DEV Community

Pahud Hsieh
Pahud Hsieh

Posted on

CDK update - August 2026

#aws #cdk #infrastructureascode #devtools

Index

Hey CDK community! Here's an update on everything that shipped in August 2026.

TL;DR

August was the month the CDK CLI became agent-aware: when a coding agent (Claude Code, Codex, Copilot CLI, and friends) runs cdk deploy, the CLI now automatically switches to a token-efficient "errors-only" progress mode — and you can opt into it yourself with --progress errors-only. The stack.node.addDependency performance fix that was reverted in July re-landed for good, alongside a broader synth performance sweep (validation overhead, performance counter memory). Firehose finally got HTTP Endpoint and Datadog destinations — closing feature requests that date back to 2021. And if you use the Glue alpha module, buckle up: a large API overhaul landed across three releases as the module gets polished for stabilization.

These features are available in aws-cdk-lib v2.264.0 through v2.267.0 and aws-cdk CLI v2.1135.0 through v2.1139.0. Full changelogs on GitHub Releases (Library | CLI).

Major Features

⚠️ Heads-Up Changes

Most of these happen automatically — this is a "know about it" list, not a to-do list. Only the last one (Glue alpha) needs you to actually change code.

  • Bedrock AgentCore metric dimensions corrected (#38486, #38487): RuntimeBase and Gateway metric helpers now emit the CloudWatch dimensions the service actually publishes — per-resource metrics use { Operation, Name, Resource } (was { Resource }) and gateway metrics use { Operation, Protocol, Resource }. Action: If you built alarms or dashboards on the old dimensions, repoint them — the old ones were matching no data anyway. Fresh alarms need nothing.
  • Firehose timeZone validated at synth (#38514): specifying an unsupported timeZone on the S3Bucket destination (3-letter abbreviations like EST, Etc/UTC, Factory, etc.) now throws a ValidationError at synth time instead of failing the CloudFormation deployment. Action: None — the same bad value now fails earlier (synth instead of deploy). You only see this if you were already passing an invalid timeZone; switch it to a standard IANA identifier like America/New_York or UTC.
  • s3-deployment default memory raised 128 MB → 1024 MB (#35501): the BucketDeployment Lambda handler frequently OOM'd at the old default, so deployments will now be faster and more reliable out of the box. Action: None required. If you run many BucketDeployment constructs and want to watch per-invocation cost, set memoryLimit: 128 explicitly to keep the old value.
  • Glue alpha breaking changes (details below): Action required — if you use @aws-cdk/aws-glue-alpha, review the API changes before upgrading. This is the one item here with real migration work (most changes are compile-time and mechanical). As always with alpha modules, this kind of churn is expected.

The CLI Now Knows When an AI Agent Is Driving

The most fun feature of the month: a new errors-only progress mode that suppresses the CloudFormation event stream and only prints errors (#1800):

$ cdk deploy --progress errors-only
Enter fullscreen mode Exit fullscreen mode

Why does this matter? Deployment event noise burns tokens and context window when a coding agent is running the CLI. So a follow-up made errors-only the default when the CLI detects it's being run by an AI agent (#1850) — detection recognizes the emerging AI_AGENT environment variable convention plus the specific markers set by Claude Code, Codex, GitHub Copilot CLI, opencode, Crush, Qwen Code, and Cline (#1855).

Humans get the full progress stream they're used to; agents get a quiet, token-efficient interface — no configuration needed on either side. This continues the fast-feedback thread from June's cdk explore and July's Language Server: CDK tooling is increasingly designed for both human and agent workflows.

The addDependency Fix Returns — Plus a Synth Performance Sweep

Remember July's note about the stack.node.addDependency optimization being reverted? The fix is back — properly this time (#38597). Adding dependencies no longer slows down as your stacks grow, which matters a lot for large multi-stack apps.

It landed alongside a broader performance sweep in v2.267.0:

Improvement Impact PR
addDependency no longer degrades with stack size Faster synth for large apps #38597
Performance counters use less memory June's slow-synth diagnostics no longer bloat memory #38620
Validation plugin check overhead reduced July's default validation costs less at synth #38619

Related fixes for the validation rollout also landed: cdk validate no longer hangs indefinitely in some setups (#38510) and no longer drops a plugin's customSeverity label (#1894). The comprehensive validation story from July keeps getting cheaper and more reliable.

Kinesis Data Firehose: HTTP Endpoint and Datadog Destinations

A long-awaited one: the Firehose L2 now supports HTTP Endpoint and Datadog delivery stream destinations (#33657) — closing feature requests open since 2021 (#15502, #20354).

import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';

// Datadog destination — API key stored in Secrets Manager
declare const apiKey: secretsmanager.Secret;
const datadogDestination = new firehose.Datadog({
  apiKey,
  endpoint: firehose.DatadogEndpoint.LOGS_US1,
});

// Or a generic HTTP endpoint destination
declare const endpointConfig: firehose.HttpEndpointConfig;
const httpDestination = new firehose.HttpEndpoint({
  endpointConfig,
});
Enter fullscreen mode Exit fullscreen mode

See the aws-kinesisfirehose README for the full destination options.

Contributed by: benjaminpottier

DocumentDB Managed Master Password

Following July's RDS-managed master password, DocumentDB DatabaseCluster gained the same native Secrets Manager integration (#35711) — DocumentDB creates and manages the master-user secret itself, no CDK-owned secret or rotation Lambda needed.

Contributed by: mazyu36

CloudWatch: Alarm Mute Rules and AT_LEAST Composite Alarms

Two notable observability additions:

Alarm Mute Rules

Automatically mute alarm actions during predefined time windows — deployments, maintenance, batch jobs — while CloudWatch keeps monitoring and evaluating alarm states (#37504):

declare const alarm1: cloudwatch.Alarm;
declare const alarm2: cloudwatch.Alarm;

const alarmMuteRule = new cloudwatch.AlarmMuteRule(this, 'AlarmMuteRule', {
  alarms: [alarm1],
  // Mute period begins at 0:00 every day in UTC
  schedule: cloudwatch.ScheduleExpression.cron({ minute: '0', hour: '0' }),
  // ... and lasts 1 hour
  duration: Duration.hours(1),
});

// Targets can be added after construction
alarmMuteRule.addAlarm(alarm2);
Enter fullscreen mode Exit fullscreen mode

Contributed by: Tietew

AT_LEAST Composite Alarm Expressions

Trigger a composite alarm when at least N (or a percentage) of child alarms fire — no more hand-building boolean expressions (#37693):

declare const alarm1: cloudwatch.Alarm;
declare const alarm2: cloudwatch.Alarm;
declare const alarm3: cloudwatch.Alarm;

new cloudwatch.CompositeAlarm(this, 'AtLeastTwo', {
  // At least 2 of these alarms must be in ALARM state
  alarmRule: cloudwatch.AlarmRule.atLeast(cloudwatch.AlarmState.ALARM, {
    operands: [alarm1, alarm2, alarm3],
    threshold: cloudwatch.AtLeastThreshold.count(2),
    // or: cloudwatch.AtLeastThreshold.percentage(60)
  }),
});
Enter fullscreen mode Exit fullscreen mode

Contributed by: rgoltz

Glue Alpha Module: Big Overhaul Ahead of Stabilization

@aws-cdk/aws-glue-alpha received a sustained API overhaul across all three August alpha releases — one of the PRs literally says "tidy GA-hygiene items" (#38593), so read this as the module being polished for stabilization. Highlights:

  • New Catalog L2 (#38443) — IDatabase.catalogArn/catalogId replaced by a type-safe ICatalog
  • Security hardening by default — stronger S3Table encryption (#38501), KMS key rotation for security configurations (#38512), warnings on plaintext secrets (#38538) and over-broad S3Table grants on shared buckets (#38542)
  • Database removal policy now defaults to RETAIN (#38535) — stateful resources protected by default
  • Typed API surface — encryption configs became factory subtypes like S3Encryption.kms(key?) (#38586), DQDL wrapped in a typed value object (#38587), workerType/numberOfWorkers paired into a required workerConfiguration (#38576), schema Type is now opaque with Schema factories
  • Flex jobs default to Glue 5.0 instead of 3.0 (#38543)

If you're on the Glue alpha module, budget time for the migration — most changes are compile-time and mechanical, and the payoff is a much safer default posture. Alpha modules move fast; this is exactly the churn the alpha label exists for.

CLI Improvements

cdk diff Shows the Target Environment

Stack headers in cdk diff output now include the account/region the diff targets (#1885) — resolving a request open since the early days of the CLI repo (#286). No more guessing which environment a diff applies to in multi-account apps.

Contributed by: badmintoncryer

cdk destroy Warns About Non-Existent Stacks

Destroying a stack that doesn't exist now warns instead of silently succeeding (#984) — a nice complement to July's non-zero exit code for declined prompts.

Contributed by: go-to-k

cdk refactor Hardening

The refactor experience got three reliability fixes: custom toolkit stack names are honored (#1791), stacks with bundled assets no longer fail (#1812), and finalizing a deployment after a refactor no longer intermittently fails while stacks are still UPDATE_IN_PROGRESS (#1805).

Additional CLI Updates

  • --notification-arns in cdk import (#1740) — closes a request from 2022 (aws-cdk#23548)
  • Change-set diff correctness — diffs no longer miss changes to JSON-typed properties (#1785)
  • No more phantom "--no-execute" notices — every change-set deployment incorrectly announced "waiting in review for manual execution" (#1818, go-to-k)
  • Fail fast on bad --proxy values (#1843)
  • Hotswap fixes — nested-stack outputs joining List<> parameters no longer throw (#1842); empty-string Lambda descriptions no longer silently dropped (#1831)
  • Real errors surfaced — a failed new-stack deployment no longer masks the root cause behind a NoStack error (#1845)
  • cdk gc accuracy — ECR tagging permission errors now fail loudly instead of silently skipping (#1828); progress output no longer shows NaN% (#1873)
  • Better Stage guidance — the stack-selection error now points Stage users to a working pattern (#1847)
  • integ-runner resilience — detects bootstrap errors and retries tests in valid regions (#1898)

Service Enhancements

EC2 & Networking

  • EBS gp3/io2 volumes up to 64 TiB (#37049) — validation caught up with service limits
  • EBS volume initialization rate on launch templates (#36451) — control how fast snapshots hydrate
  • GatewayVpcEndpoint gained ipAddressType and dnsRecordIpType (#37900) — IPv6-ready endpoints
  • IPv6 default route now depends on the VPC gateway attachment (#37893) — fixes a race at deploy time
  • NAT instance providers no longer trigger a spurious keyName deprecation warning (#38347, yasomaru)

Serverless & Data

  • Lambda SnapStart for container image functions re-landed (#38680) — the July revert is resolved
  • DynamoDB TableV2 grant fixes — grants.*Data now includes index resources (#37892, vishwakt); imported tables with tokenized ARNs accepted in multi-account replicas (#38365); no more spurious deprecation warnings (#38399, deveshsinghal09)
  • RDS serverless V2 capacity props accept tokens (#38044, yasomaru) — closes a family of long-standing issues
  • SQS metricApproximateNumberOfMessagesOutstanding (#38661)
  • Backup indexActions on BackupPlanRule (#34051, georeeve) — enable backup index for search/restore

Everything Else

  • SNS→SQS subscriptions in opt-in regions use the regionalized service principal (#38339) — fixes a 2024-era issue
  • Step Functions: CallApiGatewayRestApiEndpoint supports JSONata for apiPath (#37738, NaveenKumar-Marupalli)
  • CloudFront: warns when minimumProtocolVersion is set without a certificate (#37250); origin readTimeout/keepaliveTimeout no longer reject valid values (#38432)
  • Bedrock AgentCore: Memory L2 StreamDeliveryResources (#37527), opt-out for runtime observability resource policies (#38372, sanyamk23), least-privilege browser-recording S3 grants (#38604)
  • Assets/bundling fixes: SymlinkFollowMode.BLOCK_EXTERNAL no longer throws during bundling (#38506), single-file bundled output stays a file (#38548), symlinks in directory bundling output handled (#38665)
  • Secrets Manager: corrected SAR rotation application versions for GovCloud (#38462)
  • MediaConnect alpha keeps maturing: addOutput options and simpler VPC interface referencing (#38515), underscore-friendly name validation (#38539), plus a MediaPackageV2 GetChannel grant fix (#38582) — all jamiepmullan
  • Security: brace-expansion bumped to 5.0.9 for CVE-2026-69152 (#38520, jumic)

  • Core: Size objects now stringify properly (#38662); stack.availabilityZones returns stable strings (#38580)

  • EKS v2 reaches Provisioned Control Plane parity: the EKS v2 Cluster now supports controlPlaneScalingTier, matching the stable EKS construct introduced in July (#36863). Named tiers run from STANDARD through TIER_8XL, and ControlPlaneScalingTier.of(...) provides an escape hatch for future tiers. Contributed by: notSoWiseOldMan

Community Highlights

Contributors

lemon0333 — Added --notification-arns support to cdk import (#1740) and shipped a run of CLI hardening fixes covering proxy validation (#1843), acknowledge IDs (#1844), Stage guidance (#1847), and cdk gc progress (#1873).

notSoWiseOldMan — Brought Provisioned Control Plane scaling to the EKS v2 Cluster (#36863), closing the parity gap with the stable EKS construct.

go-to-k — Four CLI improvements this month: cdk destroy warnings for non-existent stacks (#984), the phantom --no-execute notice fix (#1818), the cdk context header fix (#1816), and refactor support for bundled assets (#1812).

badmintoncryer (distinguished-contributor, AWS Community Builder) — Target environments in cdk diff stack headers (#1885), resolving one of the oldest open requests in the CLI repo.

yasomaru (AWS Community Builder) — RDS serverless V2 tokenized capacity (#38044) and the NAT instance keyName warning fix (#38347). Four consecutive monthly updates and counting.

mazyu36 — DocumentDB managed master password (#35711), extending July's RDS pattern to another engine.

benjaminpottier — Firehose HTTP Endpoint and Datadog destinations (#33657), closing feature requests from 2021.

Tietew (distinguished-contributor) — CloudWatch alarm mute rules (#37504).

rgoltz — AT_LEAST composite alarm expressions (#37693), his second month in a row.

jamiepmullan (valued-contributor) — Continued MediaConnect/MediaPackage polish (#38515, #38539, #38582) following July's module launch.

vishwakt — Two DynamoDB TableV2 fixes (#37892, #38365).

jumic (distinguished-contributor, AWS Community Builder) — Another CVE remediation (#38520).

Zelys-DFKH — IPv6-ready GatewayVpcEndpoint props (#37900) and the IPv6 default-route race fix (#37893).

georeeve — Backup indexActions (#34051).

dalatrex — EBS volume initialization rate for launch templates (#36451).

ychjamie — The s3-deployment memory default fix (#35501).

aayushostwal — EBS 64 TiB validation update (#37049).

NaveenKumar-Marupalli — JSONata support in the API Gateway Step Functions task (#37738).

deveshsinghal09 — DynamoDB deprecation-warning cleanup (#38399).

sanyamk23 — AgentCore observability policy opt-out (#38372).

peter-smith-phd — Fixed bucket URLs for local S3 emulators (#1625) — LocalStack users rejoice.

sjh9714 — Glue struct type strings no longer include comments (#38008), fixing an issue from 2023.

Adityaj0 — Fixed cdk flags --set leaking synthesized cloud assembly directories (#1833).

Community Content & Resources

From the Community:

Your monorepo remembers infrastructure you deleted — Siddharth Pandey explains how stale templates survive in cdk.out, why recursively scanning every template can invent resources and exports that no longer exist, and how using the Cloud Assembly manifest as the source of truth fixes the problem.

AWS CDK 100 Drill Exercises #012: S3 Static Web Site — TOMOAKI Ishihara (AWS Community Builder) examines an intentionally minimal S3 website, including how an aws:SourceIp condition interacts with Block Public Access and why the S3 website endpoint cannot use HTTPS.

AWS CDK 100 Drill Exercises #013: CloudFront S3 Static Website — The follow-up evolves that site into a private S3 origin behind CloudFront OAC, with security headers, SPA-aware error handling, and a cross-region WAF stack in us-east-1.

Resources:

How Can You Be Involved

Report Issues

Open an issue on GitHub.

Contribute Code

Check our contributing guide and look for good first issue or help wanted labels.

Join the Conversation

Star the Repo

Give us a star on GitHub! ⭐

Feedback? Share in GitHub Discussions.

Top comments (0)