Update cdk

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aws-cdk (source)	2.175.1 -> 2.1003.0
aws-cdk-lib	==2.175.1 -> ==2.182.0

---

Release Notes

aws/aws-cdk-cli (aws-cdk)

v2.1003.0

Compare Source

v2.1002.0

Compare Source

2.1002.0 (2025-03-03)

Features

• cli: control library init version with a command-line parameter (#​149) (f925551)

Bug Fixes

• bootstrap: add DeletionPolicy and UpdateReplacePolicy to FileAssetsBucketEncryptionKey (#​100) (bd02059)
• cli: [object Object] in error message when CcApiContextProviderPlugin listResources throws (#​168) (c913ff1)
• cli: change-set arn is not printed on cdk deploy --no-execute (#​166) (bf33829)
• cli: notices for ranged alpha modules are not showing up correctly (#​163) (b6faaba)

v2.1001.0

Compare Source

2.1001.0 (2025-02-26)

Features

• cli: build your own fromLookup() imports with the new context provider for CloudControl API (#​138) (130445d)
• cli: can match notices against Node version (#​128) (757ae69)

v2.1000.3

Compare Source

2.1000.3 (2025-02-25)

Bug Fixes

• cdk-assets: use same SDK versions as other packages (#​121) (298a6c1)

v2.1000.2

Compare Source

2.1000.2 (2025-02-19)

Bug Fixes

• cloud-assembly-schema/cli: manifest validation fails on Node <18.17 (#​61) (bc82193)

v2.1000.1

Compare Source

2.1000.1 (2025-02-18)

Bug Fixes

• aws-cdk: CLI doesn't work on Node 16 (#​59) (4d3cdd5)

v2.1000.0

2.1000.0 (2025-02-18)

Features

• initial commit of code in new repository (#​37) (1dbec5c)

aws/aws-cdk (aws-cdk-lib)

v2.182.0

Compare Source

Features

• assertions: added getResourceId method to Template (#​33521) (a96b0f1)
• autoscaling: add new HealthChecks for multiple health check types, including EBS and VPC_LATTICE types (#​31286) (b3edd0d), closes #​31289 /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-autoscaling/lib/auto-scaling-group.ts#L233 /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-autoscaling/lib/auto-scaling-group.ts#L2232-L2258 /github.com/aws/aws-cdk/pull/31286#discussion_r1740763781
• ecs: encrypting managed storage (#​33535) (07f0fe3), closes #​33380
• inspector: add minimal L2 interface for Inspector assessment template and fromCfnAssessmentTemplate() (#​33614) (d51f70a)
• opensearchservice: nodeoptions for domain (#​32936) (1b6f0c3), closes #​32553
• rds: DatabaseCluster support replicationSourceIdentifier (#​33471) (878ad54), closes #​33280
• update L1 CloudFormation resource definitions (#​33676) (92dba49)
• upgrade @​aws-cdk/cloud-assembly-schema to v40 (#​33620) (127059e)

Bug Fixes

• apigateway: move endpointConfiguration to RestApiBaseProps (#​33514) (e07a89c), closes #​33295
• appsync: appsync Event API integration assertion tests (#​33572) (6f966a6)
• cloudwatch: update regex expression that prevents CloudWatch:Mah:UnknownIdentifier warnings (#​33591) (#​33592) (97744e7)
• iam: adding organization id pattern verification (#​33555) (6df9bfe), closes #​32756
• lambda-nodejs: do not require a frozen lockfile for bun (#​32908) (a21190e), closes #​32906 #​32906
• s3: cannot deploy multiple replication source buckets (under feature flag) (#​33360) (d580853), closes #​33355
• sns: for SSE topics, add KMS permissions in grantPublish (#​32794) (f1c0926), closes #​18387 #​31012 #​24848 #​16271 #​29511 /github.com/aws/aws-cdk/issues/16271#issuecomment-917221985

---

Alpha modules (2.182.0-alpha.0)

Features

• pipes-alpha: support for customer-managed KMS keys to encrypt pipe data (#​33546) (dd0d62f), closes #​31453

Bug Fixes

• cognito-identitypool-alpha: prevent stacks from not deploying correctly (#​33609) (e220bc8), closes #​33510
• eks-v2-alpha: can't delete fargate cluster (#​33573) (4ada313), closes #​33347
• scheduler-targets: update kinesis firehose imports (#​33615) (1df1a78)

v2.181.1

Compare Source

---

Alpha modules (2.181.1-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• cognito-identitypool-alpha: Any IdentityPool resources deployed in versions >=2.179.0 will now fail to deploy. You will need to delete the IdentityPoolRoleAttachment from your stack via the console before redeploying.

Bug Fixes

• cognito-identitypool-alpha: prevent stacks from not deploying correctly (#​33609) (a1e2afe), closes #​33510

v2.181.0

Compare Source

Features

• update L1 CloudFormation resource definitions (#​33579) (a6bfe3c)
• rds: scheduling modifications in the next scheduled maintenance window (#​33448) (be2c7d0), closes #​33447
• stepfunctions: add support for custom CSV delimiters in S3CsvItemReader (#​33558) (43ae4fc), closes #​33418

Bug Fixes

• cognito: re-adding threat protection capabilities and clarifying feature plans (#​33565) (2f9bc41), closes #​33393 #​32367 #​32367 #​33393
• core: serviceTimeout for CustomResource does not work with token (#​33541) (bc91c70), closes #​33513 /github.com/go-to-k/aws-cdk/blob/75e52619cd09f363882ff62561a53cd5cd79ab30/packages/aws-cdk-lib/core/lib/custom-resource.ts#L169 /github.com/go-to-k/aws-cdk/blob/75e52619cd09f363882ff62561a53cd5cd79ab30/packages/aws-cdk-lib/core/lib/duration.ts#L332
• core: cross-stack references to NestedStack list values produces invalid outputs (#​32575) (f9252ab), closes #​27233
• core: wrong priority for tag aspects (#​33460) (0b9ffeb)
• rds: monitoringInterval in DatabaseClusterProps does not work with token (#​33516) (f9b28b9), closes #​33504
• stepfunctions-tasks: SageMakerCreateTrainingJob add sagemaker:AddTags permission (#​32536) (3b07346), closes #​32294

---

Alpha modules (2.181.0-alpha.0)

Features

• eks-v2-alpha: eks auto mode support (#​33373) (e03d112)
• msk: support for Kafka version 3.8.x and add deprecated labels to legacy versions (#​33553) (29623d1)
• redshift-alpha: maintenance track name (#​33552) (9ac3084)

v2.180.0

Compare Source

Features

• cloudfront-origins: read versioned access level (#​33038) (315be88), closes #​33034
• update L1 CloudFormation resource definitions (#​33531) (93a3348), closes /docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html#cfn-ec2
• cloudfront: support gRPC for distribution (#​32535) (1b116b9), closes #​32534
• cloudfront: vpc origins (#​33318) (8f3e793), closes #​32396
• cloudwatch: throw ValidationErrors instead of untyped Errors (#​33456) (6098816), closes #​32569
• codepipeline-actions: support timeout for ManualApprovalAction (#​33472) (7901f07), closes #​33473
• kinesis: support stream consumers (#​32087) (f4453c7), closes #​32050
• ses: configurationset support default event bus and firehose as destination (#​33093) (d8b0da7), closes #​32835 #​30671

Bug Fixes

• core: adding warnings to alert when properties will be overwritten (#​33507) (b06daf8), closes #​32468
• lambda: updating addToRolePolicy to avoid circular dependency potential (under feature flag) (#​33291) (d946eb7)
• logs: DataProtectionPolicy template key must be PascalCase (#​33462) (0379878), closes #​33408 #​26728
• stepfunctions: disabling logging still requires LogGroup (#​30816) (a2cd7ae), closes #​30814
• stepfunctions: various JSONata query language fix (#​33404) (b16fac2), closes #​33403 #​33374 #​33396 /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-stepfunctions/lib/states/state.ts#L398

---

Alpha modules (2.180.0-alpha.0)

Features

• glue-alpha: include extra jars parameter in pyspark jobs (#​33238) (be3bce3), closes #​33225

v2.179.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• eks: kubectlLayer property is now required in EKS Cluster and FargateCluster constructs. The default value for kubectlLayer is outdated and hence being removed. You can specify your own kubectlLayer version based on your Kubernetes version.

Features

• reset L1 CloudFormation resource definitions to last known working version (#​33481)
• cloudtrail: throw ValidationErrors instead of untyped Errors (#​33455) (11a75b2), closes #​32569
• update L1 CloudFormation resource definitions (#​33445) (531280f)
• update L1 CloudFormation resource definitions (#​33475) (a7cacb8)
• update L1 CloudFormation resource definitions (#​33476) (3a61695)
• update L1 CloudFormation resource definitions (#​33480) (67e596e)
• apigateway: resource policy configuration for private API (#​32719) (628e649), closes #​31660 #​31692
• apigatewayv2: stage support detailedMetricsEnabled property (#​33267) (0abcacf), closes #​33222
• apigatewayv2-integrations: sqs integrations (#​29646) (775c009), closes #​24785
• appconfig: throw ValidationError instead of untyped Errors (#​33386) (b4efb1e), closes #​32569
• assertions: throw typed errors (#​33382) (0f57bd3), closes #​32569
• assets: throw ValidationError instead of untyped Errors (#​33383) (19cf902), closes #​32569
• autoscaling: throw ValidationError instead of untyped Errors (#​33388) (d3f3309), closes #​32569
• backup: throw ValidationError instead of untyped Errors (#​33387) (48f2bf7), closes #​32569
• batch: throw ValidationError instead of untyped Errors (#​33389) (c83ca82), closes #​32569
• certificatemanager: throw ValidationErrors instead of untyped Errors (#​33440) (76848e4), closes #​32569
• chatbot: throw ValidationError instead of untyped Error (#​33439) (ede5842), closes #​32569
• cloudformation-include: throw ValidationError instead of untyped Errors (#​33391) (92a9a73), closes #​32569
• cloudfront: throw ValidationErrors instead of untyped Errors (#​33438) (c08c7f0), closes #​32569
• codebuild: attribute-based compute type for Fleet (#​32251) (9fd62cb)
• codepipeline-actions: support commands action (#​31667) (2637d46), closes #​31666
• cognito: add analyticsConfiguration to UserPoolClient (#​32862) (1c98881), closes #​32837
• cognito: choice-based authentication (passwordless sign-in / passkey sign-in) (#​32369) (9a6e5cc), closes #​32265 #​32367 #​32273
• cx-api: throw CloudAssemblyError instead of untyped Errors (#​33390) (ae95d95), closes #​32569
• eks: add L2 constructs to support EKS Hybrid Nodes (#​32389) (b91965c)
• eks: make kubectlLayer property required from optional (#​32930) (b11f663), closes /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/package.json#L123
• eks: support eks with k8s 1.32 (#​33339) (3490d2e)
• elasticloadbalancingv2: minimum Loadbalancer Capacity Unit (LCU) reservation (#​32382) (9b178c1)
• events-targets: allow all ECS TaskOverrides (#​32344) (aebb331), closes #​32217 #​32217 /github.com/aws/aws-cdk/blob/1b7265bf5cc623b2e362266c96ce866df539581f/packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts#L225-L227
• logs: support regex patterns for JSON Metrics filters (#​30741) (c89afe3), closes #​30451
• pipelines: throw ValidationError instead of untyped Errors (#​33385) (14b1098), closes #​32569
• stepfunctions-tasks: allow region override in call-rest-api task (#​33252) (59470c5)
• update L1 CloudFormation resource definitions (#​33363) (ba485ef), closes /docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html#cfn-ec2
• rds: support Database Insights for Aurora databases (#​32851) (f6ed4be), closes #​32680

Bug Fixes

• cli: cdk diff fails when deploy role requires tags (#​33340) (f1d9a7d)
• cli: do not print credentials refreshed by plugins (#​33398) (a7d7373), closes #​33394 #​33394
• cli: init templates still assume the same versions (#​33449) (523e0f0)
• cli: old setInterval remains and is not cleared in garbage collection (#​32985) (a2166e2), closes #​32742 /github.com/aws/aws-cdk/blob/899965d6147829b8f8ac52ac8c1350de50d7b6d0/packages/aws-cdk/lib/api/garbage-collection/progress-printer.ts#L44
• eks: cluster.addHelmChart ignores skipCrds (#​31832) (ee63467), closes #​31831
• opensearchservice: wrong iops limit checks (#​33401) (1d15d49), closes #​29711
• do not skip bundling for stacks during CDK Import, otherwise fails (#​33322) (5160796), closes #​31999 #​31677 #​31999 #​31677 #​9540 #​17666
• lambda-event-sources: SelfManagedKafkaEventSource cannot be used in NPM symlinked workspaces (#​32937) (fe656af)
• stepfunctions-tasks: CallAwsServiceCrossRegion doesn't work with WAIT_FOR_TASK_TOKEN (#​32807) (800b775), closes #​32746 /github.com/aws/aws-cdk/blob/bbdd42c8f45916d5c6945f3429916f6199d2ec66/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/lambda/invoke.ts#L146-L165
• stepfunctions-tasks: CallAwsServiceCrossRegion doesn't work with WAIT_FOR_TASK_TOKEN (cbd8ecf)
• vpc: typo VPC Endpoint Payment Cryptography (#​33018) (51e671f), closes #​33017

---

Alpha modules (2.179.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• cognito-identitypool-alpha: The IdentityPoolRoleAttachment construct and IdentityPool.addRoleMappings() function will no longer exist. This is to disambiguate that only one role attachment can exist per Identity Pool. If you are using the IdentityPool construct, this change will trigger a redeployment. If you need to add role mappings, please do so when the IdentityPool is created.

Features

• eks-v2-alpha: support eks with k8s 1.32 (#​33344) (7175a04)
• ivs: support Multitrack Video (#​33370) (29d1945)

Bug Fixes

• cognito-identitypool-alpha: remove RoleAttachment construct (#​33305) (9449f9c), closes #​23449
• integ-tests: http flattenResponse (#​30361) (4744ee5), closes #​30327
• msk: allow both sasl/scram and iam auth (#​31743) (fbcb732), closes /github.com/aws/aws-cdk/pull/14647#issuecomment-2129517358 #​32779

v2.178.2

Compare Source

Bug Fixes

• cli: do not print credentials refreshed by plugins (#​33398) (727d42f), closes #​33394 #​33394

---

Alpha modules (2.178.2-alpha.0)

v2.178.1

Compare Source

Bug Fixes

• cli: sdk logging is always present even when not turned on (#​33324) (29a9a6d), closes #​33320
• custom-resource: provider framework lambda missing GetFunction permission (#​33315)

---

Alpha modules (2.178.1-alpha.0)

v2.178.0

Compare Source

Features

• apigateway: throw ValidationError instead of untyped errors (#​33075) (04efe6c), closes #​32569
• applicationautoscaling: throw ValidationError instead of untyped errors (#​33172) (abd4a3e), closes #​32569
• appmesh: throw ValidationError istead of untyped Errors (#​33245) (ba2f5c8), closes #​32569
• appsync: add L2 constructs for AWS AppSync Events (#​32505) (9ae1d34), closes #​32004
• appsync: throw ValidationError instead of untyped errors (#​33206) (ab9dd0a), closes #​32569
• bedrock: support Luma AI's Ray2 visual AI model (#​33163) (01abd83)
• cloudfront: add origin group selection criteria to L2 Distribution and L2 OriginGroup (#​32740) (1b35c4e)
• cognito: support password history size (#​33164) (988043e), closes #​33106
• cognito: throw ValidationError instead of untyped errors (#​33170) (ecbe1bf)
• custom-resource: update default node runtime to node20 for China and Gov regions (#​33112) (8c13cf2)
• dynamodb: add pointintimerecoveryspecification and deprecate old (#​33059) (aec64f0), closes #​32786
• ecs: ExternalService support daemon scheduling strategy (#​32630) (361c7d3), closes #​32538
• ecs: add tls property to a ServiceConnectService (#​32605) (d32baf6), closes #​32583
• ecs: support availability zone rebalancing (#​32263) (a8e2622), closes #​32226
• ecs: support container version consistency (#​32225) (37df0d2), closes #​32202
• ecs: mark TaskDefinition inferenceAccelerators as deprecated (#​33248)
• ecs-patterns: add containerCpu and containerMemoryLimitMiB property to ApplicationLoadBalancedFargateService (#​30920) (4dd97bc), closes #​20638 #​20638
• elasticloadbalancingv2: support AdvertiseTrustStoreCaNames for mTLS (#​32678) (6a77e4f)
• kinesisfirehose: graduate to stable 🚀 (#​33296) (7aaac12)
• enable additional metadata collection (under feature flag) (#​33232) (6b9e47a), closes /github.com/aws/aws-cdk/pull/33232/files#diff-81f821b1205e7040fc3103bf7c0114060a6d5c43ebd2994aa4ed5906e42c9c5fR33
• metadata collection for construct methods (#​33292) (bc96ee1)
• throw ValidationError instead of untyped errors in L1s (#​33032) (1b666db), closes #​32569
• update L1 CloudFormation resource definitions (#​33191) (1beaf83)
• update L1 CloudFormation resource definitions (#​33272) (80073c8)
• lambda: latest versions for ADOT Lambda Layers (v0.115.0) (#​32783) (39e5578)
• rds: support Aurora PostgreSQL Limitless Database PostgreSQL 16.6 (#​33162) (111ffc2), closes /docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/limitless-updates.html#16
• sns: support high throughput mode for FIFO topics (#​33056) (bfa0f15)
• stepfunctions: add support JSONata and variables (#​32343) (0bb3d6f), closes #​32262 #​32262 /github.com/aws/aws-cdk/pull/32343#issuecomment-2524096740

Bug Fixes

• apigatewayv2: incorrect arn function causing unwanted behavior (#​33100) (ffe9863), closes #​33218
• batch: support cfn parameters for managed compute environment properties minvcpus, maxvcpus, and spotbidpercentage (#​32954) (5fef9e0), closes #​32905
• cli: array arguments in cdk.json are ignored (#​33107) (2eff2bd), closes #​32814
• custom-resources: incorrect IAM prefix generated for CloudWatch actions (#​33078) (c76f668), closes #​32968
• sns: topic policy is not created even if enforceSSL enabled (#​31569) (b3975c5), closes #​31558

---

Alpha modules (2.178.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• ec2-alpha: operatingRegion property under IPAM class is now renamed to operatingRegions.

⚠ BREAKING CHANGES TO STABLE MODULES

• ecs: The TaskDefinitionProps.inferenceAccelerators attribute and TaskDefinition.addInferenceAccelerator() method will be marked as deprecated.

Features

• ec2-alpha: ec2-alpha module is now in Developer Preview (#​33230) (a06f91a)
• ec2-alpha: add Transit Gateway L2 (#​32956) (af44791)
• eks-v2: new eks v2 alpha module (#​33215) (ccc9f5e)
• msk: support ServerlessCluster (#​32780) (86ce155), closes #​28709

Bug Fixes

• ec2-alpha: readme updates, new unit tests, logic update (#​33086) (bcb7f9b), closes #​30762

v2.177.0

Compare Source

Features

• apigatewayv2: throw ValidationError instead of untyped errors (#​33072) (8b472fc), closes #​32569
• apigatewayv2: throw ValidationError instead of untyped errors (#​33082) (5377586), closes #​32569
• apigatewayv2-authorizers: throw ValidationError instead of untyped errors (#​33076) (dd34d2e), closes #​32569
• bedrock: deprecate Claude 2, 2.1, Instant (#​33058) (c0ed449)
• cli: add --untrust option to bootstrap (#​33091) (4713bdd)
• cli: show all information from waiter errors (#​33035) (b512a72)
• cli: throw typed errors (#​33005) (bf81b3c), closes #​32548
• cloudfront-origins: list access level for 404 response (#​32059) (2b2443d), closes #​13983 #​31689
• cognito: managed login (#​33097) (188f52d)
• elbv2: throw ValidationError intsead of untyped errors (#​33111) (cc1988a), closes #​32569
• lambda: throw ValidationError instead of untyped errors (#​33033) (a928748), closes #​32569
• rds: throw ValidationError instead of untyped errors (#​33042) (0b2db62), closes #​32569
• route53: throw ValidationError instead of untyped errors ([#​33

---

Configuration

📅 Schedule: Branch creation - "* 0-3 1 * *" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coveralls]

coverage: 72.121%. remained the same
when pulling e736850 on renovate/cdk
into 4fb8de4 on master.