All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

• location: support Map (#30648) (98b801c), closes #30647
• scheduler: scheduler and scheduler-targets modules are now in Developer Preview (#32207) (8776832), closes #31785

• location: underscores are not allowed in the name (#32046) (f6ad9c9)

• scheduler-targets-alpha: imported target resources as schedule target throws synth error (#32105) (1a8306f), closes #31785 /github.com/aws/aws-cdk/pull/29615#issuecomment-2417858246
• scheduler-targets-alpha: kinesis data firehose target uses l1 instead of l2 (#32150) (11384f0), closes #31785
• scheduler-targets-alpha: scope down permissions for sqs and kinesis stream targets (#32122) (6bb142e), closes #31785

• ivs: support recording configuration for channel (#31899) (8a3734d), closes #31780
• redshift: relocating a cluster (#31993) (b763d86)

• scheduler-targets-alpha: add dlq policy to execution role instead of queue policy (#32032) (b953b2a), closes #31785

• scheduler-targets-alpha: Schedule Target will reuse role if target is re-used across schedules. This change triggered replacement of existing roles for Schedule as logical ID of the roles are changed.

• glue-alpha: add job run queuing to Glue job (#31830) (5fca268), closes #31826

• scheduler-targets-alpha: create a role per target instead of singleton schedule target role (#31895) (aee1b30), closes #31785

• ec2-alpha: The new VpcCidrBlock L2 construct replaces CfnVPCCidrBlock. This change alters the logical ID of AWS::EC2::VPCCidrBlock resources in CloudFormation templates. Existing deployments will see errors like CIDR range conflicts with x.xx.xx.xx/xx with association ID vpc-cidr-assoc-ABCD. To resolve this, you must recreate your existing stacks to use the new module.

• apprunner: support vpc ingress connection (#30623) (048e753), closes #22850
• ec2-alpha: adding imports for SubnetV2 and VpcV2 (#31765) (d108a80)
• location: support Tracker and TrackerConsumer (#31268) (046f041), closes #30712
• pipes-enrichments: support API Gateway enrichment (#31794) (09052c2), closes #29384
• pipes-targets: add SageMaker (#30696) (a5fdf57)
• redshift-alpha: query execution timeout setting during table creation (#31818) (40f07ae), closes #31329
• kinesisfirehose-alpha: kinesis firehose and kinesis firehose destinations modules are now in Developer Preview (#31952)

• location: remove base class from PlaceIndex class (#31287) (bc67866), closes #30711 #30682
• scheduler-alpha: scheduler input always get transformed to string with extra double quotes (#31894) (186b8ab)
• scheduler-alpha: too many KMS permissions granted (#31923) (06678a3), closes #31785

• iot: scheduled audit (#31776) (366b492), closes #31779

• ec2: allow NAT instance to associate public IP (#31812) (e96b4ce), closes #31711
• scheduler-targets-alpha: imported lambda function as schedule target throws synth error (#31837) (d1d179f), closes #29284

• ec2: disable api termination (#30620) (108737d)
• kinesisfirehose-alpha: refactor sourceStream property to support multiple types of sources (#31723) (0260046)
• pipes-enrichments: support API destination enrichment (#31312) (1557793), closes #29383
• pipes-targets: add CloudWatch Logs (#30665) (893769e)

• ec2: exposed userDataCausesReplacement in BastionHostLinuxProps (#31416) (029c298), closes #31348
• scheduler-alpha: remove targetOverrides prop from Schedule (#31799) (be4154b)

• kinesisfirehose-alpha: replaced destinations property with destination (singular) and changed the type from array of Destinations to a single Destination. Old behaviour would only allow an array with a single Destination to be passed in anyway.

• iot-alpha: support for account audit configuration (#31661) (fc19571), closes #31663
• pipes-targets: add EventBridge (#30654) (842f49a)

• cli-lib: cannot bootstrap specific environment (#31713) (fec4bb1)

• kinesisfirehose-alpha: replacedestinations property with destination and change type from array to single IDestination (#31630) (1e2cff1)

• kinesisfirehose-destinations: the logging and logGroup properties in DestinationLoggingProps have been removed and replaced with a single optional property loggingConfig which accepts a class of type LoggingConfig.

Combine the logging and logGroup properties into a single new optional property called loggingConfig which accepts a class of type LoggingConfig.

LoggingConfig is an abstract class which can be instantiated through either an instance of EnableLogging or DisableLogging which can be used in the following 3 ways:

import * as logs from 'aws-cdk-lib/aws-logs';

const logGroup = new logs.LogGroup(this, 'Log Group');
declare const bucket: s3.Bucket;

// 1. Enable logging with no parameters - a log group will be created for you
const destinationWithLogging = new destinations.S3Bucket(bucket, {
  loggingConfig: new destinations.EnableLogging(),
});

// 2. Enable a logging and pass in a logGroup to be used
const destinationWithLoggingAndMyLogGroup = new destinations.S3Bucket(bucket, {
  loggingConfig: new destinations.EnableLogging(logGroup),
});

// 3. Disable logging (does not accept any parameters so it is now impossible to provide a logGroup in this case)
const destinationWithoutLogging = new destinations.S3Bucket(bucket, {
  loggingConfig: new destinations.DisableLogging(),
});

unit + integ test

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

• ec2: add interface endpoint dynamodb (#30162) (182804a), closes #29547
• pipes-sources: add Kinesis and DynamoDB (#29476) (00c2efb), closes #29378 #29377
• pipes-targets: add API destination (#30756) (5e08c98), closes /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-events-targets/lib/api-gateway.ts#L11-L32
• pipes-targets: add Kinesis (#30656) (d0c99d8)
• redshift: supports excludeCharacters settings for DatabaseSecret (#30563) (a1c46cf), closes #26847

• custom-resource-handlers: better fallback for require failures (#31571) (00cdbcb), closes #30067

• kinesisfirehose-destinations: refactor logging to combine logGroup and logging properties into loggingConfig (#31488) (c4bda64)

• kinesisanalytics-flink: support Apache Flink 1.20 (#31349) (b3b9aa8)

• cognito-identitypool-alpha: cannot configure roleMappings with imported userPool and client (#30421) (0fdd6a9), closes #30304 /github.com/aws/aws-cdk/blob/c3003ab41f0efc763f39eb2cab490c8a005e146b/packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts#L902
• ec2: instance resourceSignalTimeout overwrites initOptions.timeout (#31446) (a29bf19), closes #30052

• kinesisfirehose-alpha: encryptionKey property is removed and encryption property type has changed from the StreamEncryption enum to the StreamEncryption class.

To pass in a KMS key for the customer managed key case, use StreamEncryption.customerManagedKey(key)

Replaced encryption and encryptionKey properties with a single property encryption of type StreamEncryption and is used by calling one of the 3 methods:

SreamEncryption.unencrypted()
StreamEncryption.awsOwnedKey()
StreamEncryption.customerManagedKey(key?: IKey)

This makes it so it's not longer possible to pass in a key when the encryption type is AWS owned or unencrypted. The key is an optional parameter in StreamEncryption.customerManagedKey(key?: IKey) so following the previous behaviour, if a key is provided it will be used, otherwise a key will be created for the user.

Generated templates do not change so behaviour remains the same.

Updated integ/unit tests.

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

• ivs: support RTMP ingest for IVS channel (#31380) (a907a7e)

• ec2: fixing vpc endpoint pattern for ecr and ecr docker (#31434) (95c49ab)

• kinesisfirehose-alpha: refactor encryption property to combine encryptionKey (#31430) (8e92185)

• amplify: support cache configuration for app (#31381) (b7bd041)
• iot: configure IoT Logging (#31352) (6348717), closes #31357

• location: support RouteCalculator (#30682) (574d383), closes #30681
• neptune-alpha: specify port for the cluster (#31137) (130b62b), closes #31074
• scheduler: validate schedule name length (#31200) (d0f9688)

• scheduler: the value of the description property is not reflected to the resource. (#31276) (a3332b6), closes #31269

• ec2: ipv6AddressCount property for an instance (#31076) (e3e5e1c), closes #31075
• ec2: support throughput on LaunchTemplate EBS volumes (#30716) (6ed0bed), closes #24341 #22441
• location: support GeofenceCollection (#30711) (04d73ac), closes #30710

• amplify: support custom certificate (#30791) (8d76778), closes #30594
• ec2: security group lookup via filters (#30625) (abc78bf), closes #30331
• sagemaker: network isolation for a model (#30657) (f1af7fc)

• cli-lib-alpha: bootstrap fails with "bad argument name" error for trust and trustForLookup (#31159) (b11ca4a), closes #30404
• cognito-identitypool-alpha: validation error if provided id is a token (#30882) (ad1b797), closes #29780 #28184
• ec2: prevent deduplication of init command args (#30821) (1e7c690), closes #26221

• kinesisanalytics-flink: add support for Flink 1.19 (#30723) (c185194), closes /docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kinesisanalyticsv2-application.html#aws-resource-kinesisanalyticsv2

• apprunner: add AutoScalingConfiguration for AppRunner Service (#30358) (a598508), closes #30353
• apprunner: add ObservabilityConfiguration for AppRunner Service (#30359) (9e9cc27), closes #22985
• pipes-enrichments: add Step Functions enrichment eventbridge pipes (#30495) (8b495f9), closes #29385
• pipes-targets: add lambda function (#30271) (f594fae), closes #30270

• apprunner: auto deployment fails after new container image pushed due to lack of a permission (#30630) (cce10b1), closes #26640 /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-ecr/lib/repository.ts#L385 40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1303 40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1368

• custom-resource-handlers: don't recursively process s3 bucket objects (#30209) (25835e4), closes #30573 /github.com/aws/aws-cdk/pull/30209#issuecomment-2118991218

• apprunner: add ipAddressType property to the Service class (#30351) (665396f)

• apprunner: add kmsKey property for the AppRunner Service class (#30352) (0c1aeb6), closes #30365
• ivs-alpha: support advanced channel type (#30086) (544e54a), closes #30075
• neptune: add copyTagsToSnapshot property to the DatabaseCluster Construct (#30092) (ba8edb3), closes #30087

• pipes-targets: add step function target (#29987) (b0975e4), closes #29665 #29665
• redshift: multi AZ cluster (#29976) (a53517c)

• cognito-identitypool-alpha: The argument of IdentityPoolProviderUrl.userPool() has been changed from url: string to userPool: UserPool, userPoolClient: UserPoolClient. If you want to specify custom identifier string, use IdentityPoolProviderUrl.custom() instead.

• cognito-identitypool-alpha: inconvenient IdentityPoolProviderUrl.userPool() (#29025) (90a7734)

• integ-tests: httpApiCall.expect with resolved URL (#29705) (49b4aa1), closes #29700 #29701

• kinesisanalytics-flink: add support for Flink 1.18 (#29554) (8fd8ee8), closes /docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kinesisanalyticsv2-application.html#aws-resource-kinesisanalyticsv2

• glue: s3 path specified in --spark-event-logs-path needs to end with slash (#29357) (4ff3565), closes #29356

• glue: PythonRayExecutableProps has innaccurate properties (#28625) (7994733), closes #28570

• appconfig: scope generated alarm role policy to '*' for composite alarm support (#29171) (c17879d)

• app-staging-synthesizer-alpha: stagingBucketEncryption property is now required. For existing apps, specify BucketEncryption.KMS to retain existing behavior. For new apps, choose the bucket encryption that makes most sense for your use case. BucketEncryption.S3_MANAGED is available and is intended to be the default when this module is stabilized.

• app-staging-synthesizer-alpha: require passing stagingBucketEncryption and note that we intend to default to S3_MANAGED in the future (#28978) (fc8b955), closes #28815 #28903 /github.com/aws/aws-cdk/pull/28978#issuecomment-1930007176
• pipes-enrichments: new EventBridge Pipes enrichments alpha module (#29063) (5a54ec5)
• pipes-targets: new EventBridge Pipes targets alpha module (#29057) (9419f54)
• scheduler-targets-alpha: SageMakerStartPipelineExecution Target (#28927) (db260b0), closes #27457

• appconfig: deployment recreated on every cdk deployment (#28782) (a21731c)

• pipes-sources: new EventBridge Pipes sources alpha module (#29048) (2e53568)

• appconfig: deprecate deploy method (#29021) (9675bcd)
• integ-tests: cannot use v3 package name in an awsApiCall (#28895) (5035080), closes /github.com/aws/aws-cdk/pull/27313/files#diff-3ab65cbf843775673ff370c9c90deceba5f0ead8a3e016e0c2f243d27bf84609 #28844

• integ-runner: Parsing of the cli input caused arguments passed after the first instance --language <language> to be interpreted as a language as well. This prevented passing a test name after providing cli options. To overcome this limitation, integ-runner now requires an explicit --language option for each language you want to include: integ-runner --language javascript --language python. This was already documented that way and always the intended way to use this feature.
• neptune-alpha: Corrected LogRetention IDs for DatabaseCluster. Previously, regardless of the log type, the string ‘objectObject’ was always included, but after the correction, the log type is now included.

• app-staging-synthesizer-alpha: encryption type for staging bucket (#28903) (69f4b8d), closes #28815
• pipes: EventBridge Pipes alpha module (#28388) (2d9106b), closes #23495

• integ-runner: cannot pass test name after --language (#28922) (f9fbbb4)
• neptune-alpha: multiple cloudwatchLogsExports cannot be set when configuring log retention (#28643) (56794fc), closes #26295

• iot-actions-alpha: open search action in IoT topic rule (#28748) (84b23cb)

• amplify: addBranch fails synth with "cannot find entry file..." (#28772) (cb522bb), closes #28658 #28764
• redshift: enableRebootForParameterChanges fails synth with "cannot find entry file…" (#28760) (4952f36)

• appconfig: deploymentStrategyId prop in fromDeploymentStrategyId now takes a DeploymentStrategyId rather than a string. To import a predefined deployment strategy id, use DeploymentStrategyId.CANARY_10_PERCENT_20_MINUTES. Otherwise, use DeploymentStrategyId.fromString('abc123').
• appconfig: ApplicationProps.name renamed to ApplicationProps.applicationName
  • appconfig: EnvironmentProps.name renamed to EnvironmentProps.environmentName
  • appconfig: DeploymentStrategyProps.name renamed to DeploymentStrategyProps.deploymentStrategyName
  • appconfig: ExtensionProps.name renamed to ExtensionProps.extensionName

• amplify: addBranch fails synth with "cannot find entry file..." (#28658) (0f2b8f8), closes #27955 #28633 #28089
• appconfig: fromDeploymentStrategyId takes an enum-like class rather than a string (#28743) (2b59ed1), closes #28671
• appconfig: prefix names with resource name (#28742) (3960720), closes #28671

• neptune-alpha: engineVersion v1.3 (#28647) (957598b), closes #28648

• glue: database description property (#27744) (cbac240), closes #27740
• glue-alpha: add cfn-glue-table-tableinput-parameters to Glue table construct (#27643) (8e15482)

• lambda-go: path with space breaks go build (#28554) (a8a639e), closes #28555

• lambda-python-alpha: bundling hash logic includes auth tokens in PIP urls, causing an unnecessary rebuild (#27903) (00331a7), closes #27331
• lambda-python-alpha: use function architecture (#18696) (#28449) (c724d27)

• scheduler: flexible time windows (#28098) (6554e48)
• scheduler-targets: add CodePipeline as target for scheduler (#27799) (8c44f32), closes #27449

• integ-tests: apply correct IAM policy to waiterProvider (#28424) (c488035), closes 40aws-cdk/integ-tests-alpha/lib/assertions/sdk.ts#L136 40aws-cdk/integ-tests-alpha/lib/assertions/sdk.ts#L247 #27865
• lambda-python-alpha: pipenv lock -r is no longer supported (#28317) (f85f486), closes #28015 /github.com/pypa/pipenv/blob/main/CHANGELOG.md#2022813-2022-08-13 #28015

• scheduler: The typos in the Schedule and Group construct method names have been fixed, changing metricSentToDLQTrunacted to metricSentToDLQTruncated and metricAllSentToDLQTrunacted to metricAllSentToDLQTruncated.
• redshift: Further updates of the Redshift table will fail for existing tables, if the table name is changed. Therefore, changing the table name for existing Redshift tables have been disabled.

• appconfig-alpha: add deploy method to configuration constructs (#28269) (c723ef9)
• cloud9-alpha: support image ids for Amazon Linux 2023 and Ubuntu 22.04 (#28346) (93681e0), closes /docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-cloud9-environmentec2.html#cfn-cloud9-environmentec2
• scheduler: start and end time for schedule construct (#28306) (0b4ab1d), closes /github.com/aws/aws-cdk/pull/26819#discussion_r1301532299

• appconfig-alpha: extensions always create cdk diff (#28264) (2075559), closes #27676
• redshift: tables were dropped on table name change (#24308) (7ac237b), closes #24246
• scheduler: typo in metricSentToDLQ... methods (#28307) (8b91e10)

• appconfig-alpha: support for composite alarms (#28156) (d19640b)
• appconfig-alpha: support for relative file paths when importing config (#28191) (4867294), closes #26937
• scheduler-targets-alpha: KinesisDataFirehosePutRecord Target (#27842) (46f3a00), closes #27450
• scheduler-targets-alpha: KinesisStreamPutRecord Target (#27845) (47a09b5), closes #27451

• msk-alpha: MSK Kafka versions 2.8.2.tiered and 3.5.1 and StorageMode property (#27560) (f9f15fa)

• integ-tests: Fix typo in the InvocationType property from REQUEST_RESPONE to REQUEST_RESPONSE

• scheduler-targets: eventBridge putEvents target (#27629) (cd12ce4), closes #27454
• scheduler-targets: SqsSendMessage Target (#27774) (80c1d26), closes #27458
• scheduler-targets-alpha: InspectorStartAssessmentRun Target (#27850) (073958f), closes #27453
• scheduler-targets-alpha: SnsPublish scheduler target (#27838) (ff203a1), closes #27459

• cli-lib: deploy fails with "no such file or directory, open 'node_modules/@aws-cdk/integ-runner/lib/workers/db.json.gz'" (#28199) (78b34ac), closes #27813 #27983
• integ-tests: fix typo in InvocationType enum property name (#28162) (48c275c)
• msk-alpha: cluster deployment fails in ap-southeast-1 (#28112) (0ee4199), closes #28108
• scheduler: schedule not added to group with unspecified name (#27927) (cfa2d76), closes #27885

• integ-runner: fails with "no such file or directory, open 'node_modules/@aws-cdk/integ-runner/lib/workers/db.json.gz'" (#27983) (56daf0b)
• integ-runner: update workflow error message is inaccurate (#27924) (844cd6f)

• appconfig: Environment.fromEnvironmentAttributes function signature changed; property called attr is now attrs. This should affect only Python users.
  • appconfig: Extension.fromExtensionAttributes function signature changed; property called attr is now attrs. This should affect only Python users.

• appconfig: inline YAML support for hosted configuration (#27696) (de0a9e2)
• gamelift: support Build serverSdkVersion, updated OperatingSystem values (#27857) (f1bb801), closes #27655
• scheduler-targets: CodeBuild scheduler target (#27792) (9d63316), closes #27448

• appconfig: turn on awslint and fix linter errors (#27893) (5256de7), closes #27894

• appconfig: support for CfnMonitorsProperty in environments (#27680) (05f3453)
• cloud9-alpha: add support for federated-user and assumed-role for Cloud9 environment ownership (#27001) (00d2ff2)
• scheduler-alpha: target properties override (#27603) (1433ff2), closes #27545

• apigatewayv2: defaultAuthorizer cannot be applied to HttpRoute (#27576) (f397071), closes #27436
• apigatewayv2: trigger on websocket connect and disconnect is not working (#27732) (89f4f86), closes #19532 40aws-cdk/aws-apigatewayv2-integrations-alpha/lib/websocket/lambda.ts#L36

• schedule-alpha: support customer managed KMS keys (#27609) (df24d22), closes #27543

• scheduler: metrics for all schedules (#27544) (5448009), closes #23394

• glue-alpha: SparkUIProps.prefix strings in the original /prefix-name format will now result in a validation error. To retain the same behavior, prefixes must be changed to the new prefix-name/ format.

• lambda-python-alpha: add without-urls option for poetry (#27442) (5893b3f), closes #27103
• scheduler-targets: step function start execution target (#27424) (3a87141), closes 40aws-cdk/aws-scheduler-targets-alpha/lib/lambda-invoke.ts#L8 #27377

• glue-alpha: prefix validation logic is incorrect (#27472) (b898d3b), closes #27396
• integ-tests: cannot make two or more identical assertions (#27380) (ea06f7d), closes #22043 #23049

• redshift: the behavior of redshift tables has changed. UPDATE action will not be triggered on new table names and instead be triggered on table id changes.

• redshift: UserTablePriviliges to track changes using table IDs (#26955) (7e4fdc7), closes #26558

• apprunner: add HealthCheckConfiguration property in Service (#27029) (4e8c9c4), closes #26972

• appconfig: allow multiple environment monitor roles to be created (#27243) (9312c97)

• scheduler: disable Schedule on creation (#27236) (193cd3f)

• cli-lib-alpha: support hotswap deployments (#26786) (e01faff), closes #26785

• synthetics: synth-time failure for canary assets in nested stages (#27167) (7a04a5a), closes #27089 #26291

• glue: add ExternalTable for use with connections (#24753) (1c03cb3), closes #24741

• integ-tests: use transformToString on API call response body (#27122) (b0bbd5e), closes 1#L573-L576 #27114
• synthetics: include auto-delete-underlying-resources in package (#27096) (5046a9b)

• integ-tests: Uint8Arrays are not decoded properly (#27009) (47ab5c8)

• amplify: enables apps hosted with server side rendering (#26861) (c67da83), closes #24076 #23325
• scheduler: base target methods and lambda invoke target (#26575) (39cbd46)
• synthetics-alpha: add latest two NodeJS runtimes (#26967) (0a0b37c)

• app-staging-synthesizer: enable tag immutability (#26656) (0bcc4b4)
• synthetics: enable auto delete lambdas via custom resource (#26580) (6d1dc5b), closes #18448

• lambda-python: poetry bundling is broken after Aug 20 (#26823) (95f8cef)
• redshift: adding distKey to an existing table fails deployment (#26789) (8c9f0e2), closes #26733

• batch: if using spot instances on your Compute Environments, they will default to SPOT_PRICE_CAPACITY_OPTIMIZED instead of SPOT_CAPACITY_OPTIMIZED now.

• batch: grantSubmitJob method (#26729) (716871f), closes #25574
• batch: set default spot allocation strategy to SPOT_PRICE_CAPACITY_OPTIMIZED (#26731) (e0ca252)

• appconfig: L2 constructs (#26639) (e479bd4)
• glue: Job construct does not honor SparkUIProps S3 prefix when granting S3 access (#26696) (42250f1), closes #19862

• glue: synth time validation does not work in Python/Java/C#/Go (#26650) (dba8cf3), closes #26620

• glue: glue tables can include storage parameters (#24498) (f1df9ab), closes #23132

• app-staging-synthesizer: misleading error message about environment-agnostic/aware stacks (#26607) (7e2f335)
• synthetics: updated handler validation (#26569) (1eaec92), closes #26540

• app-staging-synthesizer: option to specify staging stack name prefix (#26324) (1b36124)
• apprunner: make Service implement IGrantable (#26130) (6033c9a), closes #26089
• neptune-alpha: support for Neptune serverless (#26445) (b42dbc8), closes #26428
• scheduler: ScheduleGroup (#26196) (27dc8ff)

• cli-lib: set skipLibCheck on generateSchema to prevent intermittent test failures (#26551) (1807f57)

• apprunner-alpha: This change will be destructive if the serviceName is set on an existing resources.

• glue: support Data Quality ruleset (#26272) (af3a188)
• glue: validate maxCapacity, workerCount, and workerType (#26241) (349e4d4)
• iot-actions: iot rule https action l2 construct (#25535) (3aee826), closes #25491
• synthetics: lifecycle rules for auto-generated artifact buckets (#26290) (ad0d40c), closes #22863 #22634

• apprunner-alpha: respect serviceName property (#26238) (6da9a4c), closes #26237
• batch: grant execution role logs:CreateLogStream by default (#26288) (c755f50), closes #25675
• batch: SSM parameters can't be used as ECS Container secrets (#26373) (bc3d6a7), closes #26339
• integ-tests-alpha: assertions handler is broken (#26400) (111a1cf), closes #26271 #26359 #26360
• integ-tests-alpha: incorrect sdk client resolution (#26271) (17e343a)
• redshift-alpha: incorrect CR runtime version (#26406) (c8d8421), closes #26397
• synthetics: asset code validation failed on bundled assets (#26291) (02a5482), closes #19342 #11630

• cli-lib: support bootstrap command (#26205) (9364e94)
• glue: add ExecutionClass for FLEX (#26203) (db923dd), closes #22224
• iot: add action to start Step Functions State Machine (#26059) (bd86993), closes #17698
• scheduler: ScheduleTargetInput (#25663) (bc9f3de)

• batch: Allow ECS JobDefinition Containers to pass Secrets as Environment Variables & Enable Kubernetes Secret Volumes (#26126) (dc6f120), closes #25559
• cli-lib: bundle bootstrap template (#26229) (41cb288), closes #26224
• glue: support Ray jobs with Runtime parameter (#25867) (8153237), closes #25787

• app-staging-synthesizer: select different bootstrap region (#26129) (2fec6a4)
• integ-runner: integ-runner --watch (#26087) (1fe2f09)
• integ-tests: new HttpApiCall method to easily make http calls (#26102) (00b9c84)

• batch-alpha: cannot import FargateComputeEnvironment with fromFargateComputeEnvironmentArn (#25985) (05810f4), closes 40aws-cdk/aws-batch-alpha/lib/managed-compute-environment.ts#L1071 40aws-cdk/aws-batch-alpha/lib/managed-compute-environment.ts#L1077-L1079 #25979

• app-staging-synthesizer: clean up staging resources on deletion (#25906) (3b14213), closes #25722
• batch: ephemeralStorage property on job definitions (#25399) (a8768f4), closes #25393

• apprunner: incorrect serviceName (#26015) (ad89f01), closes #26002

• batch: computeEnvironmentName is not set in FargateComputeEnvironment (#25944) (fb9f559)

• cloud9: support setting automaticStopTimeMinutes (#25593) (437345e), closes #25592

• synthetics: support runtime nodejs puppeteer 4.0 (#25553) (1d7a9a8), closes #25493
• app-staging-synthesizer: new synthesizer separates assets out per CDK application (#24430) (ae21ecc)

• batch-alpha: tag instances launched from your managed CEs (#25643) (8498740)

• servicecatalogappregistry: Revert deprecated method to keep deprecated method in alpha version (b20b123)
• batch: JobDefinition's ContainerDefinition's Image is synthesized with [Object object] (#25250) (b3d0d57)

• servicecatalogappregistry: This commit involves share replacement during the deployment of ApplicationAssociator due to share construct id update. After this change, frequent share replacements due to structural change in Application construct should be avoided. Application.shareApplication starts to require construct id (first argument) and share name (added in ShareOption) as input.
• ivs: Renamed ChannelProps.name to ChannelProps.channelName
• Renamed PlaybackKeyPairProps.name to PlaybackKeyPairProps.playbackKeyPairName
• Channel now generates a physical name if one is not provided
• PlaybackKeyPair now generates a physical name if one is not provided

• integ-runner: update workflow doesn't support resource replacement (#24720) (07d3aa7)
• ivs: Not a standard physical name pattern (#24706) (7d17fe3)
• servicecatalogappregistry: RAM Share is replaced on every change to Application (#24760) (8977d0d)

• servicecatalogappregistry: This commit contains destructive changes to the RAM Share. Since the application RAM share name is calculated by the application construct, where one method is added. Integration test detects a breaking change where RAM share will be created. Integration test snapshot is updated to cater this destructive change.

• servicecatalogappregistry: add attribute groups to an application (#24672) (7baffa2)

• kinesisanalytics-flink: VPC support for Flink applications (#24442) (7c7ad6d), closes 40aws-cdk/aws-lambda/lib/function.ts#L170 #21104

• servicecatalogappregistry: This commit contains destructive changes to the RAM Share. Since the application RAM share name is calculated by the application construct, where one property is removed. Integration test detects a breaking change where RAM share will be created. Integration test snapshot is updated to cater this destructive change.

• msk: add Kafka version 3.3.2 (#24440) (1b2014e), closes #24432
• redshift: column compression encodings and comments can now be customised (#24177) (1ca3e00), closes #24165 #23597 #22506
• redshift: columns require an id attribute (under feature flag) (#24272) (9a07ab0), closes #24234

• servicecatalogappregistry: allow disabling automatic CfnOutput (#24483) (3db1a0d), closes #23779
• servicecatalogappregistry: Associate an application with attribute group (#24378) (d1264c1)

• msk: add Kafka versions 3.1.1, 3.2.0, and and 3.3.1 (#23918) (53a1d5f), closes #23899

• servicecatalogappregistry: applicationName can not be changed after deployment (#24409) (6aa763f)

• apigatewayv2: allow websockets routes to return response to client (#22984) (f8fe1d2)
• lambda-python: add optional poetry bundling exclusion list parameter (#23670) (53beeae), closes #22585 #22585
• redshift: optionally reboot Clusters to apply parameter changes (#22063) (f61d950), closes #22009 #22055 #22059

• servicecatalogappregistry: Allow user to control stack id via stack name for Application stack (#24171) (0c7c7e4), closes #24160

• glue: support Ray jobs (#23822) (8de50d6)
• redshift: IAM roles can be attached to a cluster, post creation (#23791) (1a46808), closes #22632
• synthetics: support runtime 3.9 (#24101) (9d23cad)

• cloud9: support setting environment owner (#23878) (08a2f36), closes #22474
• redshift: Tables can include comments (#23847) (46cadd4), closes #22682

• servicecatalogappregistry: default stack name is not meaningful and causes conflict when multiple stacks deployed to the same account-region (#23823) (420b5ff)

• synthetics: Adding DeleteLambdaResourcesOnCanaryDeletion prop to the canary L2 (#23820) (45c191e)
• redshift: support default role for redshift clusters (#22551)

• apprunner: apprunner secrets manager (#23692) (a914fc0)

• integ-runner: cleanup tmp snapshot before running test (#23773) (366f2ab)

• cli-lib: [JS/TS only] experimental support for programmatic CLI api (#22836) (0b6b716)

• glue: --conf parameter is no longer a reserved keyword for glue jobs (#23673) (3d0f4ba)
• servicecatalogappregistry: outputs are not deployable (#23652) (fa9eef0), closes #23641

• gamelift: add MatchmakingConfiguration L2 Construct for GameLift (#23326) (9b2573b)
• integ-runner: support --language presets for JavaScript, TypeScript, Python and Go (#22058) (22673b2), closes #21169

• aws-redshift: Columns are not dropped on removal from array (#23011) (2981313), closes #22208

• integ-tests: add serializedJson on match utility (#23218) (1a62dc4)
• servicecatalogappregistry: Cross region warning and default application tag (#23412) (8d359ae)

• appsync: DataSource.createResolver, DataSource.createFunction, and GraphQlApi.createResolver now require 2 arguments instead of 1.
• appsync: Renames Schema to SchemaFile that implements ISchema. Removes all addXxx type methods from GraphQlApi.

• aws-lambda-python: add command hooks for bundling to allow for execution of custom commands in the build container (#23330) (d3d071f)
• gamelift: add GameSessionQueue L2 Construct for GameLift (#23266) (1ded644)

• appsync: unexpected resolver replacement (#23322) (6dc15d4), closes #13269
• servicecatalogappregistry: synth error when associating a nested stack (#23248) (30301d9)

• appsync: removes codefirst schema generation (#23250) (2bd1e41)

• servicecatalogappregistry: Stack inside ApplicationAssociator is no longer is created inside ApplicationAssociator Construct scope. The stack will now get created inside cdk.App scope.
• ** servicecatalogappregistry:** stackId will no longer have ApplicationAssociator Construct scope.

• [ X] Have you followed the guidelines in our Contributing guide?

• This PR adds new unconventional dependencies following the process described here

• Have you added the new feature to an integration test?
  • Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

• gamelift: add Alias L2 Construct for GameLift (#23042) (49d5c3a)
• gamelift: add MatchmakingRuleSet L2 Construct for GameLift (#23091) (ad8a704)
• gamelift: add support for buildArn output attribute (#23070) (08f2995)
• glue: support glue version 4.0 (#23223) (fe08aa9), closes #23220
• lambda-go: allow configuration of GOPROXY (#23171) (d189161)
• location: PlaceIndex (#22853) (50422df)
• sagemaker: add Endpoint L2 construct (#22886) (bf7586b), closes #2809

• appsync: fully qualify service principal (#23054) (0bfce89)
• servicecatalogappregistry: creating ApplicationStack in AppScope to give user more control over the passed stackId (#22977) (85fe047), closes #22973

• appsync: fully qualify service principal (#23054) (d7141dd)

• gamelift: add BuildFleet L2 Construct for GameLift (#22835) (834fab4)
• gamelift: add GameServerGroup L2 Construct for GameLift (#22762) (ef74116)
• integ-runner: support config file (#22937) (4f49efe)
• integ-runner: support custom --app commands (#22761) (a7bb6e1), closes #22521
• integ-runner: support custom --test-regex to match integ test files (#22786) (fa1a439), closes #22761 #22521
• integ-runner: support snapshot diff on nested stacks (#22881) (5b3d06d)
• sagemaker: add EndpointConfig L2 construct (#22865) (0e97c15), closes #2809
• sagemaker: add Model L2 construct (#22549) (93915f1), closes #2809

• gamelift: restrict policy to access Script / Build content in S3 (#22767) (c936002)

• synthetics: aws synthetics runtime version syn-nodejs-puppeteer-3.8 (#22707) (228c865)

• synthetics: runtime version syn-nodejs-puppeteer-3.7 (#22610) (326637c)

• redshift: support enhanced vpc routing when creating redshift cluster (#22499) (e2b18e7)

• integ-runner: Fix call to spawnSync for hooks commands (#22429) (9139ca9), closes #22344
• lambda-python: root-owned cache items not cleaned up after install (#22512) (5ef65e0), closes #22398

• integ-tests: add ability to wait for assertions to pass (#22335) (700f9c4)
• integ-tests: allow for user provided assertions stack (#22404) (39089f5)
• synthetics: new runtime synthetics nodejs puppeteer 3 6 (#22374) (e0c0b56)

• appsync: can not use Tokens in the name of a DataSource (#22378) (511eb79), closes #18900
• aws-lambda-python: export poetry dependencies without hashes (#22351) (76482f6), closes #14201 #19232
• lambda-python: commands run non-sequentially on Graviton when building container image (#22398) (e427fd6), closes #22012

• gamelift: add Build L2 constructs for GameLift (#22313) (983d26e)
• gamelift: add Script L2 Construct for GameLift (#22343) (da181ba)
• neptune: enable cloudwatch logs exports (#22004) (2b2bb01), closes #20248 #15888
• servicecatalogappregistry: application-associator L2 Construct (#22024) (a2b7a46)

• integ-tests: chain assertion api calls (#22196) (530e07b)
• neptune: introduce metric method to cluster and instance (#21995) (02ed837), closes #20248

• integ-tests: AwsApiCall Custom Resource length could be greater than 60 characters (#22119) (35b2806)
• integ-tests: can't enable lookups when creating an IntegTest (#22075) (d0e0ab9)

• neptune: add engine version 1.2.0.0 (#21908) (be65da6), closes #21877
• neptune: introduce cluster grant method for granular actions (#21926) (42e559d), closes #21877

• lambda-python: bundling artifacts are written to the entry path (#21967) (bc4427c), closes #19231

• batch: add propagate tags prop in job definition (#21904) (1bc4526), closes #21740

• lambda-python: bundling with poetry is broken (#21945) (4b37157), closes #21867
• lambda-python: poetry bundling fails on python3.7 (#21950) (809e1b0)

• glue: Added value to PythonVersion enum (#21670) (9774d4c), closes #21568 /github.com/aws/aws-cdk/issues/21568#issuecomment-1219668861
• msk: added msk cluster sasl iam property (#21798) (d30a530)

• integ-runner: array arguments aren't recognizing multiple options (#21763) (d942324), closes #20384

• python: NameError name 'SubnetSelection' is not defined (#21790) (eaaba39), closes #21790

• servicecatalogappregistry: add sharing of applications and attribute groups (#20850) (cf3bb6e)

• aws-batch: Support omitting ComputeEnvironment security groups so that they can be specified in Launch Template (#21579) (33b00dd), closes #21577
• integ-runner: ignoring asset changes doesn't work with new style assets (#21638) (7857f55)
• integ-tests: assertions stack not deployed on v2 (#21646) (ee1b66d), closes #21639

• appsync: expose the AppSyncDomain of the custom domain of an AppSync api (#21554) (d1097b5)

• redshift: The way to specify a logging bucket and prefix will change to use an interface.

• apigatewayv2: WebSocket API - IAM authorizer support (#21393) (a1a6e6c)
• appsync: allow user to configure log retention time (#21418) (a2bb263), closes #20536
• batch: ComputeEnvironment implements IConnectable (#21458) (4bc9651), closes #20983
• integ-runner: add option to show deployment output (#21466) (289fb96)
• iot-actions: add support for DynamoDBv2 rule (#20171) (a57dec3), closes #20162
• iot-actions: support for sending messages to iot-events (#19953) (35fc169)
• iotevents: support timer actions (#19949) (af301dd)

• redshift: deploy fails when creating logging bucket without s3 key (#21243) (220177f)

• cognito-identitypool: providerUrl causes error when mappingKey is not provided and it is a token (#21191) (d91c904), closes #19222 /github.com/aws/aws-cdk/pull/21056#issuecomment-1178879318

• Revert to [email protected] as dynamic runtime type-checking it introduced for Python results in incorrect code being produced.

• appsync: support for read consistency during DynamoDB reads (#20793) (0b911ef)
• batch: add default AWS_ACCOUNT and AWS_REGION to Batch container, if they are not explicitly set (#21041) (eed854e)

• cloud9: The imageId parameter is now required and deployments will fail without it

• cloud9: support imageid when creating cloud9 environment (#21194) (dcf3eb3)
• redshift: adds elasticIp parameter to redshift cluster (#21085) (c88030f), closes #19191

• appsync: set max batch size when using batch invoke (#20995) (69d25a6), closes #20467
• batch: add launchTemplateId in LaunchTemplateSpecification (#20184) (269b8d0), closes #20163
• glue: enable partition filtering on tables (#21081) (bf35048), closes #20825
• integ-tests: expose adding IAM policies to the assertion provider (#20769) (c2f40b7)
• neptune: add engine version 1.1.1.0 (#21079) (a113816), closes #20869
• redshift: adds classic or elastic resize type option (#21084) (b5e9c1a), closes #19430

• appsync: domain name api association fails when domain name creation is in the same stack (#20173) (c1495f0), closes #18395
• integ-runner: test names change depending on the discovery directory (#21093) (d38f78c)

• batch: add secrets props to job definition (#20871) (9b1051f), closes #19506 #10976

• appsync: Create Lambda permission when using Lambda Authorizer(#… (#20641) (6176400), closes #20234
• integ-runner: don't allow new legacy tests (#20614) (c946615)

• integ-runner: publish integ-runner cli (#20477) (7779531)

• integ-runner: catch snapshot errors, treat --from-file as command-line (#20523) (cedfde8)
• integ-runner: don't throw error if tests pass (#20511) (c274c2f), closes #20384

• apprunner: VpcConnector construct (#20471) (5052191)

• integ-runner: always resynth on deploy (#20508) (7138057)
• integ-tests: DeployAssert should be private (#20466) (0f52813)

• cloud9: configure Connection Type of Ec2Environment (#20250) (01708bc), closes #17027
• integ-tests: enhancements to integ-tests (#20180) (3ff3fb7)

• amplify: custom headers break with tokens (#20395) (765f441)

• appsync: incorrect region used for imported Cognito user pool (#20193) (3e0393e), closes #20195

• redshift: expose user.secret as property (#17520) (#20078) (8da006a)

• integ-runner: disable-update-workflow default is 'false' instead of false (#20073) (9f7aa65)
• integ-runner: only diff registered stacks (#20100) (721bd4b)

• integ-tests: add IntegTest to group test cases (#20015) (b4f8d91)
• integ-tests: make assertions on deployed infrastructure (#20071) (8362efe)

• lambda-python: handler path is incorrectly generated when using PythonFunction (#20083) (6787376)
• lambda-python: Pipenv projects no longer work for Python 3.6 (#20019) (c5dcdeb)
• lambda-python: Pipenv projects no longer work for Python 3.6 (#20019) (5024021)

• apigatewayv2: set throttling on stages (#19776) (3cabd10), closes #19626
• integ-runner: add missing features from the integ manifest (#19969) (2ca5050)
• integ-runner: integ-runner enhancements (#19865) (697fdbe)
• integ-runner: test update path when running tests (#19915) (d0ace8f)
• integ-tests: Add IntegTestCase (#19829) (ad249c9)
• iotevents: support comparison operators (#19329) (95cb3f3)

• integ-runner: enable all feature flags by default (#19955) (ca3920d)
• lambda-python: Pipenv projects no longer work for Python 3.6 (#20019) (08cfc2d)

• synthetics: new puppeteer 3.5 runtime (#19673) (ce2b91b), closes #19634

• kinesisanalytics-flink: Add metrics to Flink applications (#19599) (dab6aca)

• appsync: support custom domain mappings (#19368) (8c7a4ac), closes #18040
• synthetics: add support for puppeteer 3.4 runtime (#19429) (024b890), closes #19382

• appsync: add OpenSearch domain data source (#16529) (922a9dc), closes #16528
• iotevents: support SetVariable action (#19305) (c222b12)
• synthetics: add vpc configuration (#18447) (c991e92), closes #11865 #9954

• aws-s3objectlambda: add L2 construct for S3 Object Lambda (#15833) (fe9f750), closes #13675
• iotevents: support actions (#18869) (e01654e)
• iotevents: support setting Events on input and exit for State (#19249) (ffa9e0d)
• servicecatalog: Service Catalog is now in Developer Preview (#19204) (6dfc254)

• apigatewayv2-integrations: in case of multiple routes, only one execute permission is created (#18716) (1e352ca)
• lambda-python: asset bundling fails on windows (#19270) (0da57da), closes #18861
• lambda-python: docker image gets built even when we don't need to bundle assets (#16192) (5dc61ea), closes #14747

• aws-lambda-python: skip default docker build when image passed (#19143) (7300f2e), closes #18082

• apigatewayv2: Import existing WebSocketApi from attributes (#18958) (f203845)

• iot-actions: add SNS publish action (#18839) (3a39f6b), closes #17700
• iotevents: create new module for IoT Events actions (#18956) (3533ea9), closes /github.com/aws/aws-cdk/pull/18869#discussion_r802719713

• synthetics: generated role has incorrect permissions for cloudwatch logs (#18946) (f8bb85f), closes #18910

• iotevents: support transition events (#18768) (ccc1988), closes #17711

• amplify: support performance mode in Branch (#18598) (bdeb8eb), closes #18557
• iot: add Action to republish MQTT messages to another MQTT topic (#18661) (7ac1215)
• iotevents: add grant method to Input class (#18617) (e89688e)

• aws-appsync: Strip unsupported characters from Lambda DataSource (#18765) (bb8d6f6)

• servicecatalog: TagOptions now have scope and props argument in constructor, and data is now passed via a allowedValueForTags field in props

• iotevents: add DetectorModel L2 Construct (#18049) (d0960f1), closes #17711 #17711
• iotevents: allow setting description, evaluation method and key of DetectorModel (#18644) (2eeaebc)
• lambda-python: support setting environment vars for bundling (#18635) (30e2233)
• servicecatalog: Create TagOptions Construct (#18314) (903c4b6), closes #17753

• apigatewayv2: websocket api: allow all methods in grant manage connections (#18544) (41c8a3f), closes #18410
• synthetics: correct getbucketlocation policy (#13573) (e743525), closes #13572

• aws-neptune: add autoMinorVersionUpgrade to cluster props (#18394) (8b5320a), closes #17545
• iot: add Action to put record to Kinesis Data stream (#18321) (1480213), closes #17703

• apigatewayv2: HttpIntegrationType.LAMBDA_PROXY has been renamed to HttpIntegrationType.AWS_PROXY

• apigatewayv2: HttpRouteIntegration supports AWS services integrations (#18154) (a8094c7), closes #16287
• apigatewayv2: support for mock integration type (#18129) (7779c14), closes #15008

• iot: the class FirehoseStreamAction has been renamed to FirehosePutRecordAction
• apigatewayv2-authorizers: WebSocketLambdaAuthorizerProps.identitySource default changes from ['$request.header.Authorization'] to ['route.request.header.Authorization'].

• apigatewayv2: websocket api: api keys (#16636) (24f8f74)

• apigatewayv2-authorizers: incorrect identitySource default for WebSocketLambdaAuthorizer (#18315) (74eee1e), closes #16886 /docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2 #18307
• iot: FirehoseStreamAction is now called FirehosePutRecordAction (#18356) (c016a9f), closes /github.com/aws/aws-cdk/pull/18321#discussion_r781620195
• lambda-python: asset files are generated inside the 'asset-input' folder (#18306) (b00b44e)
• lambda-python: asset files are generated inside the 'asset-input' folder (#18306) (aff607a)
• lambda-python: bundle asset files correctly (#18335) (3822c85), closes /github.com/aws/aws-cdk/pull/18306#discussion_r780186564 #18301 /github.com/aws/aws-cdk/pull/18082#issuecomment-1008442363

• lambda-python: asset files are generated inside the 'asset-input' folder (backport #18306) (#18341) (a1715e4)

• lambda-python: assetHashType and assetHash properties moved to new bundling property.
• lambda-python: Runtime is now required for LambdaPython
• appsync: The CachingConfig#ttl property is now required.

• amplify: Add Amplify asset deployment resource (#16922) (499ba85), closes #16208
• apigatewayv2: http api - IAM authorizer support (#17519) (fd8e0e3), closes #15123 /github.com/aws/aws-cdk/pull/14853#discussion_r648952691 #10534
• apigatewayv2: Lambda authorizer for WebSocket API (#16886) (67cce37), closes #13869
• glue: support partition index on tables (#17998) (c071367), closes #17589
• iot: Action to send messages to SQS queues (#18087) (37537fe), closes #17699
• iot: add Action to set a CloudWatch alarm (#18021) (de2369c), closes #17705
• lambda-python: support for providing a custom bundling docker image (#18082) (c3c4a97), closes #10298 #12949 #15391 #16234 #15306
• msk: add Kafka versions 2.6.3, 2.7.1 and 2.7.2 (#18191) (8832df1)

• amplify: deploy asset Custom Resource points to TS file (#18166) (a1508af)
• appsync: ttl property of CachingConfig is not required (#17981) (73e5fec)
• lambda-python: runtime is now required (#18143) (98f1bb1), closes #10248

• glue: the grantRead API previously included 'glue:BatchDeletePartition', and now it does not.

• iotevents: add IoT Events input L2 Construct (#17847) (9f03dc4), closes /github.com/aws/aws-cdk/issues/17711#issuecomment-986153267

• appsync: empty caching config is created when not provided (#17947) (3a9f206)
• glue: remove batchDeletePartition from grantRead() permissions (#17941) (3d64f9b), closes #17935 #15116

• apigatewayv2-authorizers: The default value for the prop authorizerName in HttpJwtAuthorizerProps has changed.
• apigatewayv2-authorizers: HttpJwtAuthorizer now takes the construct id and the target jwt issuer as part of its constructor.
• apigatewayv2-authorizers: HttpLambdaAuthorizer now takes the construct id and the target lambda function handler as part of its constructor.
• apigatewayv2-authorizers: The default value for the prop authorizerName in HttpUserPoolAuthorizerProps has changed.
• apigatewayv2: The HttpIntegration and WebSocketIntegration classes require an "id" parameter to be provided during its initialization.
• apigatewayv2-integrations: The LambdaWebSocketIntegration is now renamed to WebSocketLambdaIntegration. The new class accepts the handler to the target lambda function directly in its constructor.
• apigatewayv2-integrations: HttpProxyIntegration and HttpProxyIntegrationProps are now renamed to HttpUrlIntegration and HttpUrlIntegrationProps respectively. The new class accepts the target url directly in its constructor.
• apigatewayv2-integrations: LambdaProxyIntegration and LambdaProxyIntegrationProps are now renamed to HttpLambdaIntegration and HttpLambdaIntegrationProps respectively. The new class accepts the lambda function handler directly in its constructor.
• apigatewayv2-integrations: HttpAlbIntegration now accepts the ELB listener directly in its constructor.
• apigatewayv2-integrations: HttpNlbIntegration now accepts the ELB listener directly in its constructor.
• apigatewayv2-integrations: HttpServiceDiscoveryIntegration now accepts the service discovery Service directly in its constructor.
• apigatewayv2-authorizers: UserPoolAuthorizerProps is now renamed to HttpUserPoolAuthorizerProps.
• apigatewayv2: The interface IHttpRouteIntegration is replaced by the abstract class HttpRouteIntegration.
• apigatewayv2: The interface IWebSocketRouteIntegration is now replaced by the abstract class WebSocketRouteIntegration.
• apigatewayv2: Previously, we allowed the usage of integration classes to be used with routes defined in multiple HttpApi instances (or WebSocketApi instances). This is now disallowed, and separate instances must be created for each instance of HttpApi or WebSocketApi.

• iot: add Action to capture CloudWatch metrics (#17503) (ec4187c), closes /github.com/aws/aws-cdk/pull/16681#issuecomment-942233029
• neptune: add engine version 1.1.0.0 and instance types t4g, r6g (#17669) (83e669d)
• servicecatalog: Add TagOptions to a CloudformationProduct (#17672) (2d19e15)

• apigatewayv2: integration class does not render an integration resource (#17729) (3b5b97a), closes #13213
• apprunner: startCommand and environment are ignored in imageConfiguration (#16939) (d911c58), closes #16812
• appsync: add caching config to AppSync resolvers (#17815) (52b535b)
• appsync: remove 'id' suffix to union definition key (#17787) (86e7780), closes #17771
• assert: support multiline strings with stringLike() (#17692) (37596e6)

• apigatewayv2: integration api re-organization (#17752) (29039e8)
• apigatewayv2-authorizers: re-organize authorizer api (#17772) (719f33e)

• apigatewayv2: domain endpoint type, security policy and endpoint migration (#17518) (261b331)
• apigatewayv2: http api - mTLS support (#17284) (54be156), closes #12559
• apigatewayv2: websocket api: grant manage connections (#16872) (10dfa60), closes #14828
• iot: add Action to put objects in S3 Buckets (#17307) (49b87db), closes /github.com/aws/aws-cdk/pull/16681#issuecomment-942233029
• iot: add Action to put records to a Firehose stream (#17466) (7cb5f2c), closes /github.com/aws/aws-cdk/pull/16681#issuecomment-942233029
• msk: add Kafka version 2.6.2 (#17497) (5f1f476)
• redshift: Add support for distStyle, distKey, sortStyle and sortKey to Table (#17135) (a137cd1), closes #17125
• servicecatalog: support local launch role name in launch role constraint (#17371) (b307b69)

• iot: unable to add the same lambda function to two TopicRule Actions (#17521) (eda1640), closes #17508
• redshift: tableNameSuffix evaluation (#17213) (f7c3217), closes #17064

• apigatewayv2-authorizers: userPoolClient property in UserPoolAuthorizerProps is now renamed to userPoolClients.

• apigatewayv2-authorizers: http api - allow multiple user pool clients per HttpUserPoolAuthorizer (#16903) (747eb7c), closes #15431
• iot: allow setting description and enabled of TopicRule (#17225) (a9aae09), closes /github.com/aws/aws-cdk/pull/16681#issuecomment-942233029
• iot: allow setting errorAction of TopicRule (#17287) (e412308), closes /github.com/aws/aws-cdk/pull/16681#issuecomment-942233029
• iot: allow setting Actions of TopicRule (#17110) (0cabb9f), closes #16681 /github.com/aws/aws-cdk/pull/16681#discussion_r733912215
• iot-actions: Add the action to put CloudWatch Logs (#17228) (a7c869e), closes /github.com/aws/aws-cdk/pull/16681#issuecomment-942233029
• servicecatalog: allow creating a CFN Product Version with CDK code (#17144) (f8d0ef5)
• synthetics: add static cron method to schedule class (#17250) (1ab9b26), closes #16402

• amplify: Add support for custom headers in the App (#17102) (9f3abd7), closes #17084
• synthetics: add syn-nodejs-puppeteer-3.3 runtime (#17132) (8343bec)

• redshift: cluster uses key ARN instead of key ID (#17108) (bdf30c6), closes #17032

• iot: create new aws-iot-actions module (#17112) (06838e6), closes #16681 /github.com/aws/aws-cdk/pull/16681#discussion_r733912215

• apigatewayv2-integrations: http api - support for request parameter mapping (#15630) (0452aed)
• iot: add the TopicRule L2 construct (#16681) (86f85ce), closes #16602
• msk: add Kafka version 2.8.1 (#16881) (7db5c8c)

• apigatewayv2: unable to retrieve domain url for default stage (#16854) (c6db91e), closes #16638

• assertions: Starting this release, the assertions module will be published to Maven with the name 'assertions' instead of 'cdk-assertions'.
• assertions: Match.absentProperty() becomes Match.absent(), and its type changes from string to Matcher.
• assertions: The templateMatches() API previously performed an exact match. The default behavior has been updated to be "object-like".
• assertions: the findResources() API previously returned a list of resources, but now returns a map of logical id to resource.
• assertions: the findOutputs() API previously returned a list of outputs, but now returns a map of logical id to output.
• assertions: the findMappings() API previously returned a list of mappings, but now returns a map of logical id to mapping.

• appsync: Lambda Authorizer for AppSync GraphqlApi (#16743) (bdbe8b6), closes #16380
• assertions: capture matching value (#16426) (cc74f92)
• assertions: findXxx() APIs now includes the logical id as part of its result (#16454) (532a72b)
• assertions: match into serialized json (#16456) (fed30fc)
• assertions: matcher support for templateMatches() API (#16789) (0fb2179)
• aws-apprunner: support the Service L2 construct (#15810) (3cea941), closes #14813
• batch: fargate support for jobs (#15848) (066bcb1), closes #13591 #13590 #13591
• glue: Job construct (#12506) (fc74110), closes #12443
• neptune: add engine version 1.0.5.0 (#16394) (deaac4a), closes #16388
• redshift: manage database users and tables via cdk (#15931) (a9d5118), closes #9815

• apigatewayv2: ApiMapping does not depend on DomainName (#16201) (1e247d8), closes #15464
• assertions: hasResourceProperties is incompatible with Match.not and Match.absent (#16678) (6f0a507), closes #16626
• aws-servicecatalog: Allow users to create multiple product versions from assets. (#16914) (958d755)
• route53resolver: FirewallDomainList throws with wildcard domains (#16538) (643e5ee), closes #16527

• assertions: consistent naming in maven (#16921) (0dcd9ec)
• assertions: replace absentProperty() with absent() and support it as a Matcher type (#16653) (c980185)