@cdkd/cli 0.0.1 → 0.323.0

package/dist/rds-provider-C8enyD9d.js

@@ -0,0 +1,1749 @@
+import { $ as safeMsg, E as generatedNameFor, n as describeAwsFailure, s as getLogger } from "./aws-failure-text-DiHodi76.js";
+import { B as normalizeAwsTagsToCfn, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Nn as ProvisioningError, Nr as wrapMaskedAwsError, P as markNotGone, Q as isTerminalDbWaitStatus, W as resolveExplicitPhysicalId, Y as deleteWithProtectionCompensation, b as withRemovalDefaults, dt as pasteableAwsCommand, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, hr as relayedNameCollision, i as reportCreatedResource, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, nt as protectionFlipKey, o as retractCreatedResource, rt as rdsFamilyProtectionSite, tt as observeThenDisableProtection } from "./created-resource-sink-CmrPwGge.js";
+import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
+import { $i as stringifyIfAssigned, Dt as enclosingDeadlineRemainingMs, Qi as definedAttributes, Tc as dbInstanceEngineChangeIsInPlace, Wi as markDeleteStarted, Yi as refuseMalformedDesiredTags, Zi as tagPlanWarning, gl as dynamicReferenceTokens, ha as slowCcOperationTimeoutMs, qi as planTagDiff } from "./deploy-engine-dYZ0v6Kz.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DCLA_p9I.js";
+import { DescribeSecurityGroupsCommand, EC2Client } from "@aws-sdk/client-ec2";
+import { isDeepStrictEqual } from "node:util";
+import { AddTagsToResourceCommand, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBSubnetGroupCommand, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBSubnetGroupCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBSubnetGroupsCommand, DescribeGlobalClustersCommand, DisableHttpEndpointCommand, EnableHttpEndpointCommand, ListTagsForResourceCommand, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBSubnetGroupCommand, RDSClient, RebootDBInstanceCommand, RemoveFromGlobalClusterCommand, RemoveTagsFromResourceCommand } from "@aws-sdk/client-rds";
+
+// src/provisioning/providers/rds-provider.ts
+function propertyChangedForUpdate(key, desired, recorded, context) {
+	const changedProperties = context?.changedProperties;
+	if (changedProperties !== void 0) return changedProperties.has(key);
+	return holdsRecordedStandIn(recorded) || !isDeepStrictEqual(desired, recorded);
+}
+function holdsRecordedStandIn(value) {
+	if (typeof value === "string") return value === "***" || dynamicReferenceTokens(value).length > 0;
+	if (Array.isArray(value)) return value.some(holdsRecordedStandIn);
+	if (value !== null && typeof value === "object") return Object.values(value).some(holdsRecordedStandIn);
+	return false;
+}
+function masterUserPasswordToSend(properties, previousProperties, context) {
+	const desired = properties["MasterUserPassword"];
+	if (desired === void 0 || desired === null) return void 0;
+	return propertyChangedForUpdate("MasterUserPassword", desired, previousProperties["MasterUserPassword"], context) ? desired : void 0;
+}
+function masterCredentialSettingsChanged(properties, previousProperties, context) {
+	return propertyChangedForUpdate("MasterUserPassword", properties["MasterUserPassword"], previousProperties["MasterUserPassword"], context) || propertyChangedForUpdate("ManageMasterUserPassword", properties["ManageMasterUserPassword"], previousProperties["ManageMasterUserPassword"], context) || propertyChangedForUpdate("MasterUserSecret", properties["MasterUserSecret"], previousProperties["MasterUserSecret"], context);
+}
+function managedPasswordOnRemoval(properties, previousProperties) {
+	const previous = previousProperties["ManageMasterUserPassword"];
+	return properties["ManageMasterUserPassword"] === void 0 && (previous === true || previous === "true");
+}
+const CLUSTER_REMOVED_PORT = /* @__PURE__ */ new Map([
+	["aurora-postgresql", 5432],
+	["aurora-mysql", 3306],
+	["mysql", 3306],
+	["postgres", 3306]
+]);
+function numberOrUndefined(value) {
+	return value == null ? void 0 : Number(value);
+}
+const STORAGE_MEMBERS = /* @__PURE__ */ new Set([
+	"AllocatedStorage",
+	"Iops",
+	"StorageType",
+	"StorageThroughput"
+]);
+function instanceValueChanged(properties, previousProperties, key, context) {
+	const desired = properties[key];
+	if (desired == null) return false;
+	const previous = previousProperties[key];
+	if (previous == null) return true;
+	const differs = typeof desired === "object" || typeof previous === "object" ? !isDeepStrictEqual(desired, previous) : String(desired) !== String(previous);
+	if (STORAGE_MEMBERS.has(key) && !differs) return false;
+	if (context?.changedProperties !== void 0) return context.changedProperties.has(key);
+	return differs;
+}
+function sizeOrZero(value) {
+	const size = Number(value);
+	return value != null && Number.isFinite(size) ? size : 0;
+}
+function isProvisionedIoStorage(properties) {
+	const storageType = properties["StorageType"];
+	if (typeof storageType === "string" && storageType !== "") return [
+		"io1",
+		"io2",
+		"gp3"
+	].includes(storageType.toLowerCase());
+	return properties["Iops"] != null;
+}
+async function instanceModifyBackfillMembers(properties, previousProperties, liveAllocatedStorage, logicalId, context) {
+	const changed = (key) => instanceValueChanged(properties, previousProperties, key, context);
+	const desiredAllocated = numberOrUndefined(properties["AllocatedStorage"]);
+	const members = {};
+	if (changed("BackupRetentionPeriod")) members.BackupRetentionPeriod = Number(properties["BackupRetentionPeriod"]);
+	for (const key of [
+		"PreferredBackupWindow",
+		"PreferredMaintenanceWindow",
+		"StorageType",
+		"OptionGroupName",
+		"CACertificateIdentifier"
+	]) if (changed(key)) members[key] = properties[key];
+	for (const key of ["NetworkType", "LicenseModel"]) if (changed(key)) members[key] = properties[key];
+	if (changed("DatabaseInsightsMode")) members.DatabaseInsightsMode = properties["DatabaseInsightsMode"];
+	for (const key of [
+		"MultiAZ",
+		"AutoMinorVersionUpgrade",
+		"CopyTagsToSnapshot",
+		"DedicatedLogVolume"
+	]) if (changed(key)) members[key] = properties[key];
+	if (changed("StorageThroughput")) members.StorageThroughput = Number(properties["StorageThroughput"]);
+	if (changed("PromotionTier")) members.PromotionTier = Number(properties["PromotionTier"]);
+	if (changed("CACertificateIdentifier") && properties["CertificateRotationRestart"] != null) members.CertificateRotationRestart = properties["CertificateRotationRestart"];
+	if (changed("MaxAllocatedStorage")) members.MaxAllocatedStorage = Number(properties["MaxAllocatedStorage"]);
+	else if (properties["MaxAllocatedStorage"] == null && previousProperties["MaxAllocatedStorage"] != null) {
+		const live = await liveAllocatedStorage();
+		if (live === void 0) throw new Error(safeMsg`DBInstance ${logicalId}: MaxAllocatedStorage was removed from the template, which turns storage autoscaling off by setting it to the allocated storage, but DescribeDBInstances did not report the allocated storage`);
+		members.MaxAllocatedStorage = Math.max(live, sizeOrZero(desiredAllocated));
+	}
+	const rollback = context?.replayingState === true;
+	if (changed("EngineVersion") && !rollback) members.EngineVersion = String(properties["EngineVersion"]);
+	if (changed("DBParameterGroupName") && !(rollback && changed("EngineVersion"))) members.DBParameterGroupName = properties["DBParameterGroupName"];
+	if (changed("AllowMajorVersionUpgrade") || members.EngineVersion !== void 0 && properties["AllowMajorVersionUpgrade"] != null) members.AllowMajorVersionUpgrade = properties["AllowMajorVersionUpgrade"];
+	if (changed("AllocatedStorage") && !rollback) members.AllocatedStorage = desiredAllocated;
+	if (isProvisionedIoStorage(properties)) {
+		if (changed("AllocatedStorage") || changed("Iops") || changed("StorageThroughput") || changed("StorageType")) {
+			if (members.AllocatedStorage === void 0) {
+				const live = await liveAllocatedStorage();
+				const larger = Math.max(sizeOrZero(live), sizeOrZero(desiredAllocated), rollback ? sizeOrZero(previousProperties["AllocatedStorage"]) : 0);
+				if (larger > 0) members.AllocatedStorage = larger;
+			}
+			if (properties["Iops"] != null) members.Iops = Number(properties["Iops"]);
+		}
+	} else if (changed("Iops") && !rollback) members.Iops = Number(properties["Iops"]);
+	const enableChanged = changed("EnablePerformanceInsights");
+	const keyChanged = changed("PerformanceInsightsKMSKeyId");
+	const enableDesired = properties["EnablePerformanceInsights"];
+	const keyDesired = properties["PerformanceInsightsKMSKeyId"];
+	if (enableChanged || keyChanged) {
+		members.EnablePerformanceInsights = enableDesired;
+		if (keyChanged || String(enableDesired) === "true") members.PerformanceInsightsKMSKeyId = keyDesired;
+	}
+	if (changed("PerformanceInsightsRetentionPeriod")) {
+		members.PerformanceInsightsRetentionPeriod = Number(properties["PerformanceInsightsRetentionPeriod"]);
+		members.EnablePerformanceInsights = enableDesired;
+		members.PerformanceInsightsKMSKeyId = keyDesired;
+	}
+	return Object.fromEntries(Object.entries(members).filter(([, value]) => value !== void 0));
+}
+function instanceParameterGroupPendingReboot(instance) {
+	return (instance?.DBParameterGroups ?? []).some((group) => group.ParameterApplyStatus === "pending-reboot");
+}
+function instanceParameterGroupApplying(instance) {
+	return (instance?.DBParameterGroups ?? []).some((group) => group.ParameterApplyStatus === "applying");
+}
+function instanceHasPendingChanges(instance, caRotationRestarts) {
+	const pending = instance.PendingModifiedValues;
+	if (pending === void 0) return false;
+	return pending.DBInstanceClass !== void 0 || pending.AllocatedStorage !== void 0 || pending.AutomationMode !== void 0 || pending.BackupRetentionPeriod !== void 0 || pending.DBInstanceIdentifier !== void 0 || pending.DBSubnetGroupName !== void 0 || pending.Engine !== void 0 || pending.EngineVersion !== void 0 || pending.IAMDatabaseAuthenticationEnabled !== void 0 || pending.Iops !== void 0 || pending.LicenseModel !== void 0 || pending.MasterUserPassword !== void 0 || pending.MultiAZ !== void 0 || pending.PendingCloudwatchLogsExports !== void 0 || pending.Port !== void 0 || (pending.ProcessorFeatures ?? []).length > 0 || pending.ResumeFullAutomationModeTime !== void 0 || pending.StorageThroughput !== void 0 || pending.StorageType !== void 0 || caRotationRestarts && pending.CACertificateIdentifier !== void 0;
+}
+function instanceParameterGroupSettled(instance, sentGroup, caRotationRestarts) {
+	if (instance.DBInstanceStatus !== "available") return false;
+	if (instanceHasPendingChanges(instance, caRotationRestarts)) return false;
+	const groups = instance.DBParameterGroups ?? [];
+	if (groups.some((group) => group.ParameterApplyStatus === "applying")) return false;
+	if (sentGroup === void 0 || groups.length === 0) return true;
+	return groups.some((group) => group.DBParameterGroupName?.toLowerCase() === sentGroup.toLowerCase());
+}
+function instanceRebootApplied(instance) {
+	return instance.DBInstanceStatus === "available" && (instance.DBParameterGroups ?? []).every((group) => group.ParameterApplyStatus === "in-sync") && (instance.OptionGroupMemberships ?? []).every((group) => group.Status === "in-sync");
+}
+function logExportsList(value) {
+	if (value == null) return void 0;
+	if (!Array.isArray(value) || !value.every((type) => typeof type === "string")) return "malformed";
+	return [...new Set(value)];
+}
+function desiredLogExports(properties, resourceType, logicalId, physicalId) {
+	const desired = logExportsList(properties["EnableCloudwatchLogsExports"]);
+	if (desired !== "malformed") return desired;
+	throw markNonRetryable(new ProvisioningError(`${resourceType} ${logicalId}: EnableCloudwatchLogsExports must be a list of log type names`, resourceType, logicalId, physicalId));
+}
+function logExportsDelta(desired, previousValue) {
+	const previous = logExportsList(previousValue);
+	const had = previous === void 0 || previous === "malformed" ? [] : previous;
+	const want = desired ?? [];
+	const enable = want.filter((type) => !had.includes(type));
+	const disable = had.filter((type) => !want.includes(type));
+	if (enable.length === 0 && disable.length === 0) return void 0;
+	return {
+		...enable.length > 0 && { EnableLogTypes: enable },
+		...disable.length > 0 && { DisableLogTypes: disable }
+	};
+}
+function liveLogExports(enabled, pending) {
+	const disabled = pending?.LogTypesToDisable ?? [];
+	const out = (enabled ?? []).filter((type) => !disabled.includes(type));
+	for (const type of pending?.LogTypesToEnable ?? []) if (!out.includes(type)) out.push(type);
+	return out;
+}
+function logExportsApplied(config, enabled, pending) {
+	if ((pending?.LogTypesToEnable?.length ?? 0) > 0) return false;
+	if ((pending?.LogTypesToDisable?.length ?? 0) > 0) return false;
+	const live = enabled ?? [];
+	return (config.EnableLogTypes ?? []).every((type) => live.includes(type)) && !(config.DisableLogTypes ?? []).some((type) => live.includes(type));
+}
+function instanceAvailabilityZoneKept(properties, previousProperties) {
+	const desired = properties["AvailabilityZone"];
+	if (desired === previousProperties["AvailabilityZone"]) return true;
+	return (desired == null || desired === "") && String(properties["MultiAZ"]) === "true";
+}
+function withPreviousAvailabilityZone(properties, previousProperties) {
+	const { AvailabilityZone: _desired, ...rest } = properties;
+	const previous = previousProperties["AvailabilityZone"];
+	return previous === void 0 ? rest : {
+		...rest,
+		AvailabilityZone: previous
+	};
+}
+function serverlessV2ScalingToSend(config) {
+	const seconds = numberOrUndefined(config.SecondsUntilAutoPause);
+	return {
+		MinCapacity: config.MinCapacity,
+		MaxCapacity: config.MaxCapacity,
+		...seconds !== void 0 && { SecondsUntilAutoPause: seconds }
+	};
+}
+const CLUSTER_BACKFILL_STRING_MEMBERS = [
+	"DBClusterParameterGroupName",
+	"PreferredBackupWindow",
+	"PreferredMaintenanceWindow",
+	"StorageType"
+];
+function clusterCreateBackfillMembers(properties) {
+	const members = {};
+	for (const key of CLUSTER_BACKFILL_STRING_MEMBERS) if (properties[key] != null) members[key] = properties[key];
+	if (properties["CopyTagsToSnapshot"] != null) members.CopyTagsToSnapshot = properties["CopyTagsToSnapshot"];
+	return members;
+}
+function clusterModifyBackfillMembers(properties, previousProperties, context) {
+	const changed = (key) => instanceValueChanged(properties, previousProperties, key, context);
+	const members = {};
+	for (const key of CLUSTER_BACKFILL_STRING_MEMBERS) if (changed(key)) members[key] = properties[key];
+	if (changed("CopyTagsToSnapshot")) members.CopyTagsToSnapshot = properties["CopyTagsToSnapshot"];
+	return members;
+}
+const CLUSTER_PERFORMANCE_INSIGHTS_MEMBERS = [
+	["PerformanceInsightsEnabled", "EnablePerformanceInsights"],
+	["PerformanceInsightsKmsKeyId", "PerformanceInsightsKMSKeyId"],
+	["PerformanceInsightsRetentionPeriod", "PerformanceInsightsRetentionPeriod"]
+];
+function clusterPerformanceInsightsMembers(properties) {
+	const members = {};
+	if (properties["PerformanceInsightsEnabled"] != null) members.EnablePerformanceInsights = properties["PerformanceInsightsEnabled"];
+	if (properties["PerformanceInsightsKmsKeyId"] != null) members.PerformanceInsightsKMSKeyId = properties["PerformanceInsightsKmsKeyId"];
+	const retention = retentionPeriodValue(properties["PerformanceInsightsRetentionPeriod"]);
+	if (typeof retention === "number") members.PerformanceInsightsRetentionPeriod = retention;
+	return members;
+}
+function clusterCreateScalarMembers(properties) {
+	return {
+		...properties["AutoMinorVersionUpgrade"] != null && { AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"] },
+		...properties["NetworkType"] != null && { NetworkType: properties["NetworkType"] },
+		...clusterPerformanceInsightsMembers(properties)
+	};
+}
+function clusterModifyScalarMembers(properties, previousProperties, context) {
+	const changed = (key) => instanceValueChanged(properties, previousProperties, key, context);
+	const members = {};
+	if (changed("AutoMinorVersionUpgrade")) members.AutoMinorVersionUpgrade = properties["AutoMinorVersionUpgrade"];
+	if (changed("NetworkType")) members.NetworkType = properties["NetworkType"];
+	if (CLUSTER_PERFORMANCE_INSIGHTS_MEMBERS.some(([key]) => changed(key))) Object.assign(members, clusterPerformanceInsightsMembers(properties));
+	return members;
+}
+function httpEndpointFlag(value) {
+	if (value == null) return void 0;
+	if (value === true || value === "true") return true;
+	if (value === false || value === "false") return false;
+	return "malformed";
+}
+const CLUSTER_BOOLEAN_SCALARS = [
+	"AutoMinorVersionUpgrade",
+	"PerformanceInsightsEnabled",
+	"EnableHttpEndpoint"
+];
+function retentionPeriodValue(value) {
+	if (value == null) return void 0;
+	const parsed = typeof value === "number" ? value : typeof value === "string" && /^\d+$/.test(value.trim()) ? Number(value) : NaN;
+	return Number.isInteger(parsed) && parsed >= 0 ? parsed : "malformed";
+}
+function clusterHttpEndpointAction(properties, previousProperties, resourceType, logicalId, physicalId, context) {
+	const desired = httpEndpointFlag(properties["EnableHttpEndpoint"]);
+	if (desired === "malformed") {
+		if (context?.replayingState === true || context?.desiredFromAwsReadback === true) return "skip";
+		throw markNonRetryable(new ProvisioningError(`${resourceType} ${logicalId}: EnableHttpEndpoint must be true or false`, resourceType, logicalId, physicalId));
+	}
+	const engine = properties["Engine"];
+	if (typeof engine !== "string") return void 0;
+	if (!["aurora-mysql", "aurora-postgresql"].includes(engine.toLowerCase())) return void 0;
+	const recorded = httpEndpointFlag(previousProperties["EnableHttpEndpoint"]);
+	if (desired === (recorded === "malformed" ? void 0 : recorded)) return void 0;
+	if (desired !== true) return "disable";
+	return context?.desiredFromAwsReadback === true ? "withheld" : "enable";
+}
+function withPreviousValues(properties, previousProperties, skipped) {
+	const out = { ...properties };
+	for (const [key, usable] of skipped) {
+		delete out[key];
+		const previous = previousProperties[key];
+		if (previous != null && usable(previous)) out[key] = previous;
+	}
+	return out;
+}
+const usableHttpEndpoint = (value) => typeof httpEndpointFlag(value) === "boolean";
+const usableRetentionPeriod = (value) => typeof retentionPeriodValue(value) === "number";
+function clusterEngineVersionChanged(properties, previousProperties, context) {
+	if (context?.replayingState === true) return false;
+	return instanceValueChanged(properties, previousProperties, "EngineVersion", context);
+}
+const SECURITY_GROUP_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying"]);
+const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "rebooting"]);
+function clusterPortToSend(properties, previousProperties) {
+	if (properties["Port"] != null) return Number(properties["Port"]);
+	if (previousProperties["Port"] == null) return void 0;
+	const engine = properties["Engine"] ?? previousProperties["Engine"];
+	const reset = typeof engine === "string" ? CLUSTER_REMOVED_PORT.get(engine.toLowerCase()) : void 0;
+	return reset === Number(previousProperties["Port"]) ? void 0 : reset;
+}
+const RDS_DELETE_WAIT_MS = Math.max(18e5, slowCcOperationTimeoutMs("AWS::RDS::DBCluster", "DELETE"), slowCcOperationTimeoutMs("AWS::RDS::DBInstance", "DELETE"));
+function deleteAutomatedBackupsInput(properties) {
+	const value = properties?.["DeleteAutomatedBackups"];
+	if (value === true || value === "true") return { DeleteAutomatedBackups: true };
+	if (value === false || value === "false") return { DeleteAutomatedBackups: false };
+	return {};
+}
+function recordedGlobalClusterIdentifier(properties) {
+	const value = properties?.["GlobalClusterIdentifier"];
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+const HTTP_ENDPOINT_BUSY_FAULTS = /* @__PURE__ */ new Set(["InvalidResourceStateFault", "InvalidDBClusterStateFault"]);
+const HTTP_ENDPOINT_MAX_ATTEMPTS = 8;
+const TRANSIENT_DETACH_FAULTS = /* @__PURE__ */ new Set([
+	"InvalidDBClusterStateFault",
+	"InvalidGlobalClusterStateFault",
+	"ThrottlingException",
+	"Throttling",
+	"RequestLimitExceeded"
+]);
+function isDbIdentifier(id) {
+	return id.length <= 63 && /^[A-Za-z](?:-?[A-Za-z0-9])*$/.test(id);
+}
+function awsErrorName(error) {
+	return error?.name ?? "";
+}
+var GlobalClusterDetachError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "GlobalClusterDetachError";
+	}
+};
+var RDSProvider = class {
+	rdsClient;
+	createClient;
+	ec2Client;
+	providerRegion;
+	logger = getLogger().child("RDSProvider");
+	protectionFlips = new ProtectionFlipRegistry();
+	removalDefaults = /* @__PURE__ */ new Map();
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::RDS::DBSubnetGroup", /* @__PURE__ */ new Set([
+			"DBSubnetGroupName",
+			"DBSubnetGroupDescription",
+			"SubnetIds",
+			"Tags"
+		])],
+		["AWS::RDS::DBCluster", /* @__PURE__ */ new Set([
+			"DBClusterIdentifier",
+			"Engine",
+			"EngineVersion",
+			"MasterUsername",
+			"MasterUserPassword",
+			"DatabaseName",
+			"Port",
+			"VpcSecurityGroupIds",
+			"DBSubnetGroupName",
+			"StorageEncrypted",
+			"KmsKeyId",
+			"BackupRetentionPeriod",
+			"DeletionProtection",
+			"ServerlessV2ScalingConfiguration",
+			"Tags",
+			"ManageMasterUserPassword",
+			"MasterUserSecret",
+			"MonitoringRoleArn",
+			"MonitoringInterval",
+			"EnableIAMDatabaseAuthentication",
+			"PubliclyAccessible",
+			"DBClusterParameterGroupName",
+			"PreferredBackupWindow",
+			"PreferredMaintenanceWindow",
+			"CopyTagsToSnapshot",
+			"StorageType",
+			"EnableCloudwatchLogsExports",
+			"AutoMinorVersionUpgrade",
+			"NetworkType",
+			"PerformanceInsightsEnabled",
+			"PerformanceInsightsKmsKeyId",
+			"PerformanceInsightsRetentionPeriod",
+			"EnableHttpEndpoint"
+		])],
+		["AWS::RDS::DBInstance", /* @__PURE__ */ new Set([
+			"DBInstanceIdentifier",
+			"DBInstanceClass",
+			"Engine",
+			"DBClusterIdentifier",
+			"DBSubnetGroupName",
+			"PubliclyAccessible",
+			"Tags",
+			"AllocatedStorage",
+			"DeletionProtection",
+			"EngineVersion",
+			"MasterUsername",
+			"MasterUserPassword",
+			"Port",
+			"StorageEncrypted",
+			"VPCSecurityGroups",
+			"KmsKeyId",
+			"MasterUserSecret",
+			"ManageMasterUserPassword",
+			"MonitoringRoleArn",
+			"MonitoringInterval",
+			"EnableIAMDatabaseAuthentication",
+			"BackupRetentionPeriod",
+			"PreferredBackupWindow",
+			"PreferredMaintenanceWindow",
+			"StorageType",
+			"MultiAZ",
+			"MaxAllocatedStorage",
+			"AutoMinorVersionUpgrade",
+			"CopyTagsToSnapshot",
+			"EnablePerformanceInsights",
+			"PerformanceInsightsKMSKeyId",
+			"PerformanceInsightsRetentionPeriod",
+			"Iops",
+			"StorageThroughput",
+			"OptionGroupName",
+			"CACertificateIdentifier",
+			"NetworkType",
+			"LicenseModel",
+			"PromotionTier",
+			"DatabaseInsightsMode",
+			"DedicatedLogVolume",
+			"AllowMajorVersionUpgrade",
+			"CertificateRotationRestart",
+			"DBParameterGroupName",
+			"EnableCloudwatchLogsExports",
+			"DBName",
+			"AvailabilityZone"
+		])]
+	]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"]])], ["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([
+		["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
+		["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
+		["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"]
+	])]]);
+	constructor(options) {
+		this.providerRegion = options?.region ?? ambientRegion();
+	}
+	getClient() {
+		if (!this.rdsClient) {
+			this.rdsClient = new RDSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new RDSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
+		return this.rdsClient;
+	}
+	getEc2Client() {
+		if (!this.ec2Client) this.ec2Client = new EC2Client({
+			...ambientClientDefaults(),
+			...this.providerRegion ? { region: this.providerRegion } : {}
+		});
+		return this.ec2Client;
+	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
+	async create(logicalId, resourceType, properties, context) {
+		const mask = context?.maskSecrets;
+		switch (resourceType) {
+			case "AWS::RDS::DBSubnetGroup": return this.createDBSubnetGroup(logicalId, resourceType, properties, mask);
+			case "AWS::RDS::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask, context?.replayingState === true);
+			case "AWS::RDS::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask);
+			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+		switch (resourceType) {
+			case "AWS::RDS::DBSubnetGroup": return this.updateDBSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::RDS::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context);
+			case "AWS::RDS::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
+			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		switch (resourceType) {
+			case "AWS::RDS::DBSubnetGroup": return this.deleteDBSubnetGroup(logicalId, physicalId, resourceType, context);
+			case "AWS::RDS::DBCluster": return this.deleteDBCluster(logicalId, physicalId, resourceType, properties, context);
+			case "AWS::RDS::DBInstance": return this.deleteDBInstance(logicalId, physicalId, resourceType, properties, context);
+			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
+		}
+	}
+	async createDBSubnetGroup(logicalId, resourceType, properties, mask) {
+		this.logger.debug(`Creating DBSubnetGroup ${logicalId}`);
+		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const dbSubnetGroupName = properties["DBSubnetGroupName"] || generatedNameFor("AWS::RDS::DBSubnetGroup", logicalId);
+		try {
+			const created = await this.getCreateClient().send(new CreateDBSubnetGroupCommand({
+				DBSubnetGroupName: dbSubnetGroupName,
+				DBSubnetGroupDescription: properties["DBSubnetGroupDescription"] || `Subnet group for ${logicalId}`,
+				SubnetIds: properties["SubnetIds"],
+				...tags.length > 0 && { Tags: tags }
+			}));
+			this.logger.debug(`Successfully created DBSubnetGroup ${logicalId}: ${dbSubnetGroupName}`);
+			const dbSubnetGroupArn = created.DBSubnetGroup?.DBSubnetGroupArn;
+			return {
+				physicalId: dbSubnetGroupName,
+				attributes: {
+					DBSubnetGroupName: dbSubnetGroupName,
+					...dbSubnetGroupArn !== void 0 && { DBSubnetGroupArn: dbSubnetGroupArn }
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create DBSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, dbSubnetGroupName, cause));
+		}
+	}
+	async updateDBSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
+		this.logger.debug(`Updating DBSubnetGroup ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		try {
+			const subnetIds = properties["SubnetIds"];
+			const sendSubnetIds = subnetIds !== void 0 && subnetIds.length > 0;
+			const modifyInput = {
+				DBSubnetGroupName: physicalId,
+				DBSubnetGroupDescription: properties["DBSubnetGroupDescription"],
+				...sendSubnetIds && { SubnetIds: subnetIds }
+			};
+			await this.getClient().send(new ModifyDBSubnetGroupCommand(modifyInput));
+			const arn = (await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: physicalId }))).DBSubnetGroups?.[0]?.DBSubnetGroupArn;
+			if (arn) await this.applyTagDiff(arn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			this.logger.debug(`Successfully updated DBSubnetGroup ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: {
+					DBSubnetGroupName: physicalId,
+					...arn !== void 0 && { DBSubnetGroupArn: arn }
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update DBSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async deleteDBSubnetGroup(logicalId, physicalId, resourceType, context) {
+		this.logger.debug(`Deleting DBSubnetGroup ${logicalId}: ${physicalId}`);
+		try {
+			await this.getClient().send(new DeleteDBSubnetGroupCommand({ DBSubnetGroupName: physicalId }));
+			this.logger.debug(`Successfully deleted DBSubnetGroup ${logicalId}`);
+		} catch (error) {
+			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DBSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async createDBCluster(logicalId, resourceType, properties, mask, replaying = false) {
+		this.logger.debug(`Creating DBCluster ${logicalId}`);
+		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		let httpEndpoint = httpEndpointFlag(properties["EnableHttpEndpoint"]);
+		if (httpEndpoint === "malformed") {
+			if (!replaying) throw markNonRetryable(new ProvisioningError(`${resourceType} ${logicalId}: EnableHttpEndpoint must be true or false`, resourceType, logicalId));
+			this.logger.warn(safeMsg`DBCluster ${logicalId}: the replayed EnableHttpEndpoint is not true or false; the cluster is created with the Data API off`);
+			httpEndpoint = void 0;
+		}
+		const retentionSkipped = retentionPeriodValue(properties["PerformanceInsightsRetentionPeriod"]) === "malformed";
+		if (retentionSkipped) {
+			if (!replaying) throw markNonRetryable(new ProvisioningError(`${resourceType} ${logicalId}: PerformanceInsightsRetentionPeriod must be a whole number of days`, resourceType, logicalId));
+			this.logger.warn(safeMsg`DBCluster ${logicalId}: the replayed PerformanceInsightsRetentionPeriod is not a whole number of days; the cluster is created with AWS's default retention`);
+		}
+		const skippedKeys = [...properties["EnableHttpEndpoint"] != null && httpEndpoint === void 0 ? ["EnableHttpEndpoint"] : [], ...retentionSkipped ? ["PerformanceInsightsRetentionPeriod"] : []];
+		const effectiveProperties = skippedKeys.length > 0 ? Object.fromEntries(Object.entries(properties).filter(([key]) => !skippedKeys.includes(key))) : void 0;
+		const logExports = desiredLogExports(properties, resourceType, logicalId);
+		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::RDS::DBCluster", logicalId);
+		let clusterLeftBehind = false;
+		let createdResourceId;
+		try {
+			const serverlessV2Config = properties["ServerlessV2ScalingConfiguration"];
+			const masterUserSecret = properties["MasterUserSecret"];
+			const response = await this.getCreateClient().send(new CreateDBClusterCommand({
+				DBClusterIdentifier: dbClusterIdentifier,
+				Engine: properties["Engine"],
+				EngineVersion: properties["EngineVersion"],
+				MasterUsername: properties["MasterUsername"],
+				MasterUserPassword: properties["MasterUserPassword"],
+				DatabaseName: properties["DatabaseName"],
+				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
+				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
+				DBSubnetGroupName: properties["DBSubnetGroupName"],
+				StorageEncrypted: properties["StorageEncrypted"],
+				KmsKeyId: properties["KmsKeyId"],
+				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
+				DeletionProtection: properties["DeletionProtection"],
+				...properties["ManageMasterUserPassword"] !== void 0 && { ManageMasterUserPassword: properties["ManageMasterUserPassword"] },
+				...masterUserSecret?.KmsKeyId !== void 0 && { MasterUserSecretKmsKeyId: masterUserSecret.KmsKeyId },
+				...properties["MonitoringRoleArn"] !== void 0 && { MonitoringRoleArn: properties["MonitoringRoleArn"] },
+				...properties["MonitoringInterval"] !== void 0 && { MonitoringInterval: Number(properties["MonitoringInterval"]) },
+				...properties["EnableIAMDatabaseAuthentication"] !== void 0 && { EnableIAMDatabaseAuthentication: properties["EnableIAMDatabaseAuthentication"] },
+				...properties["PubliclyAccessible"] !== void 0 && { PubliclyAccessible: properties["PubliclyAccessible"] },
+				...serverlessV2Config && { ServerlessV2ScalingConfiguration: serverlessV2ScalingToSend(serverlessV2Config) },
+				...clusterCreateBackfillMembers(properties),
+				...logExports !== void 0 && logExports.length > 0 && { EnableCloudwatchLogsExports: logExports },
+				...clusterCreateScalarMembers(properties),
+				...httpEndpoint !== void 0 && { EnableHttpEndpoint: httpEndpoint },
+				...tags.length > 0 && { Tags: tags }
+			}));
+			clusterLeftBehind = true;
+			createdResourceId = response.DBCluster?.DbClusterResourceId;
+			reportCreatedResource(logicalId, resourceType, dbClusterIdentifier, createdResourceId);
+			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
+			this.logger.debug(`Successfully created DBCluster ${logicalId}: ${dbClusterIdentifier}`);
+			const wantsDeletionProtection = properties["DeletionProtection"] === true;
+			try {
+				if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier);
+				const described = await this.describeDBCluster(dbClusterIdentifier);
+				return {
+					physicalId: dbClusterIdentifier,
+					attributes: definedAttributes({
+						"Endpoint.Address": described?.Endpoint,
+						"Endpoint.Port": stringifyIfAssigned(described?.Port),
+						"ReadEndpoint.Address": described?.ReaderEndpoint,
+						Arn: described?.DBClusterArn,
+						DBClusterResourceId: described?.DbClusterResourceId
+					}),
+					...effectiveProperties !== void 0 && { effectiveProperties }
+				};
+			} catch (innerError) {
+				try {
+					if (wantsDeletionProtection) try {
+						await this.getClient().send(new ModifyDBClusterCommand({
+							DBClusterIdentifier: dbClusterIdentifier,
+							DeletionProtection: false,
+							ApplyImmediately: true
+						}));
+					} catch (disableError) {
+						this.logger.debug(maskerOrIdentity(mask)(`Could not disable DeletionProtection on partially-created DBCluster ${dbClusterIdentifier}: ${describeAwsFailure(disableError).detail} (proceeding with DeleteDBCluster anyway)`));
+					}
+					await this.getClient().send(new DeleteDBClusterCommand({
+						DBClusterIdentifier: dbClusterIdentifier,
+						SkipFinalSnapshot: true
+					}));
+					clusterLeftBehind = false;
+					retractCreatedResource(logicalId, resourceType, dbClusterIdentifier);
+					this.logger.debug(`Delete requested for partially-created DBCluster ${logicalId} (${dbClusterIdentifier}) after wiring failure (not waiting for deleted state)`);
+				} catch (cleanupError) {
+					const retiring = await this.partialClusterRetiring(dbClusterIdentifier);
+					if (retiring !== void 0) {
+						this.logger.debug(maskerOrIdentity(mask)(`Cleanup delete of partially-created DBCluster ${logicalId} refused: ${maskerOrIdentity(mask)(describeAwsFailure(cleanupError).detail)}`));
+						this.logger.warn(maskerOrIdentity(mask)(`Partially-created DBCluster ${logicalId} (${dbClusterIdentifier}) is ${retiring === "gone" ? "read as already deleted" : "already in status 'deleting'"}; cdkd did not delete it again. Outside a rollback's re-create, the failed deploy's rollback journal still records it, so \`cdkd rollback --revert-failed\` confirms it is gone`));
+						throw innerError;
+					}
+					const aws = pasteableAwsCommand();
+					const unprotect = wantsDeletionProtection ? aws`aws rds modify-db-cluster --db-cluster-identifier ${dbClusterIdentifier} --no-deletion-protection --apply-immediately; ` : aws``;
+					const m = maskerOrIdentity(mask);
+					const cleanupFailure = describeAwsFailure(cleanupError);
+					const cleanupHead = `Failed to delete partially-created DBCluster ${logicalId} (${dbClusterIdentifier}): `;
+					if (cleanupFailure.redacted) this.logger.debug(m(`${cleanupHead}${m(cleanupFailure.detail)}`));
+					this.logger.warn(`${cleanupHead}${cleanupFailure.redacted ? `${m(cleanupFailure.summary)} ` : `${m(cleanupFailure.detail)}. `}THE CLUSTER IS STILL RUNNING AND BILLING. Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`${wantsDeletionProtection ? ", which cannot delete it while its DeletionProtection is on" : ""}; otherwise delete it yourself: ${aws`${unprotect}aws rds delete-db-cluster --db-cluster-identifier ${dbClusterIdentifier} --skip-final-snapshot`.render()}`);
+				}
+				throw innerError;
+			}
+		} catch (error) {
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create DBCluster ${logicalId}: ${text}`, resourceType, logicalId, dbClusterIdentifier, error instanceof Error ? error : void 0));
+			if (clusterLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbClusterIdentifier, createdResourceId);
+			throw thrown;
+		}
+	}
+	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		this.logger.debug(`Updating DBCluster ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const logExportConfig = logExportsDelta(desiredLogExports(properties, resourceType, logicalId, physicalId), previousProperties["EnableCloudwatchLogsExports"]);
+		const httpEndpointAction = clusterHttpEndpointAction(properties, previousProperties, resourceType, logicalId, physicalId, context);
+		if (httpEndpointAction === "skip") this.logger.warn(safeMsg`DBCluster ${logicalId}: the replayed EnableHttpEndpoint is not true or false; the Data API setting is left as it is`);
+		if (httpEndpointAction === "withheld") this.logger.warn(safeMsg`DBCluster ${logicalId}: drift --revert does not turn the Data API (EnableHttpEndpoint) back on; if the template declares it, turn it on with aws rds enable-http-endpoint`);
+		const skippedKeys = httpEndpointAction === "skip" || httpEndpointAction === "withheld" ? [["EnableHttpEndpoint", usableHttpEndpoint]] : [];
+		if (retentionPeriodValue(properties["PerformanceInsightsRetentionPeriod"]) === "malformed") {
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw markNonRetryable(new ProvisioningError(`${resourceType} ${logicalId}: PerformanceInsightsRetentionPeriod must be a whole number of days`, resourceType, logicalId, physicalId));
+			this.logger.warn(safeMsg`DBCluster ${logicalId}: the replayed PerformanceInsightsRetentionPeriod is not a whole number of days; the retention period is left as it is`);
+			skippedKeys.push(["PerformanceInsightsRetentionPeriod", usableRetentionPeriod]);
+		}
+		try {
+			const vpcSgIds = await this.securityGroupsToSend("DBCluster", logicalId, physicalId, resourceType, properties, previousProperties, context);
+			const serverlessV2Config = properties["ServerlessV2ScalingConfiguration"];
+			const hasServerlessV2 = serverlessV2Config !== void 0 && (serverlessV2Config.MinCapacity !== void 0 || serverlessV2Config.MaxCapacity !== void 0 || serverlessV2Config.SecondsUntilAutoPause !== void 0);
+			const masterUserSecret = properties["MasterUserSecret"];
+			const sendCredentialSettings = masterCredentialSettingsChanged(properties, previousProperties, context);
+			const manageMasterUserPasswordOff = managedPasswordOnRemoval(properties, previousProperties);
+			const portToSend = clusterPortToSend(properties, previousProperties);
+			const engineVersionChanged = clusterEngineVersionChanged(properties, previousProperties, context);
+			await this.getClient().send(new ModifyDBClusterCommand({
+				DBClusterIdentifier: physicalId,
+				...engineVersionChanged && {
+					EngineVersion: properties["EngineVersion"],
+					AllowMajorVersionUpgrade: true
+				},
+				DeletionProtection: properties["DeletionProtection"],
+				BackupRetentionPeriod: clearOnUpdateRemoval(properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0, previousProperties["BackupRetentionPeriod"] != null ? Number(previousProperties["BackupRetentionPeriod"]) : void 0, 1),
+				...vpcSgIds !== void 0 && { VpcSecurityGroupIds: vpcSgIds },
+				MasterUserPassword: masterUserPasswordToSend(properties, previousProperties, context),
+				Port: portToSend,
+				...sendCredentialSettings && properties["ManageMasterUserPassword"] !== void 0 && { ManageMasterUserPassword: properties["ManageMasterUserPassword"] },
+				...manageMasterUserPasswordOff && { ManageMasterUserPassword: false },
+				...sendCredentialSettings && masterUserSecret?.KmsKeyId !== void 0 && { MasterUserSecretKmsKeyId: masterUserSecret.KmsKeyId },
+				...properties["MonitoringRoleArn"] !== void 0 && { MonitoringRoleArn: properties["MonitoringRoleArn"] },
+				...properties["MonitoringInterval"] != null && { MonitoringInterval: Number(properties["MonitoringInterval"]) },
+				EnableIAMDatabaseAuthentication: properties["EnableIAMDatabaseAuthentication"],
+				...hasServerlessV2 && { ServerlessV2ScalingConfiguration: serverlessV2ScalingToSend(serverlessV2Config) },
+				...clusterModifyBackfillMembers(properties, previousProperties, context),
+				...clusterModifyScalarMembers(properties, previousProperties, context),
+				...logExportConfig !== void 0 && { CloudwatchLogsExportConfiguration: logExportConfig },
+				ApplyImmediately: true
+			}));
+			this.logger.debug(`Successfully updated DBCluster ${logicalId}`);
+			const noWait = process.env["CDKD_NO_WAIT"] === "true";
+			const portChanged = portToSend !== void 0 && portToSend !== numberOrUndefined(previousProperties["Port"]);
+			if (!noWait && portChanged) await this.waitForClusterPortApplied(physicalId, logicalId, portToSend);
+			if (!noWait && logExportConfig !== void 0) await this.waitForClusterState(logicalId, physicalId, (cluster) => logExportsApplied(logExportConfig, cluster.EnabledCloudwatchLogsExports, cluster.PendingModifiedValues?.PendingCloudwatchLogsExports), "CloudWatch Logs exports");
+			const described = await this.describeDBCluster(physicalId);
+			if (httpEndpointAction === "enable" || httpEndpointAction === "disable") {
+				const arn = described?.DBClusterArn;
+				if (!arn) throw new Error(`DescribeDBClusters did not report the cluster ARN, which ${httpEndpointAction === "enable" ? "EnableHttpEndpoint" : "DisableHttpEndpoint"} needs`);
+				const enable = httpEndpointAction === "enable";
+				await this.sendHttpEndpointChange(logicalId, physicalId, arn, enable);
+				if (!noWait) await this.waitForClusterState(logicalId, physicalId, (cluster) => (cluster.HttpEndpointEnabled ?? false) === enable, "HTTP endpoint (Data API) setting");
+			}
+			if (!noWait && portChanged) {
+				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterClusterChange(member.DBInstanceIdentifier, logicalId, PORT_CHANGE_MEMBER_STATUSES, "port");
+			}
+			if (!noWait && securityGroupListChanged(vpcSgIds, previousProperties["VpcSecurityGroupIds"])) {
+				await this.waitForSecurityGroupsApplied(physicalId, logicalId, vpcSgIds ?? []);
+				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterClusterChange(member.DBInstanceIdentifier, logicalId, SECURITY_GROUP_CHANGE_MEMBER_STATUSES, "VPC security groups");
+			}
+			if (described?.DBClusterArn) await this.applyTagDiff(described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(noWait && portChanged && described !== void 0 ? portToSend : described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					Arn: described?.DBClusterArn,
+					DBClusterResourceId: described?.DbClusterResourceId
+				}),
+				...skippedKeys.length > 0 && { effectiveProperties: withPreviousValues(properties, previousProperties, skippedKeys) }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async deleteDBCluster(logicalId, physicalId, resourceType, properties, context) {
+		await deleteWithProtectionCompensation({
+			registry: this.protectionFlips,
+			key: protectionFlipKey(resourceType, physicalId, context?.expectedRegion),
+			run: (flip) => this.deleteDBClusterOnce(logicalId, physicalId, resourceType, properties, context, flip),
+			compensation: {
+				logicalId,
+				physicalId,
+				logger: this.logger,
+				site: rdsFamilyProtectionSite({
+					cliService: "rds",
+					serviceLabel: "RDS",
+					kind: "cluster",
+					physicalId,
+					region: context?.expectedRegion,
+					notFoundFault: "DBClusterNotFoundFault",
+					isNotFound: (error) => this.isNotFoundError(error, "DBClusterNotFoundFault")
+				}),
+				reEnable: async () => {
+					await this.getClient().send(new ModifyDBClusterCommand({
+						DBClusterIdentifier: physicalId,
+						DeletionProtection: true,
+						ApplyImmediately: true
+					}));
+				}
+			}
+		});
+	}
+	async deleteDBClusterOnce(logicalId, physicalId, resourceType, properties, context, flip) {
+		this.logger.debug(`Deleting DBCluster ${logicalId}`);
+		let detachedFrom;
+		const progress = { stripped: false };
+		try {
+			if (context?.removeProtection === true) try {
+				await observeThenDisableProtection({
+					flip,
+					logger: this.logger,
+					physicalId,
+					mask: context?.maskSecrets,
+					guardName: "DeletionProtection",
+					observe: async () => (await this.describeDBCluster(physicalId))?.DeletionProtection === true,
+					disable: async () => {
+						await this.getClient().send(new ModifyDBClusterCommand({
+							DBClusterIdentifier: physicalId,
+							DeletionProtection: false,
+							ApplyImmediately: true
+						}));
+					}
+				});
+				this.logger.debug(`Disabled DeletionProtection on DBCluster ${logicalId} before delete`);
+			} catch (disableError) {
+				if (!this.isNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`));
+			}
+			const globalClusterId = recordedGlobalClusterIdentifier(properties);
+			if (globalClusterId !== void 0) detachedFrom = await this.detachFromGlobalCluster(logicalId, physicalId, globalClusterId, context?.removeProtection === true, progress, maskerOrIdentity(context?.maskSecrets)) ? globalClusterId : void 0;
+			const finalSnapshotId = context?.finalSnapshotIdentifier;
+			const sendDelete = () => this.getClient().send(new DeleteDBClusterCommand({
+				DBClusterIdentifier: physicalId,
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true },
+				...deleteAutomatedBackupsInput(properties)
+			}));
+			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.deleteAfterProtectionFlip(logicalId, physicalId, sendDelete);
+			else await sendDelete();
+			flip.deleteAccepted = true;
+			if (finalSnapshotId) this.logger.info(`Deleting DBCluster ${logicalId} with a final snapshot (DeletionPolicy: Snapshot)`);
+			this.logger.debug(`Successfully initiated deletion of DBCluster ${logicalId}`);
+			await this.waitForClusterDeleted(logicalId, physicalId, RDS_DELETE_WAIT_MS);
+		} catch (error) {
+			if (error instanceof GlobalClusterDetachError) {
+				const detachFailure = markNotGone(markNonRetryable(new ProvisioningError(`Failed to delete DBCluster ${logicalId}: ${error.message}`, resourceType, logicalId, physicalId, error)));
+				throw progress.stripped ? markDeleteStarted(detachFailure) : detachFailure;
+			}
+			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  RDS DB cluster ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`DBCluster ${logicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			const detachedNote = detachedFrom !== void 0 ? " (it was already detached from its global cluster, and stays a standalone cluster)" : "";
+			const failure = this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DBCluster ${logicalId}: ${text}${detachedNote}`, resourceType, logicalId, physicalId, cause));
+			throw progress.stripped ? markDeleteStarted(failure) : failure;
+		}
+	}
+	async createDBInstance(logicalId, resourceType, properties, mask) {
+		this.logger.debug(`Creating DBInstance ${logicalId}`);
+		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const logExports = desiredLogExports(properties, resourceType, logicalId);
+		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::RDS::DBInstance", logicalId);
+		let instanceCreated = false;
+		let createdResourceId;
+		try {
+			const masterUserSecret = properties["MasterUserSecret"];
+			const response = await this.getCreateClient().send(new CreateDBInstanceCommand({
+				DBInstanceIdentifier: dbInstanceIdentifier,
+				DBInstanceClass: properties["DBInstanceClass"],
+				Engine: properties["Engine"],
+				DBClusterIdentifier: properties["DBClusterIdentifier"],
+				DBSubnetGroupName: properties["DBSubnetGroupName"],
+				PubliclyAccessible: properties["PubliclyAccessible"],
+				...properties["AllocatedStorage"] !== void 0 && { AllocatedStorage: Number(properties["AllocatedStorage"]) },
+				...properties["MasterUsername"] !== void 0 && { MasterUsername: properties["MasterUsername"] },
+				...properties["DeletionProtection"] !== void 0 && { DeletionProtection: properties["DeletionProtection"] },
+				...properties["EngineVersion"] !== void 0 && { EngineVersion: properties["EngineVersion"] },
+				...properties["Port"] !== void 0 && { Port: Number(properties["Port"]) },
+				...properties["MasterUserPassword"] !== void 0 && { MasterUserPassword: properties["MasterUserPassword"] },
+				...properties["StorageEncrypted"] !== void 0 && { StorageEncrypted: properties["StorageEncrypted"] },
+				...properties["VPCSecurityGroups"] !== void 0 && { VpcSecurityGroupIds: properties["VPCSecurityGroups"] },
+				...properties["KmsKeyId"] !== void 0 && { KmsKeyId: properties["KmsKeyId"] },
+				...masterUserSecret?.KmsKeyId !== void 0 && { MasterUserSecretKmsKeyId: masterUserSecret.KmsKeyId },
+				...properties["ManageMasterUserPassword"] !== void 0 && { ManageMasterUserPassword: properties["ManageMasterUserPassword"] },
+				...properties["MonitoringRoleArn"] !== void 0 && { MonitoringRoleArn: properties["MonitoringRoleArn"] },
+				...properties["MonitoringInterval"] !== void 0 && { MonitoringInterval: Number(properties["MonitoringInterval"]) },
+				...properties["EnableIAMDatabaseAuthentication"] !== void 0 && { EnableIAMDatabaseAuthentication: properties["EnableIAMDatabaseAuthentication"] },
+				...properties["BackupRetentionPeriod"] != null && { BackupRetentionPeriod: Number(properties["BackupRetentionPeriod"]) },
+				...properties["PreferredBackupWindow"] != null && { PreferredBackupWindow: properties["PreferredBackupWindow"] },
+				...properties["PreferredMaintenanceWindow"] != null && { PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"] },
+				...properties["StorageType"] != null && { StorageType: properties["StorageType"] },
+				...properties["Iops"] != null && { Iops: Number(properties["Iops"]) },
+				...properties["StorageThroughput"] != null && { StorageThroughput: Number(properties["StorageThroughput"]) },
+				...properties["MaxAllocatedStorage"] != null && { MaxAllocatedStorage: Number(properties["MaxAllocatedStorage"]) },
+				...properties["MultiAZ"] != null && { MultiAZ: properties["MultiAZ"] },
+				...properties["AutoMinorVersionUpgrade"] != null && { AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"] },
+				...properties["CopyTagsToSnapshot"] != null && { CopyTagsToSnapshot: properties["CopyTagsToSnapshot"] },
+				...properties["OptionGroupName"] != null && { OptionGroupName: properties["OptionGroupName"] },
+				...properties["CACertificateIdentifier"] != null && { CACertificateIdentifier: properties["CACertificateIdentifier"] },
+				...String(properties["EnablePerformanceInsights"]) === "true" && {
+					EnablePerformanceInsights: true,
+					...properties["PerformanceInsightsKMSKeyId"] != null && { PerformanceInsightsKMSKeyId: properties["PerformanceInsightsKMSKeyId"] }
+				},
+				...properties["PerformanceInsightsRetentionPeriod"] != null && { PerformanceInsightsRetentionPeriod: Number(properties["PerformanceInsightsRetentionPeriod"]) },
+				...properties["NetworkType"] != null && { NetworkType: properties["NetworkType"] },
+				...properties["LicenseModel"] != null && { LicenseModel: properties["LicenseModel"] },
+				...properties["PromotionTier"] != null && { PromotionTier: Number(properties["PromotionTier"]) },
+				...properties["DatabaseInsightsMode"] != null && { DatabaseInsightsMode: properties["DatabaseInsightsMode"] },
+				...properties["DedicatedLogVolume"] != null && { DedicatedLogVolume: properties["DedicatedLogVolume"] },
+				...properties["DBParameterGroupName"] != null && { DBParameterGroupName: properties["DBParameterGroupName"] },
+				...logExports !== void 0 && logExports.length > 0 && { EnableCloudwatchLogsExports: logExports },
+				...properties["DBName"] != null && { DBName: properties["DBName"] },
+				...properties["AvailabilityZone"] != null && { AvailabilityZone: properties["AvailabilityZone"] },
+				...tags.length > 0 && { Tags: tags }
+			}));
+			instanceCreated = true;
+			createdResourceId = response.DBInstance?.DbiResourceId;
+			reportCreatedResource(logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
+			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
+			this.logger.debug(`Successfully created DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
+			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(logicalId, dbInstanceIdentifier);
+			const described = await this.describeDBInstance(dbInstanceIdentifier);
+			return {
+				physicalId: dbInstanceIdentifier,
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
+			};
+		} catch (error) {
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create DBInstance ${logicalId}: ${text}`, resourceType, logicalId, dbInstanceIdentifier, error instanceof Error ? error : void 0));
+			if (instanceCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
+			throw thrown;
+		}
+	}
+	async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		this.logger.debug(`Updating DBInstance ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const logExportConfig = logExportsDelta(desiredLogExports(properties, resourceType, logicalId, physicalId), previousProperties["EnableCloudwatchLogsExports"]);
+		const vpcSgIds = await this.securityGroupsToSend("DBInstance", logicalId, physicalId, resourceType, properties, previousProperties, context);
+		try {
+			const { mask: zoneMask } = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["DBInstanceIdentifier"], physicalId]]);
+			const desiredZone = properties["AvailabilityZone"];
+			let zoneKept = context?.desiredFromAwsReadback === true || context?.replayingState === true && (desiredZone == null || desiredZone === "") || instanceAvailabilityZoneKept(properties, previousProperties);
+			let liveZoneRead = "read";
+			if (!zoneKept && typeof desiredZone === "string" && desiredZone !== "") zoneKept = await this.describeDBInstance(physicalId).then((instance) => {
+				if (instance === void 0) liveZoneRead = "not-found";
+				return instance?.AvailabilityZone;
+			}, (err) => {
+				liveZoneRead = err?.name === "DBInstanceNotFoundFault" ? "not-found" : "unreadable";
+				this.logger.debug(zoneMask(safeMsg`DBInstance ${logicalId}: could not read the live zone: ${describeAwsFailure(err).summary}`));
+			}) === desiredZone;
+			if (!zoneKept && context?.replayingState !== true) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, zoneMask(`AvailabilityZone cannot change on an existing DB instance — ModifyDBInstance has no such member, and CloudFormation refuses the same update ("Resource is immutable"). Nothing was applied to DB instance ${physicalId}. ` + (liveZoneRead === "not-found" ? "RDS reports no such DB instance: it was deleted outside cdkd, so the state record no longer matches AWS. " : liveZoneRead === "unreadable" ? "cdkd could not read the instance's live zone (an AWS read failed), so it could not tell whether the instance already sits in the declared one; a re-run may succeed. " : "") + "To keep the instance where it is, declare the zone the previous deploy declared (or none, if it declared none), or drop the zone and declare MultiAZ: true. The replace flags below apply to the WHOLE deploy: every other stateful resource in the same run whose in-place update is refused or that needs a replacement is recreated too, so run them with nothing else pending. To move it, " + (String(previousProperties["DeletionProtection"]) === "true" ? protectedReplacementAdvice({
+				evidence: "cdkd's properties for this DB instance carry DeletionProtection: true",
+				replaceFlags: "cdkd deploy --replace --force-stateful-recreation",
+				disable: {
+					before: "aws rds modify-db-instance --db-instance-identifier",
+					identifier: physicalId,
+					after: "--no-deletion-protection --apply-immediately",
+					maskSecrets: zoneMask
+				}
+			}) : "note AWS::RDS::DBInstance is a stateful type: re-run with cdkd deploy --replace --force-stateful-recreation to recreate it in the new zone (this deletes the instance and its data)")));
+			if (!zoneKept) this.logger.warn(zoneMask(safeMsg`DBInstance ${logicalId} (${physicalId}): AvailabilityZone cannot change in place ` + safeMsg`(ModifyDBInstance has no such member), so the instance keeps its current zone ` + safeMsg`and cdkd records that zone.`));
+			const effectiveProperties = zoneKept ? void 0 : withPreviousAvailabilityZone(properties, previousProperties);
+			const masterUserSecret = properties["MasterUserSecret"];
+			const sendCredentialSettings = masterCredentialSettingsChanged(properties, previousProperties, context);
+			const instancePassword = masterUserPasswordToSend(properties, previousProperties, context);
+			const manageMasterUserPasswordOff = managedPasswordOnRemoval(properties, previousProperties);
+			let liveInstance;
+			const backfillMembers = await instanceModifyBackfillMembers(properties, previousProperties, () => liveInstance ??= this.describeDBInstance(physicalId).then((instance) => instance?.AllocatedStorage), logicalId, context);
+			await modifyDbInstanceWhenAvailable({
+				send: () => this.getClient().send(new ModifyDBInstanceCommand({
+					DBInstanceIdentifier: physicalId,
+					DBInstanceClass: properties["DBInstanceClass"],
+					PubliclyAccessible: properties["PubliclyAccessible"],
+					ApplyImmediately: true,
+					...backfillMembers,
+					DeletionProtection: properties["DeletionProtection"],
+					...previousProperties["Engine"] !== properties["Engine"] && dbInstanceEngineChangeIsInPlace(previousProperties["Engine"], properties["Engine"]) && { Engine: properties["Engine"] },
+					...properties["Port"] !== void 0 && { DBPortNumber: Number(properties["Port"]) },
+					...instancePassword !== void 0 && { MasterUserPassword: instancePassword },
+					...vpcSgIds !== void 0 && { VpcSecurityGroupIds: vpcSgIds },
+					...sendCredentialSettings && masterUserSecret?.KmsKeyId !== void 0 && { MasterUserSecretKmsKeyId: masterUserSecret.KmsKeyId },
+					...sendCredentialSettings && properties["ManageMasterUserPassword"] !== void 0 && { ManageMasterUserPassword: properties["ManageMasterUserPassword"] },
+					...manageMasterUserPasswordOff && { ManageMasterUserPassword: false },
+					...properties["MonitoringRoleArn"] !== void 0 && { MonitoringRoleArn: properties["MonitoringRoleArn"] },
+					...properties["MonitoringInterval"] != null && { MonitoringInterval: Number(properties["MonitoringInterval"]) },
+					EnableIAMDatabaseAuthentication: properties["EnableIAMDatabaseAuthentication"],
+					...logExportConfig !== void 0 && { CloudwatchLogsExportConfiguration: logExportConfig }
+				})),
+				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
+				sleep: (ms) => this.sleep(ms),
+				logger: this.logger,
+				label: "RDS DBInstance",
+				logicalId,
+				remainingMs: enclosingDeadlineRemainingMs()
+			});
+			this.logger.debug(`Successfully updated DBInstance ${logicalId}`);
+			if (process.env["CDKD_NO_WAIT"] !== "true" && logExportConfig !== void 0) await this.waitForInstanceState(logicalId, physicalId, (instance) => logExportsApplied(logExportConfig, instance.EnabledCloudwatchLogsExports, instance.PendingModifiedValues?.PendingCloudwatchLogsExports), "CloudWatch Logs exports change");
+			let described = await this.describeDBInstance(physicalId);
+			const sentGroup = backfillMembers.DBParameterGroupName;
+			if (sentGroup !== void 0 || instanceParameterGroupPendingReboot(described) || instanceParameterGroupApplying(described)) described = await this.rebootForPendingParameterGroup(logicalId, physicalId, sentGroup, String(properties["CertificateRotationRestart"]) === "true");
+			if (described?.DBInstanceArn) await this.applyTagDiff(described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				}),
+				...effectiveProperties !== void 0 && { effectiveProperties }
+			};
+		} catch (error) {
+			if (error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DBInstance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async deleteDBInstance(logicalId, physicalId, resourceType, properties, context) {
+		await deleteWithProtectionCompensation({
+			registry: this.protectionFlips,
+			key: protectionFlipKey(resourceType, physicalId, context?.expectedRegion),
+			run: (flip) => this.deleteDBInstanceOnce(logicalId, physicalId, resourceType, properties, context, flip),
+			compensation: {
+				logicalId,
+				physicalId,
+				logger: this.logger,
+				site: rdsFamilyProtectionSite({
+					cliService: "rds",
+					serviceLabel: "RDS",
+					kind: "instance",
+					physicalId,
+					region: context?.expectedRegion,
+					notFoundFault: "DBInstanceNotFoundFault",
+					isNotFound: (error) => this.isNotFoundError(error, "DBInstanceNotFoundFault")
+				}),
+				reEnable: async () => {
+					await this.getClient().send(new ModifyDBInstanceCommand({
+						DBInstanceIdentifier: physicalId,
+						DeletionProtection: true,
+						ApplyImmediately: true
+					}));
+				}
+			}
+		});
+	}
+	async deleteDBInstanceOnce(logicalId, physicalId, resourceType, properties, context, flip) {
+		this.logger.debug(`Deleting DBInstance ${logicalId}`);
+		try {
+			if (context?.removeProtection === true) try {
+				await observeThenDisableProtection({
+					flip,
+					logger: this.logger,
+					physicalId,
+					mask: context?.maskSecrets,
+					guardName: "DeletionProtection",
+					observe: async () => (await this.describeDBInstance(physicalId))?.DeletionProtection === true,
+					disable: async () => {
+						await this.getClient().send(new ModifyDBInstanceCommand({
+							DBInstanceIdentifier: physicalId,
+							DeletionProtection: false,
+							ApplyImmediately: true
+						}));
+					}
+				});
+				this.logger.debug(`Disabled DeletionProtection on DBInstance ${logicalId} before delete`);
+			} catch (disableError) {
+				if (!this.isNotFoundError(disableError, "DBInstanceNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for DBInstance ${logicalId}: ${describeAwsFailure(disableError).detail}`));
+			}
+			const finalSnapshotId = properties?.["DBClusterIdentifier"] === void 0 ? context?.finalSnapshotIdentifier : void 0;
+			const sendDelete = () => this.getClient().send(new DeleteDBInstanceCommand({
+				DBInstanceIdentifier: physicalId,
+				...finalSnapshotId ? {
+					SkipFinalSnapshot: false,
+					FinalDBSnapshotIdentifier: finalSnapshotId
+				} : { SkipFinalSnapshot: true },
+				...deleteAutomatedBackupsInput(properties)
+			}));
+			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.deleteInstanceAfterProtectionFlip(logicalId, physicalId, sendDelete);
+			else await sendDelete();
+			flip.deleteAccepted = true;
+			if (finalSnapshotId) this.logger.info(`Deleting DBInstance ${logicalId} with a final snapshot (DeletionPolicy: Snapshot)`);
+			this.logger.debug(`Successfully initiated deletion of DBInstance ${logicalId}`);
+			await this.waitForInstanceDeleted(logicalId, physicalId, RDS_DELETE_WAIT_MS);
+		} catch (error) {
+			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  RDS DB instance ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`DBInstance ${logicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DBInstance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
+	async applyTagDiff(arn, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
+		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
+		if (tagWarning !== void 0) this.logger.warn(tagWarning);
+		const tagsToAdd = [...plan.set].map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0) {
+			await this.getClient().send(new RemoveTagsFromResourceCommand({
+				ResourceName: arn,
+				TagKeys: tagsToRemove
+			}));
+			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from RDS resource ${arn}`);
+		}
+		if (tagsToAdd.length > 0) {
+			await this.getClient().send(new AddTagsToResourceCommand({
+				ResourceName: arn,
+				Tags: tagsToAdd
+			}));
+			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on RDS resource ${arn}`);
+		}
+	}
+	async partialClusterRetiring(dbClusterIdentifier) {
+		try {
+			return (await this.describeDBCluster(dbClusterIdentifier))?.Status === "deleting" ? "deleting" : void 0;
+		} catch (error) {
+			return error instanceof Error && error.name === "DBClusterNotFoundFault" ? "gone" : void 0;
+		}
+	}
+	isNotFoundError(error, faultName) {
+		if (!(error instanceof Error)) return false;
+		const name = error.name ?? "";
+		const message = error.message.toLowerCase();
+		return name === faultName || message.includes("not found") || message.includes("does not exist");
+	}
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
+	wrapDeleteError(mask, error, build) {
+		const thrown = this.wrapCaughtError(mask, error, build);
+		return error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
+	}
+	wrapGlobalClusterDetachError(error, mask, build) {
+		const failure = describeAwsFailure(error);
+		if (failure.redacted) this.logger.debug(mask(build(mask(failure.detail))));
+		return new GlobalClusterDetachError(build(mask(failure.summary)));
+	}
+	async detachFromGlobalCluster(logicalId, physicalId, globalClusterId, removeProtection, progress, mask) {
+		let cluster = await this.describeDBCluster(physicalId);
+		for (let i = 0; removeProtection && cluster?.DeletionProtection === true && i < 6; i++) {
+			await this.sleep(5e3);
+			cluster = await this.describeDBCluster(physicalId);
+		}
+		if (cluster === void 0) return false;
+		if (cluster.DeletionProtection === true) throw new GlobalClusterDetachError(safeMsg`${physicalId} has deletion protection on, so cdkd did not detach it from global cluster ${globalClusterId}; turn it off (cdkd destroy --remove-protection does) and re-run`);
+		const clusterArn = cluster.DBClusterArn;
+		if (typeof clusterArn !== "string" || clusterArn === "") throw new GlobalClusterDetachError(safeMsg`could not read the ARN of ${physicalId} to detach it from global cluster ${globalClusterId}`);
+		const startTime = Date.now();
+		let delay = 5e3;
+		const backOff = async () => {
+			if (Date.now() - startTime >= RDS_DELETE_WAIT_MS) throw new GlobalClusterDetachError(safeMsg`timed out waiting for ${physicalId} to leave global cluster ${globalClusterId}`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		};
+		for (;;) try {
+			await this.getClient().send(new RemoveFromGlobalClusterCommand({
+				GlobalClusterIdentifier: globalClusterId,
+				DbClusterIdentifier: clusterArn
+			}));
+			progress.stripped = true;
+			this.logger.info(safeMsg`Detaching DBCluster ${logicalId} from global cluster ${globalClusterId} before the delete`);
+			break;
+		} catch (error) {
+			const name = awsErrorName(error);
+			if (name === "GlobalClusterNotFoundFault") return false;
+			if (name === "DBClusterNotFoundFault") break;
+			if (!TRANSIENT_DETACH_FAULTS.has(name)) throw this.wrapGlobalClusterDetachError(error, mask, (text) => safeMsg`detaching ${physicalId} from global cluster ${globalClusterId} failed (${text})`);
+			await backOff();
+		}
+		for (;;) {
+			let stillMember;
+			try {
+				stillMember = ((await this.getClient().send(new DescribeGlobalClustersCommand({ GlobalClusterIdentifier: globalClusterId }))).GlobalClusters?.[0]?.GlobalClusterMembers ?? []).some((member) => member.DBClusterArn === clusterArn);
+			} catch (error) {
+				const name = awsErrorName(error);
+				if (name === "GlobalClusterNotFoundFault") stillMember = false;
+				else if (!TRANSIENT_DETACH_FAULTS.has(name)) throw this.wrapGlobalClusterDetachError(error, mask, (text) => safeMsg`could not confirm ${physicalId} left global cluster ${globalClusterId} (${text})`);
+			}
+			if (stillMember === false) {
+				const after = await this.describeDBCluster(physicalId);
+				if (after === void 0) return true;
+				this.logger.debug(safeMsg`DBCluster ${physicalId} status after the detach: ${after.Status}`);
+				if (after.Status === "available") return true;
+			}
+			await backOff();
+		}
+	}
+	async describeDBCluster(dbClusterIdentifier) {
+		return (await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: dbClusterIdentifier }))).DBClusters?.[0];
+	}
+	async securityGroupsToSend(target, logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const key = target === "DBCluster" ? "VpcSecurityGroupIds" : "VPCSecurityGroups";
+		const noun = target === "DBCluster" ? "cluster" : "instance";
+		const desired = properties[key];
+		if (desired !== void 0) return desired.length > 0 ? desired : void 0;
+		const previous = previousProperties[key];
+		if (context?.desiredFromAwsReadback === true) return void 0;
+		if (!Array.isArray(previous) || previous.length === 0) return void 0;
+		let groupId;
+		let missing;
+		let awsError;
+		try {
+			let subnetGroupName;
+			let vpcId;
+			if (target === "DBInstance") {
+				const subnetGroup = (await this.describeDBInstance(physicalId))?.DBSubnetGroup;
+				subnetGroupName = subnetGroup?.DBSubnetGroupName;
+				vpcId = subnetGroupName ? subnetGroup?.VpcId : void 0;
+			} else {
+				subnetGroupName = (await this.describeDBCluster(physicalId))?.DBSubnetGroup;
+				vpcId = subnetGroupName ? (await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: subnetGroupName }))).DBSubnetGroups?.[0]?.VpcId : void 0;
+			}
+			if (!subnetGroupName) missing = `the ${noun} reports no DB subnet group`;
+			else if (!vpcId) missing = `DB subnet group ${subnetGroupName} reports no VPC`;
+			else {
+				groupId = (await this.getEc2Client().send(new DescribeSecurityGroupsCommand({ Filters: [{
+					Name: "vpc-id",
+					Values: [vpcId]
+				}, {
+					Name: "group-name",
+					Values: ["default"]
+				}] }))).SecurityGroups?.[0]?.GroupId;
+				if (!groupId) missing = `VPC ${vpcId} has no security group named default`;
+			}
+		} catch (error) {
+			awsError = error;
+		}
+		if (groupId === void 0) {
+			const mask = context?.maskSecrets ?? ((text) => text);
+			const failure = missing === void 0 ? describeAwsFailure(awsError) : void 0;
+			if (failure?.redacted === true) this.logger.debug(safeMsg`${logicalId}: the VPC default security group lookup failed: ${mask(failure.detail)}`);
+			const shown = mask(failure?.summary ?? "");
+			const refusal = new ProvisioningError(`Failed to update ${target} ${logicalId}: ${key} was removed from the template, so the ${noun} moves to its VPC's default security group (as CloudFormation does), but cdkd could not find that group: ${missing ?? shown}. Declare ${key} in the template to choose the ${noun}'s security groups.`, resourceType, logicalId, physicalId, awsError instanceof Error ? awsError : void 0);
+			if (missing !== void 0) throw markNonRetryable(refusal);
+			throw awsError instanceof Error && (failure?.redacted === true || shown !== (failure?.summary ?? "")) ? markRedactedCause(refusal) : refusal;
+		}
+		this.logger.warn(safeMsg`${logicalId}: ${key} was removed from the template; attaching the VPC's default security group ${groupId}, as CloudFormation does.`);
+		return [groupId];
+	}
+	async describeDBInstance(dbInstanceIdentifier) {
+		return (await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: dbInstanceIdentifier }))).DBInstances?.[0];
+	}
+	async waitForMemberAfterClusterChange(dbInstanceIdentifier, clusterLogicalId, transitional, change, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			let status;
+			try {
+				status = (await this.describeDBInstance(dbInstanceIdentifier))?.DBInstanceStatus;
+			} catch (error) {
+				if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) return;
+				throw error;
+			}
+			if (status === void 0 || !transitional.has(status)) return;
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(safeMsg`Timed out waiting for a member instance of DBCluster ${clusterLogicalId} to finish applying its new ${change}`);
+	}
+	requireClusterWhileWaiting(cluster, logicalId, change) {
+		if (cluster === void 0) throw new Error(safeMsg`DescribeDBClusters returned no cluster for DBCluster ${logicalId} while waiting for its new ${change}`);
+		if (isTerminalDbWaitStatus(cluster.Status)) throw new Error(safeMsg`DBCluster ${logicalId} entered status ${cluster.Status ?? ""} while applying its new ${change}`);
+		return cluster;
+	}
+	async waitForClusterPortApplied(dbClusterIdentifier, logicalId, port, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const cluster = this.requireClusterWhileWaiting(await this.describeDBCluster(dbClusterIdentifier), logicalId, "port");
+			if (cluster.Status !== "modifying" && cluster.Port === port) return;
+			this.logger.debug(safeMsg`DBCluster ${logicalId} port not applied yet (status ${cluster.Status ?? "unknown"})`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for DBCluster ${logicalId} to apply its new port`);
+	}
+	async waitForSecurityGroupsApplied(dbClusterIdentifier, logicalId, expected, maxWaitMs = 18e5) {
+		const want = [...new Set(expected)].sort().join(" ");
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const cluster = this.requireClusterWhileWaiting(await this.describeDBCluster(dbClusterIdentifier), logicalId, "VPC security groups");
+			const groups = cluster.VpcSecurityGroups ?? [];
+			const ids = groups.map((group) => group.VpcSecurityGroupId ?? "").sort().join(" ");
+			if (cluster.Status !== "modifying" && groups.every((group) => group.Status === "active") && ids === want) return;
+			this.logger.debug(safeMsg`DBCluster ${logicalId} security groups not settled yet (status ${cluster.Status ?? "unknown"})`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for DBCluster ${logicalId} to apply its new VPC security groups`);
+	}
+	async waitForClusterState(logicalId, dbClusterIdentifier, done, change) {
+		const remaining = enclosingDeadlineRemainingMs();
+		const maxWaitMs = Number.isFinite(remaining) ? remaining : 18e5;
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const cluster = this.requireClusterWhileWaiting(await this.describeDBCluster(dbClusterIdentifier), logicalId, change);
+			if (done(cluster)) return;
+			this.logger.debug(safeMsg`DBCluster ${logicalId} waiting for its ${change} (status ${cluster.Status ?? "unknown"})`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(safeMsg`Timed out waiting for DBCluster ${logicalId}'s ${change}`);
+	}
+	async sendHttpEndpointChange(logicalId, physicalId, arn, enable) {
+		let delay = 5e3;
+		for (let attempt = 1;; attempt += 1) {
+			await this.waitForClusterState(logicalId, physicalId, (cluster) => cluster.Status === "available", "pending changes to settle before the Data API call");
+			try {
+				await this.getClient().send(enable ? new EnableHttpEndpointCommand({ ResourceArn: arn }) : new DisableHttpEndpointCommand({ ResourceArn: arn }));
+				return;
+			} catch (error) {
+				const name = awsErrorName(error);
+				if (!HTTP_ENDPOINT_BUSY_FAULTS.has(name) || attempt >= HTTP_ENDPOINT_MAX_ATTEMPTS) throw error;
+				this.logger.debug(safeMsg`DBCluster ${logicalId}: the Data API call was refused as busy (${name}); retrying`);
+				await this.sleep(delay);
+				delay = Math.min(delay * 2, 1e4);
+			}
+		}
+	}
+	async deleteAfterProtectionFlip(logicalId, physicalId, send) {
+		await deleteAfterProtectionFlipWithFinalSnapshot({
+			stateFault: "InvalidDBClusterStateFault",
+			send,
+			noun: "cluster",
+			label: "DBCluster",
+			logicalId,
+			read: async () => {
+				const current = await this.describeDBCluster(physicalId);
+				return current === void 0 ? void 0 : {
+					deletionProtection: current.DeletionProtection,
+					status: current.Status
+				};
+			},
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
+	}
+	async deleteInstanceAfterProtectionFlip(logicalId, physicalId, send) {
+		await deleteAfterProtectionFlipWithFinalSnapshot({
+			stateFault: "InvalidDBInstanceStateFault",
+			send,
+			noun: "instance",
+			label: "DBInstance",
+			logicalId,
+			read: async () => {
+				const current = await this.describeDBInstance(physicalId);
+				return current === void 0 ? void 0 : {
+					deletionProtection: current.DeletionProtection,
+					status: current.DBInstanceStatus
+				};
+			},
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
+	}
+	async waitForClusterAvailable(logicalId, dbClusterIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const status = (await this.describeDBCluster(dbClusterIdentifier))?.Status;
+			this.logger.debug(`DBCluster ${dbClusterIdentifier} status: ${status}`);
+			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`DBCluster ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for DBCluster ${dbClusterIdentifier} to become available`);
+	}
+	async waitForClusterDeleted(logicalId, dbClusterIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			try {
+				const cluster = await this.describeDBCluster(dbClusterIdentifier);
+				const status = cluster?.Status;
+				this.logger.debug(`DBCluster ${logicalId} status: ${status}`);
+				if (!cluster) return;
+			} catch (error) {
+				if (this.isNotFoundError(error, "DBClusterNotFoundFault")) return;
+				throw error;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for DBCluster ${logicalId} to be deleted`);
+	}
+	async rebootForPendingParameterGroup(logicalId, physicalId, sentGroup, caRotationRestarts) {
+		const settled = await this.waitForInstanceState(logicalId, physicalId, (instance) => instanceParameterGroupSettled(instance, sentGroup, caRotationRestarts), "parameter group change to settle");
+		if (!instanceParameterGroupPendingReboot(settled)) return settled;
+		this.logger.info(safeMsg`Rebooting DBInstance ${logicalId} to apply its parameter group (pending-reboot), as CloudFormation does after an update`);
+		await this.getClient().send(new RebootDBInstanceCommand({ DBInstanceIdentifier: physicalId }));
+		if (process.env["CDKD_NO_WAIT"] === "true") return settled;
+		return this.waitForInstanceState(logicalId, physicalId, instanceRebootApplied, "reboot to apply its parameter group");
+	}
+	async waitForInstanceState(logicalId, dbInstanceIdentifier, done, change) {
+		const remaining = enclosingDeadlineRemainingMs();
+		const maxWaitMs = Number.isFinite(remaining) ? remaining : 18e5;
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const instance = await this.describeDBInstance(dbInstanceIdentifier);
+			if (instance === void 0) throw new Error(safeMsg`DescribeDBInstances returned no instance for DBInstance ${logicalId} while waiting for its ${change}`);
+			if (isTerminalDbWaitStatus(instance.DBInstanceStatus)) throw new Error(safeMsg`DBInstance ${logicalId} entered status ${instance.DBInstanceStatus ?? ""} while waiting for its ${change}`);
+			if (done(instance)) return instance;
+			this.logger.debug(safeMsg`DBInstance ${logicalId} waiting for its ${change} (status ${instance.DBInstanceStatus ?? "unknown"})`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(safeMsg`Timed out waiting for DBInstance ${logicalId}'s ${change}`);
+	}
+	async waitForInstanceAvailable(logicalId, dbInstanceIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 1e4;
+		while (Date.now() - startTime < maxWaitMs) {
+			const status = (await this.describeDBInstance(dbInstanceIdentifier))?.DBInstanceStatus;
+			this.logger.debug(`DBInstance ${dbInstanceIdentifier} status: ${status}`);
+			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`DBInstance ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for DBInstance ${dbInstanceIdentifier} to become available`);
+	}
+	async waitForInstanceDeleted(logicalId, dbInstanceIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 1e4;
+		while (Date.now() - startTime < maxWaitMs) {
+			try {
+				const instance = await this.describeDBInstance(dbInstanceIdentifier);
+				const status = instance?.DBInstanceStatus;
+				this.logger.debug(`DBInstance ${logicalId} status: ${status}`);
+				if (!instance) return;
+			} catch (error) {
+				if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) return;
+				throw error;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for DBInstance ${logicalId} to be deleted`);
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	async import(input) {
+		switch (input.resourceType) {
+			case "AWS::RDS::DBInstance": return this.importDBInstance(input);
+			case "AWS::RDS::DBCluster": return this.importDBCluster(input);
+			case "AWS::RDS::DBSubnetGroup": return this.importDBSubnetGroup(input);
+			default: return null;
+		}
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::RDS::DBCluster" || resourceType === "AWS::RDS::DBInstance" ? ["EnableCloudwatchLogsExports"] : [];
+	}
+	getDriftUnknownPaths(resourceType, properties) {
+		if (resourceType === "AWS::RDS::DBInstance") return ["AllowMajorVersionUpgrade", "CertificateRotationRestart"];
+		if (resourceType !== "AWS::RDS::DBCluster") return [];
+		if (properties === void 0 || Object.keys(properties).length === 0) return [];
+		return (properties?.["ServerlessV2ScalingConfiguration"])?.SecondsUntilAutoPause === void 0 ? ["ServerlessV2ScalingConfiguration.SecondsUntilAutoPause"] : [];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::RDS::DBCluster") return properties;
+		let out;
+		const set = (key, value) => {
+			out ??= { ...properties };
+			out[key] = value;
+		};
+		for (const key of CLUSTER_BOOLEAN_SCALARS) {
+			const value = properties[key];
+			if (value === "true" || value === "false") set(key, value === "true");
+		}
+		const retention = properties["PerformanceInsightsRetentionPeriod"];
+		if (typeof retention === "string") {
+			const parsed = retentionPeriodValue(retention);
+			if (typeof parsed === "number") set("PerformanceInsightsRetentionPeriod", parsed);
+		}
+		return out ?? properties;
+	}
+	async readCurrentState(physicalId, _logicalId, resourceType) {
+		switch (resourceType) {
+			case "AWS::RDS::DBInstance": return this.readCurrentStateDBInstance(physicalId);
+			case "AWS::RDS::DBCluster": return this.readCurrentStateDBCluster(physicalId);
+			case "AWS::RDS::DBSubnetGroup": return this.readCurrentStateDBSubnetGroup(physicalId);
+			default: return;
+		}
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::RDS::DBCluster" && resourceType !== "AWS::RDS::DBInstance") return "unknown";
+		if (!isDbIdentifier(journaledPhysicalId) || !isDbIdentifier(record.physicalId)) return "unknown";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordResourceId = await this.readDbResourceIdIfExists(resourceType, record.physicalId);
+		if (recordResourceId === void 0) return "unknown";
+		const journaledResourceId = await this.readDbResourceIdIfExists(resourceType, journaledPhysicalId);
+		if (journaledResourceId === void 0) return "different";
+		return journaledResourceId === recordResourceId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::RDS::DBCluster" && resourceType !== "AWS::RDS::DBInstance") return;
+		if (!isDbIdentifier(physicalId)) return void 0;
+		if (await this.getClient().config.region() !== context.expectedRegion) return void 0;
+		const live = await this.readDbResourceIdIfExists(resourceType, physicalId);
+		return live === void 0 ? RESOURCE_NOT_FOUND : live;
+	}
+	async readDbResourceIdIfExists(resourceType, identifier) {
+		const isCluster = resourceType === "AWS::RDS::DBCluster";
+		let found;
+		try {
+			if (isCluster) {
+				const cluster = await this.describeDBCluster(identifier);
+				found = cluster && {
+					identifier: cluster.DBClusterIdentifier,
+					resourceId: cluster.DbClusterResourceId
+				};
+			} else {
+				const instance = await this.describeDBInstance(identifier);
+				found = instance && {
+					identifier: instance.DBInstanceIdentifier,
+					resourceId: instance.DbiResourceId
+				};
+			}
+		} catch (error) {
+			const notFound = isCluster ? "DBClusterNotFoundFault" : "DBInstanceNotFoundFault";
+			if (error?.name === notFound) return void 0;
+			throw error;
+		}
+		if (found === void 0) return void 0;
+		const api = isCluster ? "DescribeDBClusters" : "DescribeDBInstances";
+		if (found.identifier?.toLowerCase() !== identifier.toLowerCase()) throw new Error(`${api} answered for another identifier`);
+		if (typeof found.resourceId !== "string" || found.resourceId === "") throw new Error(`${api} returned no resource id`);
+		return found.resourceId;
+	}
+	async readCurrentStateDBInstance(physicalId) {
+		let inst;
+		try {
+			inst = await this.describeDBInstance(physicalId);
+		} catch (err) {
+			if (err?.name === "DBInstanceNotFoundFault") return RESOURCE_NOT_FOUND;
+			if (this.isNotFoundError(err, "DBInstanceNotFoundFault")) return void 0;
+			throw err;
+		}
+		if (!inst) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (inst.DBInstanceIdentifier !== void 0) result["DBInstanceIdentifier"] = inst.DBInstanceIdentifier;
+		if (inst.DBInstanceClass !== void 0) result["DBInstanceClass"] = inst.DBInstanceClass;
+		if (inst.Engine !== void 0) result["Engine"] = inst.Engine;
+		if (inst.DBClusterIdentifier !== void 0) result["DBClusterIdentifier"] = inst.DBClusterIdentifier;
+		if (inst.DBSubnetGroup?.DBSubnetGroupName !== void 0) result["DBSubnetGroupName"] = inst.DBSubnetGroup.DBSubnetGroupName;
+		if (inst.PubliclyAccessible !== void 0) result["PubliclyAccessible"] = inst.PubliclyAccessible;
+		if (inst.AllocatedStorage !== void 0) result["AllocatedStorage"] = inst.AllocatedStorage;
+		if (inst.MasterUsername !== void 0) result["MasterUsername"] = inst.MasterUsername;
+		if (inst.DeletionProtection !== void 0) result["DeletionProtection"] = inst.DeletionProtection;
+		if (inst.EngineVersion !== void 0) result["EngineVersion"] = inst.EngineVersion;
+		if (inst.Endpoint?.Port !== void 0) result["Port"] = inst.Endpoint.Port;
+		if (inst.StorageEncrypted !== void 0) result["StorageEncrypted"] = inst.StorageEncrypted;
+		const sgIds = (inst.VpcSecurityGroups ?? []).map((sg) => sg.VpcSecurityGroupId).filter((id) => !!id);
+		if (sgIds.length > 0) result["VPCSecurityGroups"] = sgIds;
+		if (inst.KmsKeyId !== void 0) result["KmsKeyId"] = inst.KmsKeyId;
+		if (inst.MonitoringRoleArn !== void 0) result["MonitoringRoleArn"] = inst.MonitoringRoleArn;
+		if (inst.MonitoringInterval !== void 0) result["MonitoringInterval"] = inst.MonitoringInterval;
+		if (inst.IAMDatabaseAuthenticationEnabled !== void 0) result["EnableIAMDatabaseAuthentication"] = inst.IAMDatabaseAuthenticationEnabled;
+		if (inst.MasterUserSecret?.KmsKeyId !== void 0) result["MasterUserSecret"] = { KmsKeyId: inst.MasterUserSecret.KmsKeyId };
+		for (const key of [
+			"BackupRetentionPeriod",
+			"PreferredBackupWindow",
+			"PreferredMaintenanceWindow",
+			"StorageType",
+			"MultiAZ",
+			"MaxAllocatedStorage",
+			"AutoMinorVersionUpgrade",
+			"CopyTagsToSnapshot",
+			"PerformanceInsightsKMSKeyId",
+			"PerformanceInsightsRetentionPeriod",
+			"Iops",
+			"StorageThroughput",
+			"CACertificateIdentifier",
+			"NetworkType",
+			"LicenseModel",
+			"PromotionTier",
+			"DatabaseInsightsMode",
+			"DedicatedLogVolume"
+		]) if (inst[key] !== void 0) result[key] = inst[key];
+		if (inst.PerformanceInsightsEnabled !== void 0) result["EnablePerformanceInsights"] = inst.PerformanceInsightsEnabled;
+		const memberships = inst.OptionGroupMemberships ?? [];
+		const optionGroupName = (memberships.find((m) => m.Status === "in-sync" || m.Status === "pending-apply") ?? memberships[0])?.OptionGroupName;
+		if (optionGroupName !== void 0) result["OptionGroupName"] = optionGroupName;
+		const parameterGroupName = inst.DBParameterGroups?.[0]?.DBParameterGroupName;
+		if (parameterGroupName !== void 0) result["DBParameterGroupName"] = parameterGroupName;
+		if (inst.DBClusterIdentifier === void 0) {
+			const instanceLogs = liveLogExports(inst.EnabledCloudwatchLogsExports, inst.PendingModifiedValues?.PendingCloudwatchLogsExports);
+			if (instanceLogs.length > 0) result["EnableCloudwatchLogsExports"] = instanceLogs;
+		}
+		if (inst.DBName !== void 0) result["DBName"] = inst.DBName;
+		if (inst.AvailabilityZone !== void 0 && inst.MultiAZ !== true) result["AvailabilityZone"] = inst.AvailabilityZone;
+		if (inst.DBInstanceArn) await this.attachTags(result, inst.DBInstanceArn);
+		return result;
+	}
+	async readCurrentStateDBCluster(physicalId) {
+		let cluster;
+		try {
+			cluster = await this.describeDBCluster(physicalId);
+		} catch (err) {
+			if (err?.name === "DBClusterNotFoundFault") return RESOURCE_NOT_FOUND;
+			if (this.isNotFoundError(err, "DBClusterNotFoundFault")) return void 0;
+			throw err;
+		}
+		if (!cluster) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (cluster.DBClusterIdentifier !== void 0) result["DBClusterIdentifier"] = cluster.DBClusterIdentifier;
+		if (cluster.Engine !== void 0) result["Engine"] = cluster.Engine;
+		if (cluster.EngineVersion !== void 0) result["EngineVersion"] = cluster.EngineVersion;
+		if (cluster.MasterUsername !== void 0) result["MasterUsername"] = cluster.MasterUsername;
+		if (cluster.DatabaseName !== void 0) result["DatabaseName"] = cluster.DatabaseName;
+		if (cluster.Port !== void 0) result["Port"] = cluster.Port;
+		result["VpcSecurityGroupIds"] = (cluster.VpcSecurityGroups ?? []).map((sg) => sg.VpcSecurityGroupId).filter((id) => !!id);
+		if (cluster.DBSubnetGroup !== void 0) result["DBSubnetGroupName"] = cluster.DBSubnetGroup;
+		if (cluster.StorageEncrypted !== void 0) result["StorageEncrypted"] = cluster.StorageEncrypted;
+		if (cluster.KmsKeyId !== void 0) result["KmsKeyId"] = cluster.KmsKeyId;
+		if (cluster.BackupRetentionPeriod !== void 0) result["BackupRetentionPeriod"] = cluster.BackupRetentionPeriod;
+		if (cluster.DeletionProtection !== void 0) result["DeletionProtection"] = cluster.DeletionProtection;
+		if (cluster.MonitoringRoleArn !== void 0) result["MonitoringRoleArn"] = cluster.MonitoringRoleArn;
+		if (cluster.MonitoringInterval !== void 0) result["MonitoringInterval"] = cluster.MonitoringInterval;
+		if (cluster.IAMDatabaseAuthenticationEnabled !== void 0) result["EnableIAMDatabaseAuthentication"] = cluster.IAMDatabaseAuthenticationEnabled;
+		if (cluster.PubliclyAccessible !== void 0) result["PubliclyAccessible"] = cluster.PubliclyAccessible;
+		if (cluster.MasterUserSecret?.KmsKeyId !== void 0) result["MasterUserSecret"] = { KmsKeyId: cluster.MasterUserSecret.KmsKeyId };
+		if (cluster.ServerlessV2ScalingConfiguration?.MinCapacity !== void 0 || cluster.ServerlessV2ScalingConfiguration?.MaxCapacity !== void 0) {
+			const sc = {};
+			if (cluster.ServerlessV2ScalingConfiguration?.MinCapacity !== void 0) sc["MinCapacity"] = cluster.ServerlessV2ScalingConfiguration.MinCapacity;
+			if (cluster.ServerlessV2ScalingConfiguration?.MaxCapacity !== void 0) sc["MaxCapacity"] = cluster.ServerlessV2ScalingConfiguration.MaxCapacity;
+			if (cluster.ServerlessV2ScalingConfiguration?.SecondsUntilAutoPause !== void 0) sc["SecondsUntilAutoPause"] = cluster.ServerlessV2ScalingConfiguration.SecondsUntilAutoPause;
+			result["ServerlessV2ScalingConfiguration"] = sc;
+		}
+		if (cluster.DBClusterParameterGroup !== void 0) result["DBClusterParameterGroupName"] = cluster.DBClusterParameterGroup;
+		if (cluster.PreferredBackupWindow !== void 0) result["PreferredBackupWindow"] = cluster.PreferredBackupWindow;
+		if (cluster.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = cluster.PreferredMaintenanceWindow;
+		if (cluster.CopyTagsToSnapshot !== void 0) result["CopyTagsToSnapshot"] = cluster.CopyTagsToSnapshot;
+		const storageType = cluster.PendingModifiedValues?.StorageType ?? cluster.StorageType ?? (cluster.Engine?.toLowerCase().startsWith("aurora") ? "aurora" : void 0);
+		if (storageType !== void 0) result["StorageType"] = storageType;
+		const clusterLogs = liveLogExports(cluster.EnabledCloudwatchLogsExports, cluster.PendingModifiedValues?.PendingCloudwatchLogsExports);
+		if (clusterLogs.length > 0) result["EnableCloudwatchLogsExports"] = clusterLogs;
+		if (cluster.AutoMinorVersionUpgrade !== void 0) result["AutoMinorVersionUpgrade"] = cluster.AutoMinorVersionUpgrade;
+		if (cluster.NetworkType !== void 0) result["NetworkType"] = cluster.NetworkType;
+		if (cluster.PerformanceInsightsEnabled !== void 0) result["PerformanceInsightsEnabled"] = cluster.PerformanceInsightsEnabled;
+		if (cluster.PerformanceInsightsKMSKeyId !== void 0) result["PerformanceInsightsKmsKeyId"] = cluster.PerformanceInsightsKMSKeyId;
+		if (cluster.PerformanceInsightsRetentionPeriod !== void 0) result["PerformanceInsightsRetentionPeriod"] = cluster.PerformanceInsightsRetentionPeriod;
+		if (cluster.HttpEndpointEnabled !== void 0) result["EnableHttpEndpoint"] = cluster.HttpEndpointEnabled;
+		if (cluster.DBClusterArn) await this.attachTags(result, cluster.DBClusterArn);
+		return result;
+	}
+	async readCurrentStateDBSubnetGroup(physicalId) {
+		let resp;
+		try {
+			resp = await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: physicalId }));
+		} catch (err) {
+			if (err?.name === "DBSubnetGroupNotFoundFault") return RESOURCE_NOT_FOUND;
+			if (this.isNotFoundError(err, "DBSubnetGroupNotFoundFault")) return void 0;
+			throw err;
+		}
+		const sg = resp.DBSubnetGroups?.[0];
+		if (!sg) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (sg.DBSubnetGroupName !== void 0) result["DBSubnetGroupName"] = sg.DBSubnetGroupName;
+		if (sg.DBSubnetGroupDescription !== void 0) result["DBSubnetGroupDescription"] = sg.DBSubnetGroupDescription;
+		result["SubnetIds"] = (sg.Subnets ?? []).map((s) => s.SubnetIdentifier).filter((id) => !!id);
+		if (sg.DBSubnetGroupArn) await this.attachTags(result, sg.DBSubnetGroupArn);
+		return result;
+	}
+	async attachTags(result, arn) {
+		try {
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
+		} catch (err) {
+			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
+		}
+	}
+	async importDBInstance(input) {
+		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
+		if (explicit) try {
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
+			return {
+				physicalId: explicit,
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
+			};
+		} catch (err) {
+			if (err.name === "DBInstanceNotFoundFault") return null;
+			throw err;
+		}
+		return null;
+	}
+	async importDBCluster(input) {
+		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
+		if (explicit) try {
+			const described = (await this.getClient().send(new DescribeDBClustersCommand({ DBClusterIdentifier: explicit }))).DBClusters?.[0];
+			return {
+				physicalId: explicit,
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint,
+					"Endpoint.Port": stringifyIfAssigned(described?.Port),
+					"ReadEndpoint.Address": described?.ReaderEndpoint,
+					Arn: described?.DBClusterArn,
+					DBClusterResourceId: described?.DbClusterResourceId
+				})
+			};
+		} catch (err) {
+			if (err.name === "DBClusterNotFoundFault") return null;
+			throw err;
+		}
+		return null;
+	}
+	async importDBSubnetGroup(input) {
+		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
+		if (explicit) try {
+			const arn = (await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: explicit }))).DBSubnetGroups?.[0]?.DBSubnetGroupArn;
+			return {
+				physicalId: explicit,
+				attributes: { ...arn !== void 0 && { DBSubnetGroupArn: arn } }
+			};
+		} catch (err) {
+			if (err.name === "DBSubnetGroupNotFoundFault") return null;
+			throw err;
+		}
+		return null;
+	}
+};
+function securityGroupListChanged(sent, previous) {
+	if (sent === void 0) return false;
+	const before = Array.isArray(previous) ? previous.filter((id) => typeof id === "string") : [];
+	return [...sent].sort().join(" ") !== [...before].sort().join(" ");
+}
+
+export { RDSProvider };
+//# sourceMappingURL=rds-provider-C8enyD9d.js.map