Chore(deps): Bump the multi-account-python-minor-patch group across 4 directories with 3 updates

[dependabot]

Bumps the multi-account-python-minor-patch group with 3 updates in the /backend/multi-account directory: aws-cdk-lib, cdk-nag and moto.
Bumps the multi-account-python-minor-patch group with 2 updates in the /backend/multi-account/backups directory: aws-cdk-lib and moto.
Bumps the multi-account-python-minor-patch group with 2 updates in the /backend/multi-account/control-tower directory: aws-cdk-lib and cdk-nag.
Bumps the multi-account-python-minor-patch group with 1 update in the /backend/multi-account/log-aggregation directory: aws-cdk-lib.

Updates aws-cdk-lib from 2.251.0 to 2.252.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.252.0

Features

• core: Validations class now supports addWarning, addError, and acknowledge (#37668) (5e8083c), closes aws/aws-cdk-rfcs#899
• core: add Box API for deferred values with accurate stack traces (#37604) (d592a96)

Bug Fixes

• aws-cdk-lib: cannot be used as a bundledDependency (#37726) (6ba0598), closes #37717
• s3: resolve S3 notification removal race condition (#37708) (dc5be98), closes #37667

---

Alpha modules (2.252.0-alpha.0)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.253.0-alpha.0 (2026-05-06)

Features

• bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
• glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

• bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

Features

• bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#37238) (1e89e7e)
• bedrock-agentcore-alpha: add observability configuration for Runtime (#36689) (34b43aa), closes #36596
• bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#36610) (f20bd8e)
• dsql-alpha: initial L2 construct (#34599) (be1a458), closes #34593

2.250.0-alpha.0 (2026-04-14)

2.249.0-alpha.0 (2026-04-10)

2.248.0-alpha.0 (2026-04-02)

2.247.0-alpha.0 (2026-04-02)

Features

• mediapackagev2-alpha: new L2 construct (#37279) (7debfb9)

2.246.0-alpha.0 (2026-03-31)

2.245.0-alpha.0 (2026-03-27)

Features

• s3tables-alpha: add support for partition spec, sort order, and table properties (#36811) (2696cd1)

... (truncated)

Commits

• a58510c chore(release): 2.252.0 (#37727)
• 9e000ff chore: trigger build
• 323844a chore: update analytics metadata blueprints
• 9f70a52 chore(release): 2.252.0
• 6ba0598 fix(aws-cdk-lib): cannot be used as a bundledDependency (#37726)
• d592a96 feat(core): add Box API for deferred values with accurate stack traces (#37604)
• 0616322 refactor(lambda-nodejs): unify code paths between local & Docker bundling (#3...
• dc5be98 fix(s3): resolve S3 notification removal race condition (#37708)
• a78ddc5 chore(ci): fix pr-issue-check unable to comment on PRs from forks (#37703)
• 556f8d3 chore(core): migrate off of Beta1 properties internally (#37711)
• Additional commits viewable in compare view

Updates cdk-nag from 2.38.1 to 2.38.2

Release notes

Sourced from cdk-nag's releases.

v2.38.2

2.38.2 (2026-04-27)

Bug Fixes

• prefix using Stage Construct ID to avoid StageName colissions (#2338) (c0d76f6)

Commits

• c0d76f6 fix: prefix using Stage Construct ID to avoid StageName colissions (#2338)
• 0d52df5 chore: add tests for uncovered branches in elasticbeanstalk rules (#2210)
• 4511bc0 chore: add tests for uncovered branches in apigw rules (#2190)
• b684354 chore: add tests for uncovered branches in codebuild rules (#2196)
• e4dc7d9 chore: add tests for uncovered branches in ecs rules (#2206)
• c6f2d4f chore: add tests for uncovered branches in ec2 rules (#2202)
• 07e6258 chore: add tests for uncovered branches in elasticache rules (#2208)
• e5d11b1 chore: add tests for uncovered branches in ecr rules (#2204)
• 8396469 chore: add tests for uncovered branches in cloudwatch rules (#2194)
• 51dd228 chore: add tests for uncovered branches in cognito rules (#2198)
• Additional commits viewable in compare view

Updates moto from 5.1.22 to 5.2.0

Changelog

Sourced from moto's changelog.

5.2.0

Docker Digest for 5.2.0: sha256:d8d063e3e704d256cbe8165072fa273c17698be91311e49fc602b7716f459bea

General:
    * Drops support for Python 3.9
    * Lambda Containers now configure the AWS_ENDPOINT_URL, automatically intercepting requests to other AWS services
New Services:

* Bedrock-AgentCore-Control:

* create_agent_runtime()

* create_agent_runtime_endpoint()

* create_gateway()

* create_gateway_target()

* create_memory()

* delete_agent_runtime()

* delete_agent_runtime_endpoint()

* delete_gateway()

* delete_gateway_target()

* delete_memory()

* get_agent_runtime()

* get_agent_runtime_endpoint()

* get_gateway()

* get_gateway_target()

* get_memory()

* list_agent_runtimes()

* list_agent_runtime_endpoints()

* list_agent_runtime_versions()

* list_gateways()

* list_gateway_targets()

* list_memories()

* list_tags_for_resource()

* tag_resource()

* update_agent_runtime()

* update_agent_runtime_endpoint()

* update_gateway()

* update_gateway_target()

* untag_resource()
* Bedrock-Runtime:
    * invoke_model()

FIS:

create_experiment_template()
delete_experiment_template()
list_tags_for_resource()
tag_resource()
untag_resource()





New Methods:

... (truncated)

Commits

• 4d17a10 Pre-Release: Up Version Number
• 67b2c31 Prep release 5.2.0 (#9992)
• f92709e AWSLambda: Use shogo82148 as the default image provider (#9777)
• 64df5e3 Bump softprops/action-gh-release from 2 to 3 (#10004)
• 16e8573 Bump the go-deps group in /other_langs/tests_go with 6 updates (#10005)
• 91c2366 Bump ruby/setup-ruby from 1.299.0 to 1.306.0 (#10002)
• 6568f5e Bump software.amazon.awssdk:bom (#10003)
• 0a9c7bf chore: update Config Managed Rules (#10001)
• 8f04f30 chore: update SSM default parameters (#9999)
• 50a0c55 Chore: Update EC2 types (#10000)
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.251.0 to 2.252.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.252.0

Features

• core: Validations class now supports addWarning, addError, and acknowledge (#37668) (5e8083c), closes aws/aws-cdk-rfcs#899
• core: add Box API for deferred values with accurate stack traces (#37604) (d592a96)

Bug Fixes

• aws-cdk-lib: cannot be used as a bundledDependency (#37726) (6ba0598), closes #37717
• s3: resolve S3 notification removal race condition (#37708) (dc5be98), closes #37667

---

Alpha modules (2.252.0-alpha.0)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.253.0-alpha.0 (2026-05-06)

Features

• bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
• glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

• bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

Features

• bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#37238) (1e89e7e)
• bedrock-agentcore-alpha: add observability configuration for Runtime (#36689) (34b43aa), closes #36596
• bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#36610) (f20bd8e)
• dsql-alpha: initial L2 construct (#34599) (be1a458), closes #34593

2.250.0-alpha.0 (2026-04-14)

2.249.0-alpha.0 (2026-04-10)

2.248.0-alpha.0 (2026-04-02)

2.247.0-alpha.0 (2026-04-02)

Features

• mediapackagev2-alpha: new L2 construct (#37279) (7debfb9)

2.246.0-alpha.0 (2026-03-31)

2.245.0-alpha.0 (2026-03-27)

Features

• s3tables-alpha: add support for partition spec, sort order, and table properties (#36811) (2696cd1)

... (truncated)

Commits

• a58510c chore(release): 2.252.0 (#37727)
• 9e000ff chore: trigger build
• 323844a chore: update analytics metadata blueprints
• 9f70a52 chore(release): 2.252.0
• 6ba0598 fix(aws-cdk-lib): cannot be used as a bundledDependency (#37726)
• d592a96 feat(core): add Box API for deferred values with accurate stack traces (#37604)
• 0616322 refactor(lambda-nodejs): unify code paths between local & Docker bundling (#3...
• dc5be98 fix(s3): resolve S3 notification removal race condition (#37708)
• a78ddc5 chore(ci): fix pr-issue-check unable to comment on PRs from forks (#37703)
• 556f8d3 chore(core): migrate off of Beta1 properties internally (#37711)
• Additional commits viewable in compare view

Updates moto from 5.1.22 to 5.2.0

Changelog

Sourced from moto's changelog.

5.2.0

Docker Digest for 5.2.0: sha256:d8d063e3e704d256cbe8165072fa273c17698be91311e49fc602b7716f459bea

General:
    * Drops support for Python 3.9
    * Lambda Containers now configure the AWS_ENDPOINT_URL, automatically intercepting requests to other AWS services
New Services:

* Bedrock-AgentCore-Control:

* create_agent_runtime()

* create_agent_runtime_endpoint()

* create_gateway()

* create_gateway_target()

* create_memory()

* delete_agent_runtime()

* delete_agent_runtime_endpoint()

* delete_gateway()

* delete_gateway_target()

* delete_memory()

* get_agent_runtime()

* get_agent_runtime_endpoint()

* get_gateway()

* get_gateway_target()

* get_memory()

* list_agent_runtimes()

* list_agent_runtime_endpoints()

* list_agent_runtime_versions()

* list_gateways()

* list_gateway_targets()

* list_memories()

* list_tags_for_resource()

* tag_resource()

* update_agent_runtime()

* update_agent_runtime_endpoint()

* update_gateway()

* update_gateway_target()

* untag_resource()
* Bedrock-Runtime:
    * invoke_model()

FIS:

create_experiment_template()
delete_experiment_template()
list_tags_for_resource()
tag_resource()
untag_resource()





New Methods:

... (truncated)

Commits

• 4d17a10 Pre-Release: Up Version Number
• 67b2c31 Prep release 5.2.0 (#9992)
• f92709e AWSLambda: Use shogo82148 as the default image provider (#9777)
• 64df5e3 Bump softprops/action-gh-release from 2 to 3 (#10004)
• 16e8573 Bump the go-deps group in /other_langs/tests_go with 6 updates (#10005)
• 91c2366 Bump ruby/setup-ruby from 1.299.0 to 1.306.0 (#10002)
• 6568f5e Bump software.amazon.awssdk:bom (#10003)
• 0a9c7bf chore: update Config Managed Rules (#10001)
• 8f04f30 chore: update SSM default parameters (#9999)
• 50a0c55 Chore: Update EC2 types (#10000)
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.251.0 to 2.252.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.252.0

Features

• core: Validations class now supports addWarning, addError, and acknowledge (#37668) (5e8083c), closes aws/aws-cdk-rfcs#899
• core: add Box API for deferred values with accurate stack traces (#37604) (d592a96)

Bug Fixes

• aws-cdk-lib: cannot be used as a bundledDependency (#37726) (6ba0598), closes #37717
• s3: resolve S3 notification removal race condition (#37708) (dc5be98), closes #37667

---

Alpha modules (2.252.0-alpha.0)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.253.0-alpha.0 (2026-05-06)

Features

• bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
• glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

• bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

Features

• bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#37238) (1e89e7e)
• bedrock-agentcore-alpha: add observability configuration for Runtime (#36689) (34b43aa), closes #36596
• bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#36610) (f20bd8e)
• dsql-alpha: initial L2 construct (#34599) (be1a458), closes #34593

2.250.0-alpha.0 (2026-04-14)

2.249.0-alpha.0 (2026-04-10)

2.248.0-alpha.0 (2026-04-02)

2.247.0-alpha.0 (2026-04-02)

Features

• mediapackagev2-alpha: new L2 construct (#37279) (7debfb9)

2.246.0-alpha.0 (2026-03-31)

2.245.0-alpha.0 (2026-03-27)

Features

• s3tables-alpha: add support for partition spec, sort order, and table properties (#36811) (2696cd1)

... (truncated)

Commits

• a58510c chore(release): 2.252.0 (#37727)
• 9e000ff chore: trigger build
• 323844a chore: update analytics metadata blueprints
• 9f70a52 chore(release): 2.252.0
• 6ba0598 fix(aws-cdk-lib): cannot be used as a bundledDependency (#37726)
• d592a96 feat(core): add Box API for deferred values with accurate stack traces (#37604)
• 0616322 refactor(lambda-nodejs): unify code paths between local & Docker bundling (#3...
• dc5be98 fix(s3): resolve S3 notification removal race condition (#37708)
• a78ddc5 chore(ci): fix pr-issue-check unable to comment on PRs from forks (#37703)
• 556f8d3 chore(core): migrate off of Beta1 properties internally (#37711)
• Additional commits viewable in compare view

Updates cdk-nag from 2.38.1 to 2.38.2

Release notes

Sourced from cdk-nag's releases.

v2.38.2

2.38.2 (2026-04-27)

Bug Fixes

• prefix using Stage Construct ID to avoid StageName colissions (#2338) (c0d76f6)

Commits

• c0d76f6 fix: prefix using Stage Construct ID to avoid StageName colissions (#2338)
• 0d52df5 chore: add tests for uncovered branches in elasticbeanstalk rules (#2210)
• 4511bc0 chore: add tests for uncovered branches in apigw rules (#2190)
• b684354 chore: add tests for uncovered branches in codebuild rules (#2196)
• e4dc7d9 chore: add tests for uncovered branches in ecs rules (#2206)
• c6f2d4f chore: add tests for uncovered branches in ec2 rules (#2202)
• 07e6258 chore: add tests for uncovered branches in elasticache rules (#2208)
• e5d11b1 chore: add tests for uncovered branches in ecr rules (#2204)
• 8396469 chore: add tests for uncovered branches in cloudwatch rules (#2194)
• 51dd228 chore: add tests for uncovered branches in cognito rules (#2198)
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.251.0 to 2.252.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.252.0

Features

• core: Validations class now supports addWarning, addError, and acknowledge (#37668) (5e8083c), closes aws/aws-cdk-rfcs#899
• core: add Box API for deferred values with accurate stack traces (#37604) (d592a96)

Bug Fixes

• aws-cdk-lib: cannot be used as a bundledDependency (#37726) (6ba0598), closes #37717
• s3: resolve S3 notification removal race condition (#37708) (dc5be98), closes #37667

---

Alpha modules (2.252.0-alpha.0)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.253.0-alpha.0 (2026-05-06)

Features

• bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
• glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

• bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

Features

• bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#37238) (1e89e7e)
• bedrock-agentcore-alpha: add observability configuration for Runtime (#36689) (34b43aa), closes #36596
• bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#36610) (f20bd8e)
• dsql-alpha: initial L2 construct (#34599) (be1a458), closes #34593

2.250.0-alpha.0 (2026-04-14)

2.249.0-alpha.0 (2026-04-10)

2.248.0-alpha.0 (2026-04-02)

2.247.0-alpha.0 (2026-04-02)

Features

• mediapackagev2-alpha: new L2 construct (#37279) (7debfb9)

2.246.0-alpha.0 (2026-03-31)

2.245.0-alpha.0 (2026-03-27)

Features

• s3tables-alpha: add support for partition spec, sort order, and table properties (#36811) (2696cd1)

... (truncated)

Commits

• a58510c chore(release): 2.252.0 (#37727)
• 9e000ff chore: trigger build
• 323844a chore: update analytics metadata blueprints
• 9f70a52 chore(release): 2.252.0
• 6ba0598 fix(aws-cdk-lib): cannot be used as a bundledDependency (#37726)
• d592a96 feat(core): add Box API for deferred values with accurate stack traces (#37604)
• 0616322 refactor(lambda-nodejs): unify code paths between local & Docker bundling (#3...
• dc5be98 fix(s3): resolve S3 notification removal race condition (#37708)
• a78ddc5 chore(ci): fix pr-issue-check unable to comment on PRs from forks (#37703)
• 556f8d3 chore(core): migrate off of Beta1 properties internally (#37711)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions