chore(release): 2.266.0

AGENTS.md

@@ -134,7 +134,7 @@ public static isFoo(x: any): x is Foo {
 ## Props Design
 
 - Name: `FooProps` — always a struct (readonly properties only)
-- Flat — no artificial nesting, use shared prefixes for related props
+- Flat — no artificial nesting, use shared prefixes for related props. Exception: group **co-dependent** props (only valid together) into a required-together value object when it makes incomplete combinations unrepresentable — e.g. `workerConfiguration: { workerType, numberOfWorkers }`. Litmus: if flattening would need a synth-time throw for partial input, nest; mutually *exclusive* props use factory methods instead
 - Every optional prop needs `@default` tag:
   - Simple: `@default true`
   - Context-dependent: `@default - uses the account default encryption`

CHANGELOG.v2.alpha.md

@@ -2,6 +2,34 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.266.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.265.0-alpha.0...v2.266.0-alpha.0) (2026-08-19)
+
+
+### ⚠ BREAKING CHANGES
+
+* **glue-alpha:** `DataQualityRulesetProps.rulesetDqdl: string` is replaced by
+`dqdl: Dqdl`. Build it with `Dqdl.fromString('Rules = [ ... ]')`.
+* **glue-alpha:** `s3Encryption`, `cloudWatchEncryption`, and `jobBookmarksEncryption` are no longer object literals. Use `S3Encryption.s3Managed()` / `S3Encryption.kms(key?)`, `CloudWatchEncryption.kms(key?)`, and `JobBookmarksEncryption.clientSideKms(key?)`. The `CloudWatchEncryptionMode` and `JobBookmarksEncryptionMode` enums are removed (their mode is now implicit); `S3EncryptionMode` is retained.
+* **glue-alpha:** this is a corrective breaking change. Apps that leaned on the bug, and did things like `InputFormat x = OutputFormat.AVRO;` will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
+* **glue-alpha:** `workerType` and `numberOfWorkers` are no longer top-level job props. For Spark jobs, pass them together via `workerConfiguration: { workerType, numberOfWorkers }`. `PythonShellJob` no longer accepts them (it is sized by `maxCapacity`). `RayJob` no longer accepts `workerType` (it is fixed to `Z.2X`).
+* **glue-alpha:** `SparkJobProps.enableMetrics` removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
+* **glue-alpha:** a differing/tokenized `has_encrypted_data` supplied via `parameters` now throws.
+
+### Features
+
+* **glue-alpha:** add warning for maxRetries when job run queuing is enabled ([#38575](https://github.com/aws/aws-cdk/issues/38575)) ([09ae11e](https://github.com/aws/aws-cdk/commit/09ae11e81d44bd58059ac337d3c418254a6955a7))
+* **glue-alpha:** model SecurityConfiguration encryption as factory subtypes ([#38586](https://github.com/aws/aws-cdk/issues/38586)) ([e37e7a6](https://github.com/aws/aws-cdk/commit/e37e7a6ea3d525ca0b4048093416eac059272cdf))
+* **glue-alpha:** new `hasEncryptedData` property ([#38511](https://github.com/aws/aws-cdk/issues/38511)) ([c977e36](https://github.com/aws/aws-cdk/commit/c977e36c3aa43c0be3d043aef80775d9748477a6))
+* **glue-alpha:** pair workerType and numberOfWorkers into a required workerConfiguration ([#38576](https://github.com/aws/aws-cdk/issues/38576)) ([5f3b1b6](https://github.com/aws/aws-cdk/commit/5f3b1b6f3aa700d73fbc10c956ae53809af99047))
+* **glue-alpha:** wrap DataQualityRuleset DQDL in a typed value object ([#38587](https://github.com/aws/aws-cdk/issues/38587)) ([fd01268](https://github.com/aws/aws-cdk/commit/fd012680b1cff1905ad114082fc612ad7fb8992e))
+
+
+### Bug Fixes
+
+* **glue-alpha:** correct OutputFormat.AVRO/ORC type and tidy GA-hygiene items ([#38593](https://github.com/aws/aws-cdk/issues/38593)) ([35aefaf](https://github.com/aws/aws-cdk/commit/35aefaf5a72b89eda630de8cae38a1ed9c4c95ce))
+* **glue-alpha:** omit comments from struct type strings ([#38008](https://github.com/aws/aws-cdk/issues/38008)) ([5f16a86](https://github.com/aws/aws-cdk/commit/5f16a86dc8edefdb223260f8202acd272d43e643)), closes [#26935](https://github.com/aws/aws-cdk/issues/26935)
+* **mediapackagev2-alpha:** add GetChannel grant on MediaPackageV2 ([#38582](https://github.com/aws/aws-cdk/issues/38582)) ([74d922c](https://github.com/aws/aws-cdk/commit/74d922c4bf22fde05465f61c5dd19291b9db608f)), closes [#38581](https://github.com/aws/aws-cdk/issues/38581)
+
 ## [2.265.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.264.0-alpha.0...v2.265.0-alpha.0) (2026-08-13)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.266.0](https://github.com/aws/aws-cdk/compare/v2.265.0...v2.266.0) (2026-08-19)
+
+
+### Features
+
+* adding controlPlaneScalingConfig to Cluster  ([#36863](https://github.com/aws/aws-cdk/issues/36863)) ([94e5c1a](https://github.com/aws/aws-cdk/commit/94e5c1a64427374423e88c0b727fd19aa41a192c))
+* update L1 CloudFormation resource definitions ([#38578](https://github.com/aws/aws-cdk/issues/38578)) ([ccd2633](https://github.com/aws/aws-cdk/commit/ccd263359fd9a4f8725d2e3285d8a9641711cabb))
+
+
+### Bug Fixes
+
+* **ec2:** add DependsOn VPCGatewayAttachment to IPv6 default route ([#37893](https://github.com/aws/aws-cdk/issues/37893)) ([ab272bc](https://github.com/aws/aws-cdk/commit/ab272bc8b12614a37caa9c0679bc0c6b4163d352)), closes [#37853](https://github.com/aws/aws-cdk/issues/37853)
+* **sns-subscriptions:** use regionalized service principal for opt-in region SQS subscriptions ([#38339](https://github.com/aws/aws-cdk/issues/38339)) ([67a7eb1](https://github.com/aws/aws-cdk/commit/67a7eb1f104eea969a6539f074c7e0d282b92f59)), closes [#32526](https://github.com/aws/aws-cdk/issues/32526)
+
 ## [2.265.0](https://github.com/aws/aws-cdk/compare/v2.264.0...v2.265.0) (2026-08-13)
 
 

docs/AGENTS_CONSTRUCT_DESIGN.md

@@ -114,6 +114,14 @@ Common facade types — see [AGENTS_CONSTRUCT_IMPLEMENTATION.md](./AGENTS_CONSTR
 - Keep names concise by removing redundant context (resource type, property type, "configuration") without inventing new semantics
 - Include units of measurement in names when not using a strong type: `milli`, `sec`, `min`, `hr`, `Bytes`, `KiB`, `MiB`, `GiB`
 
+### Property Structure (flat vs. nested)
+
+- You MUST keep props flat by default — do not introduce nesting that only *groups* related props. Use a shared name prefix instead (`websiteErrorDocument`/`websiteIndexDocument`, not `websiteConfiguration: { ... }`)
+- EXCEPTION: You SHOULD group two or more **co-dependent** props (only valid together, none meaningful alone) into a required-together nested value object when doing so makes the incomplete combinations unrepresentable at compile time. Making an illegal state unrepresentable outranks flatness here
+- Litmus test: if flattening would force construction-time validation that throws when *some but not all* of the props are set, nest them; if each prop is independently valid, keep it flat
+- Mutually *exclusive* props are NOT this case — model those with factory methods or enum-like classes (a nested object cannot enforce exclusivity)
+- Example: a Glue Spark job's `workerType` + `numberOfWorkers` are required-together → `workerConfiguration: { workerType, numberOfWorkers }` instead of two severable top-level props guarded by a synth-time throw
+
 ### Default Behavior
 
 - You MUST define the default behavior for every optional prop — what happens when the user omits it is a design decision, not just a documentation task. The `@default` JSDoc tag documents it, but the behavior itself must be intentionally designed.

docs/DESIGN_GUIDELINES.md

@@ -954,6 +954,46 @@ new Bucket(this, 'MyBucket', {
 });
 ```
 
+The rule above targets nesting that only *groups* related properties. If grouping
+is your goal, you can achieve it with the shared prefix, and avoid making life 
+harder for other language users.
+
+But the situation is different when you are dealing with co-dependent properties.
+If you have a case in which two or more properties are only valid together —
+none of them makes sense on its own — then nesting lets the type system reject 
+the incomplete combinations. Here the ergonomic loss is outweighed by making an
+illegal state unrepresentable rather than caught by a runtime check.
+
+The rule of thumb is: if flattening the properties would force you to add
+construction-time validation that throws when some — but not all — of them are
+set, group them into a required-together object instead. If each property is
+independently valid, keep them flat. (Properties that are mutually exclusive
+rather than required-together are usually better modeled with factory methods or
+subtypes than with a nested object — see [Prefer Additions](#prefer-additions)
+and the enum-like class pattern.)
+
+For example, a Glue Spark job's `workerType` and `numberOfWorkers` must be set
+together. Flattened, the pair is severable, so the construct has to reject the
+partial input at synthesis:
+
+```ts
+new PySparkEtlJob(this, 'Job', {
+  workerType: WorkerType.G_2X, // throws at synth: numberOfWorkers is required with workerType
+});
+```
+
+Grouping them into a value object whose fields are both required makes "one
+without the other" impossible to express in the first place:
+
+```ts
+new PySparkEtlJob(this, 'Job', {
+  workerConfiguration: {
+    workerType: WorkerType.G_2X,
+    numberOfWorkers: 2,
+  },
+});
+```
+
 #### Concise
 
 Property names should be short and concise as possible and take into

package.json

@@ -49,8 +49,7 @@
     "@types/babel__traverse": "7.18.2",
     "@smithy/types": "3.5.0",
     "@types/minimatch": "^5.1.2",
-    "tar": "^7.5.7",
-    "@aws-cdk/service-spec-types": "0.0.260"
+    "tar": "^7.5.7"
   },
   "repository": {
     "type": "git",
@@ -181,9 +180,8 @@
     ]
   },
   "dependencies": {
-    "@aws-cdk/service-spec-types": "0.0.260",
     "string-width": "^4.2.3",
     "tar": "^7.5.20"
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
-}
+}

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.instance-ipv6-address-count.js.snapshot/InstanceIpv6AddressCountTestStack.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "Vpcipv6cidr40D3CB78"
+    "Vpcipv6cidr40D3CB78",
+    "VpcVPCGWBF912B6E"
    ]
   },
   "VpcPublicSubnet2Subnet691E08A3": {
@@ -261,7 +262,8 @@
     }
    },
    "DependsOn": [
-    "Vpcipv6cidr40D3CB78"
+    "Vpcipv6cidr40D3CB78",
+    "VpcVPCGWBF912B6E"
    ]
   },
   "VpcIGWD7BA715C": {

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.vpc-dual-stack-ec2.js.snapshot/vpc-dual-stack-ec2.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "Ip6VpcDualStackipv6cidr40BE830A"
+    "Ip6VpcDualStackipv6cidr40BE830A",
+    "Ip6VpcDualStackVPCGW304156E6"
    ]
   },
   "Ip6VpcDualStackPublicSubnet2SubnetCBBC1B43": {
@@ -261,7 +262,8 @@
     }
    },
    "DependsOn": [
-    "Ip6VpcDualStackipv6cidr40BE830A"
+    "Ip6VpcDualStackipv6cidr40BE830A",
+    "Ip6VpcDualStackVPCGW304156E6"
    ]
   },
   "Ip6VpcDualStackPrivateSubnet1Subnet842B7F4C": {

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.vpc-dual-stack.js.snapshot/DualStackVpc.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "DualStackProtocolVpcipv6cidr449C49CD"
+    "DualStackProtocolVpcipv6cidr449C49CD",
+    "DualStackProtocolVpcVPCGWADE48B7D"
    ]
   },
   "DualStackProtocolVpcPub1Subnet1EIP12EDF1FD": {
@@ -302,7 +303,8 @@
     }
    },
    "DependsOn": [
-    "DualStackProtocolVpcipv6cidr449C49CD"
+    "DualStackProtocolVpcipv6cidr449C49CD",
+    "DualStackProtocolVpcVPCGWADE48B7D"
    ]
   },
   "DualStackProtocolVpcPub1Subnet2EIP149FAFF5": {
@@ -463,7 +465,8 @@
     }
    },
    "DependsOn": [
-    "DualStackProtocolVpcipv6cidr449C49CD"
+    "DualStackProtocolVpcipv6cidr449C49CD",
+    "DualStackProtocolVpcVPCGWADE48B7D"
    ]
   },
   "DualStackProtocolVpcPub2Subnet2SubnetCA5962A0": {
@@ -583,7 +586,8 @@
     }
    },
    "DependsOn": [
-    "DualStackProtocolVpcipv6cidr449C49CD"
+    "DualStackProtocolVpcipv6cidr449C49CD",
+    "DualStackProtocolVpcVPCGWADE48B7D"
    ]
   },
   "DualStackProtocolVpcPriv1Subnet1Subnet6E77EDE7": {

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.vpc-egress-only-igw-feature-flag.js.snapshot/VpcMigrationFeatureFlagDisabledStack.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "VpcDisabledipv6cidrAE919F73"
+    "VpcDisabledipv6cidrAE919F73",
+    "VpcDisabledVPCGW116F96FA"
    ]
   },
   "VpcDisabledpublicSubnet2SubnetFD7D736A": {
@@ -261,7 +262,8 @@
     }
    },
    "DependsOn": [
-    "VpcDisabledipv6cidrAE919F73"
+    "VpcDisabledipv6cidrAE919F73",
+    "VpcDisabledVPCGW116F96FA"
    ]
   },
   "VpcDisabledIGWED9DDAA3": {

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.vpc-egress-only-igw-feature-flag.js.snapshot/VpcMigrationFeatureFlagEnabledStack.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "VpcEnabledipv6cidrDF3828C8"
+    "VpcEnabledipv6cidrDF3828C8",
+    "VpcEnabledVPCGW8D682D3E"
    ]
   },
   "VpcEnabledpublicSubnet2Subnet112835F8": {
@@ -261,7 +262,8 @@
     }
    },
    "DependsOn": [
-    "VpcEnabledipv6cidrDF3828C8"
+    "VpcEnabledipv6cidrDF3828C8",
+    "VpcEnabledVPCGW8D682D3E"
    ]
   },
   "VpcEnabledIGWADCF2C30": {

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.vpc-ipv6.js.snapshot/Ipv6Vpc.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "Ipv6ProtocolVpcipv6cidr80CB1C4B"
+    "Ipv6ProtocolVpcipv6cidr80CB1C4B",
+    "Ipv6ProtocolVpcVPCGW70BC7BE6"
    ]
   },
   "Ipv6ProtocolVpcPublicSubnet1EIP5773FDDD": {
@@ -302,7 +303,8 @@
     }
    },
    "DependsOn": [
-    "Ipv6ProtocolVpcipv6cidr80CB1C4B"
+    "Ipv6ProtocolVpcipv6cidr80CB1C4B",
+    "Ipv6ProtocolVpcVPCGW70BC7BE6"
    ]
   },
   "Ipv6ProtocolVpcPublicSubnet2EIPFA61104A": {

packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.alb-fargate-service-ipv6.js.snapshot/aws-ecs-integ-alb-fg-ipv6.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "Vpcipv6cidr40D3CB78"
+    "Vpcipv6cidr40D3CB78",
+    "VpcVPCGWBF912B6E"
    ]
   },
   "VpcPublicSubnet1EIPD7E02669": {
@@ -302,7 +303,8 @@
     }
    },
    "DependsOn": [
-    "Vpcipv6cidr40D3CB78"
+    "Vpcipv6cidr40D3CB78",
+    "VpcVPCGWBF912B6E"
    ]
   },
   "VpcPublicSubnet2EIP3C605A87": {

packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.nlb-ipv6.js.snapshot/NlbIpv6Stack.template.json

@@ -141,7 +141,8 @@
     }
    },
    "DependsOn": [
-    "Vpcipv6cidr40D3CB78"
+    "Vpcipv6cidr40D3CB78",
+    "VpcVPCGWBF912B6E"
    ]
   },
   "VpcPublicSubnet1EIPD7E02669": {
@@ -302,7 +303,8 @@
     }
    },
    "DependsOn": [
-    "Vpcipv6cidr40D3CB78"
+    "Vpcipv6cidr40D3CB78",
+    "VpcVPCGWBF912B6E"
    ]
   },
   "VpcPublicSubnet2EIP3C605A87": {