v2.170.0

Features

• lambda: support for Provisioned Pollers (#32205) (68b969e)
• vpcv2: vpc peering connection construct (#31645) (e1195f9), closes RFC#507 1#L252

Bug Fixes

• cli: sts retry options are ignored (#32227) (193ab8c)

Reverts

• "fix(ecr): allow creating repository uri to use tokens like cfn params" (#32241) (b3e39a9), closes #32238

---

Alpha modules (2.170.0-alpha.0)

v2.169.0

Features

• cloudfront: add attachWebAclId method for Distribution (#30567) (cbe2bec)
• update L1 CloudFormation resource definitions (#32223) (5d61a1b)
• sns: add delivery policy to sns subscriptions (#30830) (27babe6), closes #17576

Bug Fixes

• cli: cannot assume a doubly-chained role (#32216) (8746e44)
• cli: proxy is not configured correctly (#32213) (ec58c77)
• s3: key rotation is not enabled while creating KMS encrypted S3 buckets (#32064) (e3024fc), closes #31982

---

Alpha modules (2.169.0-alpha.0)

Features

• location: support Map (#30648) (98b801c), closes #30647
• scheduler: scheduler and scheduler-targets modules are now in Developer Preview (#32207) (8776832), closes #31785

Bug Fixes

• location: underscores are not allowed in the name (#32046) (f6ad9c9)

v2.168.0

Features

• cloudfront: function URL origin access control L2 construct (#31339) (b8f47c8), closes #31629
• elasticloadbalancingv2: support target group level cross-zone settings for ALB and NLB (#31814) (6b0b1e1), closes #31790
• lambda: add NodeJS 22.x support (#32104) (baa8561)
• lambda: support observability for ESM ( DDB, Kinesis, SQS) (#32204) (6317a2a)
• lambda-destinations: support Lambda async S3 destination (#31709) (e1a2f68)
• ses: maximum delivery time for emails (#32102) (771eeff)
• update L1 CloudFormation resource definitions (#32175) (6820c62)
• rds: support 8.0.40 engine version for RDS for MySQL (#32117) (dcb5cf1)
• stepfunctions-tasks: create scheduler (#29458) (d14a01c), closes #29351

Bug Fixes

• cdk: remove source-map-support from typescript init templates (#32113) (d5c0aa2), closes #20754 #30231
• cdk: use built-in source map support (#32115) (5d499dc)
• cli: cdk diff always falls back to template only diff (#32165) (089e9d8)
• cli: excessive stack event polling during deployment (#32196) (a8bc46d), closes /github.com/aws/aws-cdk/blob/7bb9203eb95fe894c0d40942ff49c782a9fec251/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts#L73-L74
• cli: externally managed stack notification arns are deleted on deploy (#32163) (9966f57)
• cli: failure to get credentials when session token is not set (#32134) (9ef4e72)
• cli: region specified in ~/.aws/credentials is ignored (#32133) (d1b3c81), closes #32130
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#32164) (f75dc72)
• eks: eks.AccessEntryType.STANDARD maps to a wrong value (#31147) (1bbb456)

---

Alpha modules (2.168.0-alpha.0)

Bug Fixes

• scheduler-targets-alpha: imported target resources as schedule target throws synth error (#32105) (1a8306f), closes #31785 /github.com/aws/aws-cdk/pull/29615#issuecomment-2417858246
• scheduler-targets-alpha: kinesis data firehose target uses l1 instead of l2 (#32150) (11384f0), closes #31785
• scheduler-targets-alpha: scope down permissions for sqs and kinesis stream targets (#32122) (6bb142e), closes #31785

v2.167.2

Bug Fixes

• cli: cdk diff always falls back to template only diff (#32165) (3fd9699)
• cli: externally managed stack notification arns are deleted on deploy (#32163) (465da31)
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#32164) (a0b47c5)

---

Alpha modules (2.167.2-alpha.0)

v2.167.1

Bug Fixes

• cli: failure to get credentials when session token is not set (#32134) (425efbc), closes #32120
• cli: region specified in ~/.aws/credentials is ignored (#32133) (9859f33), closes #32130

---

Alpha modules (2.167.1-alpha.0)

v2.167.0

Features

• cli: upgrade aws-sdk to sdkv3 (#31702) (5bc0662), closes #25870 #26292 #20956 #24744 #27265
• elasticloadbalancingv2: enable zonal shift for network load balancer (#31990) (497abdc), closes #31983
• kms: support KEY_AGREEMENT for keyUsage (#30993) (2323877), closes #30989
• lambda: add Python 3.13 runtime (#32054) (e0ebcfe)
• lambda: add supportsSnapStart config to dotnet8 and python 3.12 (#32112) (53f4713)
• lambda: support for customer managed encryption (CMCMK) (#32072) (2f16415)
• update L1 CloudFormation resource definitions (#32090) (6303b72)
• rds: support minor engine versions for oracle (#32058) (3d72b63)
• rds: support minor versions for RDS for SQL Server (#32055) (8c80bf8)
• service-catalog: allow Product Stack to override analytics reporting and stack descriptions (#31985) (d8ad02a), closes #31924

Bug Fixes

• ecr: allow creating repository uri to use tokens like cfn params (#32053) (5648199), closes #31860

---

Alpha modules (2.167.0-alpha.0)

Features

• ivs: support recording configuration for channel (#31899) (8a3734d), closes #31780
• redshift: relocating a cluster (#31993) (b763d86)

Bug Fixes

• scheduler-targets-alpha: add dlq policy to execution role instead of queue policy (#32032) (b953b2a), closes #31785

v2.166.0

Features

• cli: automatically roll back stacks if necessary (#31920) (2f9fb1e), closes #30546
• kinesis: support resource policy for a data stream (#31909) (18fbd6d), closes #28814
• rds: configure autoMinorVersionUpgrade for a database cluster (#31962) (0fb6106)
• route53: support HTTPS, SSHFP, SVCB, and TLSA DNS resource record (#31955) (afc2b0d), closes /docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-route53-recordset.html#cfn-route53
• synthetics: add artifactS3Encryption property to the Canary Construct. (#30197) (1f39cb9), closes #30190
• update L1 CloudFormation resource definitions (#32007) (be6a964)

Bug Fixes

• deploy-time stack tags cause synthesis to fail (#32041) (18c19fd), closes #32040
• aws_route53: cannot use CfnParameter.valueAsNumber for L2 RecordSet weight (#31823) (14561ac), closes #31810
• cli: asset uploads fail if Object Lock is enabled on access bucket (#31937) (ab1e91d)
• dynamoDB: make TableV2 taggable (#31867) (796c6d1), closes #30631
• opensearch: add I4G to list of OpenSearch nodes not requiring EBS volumes (#31948) (73378f2)

---

Alpha modules (2.166.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• scheduler-targets-alpha: Schedule Target will reuse role if target is re-used across schedules. This change triggered replacement of existing roles for Schedule as logical ID of the roles are changed.

Features

• glue-alpha: add job run queuing to Glue job (#31830) (5fca268), closes #31826

Bug Fixes

• scheduler-targets-alpha: create a role per target instead of singleton schedule target role (#31895) (aee1b30), closes #31785

v2.165.0

Features

• bootstrap: add lifecycle rule to abort multipart uploads after 7 days (#31956) (b800da8), closes #29045
• bootstrap: delete noncurrent versions after 30 days (#31949) (579041e)
• cli: garbage collect ecr assets (under --unstable flag) (#31841) (da85e54), closes #31611
• codebuild: add support of organization webhook in github source (#31740) (8c15b5f), closes #31736
• cognito: support UserPoolGroup (#31351) (408b20f), closes #21026
• update L1 CloudFormation resource definitions (#31917) (8c93291)

Bug Fixes

• assertions: throw error or warn when synth is called multiple times on mutated construct tree (#31865) (a261c9d), closes #24689
• cli: ecr garbage collection hangs when repository has no images (#31951) (a235a9f)
• cli: garbage collection ignores review_in_progress stacks (#31906) (cb3ecfe)
• s3-assets: cannot publish a file without extension (#30597) (ccab485), closes #30471
• sqs: queue with fifo: false does not deploy (#31922) (a9d3b02), closes #8550
• enable node-fips compatible body checksums for S3 (#31883) (4f29c1d)

---

Alpha modules (2.165.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• ec2-alpha: The new VpcCidrBlock L2 construct replaces CfnVPCCidrBlock. This change alters the logical ID of AWS::EC2::VPCCidrBlock resources in CloudFormation templates. Existing deployments will see errors like CIDR range conflicts with x.xx.xx.xx/xx with association ID vpc-cidr-assoc-ABCD. To resolve this, you must recreate your existing stacks to use the new module.

Features

• apprunner: support vpc ingress connection (#30623) (048e753), closes #22850
• ec2-alpha: adding imports for SubnetV2 and VpcV2 (#31765) (d108a80)
• location: support Tracker and TrackerConsumer (#31268) (046f041), closes #30712
• pipes-enrichments: support API Gateway enrichment (#31794) (09052c2), closes #29384
• pipes-targets: add SageMaker (#30696) (a5fdf57)
• redshift-alpha: query execution timeout setting during table creation (#31818) (40f07ae), closes #31329
• kinesisfirehose-alpha: kinesis firehose and kinesis firehose destinations modules are now in Developer Preview (#31952)

Bug Fixes

• location: remove base class from PlaceIndex class (#31287) (bc67866), closes #30711 #30682
• scheduler-alpha: scheduler input always get transformed to string with extra double quotes (#31894) (186b8ab)
• scheduler-alpha: too many KMS permissions granted (#31923) (06678a3), closes #31785

v2.164.1

Bug Fixes

• enable node-fips compatible body checksums for S3 (#31883) (290a499)

---

Alpha modules (2.164.1-alpha.0)

v2.164.0

Features

• cli: add ability to configure hotswap properties for ECS (#30511) (fee2cf8), closes #29618
• cognito: support email based MFA (#31816) (f9d6eef), closes #31815
• cognito: the Cognito Identity Pools module is now in Developer Preview (#31854) (b22899f)

Bug Fixes

• cli: cross-account asset publishing doesn't work without bootstrap stack (#31876) (427bf63), closes #31866
• cli: deploy-role is not authorized to perform DescribeStackResources (#31878) (8d06824)
• core: fix policy synthesizer logic for precreated roles (#31710) (aae03c9)
• dynamodb: replication regions are incompatible with resource policies in TableV2 and feature flag (#31513) (0b03eb0), closes #30705
• events-targets: kinesis Stream target with Customer-Managed KMS key causes EventBridge FailedInvocations (#31836) (58dfda0), closes #10996

---

Alpha modules (2.164.0-alpha.0)

Features

• iot: scheduled audit (#31776) (366b492), closes #31779

Bug Fixes

• ec2: allow NAT instance to associate public IP (#31812) (e96b4ce), closes #31711
• scheduler-targets-alpha: imported lambda function as schedule target throws synth error (#31837) (d1d179f), closes #29284