v2.269.0

Features

• bedrockagentcore: graduate Policy submodule to stable (#38687) (2b95e32), closes #37219
• update L1 CloudFormation resource definitions (#38784) (1b5e2e0)
• logs: support DELIVERY log group class (#38703) (b7a057a), closes #34338
• s3-deployment: expose deployed object version IDs (#38766) (09342df), closes #38765

Bug Fixes

• awslint: use a default import for chalk (#38110) (36d14e0), closes #38109 #38058
• core: cdk-nag warnings cannot be suppressed (#38787) (211029f)
• core: cdk-nag's findings duplicated in multi-environment apps (#38707) (4b7b2e7), closes #38483 #38135
• core: tree.json generation is quadratic in the number of subtrees (#38761) (3d034b6), closes #38762
• core: unnecessary warnings around builtins and AZs (#38673) (6860777)
• core: upgrade CloudFormation validation to latest version (#38804) (d703eb6)
• dynamodb: TableV2 emits internal grants deprecation warnings (#38806) (57b3043), closes #38709 #38399 #37892
• ecs: allow ephemeralStorageGiB for Windows Fargate platform version 1.0.0 (#37589) (855dfeb), closes #37510
• ecs: removing the last target group from a service is not deployed (#38776) (73100f6), closes #35446 #35446 #35452
• lambda-go: escape generated go build path arguments (#38785) (279d101)
• s3-deployment: sanitize all log outputs to mitigate CWE-117/93 (#37670) (47a3a38), closes #37671 #30746 #28469 #30211

---

Alpha modules (2.269.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved
  arguments passed through defaultArguments. Previously, a managed argument set via
  defaultArguments was silently honored in SparkJob and PythonShellJob (customer
  value won over the construct default) and silently ignored in RayJob (construct
  default won). Both behaviors let a caller bypass the construct's security and
  observability defaults with no error. Passing any of the following through
  defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log,
  --continuous-log-logGroup, --continuous-log-logStreamPrefix,
  --continuous-log-conversionPattern, --enable-continuous-log-filter,
  --enable-metrics, --enable-observability-metrics, --enable-spark-ui,
  --spark-event-logs-path, --job-language, --class, --extra-jars,
  --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a
disabled feature (e.g. enableMetrics: false) cannot be re-enabled through
defaultArguments. Configure these through their dedicated props instead
(continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI,
className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For
example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' }
with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g.
--enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

The checkNoReservedArgs(defaultArguments?) method on the Job base class was removed.
It is replaced by two protected members: setManagedArgument(key, value?), which each
job class calls to declare (and, when a value is present, emit) a managed argument, and
mergeDefaultArguments(defaultArguments?), which validates the caller-supplied
defaultArguments against the accumulated reserved set and returns the merged map.

• route53resolver-alpha: FirewallRuleGroupAssociation now honors the previously-ignored mutationProtection and name props. Stacks that set mutationProtection: true will enable mutation protection on redeploy (which blocks further CloudFormation update/delete until it is set back to false); stacks that set name will write it to the template, which may replace the association.
• glue-alpha: trigger Action and Condition are no longer plain objects — use Action.job(...) / Action.crawler(...) and Condition.job(...) / Condition.crawler(...). Jobs are referenced via IJobRef and crawlers via ICrawlerRef (a CfnCrawler instance or CfnCrawler.fromCrawlerName(...)) instead of a CfnCrawler field or crawler-name string; IJob now extends the generated IJobRef. addDailyScheduledTrigger/addWeeklyScheduledTrigger/addCustomScheduledTrigger are replaced by addScheduledTrigger(id, { schedule, ... }) (use TriggerSchedule.daily()/weekly()/cron(...)). addNotifyEventTrigger is renamed addEventTrigger (NotifyEventTriggerOptions → EventTriggerOptions). All addXxxTrigger methods now return ITriggerRef instead of CfnTrigger.
• glue-alpha: PartitionProjectionConfiguration's variant fields (integerRange, dateRange, interval, digits, format, intervalUnit, values) are no longer public; DATE projection now takes step: { interval, intervalUnit } instead of top-level interval/intervalUnit.
• glue-alpha: ConnectionOptions no longer has subnet, vpc, or vpcSubnets; use network: ConnectionNetwork.subnet(...) or network: ConnectionNetwork.vpc(...) instead.

Features

• glue-alpha: ensure job parameters consistency (#38480) (bc7dc0c)
• glue-alpha: model Connection VPC placement as a value object (#38729) (f72e9fe)
• glue-alpha: model partition projection variants as internal state (#38726) (16527cd)
• glue-alpha: overhaul the workflow trigger API (#38579) (c8f917d)

Bug Fixes

• route53resolver-alpha: association silently ignored mutationProtection and name (#38795) (5ab40b2)