CI pending maintainer action: week 2026-August10-W33

Beginning-contributor PRs that entered pending maintainer CI action during week **2026-August10-W33**.

_Last updated: 2026-08-16T21:09:18.724Z (refreshed daily by the [Pending Maintainer Action Check workflow](https://github.com/aws/aws-cdk/blob/main/.github/workflows/pending-maintainer-action-check.yml))_

**32 PR(s)** — 🔒 Pending CI approval: 31 · ⚠️ No build CI activity: 1

### 🔒 Pending CI approval (31)

| PR | Title | Author | Pending since |
|----|-------|--------|---------------|
| [#38259](https://github.com/aws/aws-cdk/pull/38259) | feat(ecs): support configurable deployment circuit breaker settings | @SIDDHESH1564 | 2026-08-10 (6d) |
| [#38524](https://github.com/aws/aws-cdk/pull/38524) | fix(ec2): validate the CIDR mask instead of reporting a NaN address | @Adityaj0 | 2026-08-10 (6d) |
| [#38385](https://github.com/aws/aws-cdk/pull/38385) | fix(ec2): eks proxy endpoint (#38369) | @wasim-builds | 2026-08-10 (6d) |
| [#38384](https://github.com/aws/aws-cdk/pull/38384) | fix(dynamodb): table v2 arn validation (#38354) | @wasim-builds | 2026-08-10 (6d) |
| [#38533](https://github.com/aws/aws-cdk/pull/38533) | fix(ecs): force deployment on capacity provider strategy update with … | @knight-54 | 2026-08-11 (5d) |
| [#38534](https://github.com/aws/aws-cdk/pull/38534) | fix(stepfunctions): scope grantRead resources to the documented values | @Adityaj0 | 2026-08-11 (5d) |
| [#38399](https://github.com/aws/aws-cdk/pull/38399) | fix(dynamodb): avoid TableGrantsProps deprecation warnings for TableV2 | @deveshsinghal09 | 2026-08-11 (5d) |
| [#38537](https://github.com/aws/aws-cdk/pull/38537) | fix(ses): `DedicatedIpPool` rejects a tokenized pool name | @Adityaj0 | 2026-08-11 (5d) |
| [#38461](https://github.com/aws/aws-cdk/pull/38461) | docs(s3,kms): replace object-literal IResourceWithPolicyV2 example with named class | @AmariahAK | 2026-08-11 (5d) |
| [#38228](https://github.com/aws/aws-cdk/pull/38228) | fix(ecs): validate environment variable limit in container definitions | @sanyamk23 | 2026-08-11 (5d) |
| [#38219](https://github.com/aws/aws-cdk/pull/38219) | feat(applicationautoscaling): add high-resolution ECS predefined metrics | @sanyamk23 | 2026-08-11 (5d) |
| [#38550](https://github.com/aws/aws-cdk/pull/38550) | fix(core): scope validation plugin acknowledgments (under feature flag) | @lytreallynb | 2026-08-12 (4d) |
| [#38553](https://github.com/aws/aws-cdk/pull/38553) | fix(eks): `Nodegroup` IPv6 grant hardcodes the 'aws' partition | @Adityaj0 | 2026-08-12 (4d) |
| [#38349](https://github.com/aws/aws-cdk/pull/38349) | docs(s3): clarify cross-account replication ownership | @fukunaga-kengo | 2026-08-13 (3d) |
| [#38564](https://github.com/aws/aws-cdk/pull/38564) | chore(s3): add integ test for cross-account replication with an imported destination bucket | @fukunaga-kengo | 2026-08-13 (3d) |
| [#38346](https://github.com/aws/aws-cdk/pull/38346) | feat(ecs-patterns): add dual-stack DNS aliases for application load balanced services | @fukunaga-kengo | 2026-08-13 (3d) |
| [#38345](https://github.com/aws/aws-cdk/pull/38345) | fix(docdb): allow unresolved subnet lists in database clusters | @fukunaga-kengo | 2026-08-13 (3d) |
| [#38565](https://github.com/aws/aws-cdk/pull/38565) | chore(lambda): add ADOT Lambda layer v0.48.0 ARNs (CVE remediation) | @priyankaDhingra | 2026-08-13 (3d) |
| [#36919](https://github.com/aws/aws-cdk/pull/36919) | feat(cloudwatch): support live data for `SingleValueWidget` in cloudwatch dashboards | @Darasimi-Ajewole | 2026-08-13 (2d) |
| [#38551](https://github.com/aws/aws-cdk/pull/38551) | chore(rds): sqlserver 14.00.3530.2.v1,15.00.4470.1.v1,16.00.4245.2.v1,16.00.4250.1.v1,16.00.4255.1.v1 | @alpin87 | 2026-08-14 (2d) |
| [#38195](https://github.com/aws/aws-cdk/pull/38195) | fix(logs): emit account root ARN in resource policies to avoid drift false positive | @UTKARSH698 | 2026-08-14 (2d) |
| [#38335](https://github.com/aws/aws-cdk/pull/38335) | docs(eks-v2): fix Architecture diagram code block in README | @omarqureshi | 2026-08-14 (2d) |
| [#38572](https://github.com/aws/aws-cdk/pull/38572) | fix(sns-subscriptions): regionalize principal for Lambda subscriptions and DLQ policies in opt-in regions | @DavidA94 | 2026-08-14 (2d) |
| [#38573](https://github.com/aws/aws-cdk/pull/38573) | fix(dynamodb): `TableGrantsProps` deprecation warnings in TableV2 | @wasim-builds | 2026-08-15 (1d) |
| [#38446](https://github.com/aws/aws-cdk/pull/38446) | fix(s3-deployment): preserve custom log groups during deletion | @Hashim1999164 | 2026-08-16 (0d) |
| [#38210](https://github.com/aws/aws-cdk/pull/38210) | fix(rds): add manageMasterUserPassword support to DatabaseInstanceFromSnapshot | @gingeekrishna | 2026-08-16 (0d) |
| [#38141](https://github.com/aws/aws-cdk/pull/38141) | feat(fsx): add L2 construct for DataRepositoryAssociation | @gingeekrishna | 2026-08-16 (0d) |
| [#38140](https://github.com/aws/aws-cdk/pull/38140) | fix(ecs): suppress shouldUseCircuitBreaker warning for DAEMON scheduling strategy services | @gingeekrishna | 2026-08-16 (0d) |
| [#37997](https://github.com/aws/aws-cdk/pull/37997) | feat(bedrock-agentcore-alpha): allow tagging service-created runtime application log group | @gingeekrishna | 2026-08-16 (0d) |
| [#37984](https://github.com/aws/aws-cdk/pull/37984) | fix(bedrock-agentcore-alpha): add tracing resource policy opt-out | @gingeekrishna | 2026-08-16 (0d) |
| [#37982](https://github.com/aws/aws-cdk/pull/37982) | fix(cdk): resolve #37783 by fixing missing top-level sseSpecification… | @gingeekrishna | 2026-08-16 (0d) |

### ⚠️ No build CI activity (1)

| PR | Title | Author | Pending since |
|----|-------|--------|---------------|
| [#38420](https://github.com/aws/aws-cdk/pull/38420) | fix(logs): use AccountPrincipal for drift prevention | @wasim-builds | 2026-08-15 (1d) |

Close this issue once all listed PRs have been handled.