build(deps): Bump aws-cdk-lib from 2.272.0 to 2.273.0 in /cdk

[dependabot]

Bumps aws-cdk-lib from 2.272.0 to 2.273.0.

Release notes

Sourced from aws-cdk-lib's releases.

v2.273.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-appstream: AWS::AppStream::StackFleetAssociation: FleetName property is now immutable. aws-appstream: AWS::AppStream::StackFleetAssociation: StackName property is now immutable. aws-appsync: AWS::AppSync::ApiCache: AtRestEncryptionEnabled property is now immutable. aws-appsync: AWS::AppSync::ApiCache: TransitEncryptionEnabled property is now immutable. aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: OutputConfig attribute removed. aws-cloud9: AWS::Cloud9::EnvironmentEC2: Id attribute removed. aws-config: AWS::Config::ConfigurationRecorder: Id attribute removed. aws-config: AWS::Config::OrganizationConfigRule: Id attribute removed. aws-datazone: AWS::DataZone::PolicyGrant: Detail property is now required. aws-datazone: AWS::DataZone::PolicyGrant: Principal property is now required. aws-directoryservice: AWS::DirectoryService::MicrosoftAD: Id attribute removed. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.NetworkProtocol property is now required. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.SecurityGroupIds property is now required.

Features

• update L1 CloudFormation resource definitions (#38969) (ed0df78)
• batch: add ConsumableResource L2 construct (#36971) (a12f3a1)
• bedrockagentcore: support runtime platformVersion (#38924) (227423f)
• cloudfront: default Distribution behaviors to redirect HTTP to HTTPS (#38721) (6ede006), closes #38599
• opensearchservice: add useLatestServiceSoftwareForBlueGreen support (#38499) (6aa03e5), closes #38664 #38664
• pipelines: add executionMode support in CodePipeline L3 construct (#35022) (7283d38), closes #35014

Bug Fixes

• bump bundled brace-expansion to 5.0.12 (#38929) (ff25def), closes #38932
• applicationautoscaling: target tracking silently ignores custom metric account and region (#36503) (5d10288), closes #36401
• bedrockagentcore: accept aws-cn ECR image URIs in Runtime container URI validation (#38948) (49ac618), closes #38947
• cloudfront-origins: missing OAC permissions for Function URL (#35919) (d213cc7), closes #35872 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-lambda/lib/function-base.ts#L577 #35725
• core: validation E2001 inadvertently not enabled (#38920) (0b763a7)
• eks: allow access policies on AccessEntryType.EC2 access entries (#38782) (e507e07), closes #37496
• s3-deployment: Source.data objectKey can write outside the staging directory (#38921) (53439f9)

---

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

• redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
• redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

• redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

• redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
• redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

• redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

Bug Fixes

• redshift-alpha: reject PUBLIC user names (#38935) (3335407)

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead

... (truncated)

Commits

• 22a8ee5 chore: update analytics metadata blueprints
• f911ee4 chore(release): 2.273.0
• ed0df78 feat: update L1 CloudFormation resource definitions (#38969)
• 07c059f docs(events): add examples for RuleTargetInput and EventField (#38470)
• 7292cc7 chore(bedrock): add Claude Opus 5, Mythos 5, and Fable 5 foundation models (#...
• 2915b0d chore(ec2): interface VPC endpoint for eks-proxy (#38385)
• a12f3a1 feat(batch): add ConsumableResource L2 construct (#36971)
• 6aa03e5 feat(opensearchservice): add useLatestServiceSoftwareForBlueGreen support (#3...
• 6ede006 feat(cloudfront): default Distribution behaviors to redirect HTTP to HTTPS (#...
• d615580 docs(core): correct arnFormat default description (#38888)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)