmchart deployments are not properly handled (#​23378) (72f2a95)
• lambda: RuntimeManagementMode.FUNCTION_UPDATE has wrong value (#​24252) (fdb0cf1)

---

Alpha modules (2.66.0-alpha.0)

Features

• apigatewayv2: allow websockets routes to return response to client (#​22984) (f8fe1d2)
• lambda-python: add optional poetry bundling exclusion list parameter (#​23670) (53beeae), closes #​22585 #​22585
• redshift: optionally reboot Clusters to apply parameter changes (#​22063) (f61d950), closes #​22009 #​22055 #​22059

Bug Fixes

• servicecatalogappregistry: Allow user to control stack id via stack name for Application stack (#​24171) (0c7c7e4), closes #​24160

v2.65.0

Compare Source

Features

• autoscaling: L2 construct for enabling capacity rebalance of autoscaling (#​24025) (d2c63f5), closes #​22625
• chatbot: support guardrail policies (#​24114) (4c72a7d), closes #​20788
• core: Allow passing Docker build secrets (#​23778) (74512fa), closes #​14910 #​14395
• elbv2: add metrics to INetworkTargetGroup and IApplicationTargetGroup (#​23993) (6a9e43f), closes #​23853 #​10850
• lambda: add insights version 1.0.178.0 (#​23836) (5272908)

Bug Fixes

• bootstrap: remove Security Hub finding S3.10 (#​24175) (a1da757), closes /docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-s3-10
• codedeploy: unable to remove alarms from deployment group (#​23308) (eee005f)
• codepipeline: x-env ECS deployment lacking support stack-dependency (#​24053) (adfe4fa), closes #​24050 #​24051
• core: messages are displayed multiple times per construct (#​24019) (57770bb), closes #​9565
• ec2: enable set throughput param to CfnVolume (#​24118) (32781f8), closes #​24107 #​24107
• elbv2: healthcheck interval is overly restrictive (#​24157) (4f83e02), closes #​24156
• iam: PrincipalWithConditions.addCondition fails with a new key (#​23782) (8951d01), closes #​23781
• iam: SamlConsolePrincipal does not work in China #​22091 (#​24034) (2902043)
• pipelines: SelfMutation CodeBuild project not accessible (#​24073) (5942978)
• rds: database proxies use ids as their resource names directly (under feature flag) (#​23703) (03a0f79), closes #​18578
• s3: logging bucket blocks KMS_MANAGED encryption (#​23514) (1e8926f)

---

Alpha modules (2.65.0-alpha.0)

Features

• glue: support Ray jobs (#​23822) (8de50d6)
• redshift: IAM roles can be attached to a cluster, post creation (#​23791) (1a46808), closes #​22632
• synthetics: support runtime 3.9 (#​24101) (9d23cad)

v2.64.0

Compare Source

Features

• cfnspec: cloudformation spec v109.0.0 (#​23968) (5d59134)
• cfnspec: cloudformation spec v109.0.0 (#​23984) (affe040)
• cli: --hotswap will not use CFN anymore, --hotswap-fallback to fall back if necessary (#​23653) (a5317ca), closes #​22784 #​21773 #​21556 #​23640
• elbv2: add metrics to INetworkLoadBalancer and IApplicationLoadBalancer (#​23853) (cb889bc), closes #​10850
• iam: implement IGrantable to Policy and ManagedPolicy (#​22712) (d3df40f), closes #​10308
• lambda: enable RuntimeManagementConfig (#​23891) (be4f971), closes #​23890
• s3: allow configuring S3 Object Lock (#​23744) (bdcd6c8), closes #​5247 #​21738

Bug Fixes

• Use the correct LB full name when creating metrics for imported LBs (#​23972) (16c23b7), closes #​23853
• cdk-assets: asset concurrency leaves a corrupted archive (#​24026) (989454f)
• cdk-assets: packaging assets is broken on Node older than 14.17 (#​23994) (5bde92c), closes #​23859
• codedeploy: cross-region referenced groups use wrong config (#​23986) (390ec78)
• core: cross-stack reference error doesn't include violation (#​23987) (c7ad66f)
• ec2: Cannot deploy VPC flow log with other resources that requires bucket policies (#​23889) (e646ad5), closes #​18985
• pipelines: cannot configure actionName for all sources (#​24027) (9cd639b)
• s3: infer bucketWebsiteUrl and bucketDomainName suffixes from bucket region (#​23919) (252f052)
• s3-deployment: wrong URL in BucketDeployment.deployedBucket.bucketWebsiteUrl (#​24055) (ece46db), closes #​23354

---

Alpha modules (2.64.0-alpha.0)

Features

• cloud9: support setting environment owner (#​23878) (08a2f36), closes #​22474
• redshift: Tables can include comments (#​23847) (46cadd4), closes #​22682

Bug Fixes

• servicecatalogappregistry: default stack name is not meaningful and causes conflict when multiple stacks deployed to the same account-region (#​23823) (420b5ff)

v2.63.2

Compare Source

---

Alpha modules (2.63.2-alpha.0)

v2.63.1

Compare Source

Reverts

• cdk-assets: packaging assets is broken on Node older than 14.17 (#​23994) (1976f1a), closes #​23859

---

Alpha modules (2.63.1-alpha.0)

v2.63.0

Compare Source

Features

• cfnspec: cloudformation spec v109.0.0 (#​23868) (8ee97b0)
• cfnspec: cloudformation spec v109.0.0 (#​23929) (39f8a30)
• core: add creation policy configuration for appstream (#​23607) (8909a04), closes #​23604
• core: allow asset bundling on docker remote host / docker in docker (#​23576) (afce30a), closes #​8799
• stepfunctions: task and heartbeat timeout specified by a path (#​23755) (26e48c7), closes #​15531

Bug Fixes

• appsync: sanitized datasource name isn't exported (#​23802) (0b25265)
• imports from ESM modules cannot find correct type definitions (#​23870) (356a128)
• eks: reuse chart name as chart dir for helmchart deployment from OCI repository (#​23392) (070f5ec)
• aws-cdk-lib imports from ESM modules are broken (#​23846) (cf2e498), closes #​23813

---

Alpha modules (2.63.0-alpha.0)

Features

• synthetics: Adding DeleteLambdaResourcesOnCanaryDeletion prop to the canary L2 (#​23820) (45c191e)
• redshift: support default role for redshift clusters (#​22551)

v2.62.2

Compare Source

Bug Fixes

• imports from ESM modules cannot find correct type definitions (#​23870) (1b9f3f7)

---

Alpha modules (2.62.2-alpha.0)

v2.62.1

Compare Source

Bug Fixes

• aws-cdk-lib imports from ESM modules are broken (#​23846) (46b93a9), closes #​23813

---

Alpha modules (2.62.1-alpha.0)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.