CI pending maintainer action: week 2026-August17-W34

Beginning-contributor PRs that entered pending maintainer CI action during week **2026-August17-W34**.

_Last updated: 2026-08-23T21:08:39.685Z (refreshed daily by the [Pending Maintainer Action Check workflow](https://github.com/aws/aws-cdk/blob/main/.github/workflows/pending-maintainer-action-check.yml))_

**36 PR(s)** — 🔒 Pending CI approval: 36

### 🔒 Pending CI approval (36)

| PR | Title | Author | Pending since |
|----|-------|--------|---------------|
| [#38219](https://github.com/aws/aws-cdk/pull/38219) | feat(applicationautoscaling): add high-resolution ECS predefined metrics | @sanyamk23 | 2026-08-17 (6d) |
| [#38471](https://github.com/aws/aws-cdk/pull/38471) | feat(codebuild): add Node.js 24 Lambda build image constants | @sanyamk23 | 2026-08-17 (6d) |
| [#38332](https://github.com/aws/aws-cdk/pull/38332) | fix(bedrockagentcore): set default child on BrowserCustom L2 so applyRemovalPolicy works | @sanyamk23 | 2026-08-17 (6d) |
| [#38372](https://github.com/aws/aws-cdk/pull/38372) | feat(bedrockagentcore): add manageDeliveryResourcePolicy opt-out for runtime observability | @sanyamk23 | 2026-08-17 (6d) |
| [#38328](https://github.com/aws/aws-cdk/pull/38328) | fix(bedrockagentcore): set default child on Runtime L2 so applyRemovalPolicy works | @sanyamk23 | 2026-08-17 (6d) |
| [#38485](https://github.com/aws/aws-cdk/pull/38485) | fix(dynamodb): use concrete ARN account/region when resourceName is tokenized | @sanyamk23 | 2026-08-17 (6d) |
| [#38228](https://github.com/aws/aws-cdk/pull/38228) | fix(ecs): validate environment variable limit in container definitions | @sanyamk23 | 2026-08-17 (6d) |
| [#38375](https://github.com/aws/aws-cdk/pull/38375) | fix(elasticloadbalancingv2): make NetworkLoadBalancer assignable to INetworkLoadBalancer under exactOptionalPropertyTypes | @sanyamk23 | 2026-08-17 (6d) |
| [#38572](https://github.com/aws/aws-cdk/pull/38572) | fix(sns-subscriptions): regionalize principal for Lambda subscriptions and DLQ policies in opt-in regions | @DavidA94 | 2026-08-17 (6d) |
| [#38590](https://github.com/aws/aws-cdk/pull/38590) | feat(events): add grantInvokeApiDestination to ApiDestination | @lemon0333 | 2026-08-18 (5d) |
| [#38596](https://github.com/aws/aws-cdk/pull/38596) | feat(ecs-patterns): support a desiredCount of 0 | @marco2216 | 2026-08-18 (5d) |
| [#35501](https://github.com/aws/aws-cdk/pull/35501) | fix(s3-deployment): increase default memory limit from 128MB to 512MB | @ychjamie | 2026-08-19 (4d) |
| [#38601](https://github.com/aws/aws-cdk/pull/38601) | docs(cloudfront): document feature-flagged Function runtime default | @piotrekwitkowski | 2026-08-19 (4d) |
| [#38605](https://github.com/aws/aws-cdk/pull/38605) | chore(ec2): add VPC interface endpoints for EventBridge Scheduler | @amodam-user | 2026-08-20 (3d) |
| [#38608](https://github.com/aws/aws-cdk/pull/38608) | fix(servicecatalog): avoid asset hash change for latest version in Pr… | @1001R | 2026-08-20 (3d) |
| [#36643](https://github.com/aws/aws-cdk/pull/36643) | feat(apigateway): update domain name security policy | @Jojo134 | 2026-08-20 (3d) |
| [#38613](https://github.com/aws/aws-cdk/pull/38613) | fix(logs): output full root ARN for resource policy principals | @sanyamk23 | 2026-08-20 (3d) |
| [#38193](https://github.com/aws/aws-cdk/pull/38193) | feat(ec2): support CpuOptions on LaunchTemplate | @emi111y | 2026-08-20 (3d) |
| [#38489](https://github.com/aws/aws-cdk/pull/38489) | feat(glue): add SNOWFLAKE connection type | @sanyamk23 | 2026-08-20 (3d) |
| [#38331](https://github.com/aws/aws-cdk/pull/38331) | fix(rds): properly handle RETAIN_ON_UPDATE_OR_DELETE in subresources | @wasim-builds | 2026-08-21 (2d) |
| [#38551](https://github.com/aws/aws-cdk/pull/38551) | chore(rds): sqlserver 14.00.3530.2.v1,15.00.4470.1.v1,16.00.4245.2.v1,16.00.4250.1.v1,16.00.4255.1.v1 | @alpin87 | 2026-08-21 (2d) |
| [#38623](https://github.com/aws/aws-cdk/pull/38623) | fix(cognito): tighten domainPrefix validation to match AWS constraint | @sanyamk23 | 2026-08-21 (2d) |
| [#38624](https://github.com/aws/aws-cdk/pull/38624) | fix(lambda): show received ephemeral storage size instead of [object Object] | @sanyamk23 | 2026-08-21 (2d) |
| [#38626](https://github.com/aws/aws-cdk/pull/38626) | feat(dsql-alpha): add encryptionKey property to Cluster | @sanyamk23 | 2026-08-21 (2d) |
| [#38420](https://github.com/aws/aws-cdk/pull/38420) | fix(logs): use AccountPrincipal for drift prevention | @wasim-builds | 2026-08-21 (2d) |
| [#36919](https://github.com/aws/aws-cdk/pull/36919) | feat(cloudwatch): support live data for `SingleValueWidget` in cloudwatch dashboards | @Darasimi-Ajewole | 2026-08-21 (2d) |
| [#38259](https://github.com/aws/aws-cdk/pull/38259) | feat(ecs): support configurable deployment circuit breaker settings | @SIDDHESH1564 | 2026-08-21 (2d) |
| [#38628](https://github.com/aws/aws-cdk/pull/38628) | fix(core): only hash stack template files during validation, not entire cdk.out | @sanyamk23 | 2026-08-21 (2d) |
| [#38630](https://github.com/aws/aws-cdk/pull/38630) | feat(codepipeline-actions): add serviceRoleOverride to CodeBuildAction | @sanyamk23 | 2026-08-21 (2d) |
| [#38470](https://github.com/aws/aws-cdk/pull/38470) | docs(events): add examples for RuleTargetInput and EventField | @krantboy | 2026-08-22 (1d) |
| [#38633](https://github.com/aws/aws-cdk/pull/38633) | feat(ecs): allow specifying whether an imported task definition ARN includes a revision | @lemon0333 | 2026-08-22 (1d) |
| [#38634](https://github.com/aws/aws-cdk/pull/38634) | fix(rds): propagate retain-on-update policy | @miachillgood | 2026-08-22 (1d) |
| [#38573](https://github.com/aws/aws-cdk/pull/38573) | fix(dynamodb): `TableGrantsProps` deprecation warnings in TableV2 | @wasim-builds | 2026-08-22 (1d) |
| [#38636](https://github.com/aws/aws-cdk/pull/38636) | feat(ec2): add allowAllSelf to SecurityGroup | @lemon0333 | 2026-08-22 (1d) |
| [#37880](https://github.com/aws/aws-cdk/pull/37880) | fix(codepipeline): clean up cross-region replication buckets | @nanookclaw | 2026-08-23 (0d) |
| [#38461](https://github.com/aws/aws-cdk/pull/38461) | docs(s3,kms): replace object-literal IResourceWithPolicyV2 example with named class | @AmariahAK | 2026-08-23 (0d) |

Close this issue once all listed PRs have been handled.