⚠ BREAKING CHANGES
- kinesisfirehose: After this change, specifying an unsupported
timeZoneon the FirehoseS3Bucketdestination now throws aValidationErrorduring synthesis instead of failing at CloudFormation deployment. Affected values: 3-letter IANA abbreviations (e.g.EST),Etc/UTC,Etc/GMT,Factory, and strings containing characters outside[a-zA-Z/_]+. Use a supported standard IANA identifier (e.g.America/New_York) orUTCfor synth to pass.
Features
- backup: add indexActions prop to BackupPlanRule (#34051) (b8be853), closes #34050
- bedrockagentcore: add manageDeliveryResourcePolicy opt-out for runtime observability (#38372) (5fb086b), closes #38342
- ci: integration test deployment on maintainer approval (#38519) (c5f6b4f), closes #37333
- core:
Sizeobjects now properly stringify (#38662) (90fe151) - sqs: metricApproximateNumberOfMessagesOutstanding (#38661) (f29b27b)
Bug Fixes
- assets:
SymlinkFollowMode.BLOCK_EXTERNALwill throw errors while bundling (#38506) (a11e451) - bedrockagentcore: least-privilege browser recording S3 grant (#38604) (7e11d11)
- ci: add environment for Atmosphere variables access (#38625) (785773e), closes #38519
- cloudfront-origins: readTimeout and keepaliveTimeout reject valid values (#38432) (6251e1a), closes #38433 #18628
- core: performance counters use too much memory (#38620) (d0ce23c)
- core: single file bundled output should be file (#38548) (9e22774)
- core: stack.node.addDependency gets slower as stacks grow (#38597) (2ab9be4), closes #38522
- core: symlinks in directory bundling output (#38665) (8d8ae2c)
- core: validation plugin check adds too much overhead (#38619) (df15b9f)
- dynamodb:
TableV2.grants.*Datadoes not include index resources (#37892) (e48a97f), closes #37569 - dynamodb:
TableV2MultiAccountReplicarejects imported tables with tokenized ARNs (#38365) (08f05e5), closes #38354 - dynamodb: avoid TableGrantsProps deprecation warnings for TableV2 (#38399) (fb5c25b), closes #37221
- ec2:
NatInstanceProviderandNatInstanceProviderV2always trigger the keyName deprecation warning (#38347) (47f2151), closes #30806 - kinesisfirehose: add validation for customTimeZone in S3BucketProps (#38514) (8cf9f90), closes #36089
- lambda: allow SnapStart for container image functions (#38680) (a5adc00), closes #38281 #38281 #38265
- rds: serverlessV2 capacity props reject tokens at synth time (#38044) (b7880de), closes #38043 #9044 #31810 #32905
- s3-deployment: increase default memory limit from 128MB to 1024MB (#35501) (7a04f32), closes #35487
- stepfunctions-tasks: resolve EvaluateExpression paths via a values lookup (#38682) (02301ea)
- stack.availabilityZones are not stable strings (#38580) (f89474a)
Alpha modules (2.267.0-alpha.0)
⚠ BREAKING CHANGES
- glue-alpha: schema
Typeis now an opaque class; construct column types via theSchemafactories orSchema.custom(...)rather than{ isPrimitive, inputString }literals.StorageParameter.custom(key, value)requires astringvalue, andStorageParameter.writeKmsKeyIdtakes akms.IKeyinstead of a string. - glue-alpha:
S3TableProps.bucket/encryption/encryptionKeyare removed. Usestorage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?))/S3TableStorage.fromBucket(bucket)andclientSideEncryption: TableClientSideEncryption.kms(key?).S3Table.encryption/encryptionKeyare removed (clientSideEncryptionKeyexposes the client-side key; readbucket.encryptionKeyfor server-side). TheTableEncryptionenum and the deprecatedTable/TablePropsare removed — useS3Table.
Features
- glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
- glue-alpha: add subnet selection to
Connection(#38561) (f9d7eac) - glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
- glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
- msk-alpha: support Kafka 4.2 (#38323) (97b181c)
- s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)