feat(cloudwatch): support alarm mute rules

[Tietew]

Issue # (if applicable)

Closes #37502.

Reason for this change

CloudWatch introduced Alarm Mute Rules, enabling us to temporarily mute alarm notifications during planned maintenance downtime, etc.
https://aws.amazon.com/about-aws/whats-new/2026/02/amazon-cloudwatch-alarm-muting-rules/

For details
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/alarm-mute-rules.html

Description of changes

This PR includes:

• A L2 construct cloudwatch.AlarmMuteRule and prop interface.
• A convenient class cloudwatch.ScheduleExpression to generate alarm mute rule's schedule expression, inspired by scheduler.ScheduleExpression.
• A convernient method cloudwatch.Alarm.addAlarmMuteRule().

Basic Usage

declare const alarm1: cloudwatch.IAlarm;
declare const alarm2: cloudwatch.IAlarm;

const alarmMuteRule = new cloudwatch.AlarmMuteRule(this, 'AlarmMuteRule', {
  // target alarms - optional
  alarms: [alarm1],
  // cron-style expression with optional time zone
  schedule: cloudwatch.ScheduleExpression.cron({ minute: '0', hour: '0', timeZone: cdk.TimeZone.ASIA_TOKYO }),
  // one-time schedule with optional time zone
  schedule: cloudwatch.ScheduleExpression.at(new Date(...), cdk.TimeZone.ASIA_TOKYO),
  // duration of mute period
  duration: cdk.Duration.minutes(30),
});

// Alarms can be added after construction
alarmMuteRule.addAlarm(alarm2);

Describe any new or updated permissions being added

No permissions.

Description of how you validated changes

Added unit tests and an integ test.
The integ test has no assertions because assertion cannot verify that nothing happens.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[badmintoncryer]

Thank you for your nice contribution! I've added two minor comments.

[badmintoncryer]

How about adding a validation that verifies the maximum length of the alarms?

https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudwatch-alarmmuterule-mutetargets.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_MuteTargets.html

I noticed that there is a difference between these two documents. I think AWS API restriction (100 APIs) is correct but I want you to confirm actual behavior.

[badmintoncryer]

Could you please add a maximum and minimum length validation?

https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-alarmmuterule.html