Update dependency aws-cdk-lib to v2.84.0

[mend-for-github-com]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aws-cdk-lib	2.7.0 -> 2.84.0

---

Release Notes

aws/aws-cdk

v2.84.0

Compare Source

Features

• backup: add recovery point tags param to backup plan rule (#​25863) (445543c), closes #​25671
• ecr: repo.grantPush (#​25845) (01f0d92)
• eks: enable ipv6 for eks cluster (#​25819) (75d1853)
• events-targets: support assignPublicIp flag to EcsTask (#​25660) (37f1eb0), closes #​9233
• lambda: provide support for AWS Parameters and Secrets Extension for Lambda (#​25725) (7a74513), closes #​23187
• lambda: provide support for AWS Parameters and Secrets Extension for Lambda (#​25928) (4a3903f), closes #​23187
• s3: support s3 bucket double encryption mode aws:kms:dsse (… (#​25961) (df263a6)

Bug Fixes

• autoscaling: AutoScalingGroup maxCapacity defaults to minCapacity when using Token (#​25922) (3bd973a), closes #​25920 /github.com/aws/aws-cdk/issues/25795#issuecomment-1571580559
• cli: assets shared between stages lead to an error (#​25907) (3196cbc)
• codebuild: add possibility to specify BUILD_GENERAL1_SMALL compute type with Linux GPU build image (#​25880) (2d74a46), closes #​25857
• core: Add stage prefix to stack name shortening process (#​25359) (79c58ed)
• ecs: remove accidental duplication of cloudmap namespaces with service connect (#​25891) (4f60293), closes #​25616 #​25616
• eks: imported clusters can't deploy manifests (#​25908) (23a84d3)
• iam: Modify addManagedPolicy to compare ARN instead of instance reference (#​25529) (5cc2b0b)
• stepfunctions-tasks: incorrect policy generated for athena startqueryexecution task (#​25911) (86e1b4c), closes #​22314 #​25875

---

Alpha modules (2.84.0-alpha.0)

Bug Fixes

• batch: computeEnvironmentName is not set in FargateComputeEnvironment (#​25944) (fb9f559)

v2.83.1

Compare Source

Bug Fixes

• cli: assets shared between stages lead to an error (#​25907) (68ed8ca)

---

Alpha modules (2.83.1-alpha.0)

v2.83.0

Compare Source

Features

• cfnspec: cloudformation spec v125.0.0 (#​25834) (674ec01)
• custom-resource: AwsCustomResource supports AWS SDK for JavaScript v3 (#​25406) (60699f4)
• events-targets: support enableExecuteCommand in EcsTask construct (#​25639) (7f3152a)

Bug Fixes

• apigateway: allow overriding apiKeyRequired on methods (#​25682) (ae778cc), closes #​8827
• cli: asset existence check is slow for many assets (#​25866) (d17642a)
• cli: deployment gets stuck deploying stacks with shared assets (#​25846) (8b97bdf), closes #​25719 #​25806
• cli: ENOENT during asset publishing (#​25869) (1668dbd), closes #​25293
• codepipeline: incorrect cross-account permissions with StepFunct ionInvokeAction (#​25850) (3694670)
• ecr: auto delete images on ECR repository containing manifest list (#​25789) (830e6d3)
• kms: aliasName references alias itself (under feature flag) (#​25822) (45734e3), closes #​25761
• lambda-nodejs: cannot use .mts, .cts, and .cjs entry files (#​25642) (cbe9fe5), closes #​21635
• lambda-nodejs: ignore noEmit in tsconfig when pre-compiling (#​25604) (dd16cf8), closes #​25603

---

Alpha modules (2.83.0-alpha.0)

Features

• cloud9: support setting automaticStopTimeMinutes (#​25593) (437345e), closes #​25592

v2.82.0

Compare Source

Features

• cfnspec: cloudformation spec v123.0.0 (#​25649) (d19646b)
• cfnspec: cloudformation spec v124.0.0 (#​25753) (fb6ec6a)
• cfnspec: cloudformation spec v124.0.0 (#​25790) (4c067c5)
• core: support nodejs18.x for CustomResourceProviderRuntime. (#​25709) (d99733f), closes #​25665
• ecr: validate repository arn in fromRepositoryArn (#​25302) (383cccb)
• lambda: add Runtime.RUBY_3_2 (#​25817) (33c820b)
• lambda: response payload streaming (#​25375) (9664515)
• rds: Support Aurora I/O Optimized for Aurora database. (#​25704) (f5797b2), closes #​25629
• rds: support Aurora Serverless V2 instances (#​25437) (fe5ed10), closes #​20197
• route53: HostedZone's default period at the end should be optional (#​25379) (cc204ca), closes #​22406
• stepfunctions: add getters for context object fields (#​25646) (42b43d6), closes #​25415

Bug Fixes

• aws-cdk-lib: attribute FindingsFilterListItems on AWS::Macie::FindingsFilter does not work (#​25778) (98fd69a)
• ec2: non-agnostic stack throws error with availability zones defined in VPC (#​25468) (c2a22fa), closes #​21690

---

Alpha modules (2.82.0-alpha.0)

Features

• synthetics: support runtime nodejs puppeteer 4.0 (#​25553) (1d7a9a8), closes #​25493
• app-staging-synthesizer: new synthesizer separates assets out per CDK application (#​24430) (ae21ecc)

v2.81.0

Compare Source

Features

• ec2: added support for network interfaces on ec2 instances by providing an associatePublicIpAddress property (#​25441) (d43834d), closes #​17127
• glue: Add G.4X and G.8X worker types for AWS Glue (#​25637) (1e4ffcd)
• lambda: lambda code assets are marked as deploy time assets (#​25705) (8a6b376)
• logs: filterName property in MetricFilter (#​25246) (4f8aae5)
• s3-deployment: add some convenient methods to CacheControl (#​25477) (21fc1d1)
• secretsmanager: add support for rotateImmediatelyOnUpdate for secret rotation schedule (#​25652) (cdafcc5), closes #​25365
• new synthesizer separates assets out per CDK application (#​24430) (ae21ecc)

Bug Fixes

• core: allow override with cross-stack references (#​24920) (1135356), closes #​18882
• core: cdk deploy stops early if 2 stacks with a dependency between them share an asset (#​25719) (9e45095), closes #​25714
• lambda: validation for FunctionUrlCorsOptions.maxAge (#​25495) (0f40880)
• s3: KMS encryption works fine for server access logging target buckets (#​25350) (6c5b67e)

---

Alpha modules (2.81.0-alpha.0)

Features

• batch-alpha: tag instances launched from your managed CEs (#​25643) (8498740)

v2.80.0

Compare Source

⚠ BREAKING CHANGES

• eks: A masters role is no longer provisioned by default. Use the mastersRole property to explicitly pass a role that needs cluster access. In addition, the creation role no longer allows any identity (with the appropriate sts:AssumeRole permissions) to assume it.

Features

• apigateway: add grantExecute to API Methods (#​25630) (ecb59fd)
• appmesh: access log format support for app mesh (#​25229) (c4b00be)
• appsync: Add Private API support when creating a GraphqlApi (#​25569) (d7e263d)
• cfnspec: cloudformation spec v122.0.0 (#​25555) (5ccc569)
• cli: assets can now depend on stacks (#​25536) (25d5d60)
• cli: logging can be corked (#​25644) (0643020), closes #​25536
• codepipeline-actions: add KMSEncryptionKeyARN for S3DeployAction (#​24536) (b60876f), closes #​24535
• eks: alb controller include versions 2.4.2 - 2.5.1 (#​25330) (83c4c36), closes #​25307
• msk: Kafka version 3.4.0 (#​25557) (6317518), closes #​25522
• scheduler: schedule expression construct (#​25422) (97a698e)

Bug Fixes

• bootstrap: bootstrap doesn't work in non-aws partitions anymore (revert security hub finding fix) (#​25540) (8854739), closes /github.com/aws/aws-cdk/issues/19380#issuecomment-1512009270 #​25272 #​25273 #​25507
• eks: overly permissive trust policies (#​25473) (51f0193). We would like to thank @​twelvemo and @​stefreak for reporting this issue.

---

Alpha modules (2.80.0-alpha.0)

v2.79.1

Compare Source

Bug Fixes

• bootstrap: bootstrap doesn't work in non-aws partitions anymore (revert security hub finding fix) (#​25272) (4c4014e)

---

Alpha modules (2.79.1-alpha.0)

v2.79.0

Compare Source

Features

• cfnspec: cloudformation spec v121.0 (#​25499) (c2ef657)
• ecr: grantRead on repositories (#​25445) (ce7bdea)
• logs: support DataProtectionPolicy in LogGroup construct (#​23402) (ed3962a), closes #​23399

Bug Fixes

• batch: JobDefinition's ContainerDefinition's Image is synthesized with [Object object] (#​25466) (b3d0d57), closes #​25250
• cfn2ts: doesn't handle property types with the same type as a primitive type (#​25460) (b76c182), closes aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json#L1437-L1442 aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json#L1727-L1742 #​22732
• core: crossRegionReferences don't work across multiple regions (#​25384) (65265e1), closes #​25190 #​25377
• dynamodb: fix hardcoded partition in replica-provider IAM policy (#​25428) (b5b4f66), closes #​25407
• elasticloadbalancingv2: ALB auth return internal server error (#​24510) (75212eb), closes #​21939 #​19035 #​18944
• servicecatalogappregistry: Revert deprecated method removing PR to keep deprecated method in alpha version (#​25454) (b20b1f2)

---

Alpha modules (2.79.0-alpha.0)

Bug Fixes

• servicecatalogappregistry: Revert deprecated method to keep deprecated method in alpha version (b20b123)
• batch: JobDefinition's ContainerDefinition's Image is synthesized with [Object object] (#​25250) (b3d0d57)

v2.78.0

Compare Source

Features

• appsync: L2 construct for EventBridge DataSource. (#​25369) (a0ad49d), closes #​24809
• cfnspec: cloudformation spec v120.0.0 (#​25354) (9096602)
• codebuild: add support for aws/codebuild/amazonlinux2-aarch64-standard:3.0 (#​25351) (0d187c1), closes #​25334
• ec2: Prefixlist Constructs (#​25252) (b2dfac0), closes #​24714
• ec2: restrict access to default security group (under feature flag) (#​25297) (d8272ef), closes /docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2 #​19394
• events: Validate events rule name (#​25366) (5bdb012), closes #​25352
• rds: add missing PerformanceInsightRetention options (#​25347) (1dbae20)

Bug Fixes

• api-gateway: add validation to variables property on Stage resource (#​25267) (04427e3), closes #​3635
• apigateway: cannot use requestValidatorOptions multiple times (under feature flag) (#​25324) (2a49fd1), closes #​7613
• batch: ManagedEc2EcsComputeEnvironment instance role missing managed policy (#​25279) (c81d115), closes #​25256
• batch: JobQueue uses wrong id for underlying CfnJobQueue (#​25269) (4cbb790), closes #​25248
• core: output folder checksum is computed unnecessarily (#​25392) (f2294ba)
• ecs: Allow scheduling DAEMON services even if no EC2 capacity attached to cluster (#​25306) (#​25328) (96bb8ce)
• elasticloadbalancingv2: the bucket policy for ELB access logging is too permissive (#​25345) (748e685), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-6
• iam: Role.fromRoleName fails on AWS created roles (#​25389) (4c9ce9b)
• integ-tests: allow multiple AwsApiCalls with the same action and different parameters (#​25241) (75967e1), closes #​25014
• s3-deployment: doesn't work in ADC regions (#​25363) (432af34)
• dns-validated-cert cr doesn't use node16 (#​25348) (ad71026), closes #​25335

---

Alpha modules (2.78.0-alpha.0)

v2.77.0

Compare Source

Features

• custom-resource: upgrade builtin custom resource runtime version to Node 16 (#​24916) (6f7c4b5)
• custom-resource: expose removalPolicy (#​25235) (79881c5), closes #​25220
• ecs-patterns: Tagging support for scheduled tasks (#​25222) (6da4eba), closes #​23838 #​25106
• eks: support for Kubernetes version 1.26 (#​25088) (792e3f2), closes #​25087
• lambda: Java 17 runtime (#​25240) (5573025)
• lambda-event-sources: Add eventsourceMappingArn to IEventSourceMapping (#​24991) (ecd7374), closes #​24801
• pipelines: added logging as option for codeBuildDefaults prop on CodePipeline construct (#​25266) (d479b4d), closes #​22045 #​22045
• s3-deployment: implement new signContent option (#​24713) (5a836cb), closes #​24711
• stepfunctions-tasks: add elasticmapreduce:AddTags permission for EmrCreateCluster state with tags (#​24856) (81beab3), closes #​24842

Bug Fixes

• cli: diff doesn't display paths for removed resources (#​25294) (9bf63ed)
• pipelines: CodeBuild Action role can be assumed by too many identities (#​25316) (90cb79f)
• log buckets don't have acls enabled (#​25303) (0e9440b), closes #​25288
• apigatewayv2: does not work in non-aws partition (#​25284) (706dc89)
• appmesh: add missing port property (#​25112) (925c9ba), closes #​22452
• backup: BackupVault.fromBackupVaultArn parses wrong arn format (#​25259) (c2082a7), closes #​25212
• batch: jobDefinitionName returns ARN instead of name (#​25207) (3ea6062), closes #​25197
• bootstrap: add previous-parameters option to bootstrap command (#​25219) (02e8758), closes #​23780
• cloudfront: can't create the default log bucket (#​25298) (0eb25f2), closes /docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#access-logs-choosing-s3 #​25288 #​25291
• core: crossRegionReferences doesn't work when exporting to multiple regions (#​25190) (89b26b8), closes #​24464
• custom-resources: State functionActiveV2 not found (#​25228) (13a230e), closes #​24358
• eks: Allow helm pull from non-ECR OCI repositories (#​25237) (27da99e), closes #​24710
• eks: policy does not exist or is not attachable in China and GovCloud regions (#​25215) (ea65415), closes #​24358 #​24696
• elasticloadbalancingv2: ALB listeners with multiple forwardi… (#​25005) (512f64e), closes #​24805
• elasticloadbalancingv2: can not set sessionTimeout (#​24457) (cefbb33), closes #​12843 #​21768
• rds: Correct ARN in IAM policy for IAM database access (#​25141) (227ea09), closes #​12416 #​11851

---

Alpha modules (2.77.0-alpha.0)

v2.76.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• servicecatalogappregistry: this change will deprecated associateStack and associateAttributeGroup in Application Construct.
  The user who are using these two method need to update to use alternative method.
  For associateStack, the alternative method is associateApplicationWithStack
  For associateAttributeGroup, the alternative method is AttributeGroup.associateWith

The user who are using these two method need to update to use alternative method. For associateStack, the alternative method is associateApplicationWithStack For associateAttributeGroup, the alternative method is AttributeGroup.associateWith

Purpose of this PR:

we need to remove deprecated resource before we moving into stable version The method that we remove is: associateStack and associateAttributeGroup

CHANGES:

1. in lib/application.ts, we remove these two methods and update their corresponding interface
2. in test/ application.test.ts & test/integ.application.ts, we update application.test.ts and integ.application.ts to remove these two methods' related test

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Features

• cli-lib: add missing deploy options (#​25042) (ac40aed)
• codebuild: adds support for standard (7.0) image (#​25136) (4eb5e99), closes #​25124
• core: add rule IDs to the analytics string (#​25084) (0c1e885)
• ec2: add new latest amazon linux machine images (#​25083) (01fd89a), closes #​21011 #​24873 #​23523
• events-targets: Add tagging for ECS tasks triggered by an event (#​23838) (e3bc59a), closes /github.com/aws/aws-cdk/pull/19583#pullrequestreview-936428722 /github.com/aws/aws-cdk/pull/19583#pullrequestreview-936428722
• kms: add required aliasname prefix to aliasnames with tokens (#​25116) (1b18a19), closes #​25033
• rds: Support SQL Server for RDS proxy (#​25102) (2ea3e45), closes #​22164 /github.com/aws/aws-cdk/issues/22164#issuecomment-1297767306

Bug Fixes

• assertions: nested stacks inside non-root stages don't resolve t… (#​25006) (2d4a60d), closes #​24004
• aws-cdk-lib: compiled .js files are no longer being minified (#​25160) (b53727f)
• batch: jobQueueName returns ARN instead of name (#​25093) (a344507), closes #​23018
• cloudwatch: correct CompositeAlarm.fromCompositeAlarmName ARN format (#​24604) (3bf6adb), closes #​24594
• core: Duration.parse() doesn't parse milliseconds (#​25010) (8ca4c09), closes #​24971
• core: pull alpine image from ecr public (#​25179) (6d906f8), closes #​24969
• ecs: allow passing execution role to imported TaskDefinitions (#​24987) (0d156a8), closes #​24984 #​24984
• kinesis: remove StreamModeDetails in template when not specified (#​24994) (787f38a), closes #​21829
• stack account id throws error if not a string (#​25134) (d9468c5)
• servicecatalogappregistry: Remove deprecated resource in Application Construct (#​25095) (9222f21)

---

Alpha modules (2.76.0-alpha.0)

v2.75.1

Compare Source

Reverts

• "fix(core): Add stage prefix to stack name shortening process #​24443

---

Alpha modules (2.75.1-alpha.0)

v2.75.0

Compare Source

Features

• aws-lambda: Add AWS Lambda runtime python3.10 (08fb3cd)

---

Alpha modules (2.75.0-alpha.0)

v2.74.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• batch: ComputeEnvironment has been removed and replaced by ManagedEc2EcsComputeEnvironment, ManagedEc2EksComputeEnvironment, and UnmanagedComputeEnvironment.

JobDefinition has been removed and replaced by EcsJobDefinition, EksJobDefinition, and MultiNodeJobDefinition

Features

• batch: new L2 Constructs (#​24775) (92e6c67)
• ec2: added ulimits property to ContainerDefinitionOptions (#​24963) (e37d16a), closes #​24918
• pipelines: allow artifactBucket to be overridden (#​24945) (292c846)
• sagemaker: support dlc images in sagemaker model (#​25018) (91553e5), closes /github.com/aws/aws-cdk/pull/17399/files#diff-356f35099770f68f4ceee2e63d34aad8729b0a9be6c933a0c05e999be7374685R98-R145
• ses: event destinations for configuration sets (#​24745) (3be43eb)
• step-functions-tasks: Support PropagatedTagSource property for EcsRunTask (#​24949) (a98a981), closes #​12999
• stepfunctions-tasks: Node.js 18.x runtime for EvaluateExpression (#​25002) (f26bfe9)

Bug Fixes

• cloudwatch: p100 statistic is no longer recognized (#​24981) (adc1a13), closes #​23095 #​24976
• events-targets: parameter JobName can exceed limit of 128 characters (#​24786) (923b9f1), closes #​24654
• redshift: Column ids were not being default assigned (#​24546) (8a655bd), closes #​24545
• s3: deprecate unencrypted encryption configuration for s3 bucket (#​24770) (b971615)
• ecr policy warning always throws (#​25041) (c0c3d19), closes #​25028
• core: Add stage prefix to stack name shortening process (#​24443) (55621ad), closes #​23628
• servicecatalogappregistry: Imported attribute group cannot be associated to an application (#​24960) (4c2e7d6)

---

Alpha modules (2.74.0-alpha.0)

v2.73.0

Compare Source

Features

• cli: exposed synth's quiet option in cdk.json (#​24793) (8c58b25), closes #​24251
• pipelines: Add ability to define fileSystemLocations for a CodePipeline (#​24584) (55906bb), closes #​24495
• rds: Add dbname parameter to RDS.DatabaseSecret construct (#​24729) (b9ce0ee), closes #​24728
• trigger: Allow trigger to work with Lambda functions with long timeouts (#​24435) (30e05f0), closes #​23788

Bug Fixes

• core: some trace info is missing from the validation report (#​24889) (5003cad)
• ec2: looking up a shared VPC has incorrect account ID in ARN (#​24486) (963634b), closes #​23865
• ecr: policytext errors when includes resource (#​24401) (a9d6966)
• globalaccelerator: parameter name can exceed limit of 64 characters (#​24796) (334dc80), closes #​24325
• iam: roleName not validated in fromRoleName function (#​24549) (637fc6a), closes #​24503
• lambda-nodejs: pnpm installs frozen lockfile in a CI environment (#​24781) (552cef4), closes /github.com/pnpm/pnpm/issues/1994#issuecomment-609403673

---

Alpha modules (2.73.0-alpha.0)

v2.72.1

Compare Source

---

Alpha modules (2.72.1-alpha.0)

v2.72.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• cdk-lib: The return type of aws-cdk-lib.aws_ec2.SecurityGroup.determineRuleScope was changed from a tuple ([SecurityGroupBase, string]) to a struct with the same values, because tuple types are not supported over the jsii interoperability layer, but jsii@v1 was incorrectly allowing this to be represented as the JSON primitive type. This made the API unusable in non-JS languages. The type of the metadata property of aws-cdk-lib.aws_s3_deployment.BucketDeploymentProps was changed from an index-only struct to an inline map, because jsii@v1 silently ignored the index signature (which is otherwise un-supported), resulting in an empty object in non-JS/TS languages. As a consequence, the values of that map can no longer be undefined (as jsii does not currently support nullable elements in collections).

Features

• apprunner-alpha: support autoDeploymentsEnabled flag for Service (#​24612) (cf5a9c4), closes #​24529
• cfnspec: cloudformation spec v117.0.0 (#​24779) (1b94ea6)
• cfnspec: cloudformation spec v117.0.0 (#​24841) (84630e9)
• cloudfront-origins: allow custom originPath for apigateway.RestApi constructs (#​24023) (bc3db02)
• core: template validation after synthesis (#​23951) (20aeb0f)
• dynamodb: adds deletion protection for tables (#​24581) (6e400a9), closes #​24540
• ecs: support pseudo terminal allocation in container definition (#​24790) (3c0756a)
• efs: implement IResourceWithPolicy (#​24453) (5771d79), closes #​15805
• kms: Adds support for hmac and sm2 key spec (#​23866) (f2f3c21), closes #​23727
• s3: add allowedActionPatterns parameter to grantWrite (#​24211) (5b5c36f), closes #​24074
• s3-deployment: added Source.dataYaml helper function (#​24579) (d969ddf), closes #​24554
• added AllViewerExceptHostHeader as new OriginRequest policy (#​24562) (8dbca12), closes #​24552

Bug Fixes

• bootstrap: ECR repository produces Security Hub finding [ECR.3] because of missing lifecycle policy (#​24735) (cdfa970)
• cli: cdk deploy output hook failure reason if cloudformation failed by hook (#​24444) (9d4b66a)
• cli: pathMetadata and assetMetadata defaults cannot be configured in cdk.json (#​24533) (45bc57a), closes #​3573
• dynamodb: add missing iam permissions to custom resource for deleting dynamodb replica table (#​24682

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box