CDK update - July 2026

Index

• TL;DR
• Major Features
  • ⚠️ Comprehensive Template Validation — On by Default
  • ⚠️ Other Action-Required Changes
  • CloudFormation Express Mode in the CLI
  • CDK Language Server
  • Modern TypeScript Project Templates
  • CloudTrail-Enriched Deployment Diagnosis
  • CLI Improvements
  • Service Enhancements
• Community Highlights
• AWS CDK Conference Japan 2026
• Community Content & Resources
• How Can You Be Involved

Hey CDK community! Here's an update on everything that shipped in July 2026.

TL;DR

The big one: CDK now validates every synthesized template against a comprehensive default rule set — the payoff of the validation work we've been tracking since April (deep dive: Stop Waiting 10 Minutes to Fail). You'll see new diagnostics at synth time, and you can opt into strict mode that fails synthesis on errors. On the CLI side, cdk deploy --express brings CloudFormation Express mode to CDK, a new CDK Language Server puts diagnostics and navigation directly in your editor, and cdk validate --watch gives you continuous validation as you code. Also worth noting: declining an interactive cdk destroy prompt now correctly exits with code 1 instead of 0.

These features are available in aws-cdk-lib v2.261.0 through v2.263.0 and aws-cdk CLI v2.1129.0 through v2.1134.0. Full changelogs on GitHub Releases (Library | CLI).

Major Features

⚠️ Comprehensive Template Validation — On by Default

Remember June's spoiler? Here it is. Building on the Validations framework introduced in April/May and the experimental cdk validate command from June, CDK apps are now validated against a comprehensive default rule set at synth time (#38135).

The new CloudFormationValidatePlugin — powered by @aws/cloudformation-validate — checks your synthesized templates for misconfigurations that would fail deployments (reported as errors) and violations of AWS best practices (reported as warnings). Instead of waiting 10+ minutes for CloudFormation to reject your deployment, you find out at synth time.

What changes for you: your existing apps may start showing new warnings at synth. Nothing fails by default — the plugin initially runs in warning mode.

Opting into strict mode: set the new context key to classify diagnostics as errors and fail synthesis when errors are present:

{
  "context": {
    "@aws-cdk/core:validateAgainstDefaultRules": true
  }
}

Suppressing a finding you've reviewed: use the acknowledge() API from the Validations framework (sample from the aws-cdk-lib README):

const app = new App();

// You can use any scope here, closer to the violation is safer
Validations.of(app).acknowledge({
  id: 'CloudFormation-Validate::W9999',
  reason: 'This is not recommended but we have a good reason to do it like this',
});

The plugin also supports loading custom Rego or CloudFormation Guard rule sets:

const app = new App();

// Rules text, read from disk perhaps
declare const myRules: string;

Validations.of(app).addPlugins(new CloudFormationValidatePlugin({
  guardRules: [{
    name: 'My rules',
    content: myRules,
  }],
}));

Opting out entirely: set the environment variable CDK_VALIDATION=false — a July fix made sure this correctly disables the built-in validator (#38379), and the CLI now forwards cdk synth --no-validation to the app process the same way (#1756).

Continuous Validation with --watch

The experimental cdk validate command gained a --watch mode (#1771) — it continuously re-synthesizes and validates after every file change, without deploying. Validation failures don't stop the watch loop, so you can keep iterating:

$ cdk --unstable=validate validate --watch

For the full picture of how offline rules and CloudFormation's online pre-deployment checks fit together, see Stop Waiting 10 Minutes to Fail: How CDK Comprehensive Validation Catches Misconfigurations Before Deploy.

A wave of polish landed alongside the rollout: fatal validation diagnostics now include the plugin name (#38273, #1720), validation reports are self-contained (#38333) with correctly resolved paths (#38352), rule namespaces are no longer duplicated in CLI output (#1707), apps can attach a user-friendly preamble to validation reports (#1735), pre-styled reports aren't rendered all-red anymore (#1742), and a synth crash on symlinked directories with validation plugins registered was fixed (#38299, contributed by sanjanaravikumar-az). If installs failed on Node ≠ 22.x right after v2.262.0, v2.262.1 fixed that (#38382).

⚠️ Other Action-Required Changes

• Declined interactive prompts now exit non-zero (#1667): answering "no" to a cdk destroy confirmation prompt now exits with code 1 instead of 0 — fixing an inconsistency where a declined operation was reported as success. Declined deploy, import, rollback, orphan, GC, and flag prompts also emit clearer, command-specific cancellation messages. This only applies to interactive prompts; when no TTY is attached (the typical automation setup), nothing changes.
• L1 resource definition updates (#38189): CloudWatch ScheduledQueryConfiguration.QueryLanguage and Classic ELB LoadBalancer.Id were removed; Classic ELB's primary identifier is now LoadBalancerName. Review generated-L1 usage if you touch these.
• MediaConnect alpha removal policy (#38437): removalPolicy was removed from FlowProps, GatewayProps, and BridgeProps in the alpha module — these resources now follow CloudFormation's default Delete behavior. Contributed by: jamiepmullan

CloudFormation Express Mode in the CLI

CloudFormation shipped Express mode this month, and CDK support landed right away (#1689): --express is available on cdk bootstrap, cdk deploy, and cdk destroy.

$ cdk deploy --express

Express mode trades stabilization waits for speed — the CLI returns while resources may still be stabilizing in the background, and prints clear notices when that's the case. Hotswap-fallback deployments also use Express mode. A follow-up hardened recovery behavior: Express-mode redeploys update failed stacks rather than calling the unsupported RollbackStack, and CLI output surfaces real SDK service errors instead of Unknown (#1745).

Weigh the trade-off for production pipelines — you're giving up the synchronous readiness guarantee. See the community analysis in Community Content below for a good discussion of when Express mode fits.

CDK Language Server

Building on June's editor-tooling groundwork, July delivered the CDK Language Server (#1681): assembly parsing plus editor diagnostics, construct/template navigation, CodeLens, and live refresh as cdk.out changes — bringing CDK intelligence to any LSP-capable editor.

Editor clients can probe what the server supports with the new capability discovery command (#1750):

$ cdk lsp --features

This emits a JSON protocol and feature manifest, so integrations can detect capabilities without opening a session. Together with cdk validate (correctness feedback), the fast-feedback story keeps compounding: understand your assembly, catch what's wrong, all before you deploy.

Modern TypeScript Project Templates

New TypeScript projects created with cdk init now use TypeScript 7, tsx for execution, and @swc/jest for tests (#1719) — sidestepping the ts-node/ts-jest incompatibility and making synth/watch iterations noticeably faster. Existing projects are unaffected.

CloudTrail-Enriched Deployment Diagnosis

Building on June's automatic ECS and custom-resource failure logs, failed cdk deploy and cdk diagnose runs can now correlate CloudTrail control-plane errors to the failed resources (#1676) — turning "resource failed to stabilize" into an actionable root cause. The lookup is best-effort and warns if your credentials lack the required CloudTrail permission.

CLI Improvements

Tunable Stack Event Polling

Programmatic toolkit users deploying many stacks concurrently can now set stackEventPollingInterval on DeployOptions and DestroyOptions (#1710) to avoid DescribeStackEvents throttling; a follow-up made the same option govern stabilization polling too (#1724). The 2-second default is unchanged.

Additional CLI Updates

• Clearer approval prompts — cdk deploy now shows the effective --require-approval value and an explicit prompt; non-interactive consumers see whether the default auto-confirmed or auto-denied (#1585)
• Width-aware tables in CI — diff/security tables honor the COLUMNS environment variable when terminal width is unavailable (#1704, faridnsh)
• Stage-aware orphaning — cdk orphan --unstable=orphan correctly resolves resources in staged and nested-stage stacks (#1733)
• cdk import role preservation — large override template uploads retain the bootstrap file-publishing role, external ID, and destination region (#1665)
• CloudFormation Hook failure details — cdk deploy surfaces HookStatusReason when hooks fail without annotations (#1768)
• Accurate update recommendations — version checks query the npm registry directly, work without an npm executable, and only recommend genuinely newer versions (#1769)
• Original errors preserved — a missing CLI package manifest no longer masks the underlying command exception (#1712)

Service Enhancements

RDS-Managed Master Password

RDS DatabaseCluster and DatabaseInstance now support the native RDS–Secrets Manager integration (#35734) — set manageMasterUserPassword: true and RDS creates and manages the secret itself, no CDK-owned secret or rotation Lambda needed:

declare const vpc: ec2.Vpc;
declare const kmsKey: kms.Key;

// Database cluster with RDS-managed password
new rds.DatabaseCluster(this, 'Cluster', {
  engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_3_01_0 }),
  writer: rds.ClusterInstance.serverlessV2('writer'),
  vpc,
  manageMasterUserPassword: true,
  credentials: rds.Credentials.fromUsername('admin', {
    encryptionKey: kmsKey, // Optional - uses default KMS key if not specified
  }),
});

Note that with manageMasterUserPassword enabled, only username and encryptionKey are allowed in credentials — the secret property becomes a read-only reference to the RDS-created secret, so use secret.grantRead(grantee) for access. See RDS-managed master password in the aws-rds README.

EKS Provisioned Control Plane

The EKS Cluster construct now supports Provisioned Control Plane with the controlPlaneScalingTier property (#36651) — provision predictable control-plane performance for demanding workloads like AI training/inference and HPC:

import { KubectlV35Layer } from '@aws-cdk/lambda-layer-kubectl-v35';

new eks.Cluster(this, 'HighPerformanceCluster', {
  version: eks.KubernetesVersion.V1_35,
  kubectlLayer: new KubectlV35Layer(this, 'kubectl'),
  controlPlaneScalingTier: eks.ControlPlaneScalingTier.TIER_XL,
});

Tiers range from STANDARD (default, no additional cost) up to TIER_8XL. EKS clusters can also now target Kubernetes 1.36 (#38441, contributed by ali-n4i).

Contributed by: yasomaru

ECS: Existing Cloud Map Namespaces

ECS clusters can now use an existing Cloud Map namespace as their default namespace (#36812) — useful for sharing a namespace across clusters or referencing one created outside CDK:

declare const vpc: ec2.Vpc;

// Create or reference an existing namespace
const existingNamespace = new cloudmap.PrivateDnsNamespace(this, 'Namespace', {
  name: 'example.local',
  vpc,
});

const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

// Use the existing namespace as the default
cluster.addExistingDefaultCloudMapNamespace({
  namespace: existingNamespace,
  useForServiceConnect: true,
});

ECS also gained support for the ECS-optimized Amazon Linux 2023 (Neuron) AMI (#34689).

Contributed by: yasomaru

MediaConnect L2 Constructs (Alpha)

A brand-new alpha module for AWS Elemental MediaConnect landed (#37945) — L2 constructs for Flows, Bridges, Gateways, and Router resources for live video transport:

declare const stack: Stack;

const flow = new Flow(stack, 'MyFlow', {
  flowName: 'my-live-stream',
  source: SourceConfiguration.rtp({
    flowSourceName: 'my-source',
    port: 5000,
    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),
  }),
});

See the aws-mediaconnect-alpha README for the full construct set. As noted above, the default removal policy was removed in a follow-up (#38437) — alpha modules move fast.

Contributed by: jamiepmullan

More Service Updates

• Lambda: Java8AL2023, Java11AL2023, and Java17AL2023 runtimes added (#38419); CapacityProvider gained logGroup/systemLogLevel (#38183) and PropagateTags (#38180, both contributed by vicheey); tokenized provisioned-concurrency and async-invoke values no longer rejected (#38246, Abuhaithem)
• Auto Scaling: AutoScalingInstanceRefresh UpdatePolicy support (#38277, ethanshen18)
• CloudFront: Managed-HostHeaderOnly origin request policy (#38236, Tietew); HttpOrigin port ranges validated (#37872, kawaaaas)
• DocumentDB: per-instance maintenance windows on DatabaseCluster (#38315)
• Bedrock AgentCore: gateway targets can specify IAM credential-provider service/region (#37697, badmintoncryer)
• Core: synthesized templates can carry Git source metadata for traceability (#37368)
• OpenSearch: gp3 EBS throughput up to 2,000 MiB/s (#38001, adisembiringle)
• ELBv2: better dropInvalidHeaderFields handling for defaults and true→false transitions (#36483, rgoltz)
• ACM: prototype-collision fix in apexDomain (#37195, abhu85)
• Backup: tokenized durations accepted in lifecycle and vault-lock validation (#38264, Abuhaithem)
• Security: brace-expansion bumped to address CVE-2026-14257 (#38410, jumic)

A note on performance this month: a fix for stack.node.addDependency slowing down as stacks grow shipped in v2.262.0 (#38314) but was reverted in v2.262.2 (#38417) due to a follow-on regression — don't count on that optimization yet. Similarly, the API Gateway ALB integration (#36247) was reverted in the same release it shipped in because it broke jsii Go packaging (#38305) — watch for its return.

Community Highlights

External Contributors

yasomaru (AWS Community Builder) — EKS Provisioned Control Plane (#36651) and existing Cloud Map namespaces for ECS clusters (#36812). That's three consecutive monthly updates featuring yasomaru's work — remarkable consistency across ECS, EKS, and AgentCore.

jamiepmullan (valued-contributor) — The entire MediaConnect L2 alpha module (#37945) plus follow-up fixes (#38434, #38437). Contributing a whole new construct library is a huge lift.

badmintoncryer (distinguished-contributor, AWS Community Builder) — Bedrock AgentCore gateway credential-provider support (#37697) and the API Gateway ALB integration (#36247) — the latter hit a jsii Go packaging issue and was temporarily reverted, but the work stands.

vicheey (beginning-contributor) — Lambda CapacityProvider logging (#38183) and tag propagation (#38180).

ethanshen18 (beginning-contributor) — AutoScalingInstanceRefresh UpdatePolicy support (#38277).

ali-n4i (beginning-contributor) — Kubernetes 1.36 support for EKS (#38441).

Tietew (distinguished-contributor) — CloudFront Managed-HostHeaderOnly origin request policy (#38236) and kept RDS MySQL engine versions current (#38261).

faridnsh — COLUMNS-aware table output for readable diff tables in CI logs (#1704).

Abuhaithem (beginning-contributor) — Two validation fixes allowing tokenized values in Lambda (#38246) and Backup (#38264) configuration.

ckawl (beginning-contributor) — Fixed fn.currentVersion to satisfy CloudFormation validation (#38267) and handled the SnapStart container-image revert (#38281).

kawaaaas (beginning-contributor) — HttpOrigin port-range validation (#37872) and VPC interface endpoints for Cognito Identity (#37302).

rgoltz (beginning-contributor, DB Systel) — Improved dropInvalidHeaderFields handling in ELBv2 (#36483).

adisembiringle (beginning-contributor) — OpenSearch gp3 EBS throughput raised to service limits (#38001).

abhu85 (beginning-contributor) — Prototype-collision fix in ACM apexDomain (#37195).

sanjanaravikumar-az (beginning-contributor) — Fixed the synth EISDIR crash with validation plugins and symlinked directories (#38299).

jumic (distinguished-contributor, AWS Community Builder) — CVE-2026-14257 remediation via the brace-expansion bump (#38410).

matoom-nomu (valued-contributor) — Added a missing Oracle engine version for RDS (#37820).

vishwakt (beginning-contributor) — Added the Claude Sonnet 5 foundation model identifier for Bedrock (#38272).

ashrafee-dev (beginning-contributor) — Removed deprecated Ubuntu 14.04 and Windows 2016 CodeBuild images (#37265).

Adam-Horse (beginning-contributor) — Clarified RouterType.GATEWAY docs for Virtual Private Gateway (#38249).

engjonah (beginning-contributor) — Fixed a typo in the TableV2 multi-account replica docs (#38123) — first contribution, welcome!

AWS CDK Conference Japan 2026

A big shoutout to the JAWS-UG CDK支部 community for the 5th annual AWS CDK Conference Japan (#cdkconf2026), held July 18 at the AWS Japan office in Azabudai Hills, Tokyo. This year's theme:「変化」— Change.

By the numbers:

Registered	340 (124 onsite — sold out — plus 170 online, 46 staff)
Sessions	~28 talks across 2 tracks, over 5+ hours
Side events	5 — AWS Blocks workshop, CDK contribution workshop, CDK re:Synth, a beginner workshop, and a live CDK Chatting podcast recording
Published decks	19 on the event slides page
Sponsors	デジコン, ギークプラス, メイツ, 野村総合研究所

The keynote, "IaC in the Agentic World," set the tone for the day: typed CDK code as an agent-friendly harness, validation and dry-run as guardrails, and the new CDK Language Server — the exact themes that shipped in this month's releases.

That AI-era thread ran through nearly every session. A selection of published decks:

• ソフトウェア設計に溶けるインフラ ― AWS CDK のインフラ認識論 — Kenji Kono: infrastructure as part of software design, not a separate domain — and why that matters more when AI writes the code
• 型も通る、synthも通る、それでも危ない — Shiro Seike: AI-generated CDK can pass type checks and synth yet still ship wildcard IAM or runaway costs — a three-layer CI gate with cdk-nag, IAM Access Analyzer, and Infracost + OPA
• あなたのCDKコード、AIに任せて大丈夫ですか？ — Soichi Iida: quality through harness engineering, not prompts — TDD-first workflows and automated quality gates
• CDKでPRごとに使い捨て環境立てたら便利すぎました — Masashi Tomooka: ephemeral preview stacks per pull request — indispensable once coding agents multiply your PR volume
• Terraform標準の組織でAWS CDKをどう使うか — Yuta Nakamura: an honest experiment converting CDK output to Terraform with cf2tf in a Terraform-standard org
• 起動時間24msのAWSエミュレーター「floci」でCDK開発を爆速化 — Haruki Kondo: fast local CDK feedback loops with a 24ms-startup emulator
• AmplifyHostingConstructからSSRフレームワークのためのホスティング設計を考察する — Masahiko Murakami: L3 construct design lessons from @aws-blocks/hosting
• CDK Contribution SkillをトランスフォームしたらIssue駆動でCDK開発できるのか — Masafumi Hayakawa: a ten-agent, human-gated issue-driven CDK workflow
• 生成AI×AWS CDK×AWS FISで"振り返れる"ミニGameDayをつくろう — Yoshimi Maehara: a repeatable chaos-engineering GameDay built with CDK, FIS, and AI assistance
• マルチスタックCDKアプリにおける安全なスタック削除運用 — Hisashi Ikenogami: safely reconciling deleted stack code with deployed CloudFormation stacks

More decks — including ECS best practices rethought for 2026, cdk-nag v3 guardrails in regulated CI, and building CDK from scratch — are on the connpass slides page. If you're in Japan, JAWS-UG CDK支部 meets regularly — join the community.

Community Content & Resources

From the Community:

Integrating Lambda Durable Functions into a Step Functions Workflow — Monica Colangelo (AWS Hero) walks through a CDK/Python pattern for durable Lambdas in Step Functions: alias and IAM setup, async task-token invocation, and replay-safe callbacks.

Terraform Modules vs CDK Constructs | What the Extra Layers Change — Alex (Upstood) compares CDK's L1/L2/L3 layering with Terraform modules, with particularly useful coverage of logical-ID changes and cdk refactor.

CloudFormation Express mode ships, returning success before resources are ready — Leo analyzes the new Express deployment mode and its CDK entry point, emphasizing the speed-versus-readiness trade-off for production pipelines.

CloudFormation now validates every stack operation, not only change sets — Leo covers automatic pre-deployment validation for stack operations and how it pairs with the cdk validate workflow.

Catch Risky IAM in Your CDK App Before cdk deploy — The Shieldly team introduces @shieldly/cdk-guard, a synth-time tool flagging wildcard actions and risky iam:PassRole (vendor post, disclosed).

Resources:

• AWS IaC MCP Server — AI-powered CDK development via Model Context Protocol.
• CDK Construct Hub — Discover community-built constructs.
• AWS CDK API Reference

How Can You Be Involved

Report Issues

Open an issue on GitHub.

Contribute Code

Check our contributing guide and look for good first issue or help wanted labels.

Join the Conversation

• Slack: CDK.dev community
• GitHub: Discussions
• Stack Overflow: aws-cdk tag

Star the Repo

Give us a star on GitHub! ⭐

Feedback? Share in GitHub Discussions.