chore(deps): update dependency aws-cdk-lib to v2.227.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.220.0 -> 2.227.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.227.0

Compare Source

v2.226.0

Compare Source

Features

• dynamodb: compound keys for global secondary indexes (046b06d)
• lambda: add multi-tenancy support with TenancyConfig (5f384db)

---

Alpha modules (2.226.0-alpha.0)

v2.225.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

  • aws-dynamodb: AWS::DynamoDB::GlobalTable: ResourcePolicy property is now required.

Features

• update L1 CloudFormation resource definitions (#​36082) (3df1d81)
• custom-resource: add External ID support for AwsCustomResource (#​35252) (9f6c02b), closes #​34018
• route53: support restricting delegated zone names when using grantDelegation (#​35129) (d832aca)

Bug Fixes

• aws-cdk-lib: temporary Cloud Assemblies are not cleaned up (#​36043) (1ace1ef), closes #​802
• cognito: remove overly strict validation for threat protection on non-PLUS plans (#​36027) (172c65f), closes #​36023
• s3-deployment: Source.jsonData() fails with null JSON values (#​36054) (67b85f2), closes #​36052

Reverts

• (dynamodb) revert Table.table field to private to fix .NET naming (#​36029) (d84fce8), closes #​36025 #​35554

---

Alpha modules (2.225.0-alpha.0)

v2.224.0

Compare Source

⚠ BREAKING CHANGES

• aws-cdk-lib: Reference interfaces (such as IBucketRef, IRoleRef, etc.) were moved to a new aws-cdk-lib.interfaces submodule to prevent cyclic dependencies between service modules. If you are importing reference interfaces, you have to update import statements accordingly. See #​36060 for full details.
• Amazon.CDK.Lib (.NET): The .NET namespace for multiple submodules has changed. If you are using any of the renamed submodules, you have to update using statements for these submodules. See #​36037 for full details.
• L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-opensearchserverless: AWS::OpenSearchServerless::Collection: StandbyReplicas property is now immutable.
aws-servicecatalog: AWS::ServiceCatalog::PortfolioPrincipalAssociation: Id attribute removed.

Features

• apigateway: add option for consolidating lambda permissions for rest and http lambda integrations (#​36021) (35f8e46), closes #​9327 #​19535 #​35705
• update L1 CloudFormation resource definitions (#​35994) (47a9a20)
• core: add methods to SecretValue and aws-secretsmanager Secret to obtain a literal (unresolved by CloudFormation) dynamic reference key (#​34397) (#​35105) (457aa99), closes /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/core/lib/secret-value.ts#L98C17-L98C31 /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts#L499
• eks: add support for Kubernetes version 1.34 (#​36016) (60096ac), closes #​35717
• lambda: add nodejs24.x runtime for Lambda (#​36001) (404bf1a)
• sagemaker: add support for serverless inference endpoints (#​35557) (3f5c5ac), closes #​23148 #​23148
• stepfunctions-tasks: add architecture support to EvaluateExpression (#​35468) (771ea13), closes #​34974

Bug Fixes

• aws-cdk-lib: move reference interfaces to their own submodules (#​35971) (1e4dfe6)
• aws-cdk-lib: multiple submodules use an incorrect namespace for .NET (#​36002) (e48e584)
• dynamodb: resolve circular dependency with AccountRootPrincipal grants (#​35983) (24d2adf), closes #​35967
• ecs: allow empty placementStrategies on EC2Service (#​35580) (0d773b1), closes #​30382 /github.com/aws/aws-cdk/pull/27572#issuecomment-1766287866

---

Alpha modules (2.224.0-alpha.0)

Features

• imagebuilder-alpha: add support for EC2 Image Builder L2 Constructs - Infrastructure Configuration (#​35882) (db1d964), closes aws/aws-cdk-rfcs#789 aws/aws-cdk-rfcs#789

v2.223.0

Compare Source

⚠ BREAKING CHANGES

L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-dynamodb: AWS::DynamoDB::GlobalTable: GlobalTableSettingsReplicationMode property removed.
• aws-dynamodb: AWS::DynamoDB::GlobalTable: GlobalTableSourceArn property removed.
• aws-dynamodb: AWS::DynamoDB::Table: GlobalTableSettingsReplicationMode property removed.
• aws-events: AWS::Events::EventBusPolicy: Id attribute removed.

Features

• update L1 CloudFormation resource definitions (#​35926) (3f4d585)
• ec2: support for Cloud Wan Core Network routes (#​35008) (fba027b)
• s3-deployment: support securityGroups in BucketDeploymentProps (#​33233) (f2a3166), closes #​33229

Bug Fixes

• stepfunctions: DistributedMap ResultWriter correct query language selection (#​35834) (75b8ead), closes #​35403
• onEvent function to pass all the options to rule resource (#​35829) (3d7023d)

---

Alpha modules (2.223.0-alpha.0)

v2.222.0

Compare Source

⚠ BREAKING CHANGES

• bedrock-agentcore: The signature of RuntimeAuthorizerConfiguration.usingCognito() has changed to accept IUserPool and IUserPoolClient constructs instead of string parameters, and now supports multiple clients.

Features

• apigateway: add binaryMediaTypes property to SpecRestApi (#​35502) (bf10d94), closes #​35498
• apigatewayv2: WebSocketStage support accessLogSettings (#​34766) (dad112e), closes #​21935
• bedrock-agentcore: use IUserPool and IUserPoolClient interfaces instead of string identifiers (#​35860) (a38afc9), closes #​35854
• core: IEnvironmentAware interface to retrieve a construct's environment (#​35817) (8ee5d4b)
• elasticloadbalancingv2: create security group settings for NLB by default (under feature flag) (#​34675) (ff83cfd), closes #​34606 /github.com/aws/aws-cdk/issues/34606#issuecomment-2931313249
• events-targets: support Amazon Data Firehose target using Firehose's IDeliveryStream (#​33798) (a374b6b), closes #​33757 #​33758
• kinesisfirehose: add built-in data processors to decompress CloudWatch logs and extract messages (#​33749) (5dec21e), closes #​33691 #​20242 /github.com/aws/aws-cdk/issues/33691#issuecomment-2713012245
• lambda: add Java25 runtime for Lambda (#​35867) (db71fac)
• lambda: add Python 3.14 runtime for Lambda (#​35869) (ebef303)
• memory: add agentcore memory l2 construct (#​35757) (6a2e17e)
• msk: support Express brokers (#​34741) (0a69e5f), closes #​32923

Bug Fixes

• agentcore: addToRolePolicy for runtime with imported role destroys and recreates policies on every deployment (#​35842) (92525e4), closes #​35844 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts#L253
• agentcore: custom execution role policy for runtime lacks proper permissions (#​35849) (ee94b63), closes #​35852 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-artifact.ts#L65 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime.ts#L252-L259 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts#L693 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function.ts#L1468 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts#L1161
• dynamodb: addToResourcePolicy has no effect (#​35554) (94d7e34), closes #​35062
• ecs: remove empty CfnClusterCapacityProviderAssociations resource (#​35783) (c8a131b), closes #​35699 #​35742
• iam: cannot grant lambda:InvokeFunction on ManagedPolicy or Policy via grantInvoke() method (#​32984) (a07d75a), closes #​32980 /github.com/aws/aws-cdk/pull/32984#pullrequestreview-2863553504
• compilation failure in Go (#​35871) (5e4f603), closes aws/aws-cdk#35770 #​35862
• ec2: remove PassRole policy emitted by cloudwatch vpc flow destination (#​35762) (c4b80df), closes #​35729

---

Alpha modules (2.222.0-alpha.0)

Features

• eks-v2-alpha: eks-v2-alpha is now in developer preview (#​35801) (32afc0f)

Bug Fixes

• bedrock-alpha: apply permission dependency to existing and non-existing roles (#​35123) (b39ccf3), closes #​35120
• eks-v2-alpha: remove hyphen from Go package name (#​35927) (2cdfc8a)

v2.221.1

Compare Source

Bug Fixes

• compilation failure in Go (#​35871) (4379f66), closes aws/aws-cdk#35770 #​35862

---

Alpha modules (2.221.1-alpha.0)

v2.221.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-datazone: AWS::DataZone::ProjectProfile: Id property removed.
• aws-logs: AWS::Logs::DeliveryDestination: DeliveryDestinationType attribute removed.
• aws-s3: AWS::S3::AccessGrantsLocation: IamRoleArn property is now required.
• aws-s3: AWS::S3::AccessGrantsLocation: LocationScope property is now required.
• aws-servicecatalog: AWS::ServiceCatalog::TagOptionAssociation: Id attribute removed.

Features

• update L1 CloudFormation resource definitions (#​35816) (82bef28)
• agentcore: add agentcore L2 constructs for 1p tools (#​35577) (3087ffa)
• agentcore: add agentcore runtime L2 construct (#​35623) (c57484a)
• ecr: image tag mutability exclusion filters (#​35246) (f6dd5cf), closes #​35454
• ecs: implement IConnectable interface for ManagedInstancesCapacityProvider (#​35745) (fd5ff76)
• kinesisfirehose: support DeliveryStream record format conversion for S3 Bucket Destination (#​35410) (79bcba2), closes #​15501 /github.com/aws/aws-cdk/issues/15501#issuecomment-3255582302
• update L1 CloudFormation resource definitions (#​35769) (a165905)

Bug Fixes

• ecs-patterns: resolve target group conflict when updating ALB internetFacing or loadBalancerName (under feature flag) (#​35508) (69b9c03), closes #​33253 #​33253 #​33253
• lambda: can't find entry file under ESM module system (#​35797) (7becd79), closes #​21630
• lambda-runtime: change fallback for latest lambda node runtime to node 22.x (#​35764) (10fcb1b)
• opensearchservice: add i8g nodes validation without EBS (#​35668) (9594842), closes #​35666
• s3-deployment: handle empty string in Source.data() (#​35824) (95c8d73), closes #​35809
• stepfunctions-tasks: allow passing apiEndpoint as intrinsic function (under feature flag) (#​32139) (ddfef06), closes #​29925 #​29925 #​30749

---

Alpha modules (2.221.0-alpha.0)

Features

• msk-alpha: support Kafka 4.1 (#​35759) (67539de)

Bug Fixes

• elasticache-alpha: cannot import Redis 7 serverless cache (#​35629) (2bde1a0)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - "after 10am,before 6pm" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Automatically approving renovate