chore(deps): update dependency aws-cdk-lib to v2.173.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aws-cdk-lib (source)	2.133.0 -> 2.173.2

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.173.2

Compare Source

Bug Fixes

• cli: allow credential plugins to return null for expiration (#​32554) (e59b1db)
• cli: doesn't support plugins that return initially empty credentials (#​32552) (7ee9b90)

---

Alpha modules (2.173.2-alpha.0)

v2.173.1

Compare Source

Bug Fixes

• cli: getting credentials via SSO fails when the region is set in the profile (#​32520) (01fec04)

---

Alpha modules (2.173.1-alpha.0)

v2.173.0

Compare Source

Features

• cognito: user pool feature plans (#​32367) (39c22de), closes #​32369
• dynamodb: add precision timestamp for kinesis stream (#​31863) (625c431), closes #​31761
• dynamodb: add warm-throughput to L2 constructs (#​32390) (496bc78), closes #​32127
• route53: added EvaluateTargetHealth to Route53 Alias targets (#​9481) (#​30664) (c23be8c), closes #​30739
• route53: added L2 construct for Route53's health checks (#​30739) (7fdd974), closes #​9481 #​30664
• stepfunctions-tasks: support dynamic values for Glue Job Worker Type (#​32453) (7df954c)
• update L1 CloudFormation resource definitions (#​32446) (093c540)

Bug Fixes

• autoscaling: AutoScalingGroup requireImdsv2 with launchTemplate or mixedInstancesPolicy throws unclear error (#​32220) (06cdaac), closes #​27586 #​27586
• cli: assuming a role from the INI file fails in non-commercial regions (#​32456) (7028242)
• cloudformation-include: string arrays inside unknown properties cannot be parsed (#​32461) (0c2f98b)
• cloudwatch: period of each metric in usingMetrics for MathExpression is ignored (#​30986) (59e96a3), closes /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-cloudwatch/lib/metric.ts#L606-L608 /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-cloudwatch/lib/metric.ts#L566
• elasticloadbalancingv2: cannot create UDP listener for dual-stack NLB (#​32184) (e9c6e23), closes /github.com/aws/aws-cdk/pull/32184#issuecomment-2510536270
• lambda: improve validation errors for lambda functions (#​32323) (2607eb3), closes #​32324
• rds: serverlessV2MaxCapacity can be set to 0.5, which is invalid (#​32232) (3fe229d), closes /docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-serverlessv2scalingconfiguration.html#cfn-rds-dbcluster-serverlessv2
• stepfunctions-task: elasticloadbalancingv2 service policy (#​32419) (2677fce), closes #​32417 /github.com/aws/aws-cdk/blame/2607eb3a905f735b96713dda4f32d28d10d686fd/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/aws-sdk/call-aws-service.ts#L93-L97
• synthetics: canary name can be up to 255 characters (#​32385) (231e1bf), closes #​32376

---

Alpha modules (2.173.0-alpha.0)

Features

• redshift-alpha: add support for RA3.large node type (#​31637) (ce0e09f), closes #​31634

v2.172.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• apigateway: We will be removing deprecated APIGatewayV2 constructs from aws-apigateway module.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Features

• aspects: priority-ordered aspect invocation (#​32097) (8ccdff4), closes #​21341 /github.com/aws/aws-cdk/blob/8b495f9ec157c0b00674715f62b1bbcabf2096ac/packages/aws-cdk-lib/core/lib/private/synthesis.ts#L217
• cognito: new cloudFrontEndpoint method for user pool domain without custom resource (#​31402) (deeb2ad), closes #​31342 /github.com/go-to-k/aws-cdk/blob/fcbdc769e681f1f915cdc8cd7aa3a565d807884d/packages/aws-cdk-lib/aws-route53-targets/lib/userpool-domain.ts#L14
• cognito: support for ALLOW_USER_AUTH explicit auth flow (#​32273) (c5bcfdc)
• elasticloadbalancingv2: ip address type for both network and application target group (#​32189) (7cc5f30)
• events: add filter rules for prefixEqualsIgnoreCase, suffixEqualsIgnoreCase, wildcard, and anythingBut* matches (#​32063) (0ce71fc), closes #​28462
• lambda-nodejs: add bun support (#​31770) (aed8ad1), closes #​31753 #​31753
• rds: limitless database cluster (#​32151) (f4c19c7)
• ses: add support to disable account-level suppression list (#​32168) (bb50c1a), closes #​32149
• update L1 CloudFormation resource definitions (#​32272) (421d327)
• update L1 CloudFormation resource definitions (#​32356) (9e6bb24)
• route53-targets: add AppSync route53 target (#​31976) (dc7574a), closes #​26109

Bug Fixes

• apigateway: remove deprecated apigatewayv2 from aws-apigateway module (#​32297) (4db9565)
• appsync: appsync.HttpDataSourceProps erroneously extends BaseDataSourceProps (#​32065) (4e7f5c4), closes #​29689
• cli: assume role calls are skipping the proxy (#​32291) (6c0f74e)
• cli: lambda hotswap fails if lambda:GetFunctionConfiguration action is not allowed (#​32301) (be000a2), closes /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdatedV2.ts#L10 /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdated.ts#L13
• cli: mfa code is not requested when $AWS_PROFILE is used (#​32313) (6458439), closes #​32312
• cli: remove source maps (#​32317) (512cf95), closes #​19930 #​19930
• cli: short-lived credentials are not refreshed (#​32354) (058a0bf)
• cli: warns about missing --no-rollback flag that is present (#​32309) (559d676), closes #​32295
• cloudformation-include: drops unknown policy attributes (#​32321) (20edc7f)
• cloudfront: propagate originAccessControlId CloudFront Origin property to CloudFormation templates (#​32020) (f9708a6), closes #​32018
• iam: Role.addManagedPolicy() does not work for imported roles IRole #​8307 (#​31212) (c78ef1b), closes /github.com/aws/aws-cdk/blob/823ff6e03899f790a4cb1c43f92a02cc906ac356/packages/aws-cdk-lib/aws-iam/lib/identity-base.ts#L17-L21

---

Alpha modules (2.172.0-alpha.0)

Features

• ec2: default BastionHostLinux to use Amazon Linux 2023 (under feature flag) (#​31996) (bf77e51), closes #​29493 #​29493
• ec2: instance support passing IAM instance profile (#​32073) (cf89d0f), closes #​8348
• neptune: auto minor version upgrade for an instance (#​31988) (d95db49)
• pipes: add LogDestination implementation (#​31672) (af5345e), closes #​31671
• pipes-targets: add API Gateway (#​31954) (c77536f)
• redshift: execute resource action (#​31995) (40835a0)

Bug Fixes

• scheduler-targets-alpha: incorrect validation of maximumEventAge (#​32284) (2eebc59)

v2.171.1

Compare Source

Bug Fixes

• cli: lambda hotswap fails if lambda:GetFunctionConfiguration action is not allowed (#​32301) (a073e93), closes /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdatedV2.ts#L10 /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdated.ts#L13

---

Alpha modules (2.171.1-alpha.0)

v2.171.0

Compare Source

Features

• rds: enhanced monitoring configuration at the cluster level (#​32157) (01f2dcd), closes #​32151
• rds: support zero ACU for Aurora Serverless V2 (#​32231) (d1b07d9)

Bug Fixes

• cli: sso with proxy fails (#​32261) (bedcf16)

---

Alpha modules (2.171.0-alpha.0)

v2.170.0

Compare Source

Features

• lambda: support for Provisioned Pollers (#​32205) (68b969e)
• vpcv2: vpc peering connection construct (#​31645) (e1195f9), closes RFC#507 1#L252

Bug Fixes

• cli: sts retry options are ignored (#​32227) (193ab8c)

Reverts

• "fix(ecr): allow creating repository uri to use tokens like cfn params" (#​32241) (b3e39a9), closes #​32238

---

Alpha modules (2.170.0-alpha.0)

v2.169.0

Compare Source

Features

• cloudfront: add attachWebAclId method for Distribution (#​30567) (cbe2bec)
• update L1 CloudFormation resource definitions (#​32223) (5d61a1b)
• sns: add delivery policy to sns subscriptions (#​30830) (27babe6), closes #​17576

Bug Fixes

• cli: cannot assume a doubly-chained role (#​32216) (8746e44)
• cli: proxy is not configured correctly (#​32213) (ec58c77)
• s3: key rotation is not enabled while creating KMS encrypted S3 buckets (#​32064) (e3024fc), closes #​31982

---

Alpha modules (2.169.0-alpha.0)

Features

• location: support Map (#​30648) (98b801c), closes #​30647
• scheduler: scheduler and scheduler-targets modules are now in Developer Preview (#​32207) (8776832), closes #​31785

Bug Fixes

• location: underscores are not allowed in the name (#​32046) (f6ad9c9)

v2.168.0

Compare Source

Features

• cloudfront: function URL origin access control L2 construct (#​31339) (b8f47c8), closes #​31629
• elasticloadbalancingv2: support target group level cross-zone settings for ALB and NLB (#​31814) (6b0b1e1), closes #​31790
• lambda: add NodeJS 22.x support (#​32104) (baa8561)
• lambda: support observability for ESM ( DDB, Kinesis, SQS) (#​32204) (6317a2a)
• lambda-destinations: support Lambda async S3 destination (#​31709) (e1a2f68)
• ses: maximum delivery time for emails (#​32102) (771eeff)
• update L1 CloudFormation resource definitions (#​32175) (6820c62)
• rds: support 8.0.40 engine version for RDS for MySQL (#​32117) (dcb5cf1)
• stepfunctions-tasks: create scheduler (#​29458) (d14a01c), closes #​29351

Bug Fixes

• cdk: remove source-map-support from typescript init templates (#​32113) (d5c0aa2), closes #​20754 #​30231
• cdk: use built-in source map support (#​32115) (5d499dc)
• cli: cdk diff always falls back to template only diff (#​32165) (089e9d8)
• cli: excessive stack event polling during deployment (#​32196) (a8bc46d), closes /github.com/aws/aws-cdk/blob/7bb9203eb95fe894c0d40942ff49c782a9fec251/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts#L73-L74
• cli: externally managed stack notification arns are deleted on deploy (#​32163) (9966f57)
• cli: failure to get credentials when session token is not set (#​32134) (9ef4e72)
• cli: region specified in ~/.aws/credentials is ignored (#​32133) (d1b3c81), closes #​32130
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#​32164) (f75dc72)
• eks: eks.AccessEntryType.STANDARD maps to a wrong value (#​31147) (1bbb456)

---

Alpha modules (2.168.0-alpha.0)

Bug Fixes

• scheduler-targets-alpha: imported target resources as schedule target throws synth error (#​32105) (1a8306f), closes #​31785 /github.com/aws/aws-cdk/pull/29615#issuecomment-2417858246
• scheduler-targets-alpha: kinesis data firehose target uses l1 instead of l2 (#​32150) (11384f0), closes #​31785
• scheduler-targets-alpha: scope down permissions for sqs and kinesis stream targets (#​32122) (6bb142e), closes #​31785

v2.167.2

Compare Source

Bug Fixes

• cli: cdk diff always falls back to template only diff (#​32165) (3fd9699)
• cli: externally managed stack notification arns are deleted on deploy (#​32163) (465da31)
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#​32164) (a0b47c5)

---

Alpha modules (2.167.2-alpha.0)

v2.167.1

Compare Source

Bug Fixes

• cli: failure to get credentials when session token is not set (#​32134) (425efbc), closes #​32120
• cli: region specified in ~/.aws/credentials is ignored (#​32133) (9859f33), closes #​32130

---

Alpha modules (2.167.1-alpha.0)

v2.167.0

Compare Source

Features

• cli: upgrade aws-sdk to sdkv3 (#​31702) (5bc0662), closes #​25870 #​26292 #​20956 #​24744 #​27265
• elasticloadbalancingv2: enable zonal shift for network load balancer (#​31990) (497abdc), closes #​31983
• kms: support KEY_AGREEMENT for keyUsage (#​30993) (2323877), closes #​30989
• lambda: add Python 3.13 runtime (#​32054) (e0ebcfe)
• lambda: add supportsSnapStart config to dotnet8 and python 3.12 (#​32112) (53f4713)
• lambda: support for customer managed encryption (CMCMK) (#​32072) (2f16415)
• update L1 CloudFormation resource definitions (#​32090) (6303b72)
• rds: support minor engine versions for oracle (#​32058) (3d72b63)
• rds: support minor versions for RDS for SQL Server (#​32055) (8c80bf8)
• service-catalog: allow Product Stack to override analytics reporting and stack descriptions (#​31985) (d8ad02a), closes #​31924

Bug Fixes

• ecr: allow creating repository uri to use tokens like cfn params (#​32053) (5648199), closes #​31860

---

Alpha modules (2.167.0-alpha.0)

Features

• ivs: support recording configuration for channel (#​31899) (8a3734d), closes #​31780
• redshift: relocating a cluster (#​31993) (b763d86)

Bug Fixes

• scheduler-targets-alpha: add dlq policy to execution role instead of queue policy (#​32032) (b953b2a), closes #​31785

v2.166.0

Compare Source

Features

• cli: automatically roll back stacks if necessary (#​31920) (2f9fb1e), closes #​30546
• kinesis: support resource policy for a data stream (#​31909) (18fbd6d), closes #​28814
• rds: configure autoMinorVersionUpgrade for a database cluster (#​31962) (0fb6106)
• route53: support HTTPS, SSHFP, SVCB, and TLSA DNS resource record (#​31955) (afc2b0d), closes /docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-route53-recordset.html#cfn-route53
• synthetics: add artifactS3Encryption property to the Canary Construct. (#​30197) (1f39cb9), closes #​30190
• update L1 CloudFormation resource definitions (#​32007) (be6a964)

Bug Fixes

• deploy-time stack tags cause synthesis to fail (#​32041) (18c19fd), closes #​32040
• aws_route53: cannot use CfnParameter.valueAsNumber for L2 RecordSet weight (#​31823) (14561ac), closes #​31810
• cli: asset uploads fail if Object Lock is enabled on access bucket (#​31937) (ab1e91d)
• dynamoDB: make TableV2 taggable (#​31867) (796c6d1), closes #​30631
• opensearch: add I4G to list of OpenSearch nodes not requiring EBS volumes (#​31948) (73378f2)

---

Alpha modules (2.166.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• scheduler-targets-alpha: Schedule Target will reuse role if target is re-used across schedules. This change triggered replacement of existing roles for Schedule as logical ID of the roles are changed.

Features

• glue-alpha: add job run queuing to Glue job (#​31830) (5fca268), closes #​31826

Bug Fixes

• scheduler-targets-alpha: create a role per target instead of singleton schedule target role (#​31895) (aee1b30), closes #​31785

v2.165.0

Compare Source

Features

• bootstrap: add lifecycle rule to abort multipart uploads after 7 days (#​31956) (b800da8), closes #​29045
• bootstrap: delete noncurrent versions after 30 days (#​31949) (579041e)
• cli: garbage collect ecr assets (under --unstable flag) (#​31841) (da85e54), closes #​31611
• codebuild: add support of organization webhook in github source (#​31740) (8c15b5f), closes #​31736
• cognito: support UserPoolGroup (#​31351) (408b20f), closes #​21026
• update L1 CloudFormation resource definitions (#​31917) (8c93291)

Bug Fixes

• assertions: throw error or warn when synth is called multiple times on mutated construct tree (#​31865) (a261c9d), closes #​24689
• cli: ecr garbage collection hangs when repository has no images (#​31951) (a235a9f)
• cli: garbage collection ignores review_in_progress stacks (#​31906) (cb3ecfe)
• s3-assets: cannot publish a file without extension (#​30597) (ccab485), closes #​30471
• sqs: queue with fifo: false does not deploy (#​31922) (a9d3b02), closes #​8550
• enable node-fips compatible body checksums for S3 (#​31883) (4f29c1d)

---

Alpha modules (2.165.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• ec2-alpha: The new VpcCidrBlock L2 construct replaces CfnVPCCidrBlock. This change alters the logical ID of AWS::EC2::VPCCidrBlock resources in CloudFormation templates. Existing deployments will see errors like CIDR range conflicts with x.xx.xx.xx/xx with association ID vpc-cidr-assoc-ABCD. To resolve this, you must recreate your existing stacks to use the new module.

Features

• apprunner: support vpc ingress connection (#​30623) (048e753), closes #​22850
• ec2-alpha: adding imports for SubnetV2 and VpcV2 (#​31765) (d108a80)
• location: support Tracker and TrackerConsumer (#​31268) (046f041), closes #​30712
• pipes-enrichments: support API Gateway enrichment (#​31794) (09052c2), closes #​29384
• pipes-targets: add SageMaker (#​30696) (a5fdf57)
• redshift-alpha: query execution timeout setting during table creation (#​31818) (40f07ae), closes #​31329

Bug Fixes

• location: remove base class from PlaceIndex class (#​31287) (bc67866), closes #​30711 #​30682
• scheduler-alpha: scheduler input always get transformed to string with extra double quotes (#​31894) (186b8ab)
• scheduler-alpha: too many KMS permissions granted (#​31923) (06678a3), closes #​31785

v2.164.1

Compare Source

Bug Fixes

• enable node-fips compatible body checksums for S3 (#​31883) (290a499)

---

Alpha modules (2.164.1-alpha.0)

v2.164.0

Compare Source

Features

• cli: add ability to configure hotswap properties for ECS (#​30511) (fee2cf8), closes #​29618
• cognito: support email based MFA (#​31816) (f9d6eef), closes #​31815
• cognito: the Cognito Identity Pools module is now in Developer Preview (#​31854) (b22899f)

Bug Fixes

• cli: cross-account asset publishing doesn't work without bootstrap stack (#​31876) (427bf63), closes #​31866
• cli: deploy-role is not authorized to perform DescribeStackResources (#​31878) (8d06824)
• core: fix policy synthesizer logic for precreated roles (#​31710) (aae03c9)
• dynamodb: replication regions are incompatible with resource policies in TableV2 and feature flag (#​31513) (0b03eb0), closes #​30705
• events-targets: kinesis Stream target with Customer-Managed KMS key causes EventBridge FailedInvocations (#​31836) (58dfda0), closes #​10996

---

Alpha modules (2.164.0-alpha.0)

Features

• iot: scheduled audit (#​31776) (366b492), closes #​31779

Bug Fixes

• ec2: allow NAT instance to associate public IP (#​31812) (e96b4ce), closes #​31711
• scheduler-targets-alpha: imported lambda function as schedule target throws synth error (#​31837) (d1d179f), closes #​29284

v2.163.1

Compare Source

Bug Fixes

• 'Need to perform AWS calls for account' when doing cross-account deployments (#​31846) (5aa63d1), closes #​31845

---

Alpha modules (2.163.1-alpha.0)

v2.163.0

Compare Source

Features

• cli: garbage collect s3 assets (under --unstable flag) (#​31611) (0a0e4ad)
• cognito: support emailVerified for AttributeMapping interface (#​31632) (5de7835), closes #​30467 #​30467
• dynamodb: enable contributor insights for global secondary index (#​30560) (799b541), closes #​15671
• ecs-patterns: support NLB with TLS listener and target group (#​30611) (f4f8abc), closes #​8517
• efs: allow AccessPoint to set client token (#​31184) (8208774)
• events: dead letter queue for an Event Bus (#​30628) (318eae6), closes #​30531
• fsx: specify file system type version for the Lustre file system (#​31136) (252cca9), closes #​31130
• fsx: support HDD storage type for a Lustre file systems (#​30207) (2d9aefb), closes #​30206
• iam: allow creating service principal using custom name (#​31793) (3d650c3), closes #​31767
• kms: allow fromLookup method to return dummy key if target key was not found (#​31676) (34bdeca), closes #​31574 /github.com/aws/aws-cdk/blob/v2.161.0/packages/aws-cdk-lib/aws-kms/lib/key.ts#L686 /github.com/aws/aws-cdk/issues/31574#issuecomment-2399080697
• rds: support local write forwarding for an aurora PostgreSQL cluster (#​31803) (a32436a), closes #​31802
• s3: support transitionDefaultMinimumObjectSize for life cycle (#​31778) (4aa117b), closes #​31777 /docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-lifecycleconfiguration.html#cfn-s3
• update L1 CloudFormation resource definitions (#​31752) (8067294)
• update L1 CloudFormation resource definitions (#​31800) (fccb006)
• rds: support performance insights configuration at cluster level ([#​31385](https:

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.