Merge branch 'main' into fix-dynamo-grants

Author: mergify[bot]

.github/workflows/issue-label-assign.yml

@@ -287,7 +287,7 @@ env:
       {"area":"@aws-cdk/aws-location-alpha", "keywords":["aws-location", "aws-location-alpha"],"labels":["@aws-cdk/aws-location-alpha"]},
       {"area":"@aws-cdk/cli-lib-alpha", "keywords":["cli-lib", "cli-lib-alpha"],"labels":["@aws-cdk/cli-lib-alpha"]},
       {"area":"@aws-cdk/aws-applicationsignals-alpha", "keywords":["aws-applicationsignals", "aws-applicationsignals-alpha"],"labels":["@aws-cdk/aws-applicationsignals-alpha"]},
-      {"area":"@aws-cdk/aws-s3tables-alpha", "keywords":["aws-s3tables", "aws-s3tables-alpha"],"labels":["@aws-cdk/aws-s3tables-alpha"]},
+      {"area":"@aws-cdk/aws-s3tables-alpha", "keywords":["aws-s3tables", "aws-s3tables-alpha", "s3tables", "s3table"],"labels":["@aws-cdk/aws-s3tables-alpha"]},
       {"area":"@aws-cdk/aws-pipes-enrichments-alpha", "keywords":["aws-pipes-enrichments", "aws-pipes-enrichments-alpha"],"labels":["@aws-cdk/aws-pipes-enrichments-alpha"]},
       {"area":"@aws-cdk/aws-pipes-sources-alpha", "keywords":["aws-pipes-sources", "aws-pipes-sources-alpha"],"labels":["@aws-cdk/aws-pipes-sources-alpha"]},
       {"area":"@aws-cdk/aws-pipes-targets-alpha", "keywords":["aws-pipes-targets", "aws-pipes-targets-alpha"],"labels":["@aws-cdk/aws-pipes-targets-alpha"]},

CHANGELOG.v2.alpha.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.245.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.244.0-alpha.0...v2.245.0-alpha.0) (2026-03-27)
+
+
+### Features
+
+* **s3tables-alpha:** add support for partition spec, sort order, and table properties ([#36811](https://github.com/aws/aws-cdk/issues/36811)) ([2696cd1](https://github.com/aws/aws-cdk/commit/2696cd16e8e2edc8d40f1443b9c87eb6171e5d1f))
+* **s3tables-alpha:** add metrics configuration support for TableBucket ([#37275](https://github.com/aws/aws-cdk/issues/37275)) ([e8786f5](https://github.com/aws/aws-cdk/commit/e8786f5d782d906971f933a2d6d432309d5384d7))
+* **s3tables-alpha:** implement ITaggableV2 on TableBucket and Table L2 constructs ([#37277](https://github.com/aws/aws-cdk/issues/37277)) ([69c8944](https://github.com/aws/aws-cdk/commit/69c8944ea3f4abf0f4218af2fc42c8e862e8cad3)), closes [#33054](https://github.com/aws/aws-cdk/issues/33054)
+
 ## [2.244.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.243.0-alpha.0...v2.244.0-alpha.0) (2026-03-19)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,31 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.245.0](https://github.com/aws/aws-cdk/compare/v2.244.0...v2.245.0) (2026-03-27)
+
+
+### Features
+
+* update L1 CloudFormation resource definitions ([#37332](https://github.com/aws/aws-cdk/issues/37332)) ([6cdf84a](https://github.com/aws/aws-cdk/commit/6cdf84aa9a50ef41dae54f14c2bcf4f48d46dbd1))
+* **autoscaling:** add instanceLifecyclePolicy support to AutoScalingGroup Property ([#36434](https://github.com/aws/aws-cdk/issues/36434)) ([b72ffcc](https://github.com/aws/aws-cdk/commit/b72ffcc343a7bff1745dfea4d1e8de4a0d6b998e))
+* **cloudfront:** use JavaScript runtime 2.0 as the default for CloudFront Functions (under feature flag) ([#35941](https://github.com/aws/aws-cdk/issues/35941)) ([cd0df14](https://github.com/aws/aws-cdk/commit/cd0df148fdb0d48b14d7d161641519942083b879))
+* **core:** add source tracing for L1 construct property mutations ([#37285](https://github.com/aws/aws-cdk/issues/37285)) ([f0b6da8](https://github.com/aws/aws-cdk/commit/f0b6da82b49da6611f871b67497db8d5004738a2))
+* **ecr-assets:** add support for docker build context ([#36930](https://github.com/aws/aws-cdk/issues/36930)) ([c0849ea](https://github.com/aws/aws-cdk/commit/c0849ea241c8f8707b26f07239aa1078b196bf1c)), closes [#31598](https://github.com/aws/aws-cdk/issues/31598)
+* **s3:** add blockedEncryptionTypes field to s3.Bucket ([#37047](https://github.com/aws/aws-cdk/issues/37047)) ([262e8a7](https://github.com/aws/aws-cdk/commit/262e8a76e7f50cefeceff265c7d135f35c0d520f)), closes [#36988](https://github.com/aws/aws-cdk/issues/36988)
+* **synthetics:** add enum value for Synthetics Canary NodeJS 3.1 runtime ([#37282](https://github.com/aws/aws-cdk/issues/37282)) ([af1e89c](https://github.com/aws/aws-cdk/commit/af1e89cbf7d9d96f0c23f05fb8bdca0e9d442b7d)), closes [/docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_Nodejs.html#CloudWatch_Synthetics_runtimeversion-syn-nodejs-3](https://github.com/aws//docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_Nodejs.html/issues/CloudWatch_Synthetics_runtimeversion-syn-nodejs-3)
+
+
+### Bug Fixes
+
+* **aws-cdk-lib:** toolkit is unaware of CDK app errors ([#37294](https://github.com/aws/aws-cdk/issues/37294)) ([093de92](https://github.com/aws/aws-cdk/commit/093de927b4b5d0d0ad5c68580af1c7e7f56e12c6))
+* **eks:** throw error when kubectl subnets are isolated ([#37217](https://github.com/aws/aws-cdk/issues/37217)) ([73e5006](https://github.com/aws/aws-cdk/commit/73e50061168fc147d6af5fb60917ef003d385fd2)), closes [#26613](https://github.com/aws/aws-cdk/issues/26613)
+* **lambda:** fix typo in addPermission() warning message ([#37365](https://github.com/aws/aws-cdk/issues/37365)) ([fa21e62](https://github.com/aws/aws-cdk/commit/fa21e623484ad1ed191e542e93b16811a8ef08b6))
+* **lambda-nodejs:** use direct spawn for local bundling ([#37292](https://github.com/aws/aws-cdk/issues/37292)) ([9bf4263](https://github.com/aws/aws-cdk/commit/9bf4263ea631cae7c0cfff8872ec4fb3a3164cc1))
+* **mixin:** use withMixin in Stack to set mixin metadata in its constructs ([#37269](https://github.com/aws/aws-cdk/issues/37269)) ([293ce90](https://github.com/aws/aws-cdk/commit/293ce907d6c01e91e7f78bf9590e05aef4ae89a7)), closes [/github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/core/lib/mixins/private/mixin-metadata.ts#L30](https://github.com/aws//github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/core/lib/mixins/private/mixin-metadata.ts/issues/L30)
+* **rds:** enablePerformanceInsights false is ignored when other performance insight properties are set ([#37287](https://github.com/aws/aws-cdk/issues/37287)) ([b4bca75](https://github.com/aws/aws-cdk/commit/b4bca75d23832576840e6780bf5a62c260761cd7)), closes [#37051](https://github.com/aws/aws-cdk/issues/37051)
+* construct errors are rendered in a messy way ([#37290](https://github.com/aws/aws-cdk/issues/37290)) ([5104256](https://github.com/aws/aws-cdk/commit/5104256853a1cede1494ff065e9ce7abbce69e58))
+* **spec2cdk:** throw on unrecognized uppercase prefix in event pattern ([#37283](https://github.com/aws/aws-cdk/issues/37283)) ([c68f2f5](https://github.com/aws/aws-cdk/commit/c68f2f5961b24fba3f4a4b769e355b00d91fd6a1))
+
 ## [2.244.0](https://github.com/aws/aws-cdk/compare/v2.243.0...v2.244.0) (2026-03-19)
 
 

aws-cdk.code-workspace

@@ -6,6 +6,8 @@
     "jest.runMode": {
       "type": "on-demand"
     },
+    "eslint.useFlatConfig": true,
+    "eslint.format.enable": true,
     "jest.virtualFolders": [
       {
         "name": "aws-cdk-lib",

docs/DESIGN_GUIDELINES.md

@@ -39,7 +39,7 @@ experience across the entire AWS surface area.
       - [Prefer Additions](#prefer-additions)
       - [Dropped Mutations](#dropped-mutations)
     - [Factories](#factories)
-    - [Imports](#imports)
+    - [Referenced Resources](#referenced-resources)
       - [“from” Methods](#from-methods)
       - [From-attributes](#from-attributes)
     - [Roles](#roles)
@@ -1271,25 +1271,30 @@ export interface ILogGroup {
 }
 ```
 
-### Imports
+### Referenced resources
+
+> "Referenced resources" were formerly called "imported resources", but that may lead to confusion
+> because there is also a feature called "cdk import" that actually brings unowned
+> resources under CloudFormation's control. Therefore the current preferred terminology
+> here has changed to "referencing" instead.
 
 Construct classes should expose a set of static factory methods with a
-“**from**” prefix that will allow users to import *unowned* constructs into
+“**from**” prefix that will allow users to reference *unowned* constructs into
 their app.
 
 The signature of all “from” methods should adhere to the following rules
 _[awslint:from-signature]_:
 
 * First argument must be **scope** of type **Construct**.
 * Second argument is a **string**. This string will be used to determine the
-  ID of the new construct. If the import method uses some value that is
+  ID of the new construct. If the referencing method uses some value that is
   promised to be unique within the stack scope (such as ARN, export name),
   this value can be reused as the construct ID.
 * Returns an object that implements the construct interface (**IFoo**).
 
 #### “from” Methods
 
-Resource constructs should export static “from” methods for importing unowned
+Resource constructs should export static “from” methods for referencing unowned
 resources given one or more of its physical attributes such as ARN, name, etc. All
 constructs should have at least one `fromXxx` method _[awslint:from-method]_:
 
@@ -1307,7 +1312,7 @@ static fromFooName(scope: Construct, id: string, bucketName: string): IFoo;
   can use **Stack.parseArn** to achieve this purpose.
 
 If a resource has an ARN attribute, it should implement at least a **fromFooArn**
-import method [_awslint:from-arn_].
+referencing method [_awslint:from-arn_].
 
 To implement **fromAttribute** methods, use the abstract base class construct as
 follows:
@@ -1333,7 +1338,7 @@ If a resource has more than a single attribute (“ARN” and “name” are usu
 considered a single attribute since it's usually possible to convert one to the
 other), then the resource should provide a static **fromAttributes** method to
 allow users to explicitly supply values to all resource attributes when they
-import an external (unowned) resource [_awslint:from-attributes_].
+reference an external (unowned) resource [_awslint:from-attributes_].
 
 ```ts
 static fromFooAttributes(scope: Construct, id: string, attrs: FooAttributes): IFoo;
@@ -1348,29 +1353,33 @@ the user.
 Constructs that represent such resources should conform to the following
 guidelines.
 
-An optional prop called **role** of type **iam.IRole** should be exposed to allow
+An optional prop called **role** of type **iam.IRoleRef** should be exposed to allow
 users to "bring their own role", and use either an owned or unowned role
 _[awslint:role-config-prop]_.
 
+If the construct is going to grant permissions to the role, which is usually the case,
+the type should include **iam.IGrantable**, in a type intersection as follows:
+
 ```ts
 interface FooProps {
   /**
    * The role to associate with foo.
+   *
    * @default - a role will be automatically created
    */
-  role?: iam.IRole;
+  role?: iam.IRoleRef & iam.IGrantable;
 }
 ```
 
-The construct interface should expose a **role** property, and extends
+The construct interface should expose a **role** property, and extend
 **iam.IGrantable** _[awslint:role-property]_:
 
 ```ts
 interface IFoo extends iam.IGrantable {
   /**
-   * The role associated with foo. If foo is imported, no role will be available.
+   * The role associated with foo. If foo is an unowned resource, no role will be available.
    */
-  readonly role?: iam.IRole;
+  readonly role?: iam.IRoleRef;
 }
 ```
 
@@ -1392,7 +1401,7 @@ this resource should have the specified permission.
 
 Implementing **IGrantable** brings an implementation burden of **grantPrincipal:
 IPrincipal**. This property must be set to the **role** if available, or to a
-new **iam.ImportedResourcePrincipal** if the resource is imported and the role
+new **iam.ImportedResourcePrincipal** if the resource is referenced and the role
 is not available.
 
 ### Resource Policies
@@ -1513,7 +1522,7 @@ To enable grant methods to work with L1 constructs, the CDK uses factory
 interfaces called [Traits](#traits) that wrap L1 resources into objects
 exposing higher-level interfaces:
 
-- `IResourcePolicyFactory` wraps an L1 into an object implementing `IResourceWithPolicyV2`, enabling resource policy 
+- `IResourcePolicyFactory` wraps an L1 into an object implementing `IResourceWithPolicyV2`, enabling resource policy
 manipulation.
 - `IEncryptedResourceFactory` wraps an L1 into an object implementing `IEncryptedResource`, enabling KMS key grants.
 
@@ -1542,7 +1551,7 @@ class MyFactory implements IResourcePolicyFactory {
   }
 }
 
-// After this, every time the Grants class encounters a CfnResource of type 'AWS::Some::Type', 
+// After this, every time the Grants class encounters a CfnResource of type 'AWS::Some::Type',
 // it will be able to use MyFactory to attempt to add statements to its resource policy.
 ResourceWithPolicies.register(scope, 'AWS::Some::Type', new MyFactory());
 ```
@@ -1580,8 +1589,8 @@ where:
 * `Topic` - the class to generate grants for. This will lead to a class named TopicGrants.
 * `isEncrypted` - indicates whether the resource is encrypted with a KMS key. When true, the `actions()` method will
 have an `options` parameter of type `EncryptedPermissionOptions` that allows users to specify additional KMS permissions
-to be granted on the key. If left undefined, but at least one grant method includes `keyActions`, the CDK will assume 
-that the resource is encrypted and the same behavior will apply. Note that if `isEncrypted` is explicitly set to false, 
+to be granted on the key. If left undefined, but at least one grant method includes `keyActions`, the CDK will assume
+that the resource is encrypted and the same behavior will apply. Note that if `isEncrypted` is explicitly set to false,
 it is an error to specify `keyActions` in any of the grants.
 * `hasResourcePolicy` - indicates whether the resource supports a resource policy. When true, all auto-generated methods in the Grants class will attempt to add statements to the resource policy when applicable. When false, the methods will only modify the principal's policy.
 * `publish` - the name of a grant.
@@ -1592,13 +1601,13 @@ it is an error to specify `keyActions` in any of the grants.
 
 Code generated from the `grants.json` file will have a very basic logic: it will try to add the given statement to the
 principal's policy. If `hasResourcePolicy` is true, it will also attempt to add the statement to the resource policy.
-This will only work if the resource implements the `iam.IResourceWithPolicyV2` interface or -- in case of L1s -- if 
+This will only work if the resource implements the `iam.IResourceWithPolicyV2` interface or -- in case of L1s -- if
 there is a `IResourcePolicyFactory` registered for its type (see previous section). If `keyActions` are specified in the
-JSON file, it will also attempt to grant the specified permissions on the associated KMS key, if the resource implements 
+JSON file, it will also attempt to grant the specified permissions on the associated KMS key, if the resource implements
 the `iam.IEncryptedResource` interface (or, similarly to resource policies, if there is a `IEncryptedResourceFactory`
 registered for it).
 
-If your permission use case requires additional logic, such as combining multiple `Grant` instances or handling 
+If your permission use case requires additional logic, such as combining multiple `Grant` instances or handling
 additional parameters, you will need to implement the Grants class manually.
 
 Historically, grant methods were implemented directly on the resource construct interface (e.g.

packages/@aws-cdk-testing/framework-integ/package.json

@@ -30,7 +30,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@aws-cdk/integ-runner": "^2.196.1",
+    "@aws-cdk/integ-runner": "^2.197.1",
     "@aws-cdk/pkglint": "0.0.0",
     "@aws-sdk/client-acm": "3.632.0",
     "@aws-sdk/client-ec2": "3.632.0",