chore(release): 2.247.0 (#37497)

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/bump/2.247.0/CHANGELOG.md)

Author: mergify[bot]

CHANGELOG.v2.alpha.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.247.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.246.0-alpha.0...v2.247.0-alpha.0) (2026-04-02)
+
+
+### Features
+
+* **mediapackagev2-alpha:** new L2 construct ([#37279](https://github.com/aws/aws-cdk/issues/37279)) ([7debfb9](https://github.com/aws/aws-cdk/commit/7debfb9c5e807fac5df6e9e0ea3097d72325ffbc))
+
 ## [2.246.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.245.0-alpha.0...v2.246.0-alpha.0) (2026-03-31)
 
 ## [2.245.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.244.0-alpha.0...v2.245.0-alpha.0) (2026-03-27)

CHANGELOG.v2.md

@@ -2,6 +2,31 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.247.0](https://github.com/aws/aws-cdk/compare/v2.246.0...v2.247.0) (2026-04-02)
+
+
+### ⚠ BREAKING CHANGES
+
+* ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:
+
+aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: ExecutionStatus attribute removed.
+aws-appstream: AWS::AppStream::ImageBuilder: Name property is now immutable.
+aws-eks: AWS::EKS::Capability: EKS_CAPABILITY_ACK_S3_LOGS vended log type removed.
+
+### Features
+
+* update L1 CloudFormation resource definitions ([#37410](https://github.com/aws/aws-cdk/issues/37410)) ([bd2c318](https://github.com/aws/aws-cdk/commit/bd2c3187323c7bcf8a19943f86682c14c601d1a9))
+* **apigatewayv2:** add role support for lambda authorizers ([#35706](https://github.com/aws/aws-cdk/issues/35706)) ([2fb2f16](https://github.com/aws/aws-cdk/commit/2fb2f1650e957979e5ebf8292df3a95d41baa4ff)), closes [#35696](https://github.com/aws/aws-cdk/issues/35696)
+* **batch:** skip unregister job definition on update ([#36011](https://github.com/aws/aws-cdk/issues/36011)) ([2fb2240](https://github.com/aws/aws-cdk/commit/2fb2240d2b2ca922e0603c3e341bb61ce9131155))
+* **elasticloadbalancingv2:** jwt verification for application load balancer ([#36099](https://github.com/aws/aws-cdk/issues/36099)) ([aacd28a](https://github.com/aws/aws-cdk/commit/aacd28aac59dbf42973302e3165140d944356b32)), closes [#36096](https://github.com/aws/aws-cdk/issues/36096)
+
+
+### Bug Fixes
+
+* bump brace-expansion from 5.0.3 to 5.0.5 to address CVE-2026-33750 ([#37379](https://github.com/aws/aws-cdk/issues/37379)) ([69cf4c9](https://github.com/aws/aws-cdk/commit/69cf4c9c44c610eb029d92e355efcf6e7f931ed2))
+* prevent prototype pollution in 2 APIs ([#37453](https://github.com/aws/aws-cdk/issues/37453)) ([1016537](https://github.com/aws/aws-cdk/commit/101653766cab8a8112608e170f5e07f5b962ba49))
+* **aws-cdk-lib:** condensed stack trace hides namespaced package name ([#37413](https://github.com/aws/aws-cdk/issues/37413)) ([cb8e7fb](https://github.com/aws/aws-cdk/commit/cb8e7fbc9fc10682d505b2cdba1a7ce173b0dfd3))
+
 ## [2.246.0](https://github.com/aws/aws-cdk/compare/v2.245.0...v2.246.0) (2026-03-31)
 
 

CONTRIBUTORS.md

@@ -7,26 +7,26 @@ Shout out to our top contributors!
 - [RomainMuller](https://github.com/RomainMuller)
 - [njlynch](https://github.com/njlynch)
 - [jogold](https://github.com/jogold)
-- [iliapolo](https://github.com/iliapolo)
 - [mrgrain](https://github.com/mrgrain)
+- [iliapolo](https://github.com/iliapolo)
 - [corymhall](https://github.com/corymhall)
 - [shivlaks](https://github.com/shivlaks)
 - [otaviomacedo](https://github.com/otaviomacedo)
 - [mazyu36](https://github.com/mazyu36)
-- [pahud](https://github.com/pahud)
 - [badmintoncryer](https://github.com/badmintoncryer)
+- [pahud](https://github.com/pahud)
 - [go-to-k](https://github.com/go-to-k)
 - [comcalvi](https://github.com/comcalvi)
 - [TheRealAmazonKendra](https://github.com/TheRealAmazonKendra)
 - [madeline-k](https://github.com/madeline-k)
 - [NetaNir](https://github.com/NetaNir)
+- [aemada-aws](https://github.com/aemada-aws)
 - [robertd](https://github.com/robertd)
 - [MrArnoldPalmer](https://github.com/MrArnoldPalmer)
 - [lpizzinidev](https://github.com/lpizzinidev)
 - [phuhung273](https://github.com/phuhung273)
 - [msambol](https://github.com/msambol)
-- [peterwoodworth](https://github.com/peterwoodworth)
 - [GavinZZ](https://github.com/GavinZZ)
 
 
-_Last updated: Sun, 01 Mar 26 00:19:35 +0000_
+_Last updated: Wed, 01 Apr 26 00:23:58 +0000_

packages/@aws-cdk-testing/framework-integ/test/aws-apigatewayv2-authorizers/test/http/integ.lambda.js.snapshot/AuthorizerInteg.template.json

@@ -53,6 +53,23 @@
     "authfunctionServiceRoleFCB72198"
    ]
   },
+  "AuthRole900B840B": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "apigateway.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    }
+   }
+  },
   "MyHttpApi8AEAAC21": {
    "Type": "AWS::ApiGatewayV2::Api",
    "Properties": {
@@ -153,6 +170,12 @@
     "ApiId": {
      "Ref": "MyHttpApi8AEAAC21"
     },
+    "AuthorizerCredentialsArn": {
+     "Fn::GetAtt": [
+      "AuthRole900B840B",
+      "Arn"
+     ]
+    },
     "AuthorizerPayloadFormatVersion": "2.0",
     "AuthorizerResultTtlInSeconds": 300,
     "AuthorizerType": "REQUEST",
@@ -186,46 +209,6 @@
     "Name": "my-simple-authorizer"
    }
   },
-  "MyHttpApiAuthorizerIntegMyHttpApiLambdaAuthorizerB89228D7Permission82260331": {
-   "Type": "AWS::Lambda::Permission",
-   "Properties": {
-    "Action": "lambda:InvokeFunction",
-    "FunctionName": {
-     "Fn::GetAtt": [
-      "authfunction96361832",
-      "Arn"
-     ]
-    },
-    "Principal": "apigateway.amazonaws.com",
-    "SourceArn": {
-     "Fn::Join": [
-      "",
-      [
-       "arn:",
-       {
-        "Ref": "AWS::Partition"
-       },
-       ":execute-api:",
-       {
-        "Ref": "AWS::Region"
-       },
-       ":",
-       {
-        "Ref": "AWS::AccountId"
-       },
-       ":",
-       {
-        "Ref": "MyHttpApi8AEAAC21"
-       },
-       "/authorizers/",
-       {
-        "Ref": "MyHttpApiLambdaAuthorizerB8A0E2A4"
-       }
-      ]
-     ]
-    }
-   }
-  },
   "MyHttpApiWithDefaultAuthorizerE08800A1": {
    "Type": "AWS::ApiGatewayV2::Api",
    "Properties": {

packages/@aws-cdk-testing/framework-integ/test/aws-apigatewayv2-authorizers/test/http/integ.lambda.ts

@@ -4,6 +4,7 @@ import { HttpLambdaIntegration } from 'aws-cdk-lib/aws-apigatewayv2-integrations
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import { App, Stack, CfnOutput } from 'aws-cdk-lib';
 import { HttpLambdaAuthorizer, HttpLambdaResponseType } from 'aws-cdk-lib/aws-apigatewayv2-authorizers';
+import { Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 
 /*
  * Stack verification steps:
@@ -25,10 +26,15 @@ const authHandler = new lambda.Function(stack, 'auth-function', {
   code: lambda.Code.fromAsset(path.join(__dirname, '..', 'auth-handler'), { exclude: ['*.ts'] }),
 });
 
+const authRole = new Role(stack, 'AuthRole', {
+  assumedBy: new ServicePrincipal('apigateway.amazonaws.com'),
+});
+
 const authorizer = new HttpLambdaAuthorizer('LambdaAuthorizer', authHandler, {
   authorizerName: 'my-simple-authorizer',
   identitySource: ['$request.header.X-API-Key'],
   responseTypes: [HttpLambdaResponseType.SIMPLE],
+  role: authRole,
 });
 
 const defaultAuthorizer = new HttpLambdaAuthorizer('LambdaDefaultAuthorizer', authHandler, {