⚠ BREAKING CHANGES
- bedrock-agentcore: The signature of
RuntimeAuthorizerConfiguration.usingCognito()has changed to accept IUserPool and IUserPoolClient constructs instead of string parameters, and now supports multiple clients.
Features
- apigateway: add
binaryMediaTypesproperty to SpecRestApi (#35502) (bf10d94), closes #35498 - apigatewayv2:
WebSocketStagesupport accessLogSettings (#34766) (dad112e), closes #21935 - bedrock-agentcore: use IUserPool and IUserPoolClient interfaces instead of string identifiers (#35860) (a38afc9), closes #35854
- core:
IEnvironmentAwareinterface to retrieve a construct's environment (#35817) (8ee5d4b) - elasticloadbalancingv2: create security group settings for NLB by default (under feature flag) (#34675) (ff83cfd), closes #34606 /github.com/aws/aws-cdk/issues/34606#issuecomment-2931313249
- events-targets: support Amazon Data Firehose target using Firehose's
IDeliveryStream(#33798) (a374b6b), closes #33757 #33758 - kinesisfirehose: add built-in data processors to decompress CloudWatch logs and extract messages (#33749) (5dec21e), closes #33691 #20242 /github.com/aws/aws-cdk/issues/33691#issuecomment-2713012245
- lambda: add Java25 runtime for Lambda (#35867) (db71fac)
- lambda: add Python 3.14 runtime for Lambda (#35869) (ebef303)
- memory: add agentcore memory l2 construct (#35757) (6a2e17e)
- msk: support Express brokers (#34741) (0a69e5f), closes #32923
Bug Fixes
- agentcore:
addToRolePolicyfor runtime with imported role destroys and recreates policies on every deployment (#35842) (92525e4), closes #35844 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts#L253 - agentcore: custom execution role policy for runtime lacks proper permissions (#35849) (ee94b63), closes #35852 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-artifact.ts#L65 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime.ts#L252-L259 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts#L693 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function.ts#L1468 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts#L1161
- dynamodb: addToResourcePolicy has no effect (#35554) (94d7e34), closes #35062
- ecs: remove empty CfnClusterCapacityProviderAssociations resource (#35783) (c8a131b), closes #35699 #35742
- iam: cannot grant lambda:InvokeFunction on ManagedPolicy or Policy via
grantInvoke()method (#32984) (a07d75a), closes #32980 /github.com/aws/aws-cdk/pull/32984#pullrequestreview-2863553504 - compilation failure in Go (#35871) (5e4f603), closes aws/aws-cdk#35770 #35862
- ec2: remove PassRole policy emitted by cloudwatch vpc flow destination (#35762) (c4b80df), closes #35729