fix(elasticloadbalancingv2): make NetworkLoadBalancer assignable to INetworkLoadBalancer under exactOptionalPropertyTypes - #38375
Open
sanyamk23 wants to merge 9 commits into
Conversation
github-actions
Bot
added
p2
beginning-contributor
sanyamk23
force-pushed
the
fix/nlb-exact-optional-property-types
branch
from
July 24, 2026 16:19
99aa0d4 to
3313314
Compare
sanyamk23
force-pushed
the
fix/nlb-exact-optional-property-types
branch
from
July 31, 2026 16:08
a40c015 to
cf20c16
Compare
sanyamk23
force-pushed
the
fix/nlb-exact-optional-property-types
branch
from
August 2, 2026 20:09
cf20c16 to
4074ad0
Compare
sanyamk23
force-pushed
the
fix/nlb-exact-optional-property-types
branch
from
August 3, 2026 18:51
4074ad0 to
cf20c16
Compare
abidhasan-aws
temporarily deployed
to
automation
August 7, 2026 11:08 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Author
|
CI passing. Build workflow is action_required (needs manual approval for fork PRs). Ready for review. |
Author
|
This fixes a compilation error where NetworkLoadBalancer could not be assigned to INetworkLoadBalancer with strictOptionalPropertyTypes enabled. Happy to answer any questions. |
sanyamk23
force-pushed
the
fix/nlb-exact-optional-property-types
branch
from
August 17, 2026 13:39
68b9ce9 to
e1cdeb1
Compare
sanyamk23
force-pushed
the
fix/nlb-exact-optional-property-types
branch
from
August 17, 2026 19:53
e1cdeb1 to
5ef0bfc
Compare
…ross-repo PRs When the GitHub API returns a 404 for the list reviews endpoint (which can happen for cross-repo PRs from forks or when the PROJEN_GITHUB_TOKEN lacks access to the source repository), treat it as no existing reviews rather than crashing the entire validate-pr job. Previously, the 404 error would propagate up to run().catch() in index.ts, causing the process to exit with code 1 and failing the workflow.
…RemovalPolicy works The BrowserCustom construct creates a CfnBrowserCustom plus a ServiceRole child, so CDK never auto-assigns the Cfn resource as the default child. This made Resource.applyRemovalPolicy() throw CannotApplyRemovalPolicy when called on the L2. Explicitly set node.defaultChild to the CfnBrowserCustom, matching how other L2 resources behave. Part of aws#38327.
… removal policy Adds a BrowserWithRemovalPolicy construct to the browser integ test that calls applyRemovalPolicy(DESTROY) on the L2, and regenerates the snapshot to cover the default-child fix from the parent commit. Part of aws#38327.
…runtime observability When deploying many AgentCore Runtime constructs per account/Region, the per-stack AWS::Logs::ResourcePolicy and AWS::XRay::ResourcePolicy created by the observability delivery consume account-level quota slots (CloudWatch Logs: 10, X-Ray: lower). This adds a `manageDeliveryResourcePolicy` prop (defaults to true) that skips resource policy creation while still provisioning delivery sources, destinations, and deliveries. For same-account /aws/vendedlogs/ delivery, the log-delivery service-linked role provides write access without an explicit policy. Closes aws#38342. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
… for runtime observability Adds the manageDeliveryResourcePolicy prop to the Runtime properties table and observability section, with an example showing how to opt out of resource policy creation when deploying many runtimes per account/Region.
…NetworkLoadBalancer under exactOptionalPropertyTypes Converts the `securityGroups` and `enforceSecurityGroupInboundRulesOnPrivateLinkTraffic` getters (which returned `T | undefined`) to `?: T` fields matching the interface. The `securityGroups` field is non-readonly so it can be updated by `addSecurityGroup`, while `enforceSecurityGroupInboundRulesOnPrivateLinkTraffic` is readonly since it doesn't change after construction. Part of aws#37996. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
… getter pattern for JSII compatibility Revert securityGroups and enforceSecurityGroupInboundRulesOnPrivateLinkTraffic from public readonly properties to private backing fields with getters. JSII5010 error occurred because public readonly properties are considered mutable when implementing an interface with getter-based properties. Using private backing fields with getters maintains true read-only semantics. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
…faces under exactOptionalPropertyTypes `ICluster` and `ITaskDefinition` declare several members optional (`?:`), but the concrete classes exposed them through getters typed `T | undefined`. Under TypeScript's `exactOptionalPropertyTypes`, a member typed `T | undefined` is not assignable to an optional `?: T`, so consumers who enable the flag get TS2420 errors and type-checking `aws-cdk-lib` fails for them outright. The library does not build with the flag, so the break is invisible to its own compile. Affected members: - `TaskDefinition.executionRole` (inherited by Ec2/External/Fargate task definitions), and - `Cluster.defaultCloudMapNamespace`, `Cluster.autoscalingGroup`, `Cluster.executeCommandConfiguration`. Convert each getter to a `public readonly x?: T` field. `executionRole` and `defaultCloudMapNamespace` are populated after construction (by `obtainExecutionRole` and `addDefaultCloudMapNamespace`), so they are set through a module-private helper that assigns through a `Writeable` cast; the live view is preserved. `autoscalingGroup` and `executeCommandConfiguration` are only set in the constructor, so they use a direct guarded `readonly` assignment. The fields stay `readonly`, so the jsii assembly is unchanged (the properties remain optional and immutable) and `yarn compat` passes with no new entry. The internal `ImportedCluster` is updated the same way so the module is fully clean. Add behavior tests (undefined by default, populated from props, and the live population via `obtainExecutionRole` / `addDefaultCloudMapNamespace`) and a package-local guard that type-checks the package's concrete classes against their interfaces under the flag, asserting the package stays clean. Refs aws#37996
Merging main brought in addExistingDefaultCloudMapNamespace (aws#36812), which reads and writes the private _defaultCloudMapNamespace backing field that this branch replaces with a readonly defaultCloudMapNamespace field written through setDefaultCloudMapNamespace. The two sides touched different hunks so git merged them without conflict, but the new method no longer compiled (TS2551) and the build failed at jsii. Route the new method through the field and its helper.
sanyamk23
force-pushed
the
fix/nlb-exact-optional-property-types
branch
from
August 17, 2026 19:58
5ef0bfc to
79a64ee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Part of #37996.
Converts the securityGroups and enforceSecurityGroupInboundRulesOnPrivateLinkTraffic getters (which returned
T | undefined) to?: Tfields matching the interface.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license and that I've followed the contributing guidelines.