@cdkd/cli 0.323.0 → 0.324.0

package/dist/{provider-classes-KPYbVTtY.js → provider-classes-CZnJcera.js}

@@ -2,13 +2,13 @@ import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWp
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
 import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-CmrPwGge.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as isTtlRateLimited, $i as stringifyIfAssigned, A as resolvedResourceTimeoutMs, Aa as reEnableInstanceApiTermination, Ac as sameLambdaFunctionAddress, B as DELETE_INDEX_WAIT_PROCEED_NOTE, C as planContributorInsightsOp, Ca as withIndeterminateGuard, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Cl as recoverMaskedOutput, D as reverseMapTableContributorInsights, Da as isTerminationProtectionPropagationError, Dc as emrClusterInstancesReplaced, Dt as enclosingDeadlineRemainingMs, E as reverseMapIndexContributorInsights, Ea as ec2InstanceProtectionSite, Ec as ecsServiceLaunchTypeSetOrChanged, Et as enclosingDeadlineExpired, F as beginDeleteWait, Fi as earliestDefined, G as relayedIndexBusyDelete, Ga as s3BucketRegionalDomainName, Gi as DBPROXY_TAGS_WHAT, Gn as getCurrentProducerRegions, Gs as withheldAccountClause, H as TABLE_INDEX_NOUN, Ha as s3BucketArn, Hc as passedNoEchoParametersOf, Hr as awaitInFlightSibling, I as compensateRemovedDeletionProtection, Id as describeFileReadFailure, J as readbackVectorIndexes, Jc as markSameGenerationBag, Ji as readTagList, Jn as isRedactedRecordedValue, Js as findSdkUnwiredProperties, K as waitForIndexesSettled, Ka as s3BucketWebsiteUrl, Ki as DBPROXY_TAG_OPTIONS, Kr as replacedDeleteFailureVerdict, L as deleteBudgetKey, Ld as displayAssemblyPath, Li as reserveStackCreateToken, M as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Na as isUsableAttemptedName, Ns as refuseMalformedResourcesForDestroy, O as stripIndexContributorInsights, Oa as observeThenDisableInstanceApiTermination, Oc as canonicalLambdaFunctionName, Ol as carriesSecretMask, Oo as parseWebACLArn, P as DYNAMODB_DELETE_POLL_COST_MS, Q as isTtlAlreadyDisabled, Qi as definedAttributes, Qt as withNestedStackContext, R as resolveDynamoDbDeleteBudgetClock, Rd as renderAssemblyPathEscape, Ro as accountArgs, S as indexDeclaresContributorInsights, Sa as deleteSkipReason, Sd as canonicalizeRegion, Si as secretNamedAttributeNamesOf, T as readContributorInsightsSpec, Tl as recordAttributeIdCopy, U as deleteTableWithIndexBusyRetry, Ua as s3BucketDomainName, Ui as isRefusedByName, V as INDEX_SETTLE_POLL_INTERVAL_MS, Va as isSettledInstanceState, Vr as refuseRestoreFromItself, W as maskedLogger, Wa as s3BucketDualStackDomainName, Wi as markDeleteStarted, Wr as getStackRecords, Wt as getNestedRevertRun, X as vectorIndexesSettled, Xc as recordReferenceProvenanceEntry, Xi as tagMapAsList, Xn as redactedDeleteAddressSkip, Xs as withoutSdkUnwiredProperties, Y as vectorIndexesForCreate, Yc as redactForState, Yi as refuseMalformedDesiredTags, Yn as redactedDeleteAddressFields, Z as vectorIndexesShapeDetail, Za as outputReferenceProvenanceOf, Zc as snapshotPassProvenance, Zi as tagPlanWarning, Zt as getCurrentNestedStackContext, _ as streamMemberRefusals, _a as unchangedBehindSecretReference, _c as requireConfigArray, _o as getAccountInfo, _t as findNestedTemplateTreeDefect, aa as waitForLambdaFunctionActive, ac as WARM_THROUGHPUT_MEMBERS, at as hasCdkAutoDeleteTag, b as CONTRIBUTOR_INSIGHTS_KEY, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, c as DynamoDBGlobalTableProvider, cc as toCfnInteger, cn as chunks, ct as markRefusedBeforeApplying, d as declaredStreamPolicyMember, dc as coerceCfnInteger, dn as withApiLimit, el as hasMaskableValues, et as planTimeToLive, f as declaredStreamTagsMember, fc as configBooleanRefusal, fu as timePhase, g as streamDeclaresTags, ga as onlySecretReferencesDiffer, gc as replayWarn, gl as dynamicReferenceTokens, h as streamDeclaresPolicy, ha as slowCcOperationTimeoutMs, hc as readConfigString, hu as stringifyValue, it as S3_AUTO_DELETE_OBJECTS_TAG, jo as passedParameterClassesOf, k as waitForGoneAfterDelete, ka as reDisableInstanceApiTermination, kc as lambdaFunctionNameForMask, l as STREAM_POLICY_KEY, la as getCurrentResourceSecrets, lc as toFiniteNumber, ln as isAccessDeniedError, m as reverseMapStreamPolicy, mc as configStringRefusal, ml as withoutPhysicalNameCopies, nt as sendTtlWaitingOutRateLimit, oc as coerceWarmThroughput$1, ot as isTruthyCfnBoolean, p as planStreamMemberOps, pc as configIntegerRefusal, ps as refuseMalformedNestedChildOutputs, q as planVectorIndexUpdates, qi as planTagDiff, qn as REDACTED_DELETE_ADDRESS_SKIP_REASON, qt as revertNestedChildFromJournal, rt as ECR_AUTO_DELETE_IMAGES_TAG, sc as isWarmThroughputDecrease, st as getPriorAttempts, t as DeployEngine, tt as readTtlSpec, u as STREAM_TAGS_KEY, uc as coerceCfnBoolean, un as lookupEachName, v as streamPolicyMatchesDeclared, vc as requireConfigObject, vt as isAbsoluteAssetPath, w as planIndexContributorInsightsOps, wc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, wl as physicalNameCopiesOf, x as contributorInsightsRefusals, y as streamTagsMatchDeclared, yc as requireConfigString, yd as decodeListingKey, yt as listNestedTemplateRows, z as resolveDynamoDbDeleteBudgetMs, zd as resolveAssemblyPath, zi as acquireIdempotencyToken } from "./deploy-engine-dYZ0v6Kz.js";
-import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-Bp4osNrj.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, t as canonicalizeIpv4Cidr } from "./program-BYT8z2ca.js";
+import { $ as isTtlRateLimited, $i as stringifyIfAssigned, A as resolvedResourceTimeoutMs, Aa as reEnableInstanceApiTermination, Ac as sameLambdaFunctionAddress, B as DELETE_INDEX_WAIT_PROCEED_NOTE, C as planContributorInsightsOp, Ca as withIndeterminateGuard, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Cl as recoverMaskedOutput, D as reverseMapTableContributorInsights, Da as isTerminationProtectionPropagationError, Dc as emrClusterInstancesReplaced, Dt as enclosingDeadlineRemainingMs, E as reverseMapIndexContributorInsights, Ea as ec2InstanceProtectionSite, Ec as ecsServiceLaunchTypeSetOrChanged, Et as enclosingDeadlineExpired, F as beginDeleteWait, Fi as earliestDefined, G as relayedIndexBusyDelete, Ga as s3BucketRegionalDomainName, Gi as DBPROXY_TAGS_WHAT, Gn as getCurrentProducerRegions, Gs as withheldAccountClause, H as TABLE_INDEX_NOUN, Ha as s3BucketArn, Hc as passedNoEchoParametersOf, Hr as awaitInFlightSibling, I as compensateRemovedDeletionProtection, Id as describeFileReadFailure, J as readbackVectorIndexes, Jc as markSameGenerationBag, Ji as readTagList, Jn as isRedactedRecordedValue, Js as findSdkUnwiredProperties, K as waitForIndexesSettled, Ka as s3BucketWebsiteUrl, Ki as DBPROXY_TAG_OPTIONS, Kr as replacedDeleteFailureVerdict, L as deleteBudgetKey, Ld as displayAssemblyPath, Li as reserveStackCreateToken, M as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Na as isUsableAttemptedName, Ns as refuseMalformedResourcesForDestroy, O as stripIndexContributorInsights, Oa as observeThenDisableInstanceApiTermination, Oc as canonicalLambdaFunctionName, Ol as carriesSecretMask, Oo as parseWebACLArn, P as DYNAMODB_DELETE_POLL_COST_MS, Q as isTtlAlreadyDisabled, Qi as definedAttributes, Qt as withNestedStackContext, R as resolveDynamoDbDeleteBudgetClock, Rd as renderAssemblyPathEscape, Ro as accountArgs, S as indexDeclaresContributorInsights, Sa as deleteSkipReason, Sd as canonicalizeRegion, Si as secretNamedAttributeNamesOf, T as readContributorInsightsSpec, Tl as recordAttributeIdCopy, U as deleteTableWithIndexBusyRetry, Ua as s3BucketDomainName, Ui as isRefusedByName, V as INDEX_SETTLE_POLL_INTERVAL_MS, Va as isSettledInstanceState, Vr as refuseRestoreFromItself, W as maskedLogger, Wa as s3BucketDualStackDomainName, Wi as markDeleteStarted, Wr as getStackRecords, Wt as getNestedRevertRun, X as vectorIndexesSettled, Xc as recordReferenceProvenanceEntry, Xi as tagMapAsList, Xn as redactedDeleteAddressSkip, Xs as withoutSdkUnwiredProperties, Y as vectorIndexesForCreate, Yc as redactForState, Yi as refuseMalformedDesiredTags, Yn as redactedDeleteAddressFields, Z as vectorIndexesShapeDetail, Za as outputReferenceProvenanceOf, Zc as snapshotPassProvenance, Zi as tagPlanWarning, Zt as getCurrentNestedStackContext, _ as streamMemberRefusals, _a as unchangedBehindSecretReference, _c as requireConfigArray, _o as getAccountInfo, _t as findNestedTemplateTreeDefect, aa as waitForLambdaFunctionActive, ac as WARM_THROUGHPUT_MEMBERS, at as hasCdkAutoDeleteTag, b as CONTRIBUTOR_INSIGHTS_KEY, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, c as DynamoDBGlobalTableProvider, cc as toCfnInteger, cn as chunks, ct as markRefusedBeforeApplying, d as declaredStreamPolicyMember, dc as coerceCfnInteger, dn as withApiLimit, el as hasMaskableValues, et as planTimeToLive, f as declaredStreamTagsMember, fc as configBooleanRefusal, fu as timePhase, g as streamDeclaresTags, ga as onlySecretReferencesDiffer, gc as replayWarn, gl as dynamicReferenceTokens, h as streamDeclaresPolicy, ha as slowCcOperationTimeoutMs, hc as readConfigString, hu as stringifyValue, it as S3_AUTO_DELETE_OBJECTS_TAG, jo as passedParameterClassesOf, k as waitForGoneAfterDelete, ka as reDisableInstanceApiTermination, kc as lambdaFunctionNameForMask, l as STREAM_POLICY_KEY, la as getCurrentResourceSecrets, lc as toFiniteNumber, ln as isAccessDeniedError, m as reverseMapStreamPolicy, mc as configStringRefusal, ml as withoutPhysicalNameCopies, nt as sendTtlWaitingOutRateLimit, oc as coerceWarmThroughput$1, ot as isTruthyCfnBoolean, p as planStreamMemberOps, pc as configIntegerRefusal, ps as refuseMalformedNestedChildOutputs, q as planVectorIndexUpdates, qi as planTagDiff, qn as REDACTED_DELETE_ADDRESS_SKIP_REASON, qt as revertNestedChildFromJournal, rt as ECR_AUTO_DELETE_IMAGES_TAG, sc as isWarmThroughputDecrease, st as getPriorAttempts, t as DeployEngine, tt as readTtlSpec, u as STREAM_TAGS_KEY, uc as coerceCfnBoolean, un as lookupEachName, v as streamPolicyMatchesDeclared, vc as requireConfigObject, vt as isAbsoluteAssetPath, w as planIndexContributorInsightsOps, wc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, wl as physicalNameCopiesOf, x as contributorInsightsRefusals, y as streamTagsMatchDeclared, yc as requireConfigString, yd as decodeListingKey, yt as listNestedTemplateRows, z as resolveDynamoDbDeleteBudgetMs, zd as resolveAssemblyPath, zi as acquireIdempotencyToken } from "./deploy-engine-B32kQ3SO.js";
+import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-D3th06lJ.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, t as canonicalizeIpv4Cidr } from "./program-CcdJAeR0.js";
 import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DCLA_p9I.js";
-import { RDSProvider } from "./rds-provider-C8enyD9d.js";
-import { NeptuneProvider } from "./neptune-provider-BqtKFZaE.js";
-import { ASGProvider } from "./asg-provider-4rNFSmz9.js";
+import { RDSProvider } from "./rds-provider-YcTAhlgr.js";
+import { NeptuneProvider } from "./neptune-provider-CN7ptfAK.js";
+import { ASGProvider } from "./asg-provider-D8-GEE_f.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -16,7 +16,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionConfigurationCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionScalingConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PublishVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutFunctionScalingConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, GetIpamPoolAllocationsCommand, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateDeploymentCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -17576,6 +17576,7 @@ function readbackNatZoneAddresses(live, recorded) {
 const EIP_ALLOCATION_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidAllocationID.NotFound"]);
 const INSTANCE_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidInstanceID.NotFound"]);
 const VPC_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidVpcID.NotFound"]);
+const IPAM_POOL_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidIpamPoolId.NotFound"]);
 const SUBNET_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidSubnetID.NotFound"]);
 const SECURITY_GROUP_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidGroup.NotFound"]);
 const NAT_GATEWAY_ID_PATTERN = /^nat-[0-9a-f]+$/;
@@ -17597,6 +17598,47 @@ const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
 const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
 const allocateAddressLatch = new AmbiguousCreateLatch("ec2:AllocateAddress");
 const ec2IdsCreatedByThisProcess = new RecentIdSet();
+const vpcIpamReleaseWait = {
+	pollIntervalMs: 1e4,
+	maxWaitMs: 15e5
+};
+const VPC_ENCRYPTION_CONTROL_EXCLUSIONS = [
+	"InternetGatewayExclusion",
+	"EgressOnlyInternetGatewayExclusion",
+	"NatGatewayExclusion",
+	"VirtualPrivateGatewayExclusion",
+	"VpcPeeringExclusion",
+	"LambdaExclusion",
+	"VpcLatticeExclusion",
+	"ElasticFileSystemExclusion"
+];
+function replayedRecordNote(context) {
+	return context?.replayingState === true ? " The value comes from the state record being restored." : "";
+}
+const VPC_CREATE_ONLY_SENT = [
+	"Ipv4IpamPoolId",
+	"Ipv4NetmaskLength",
+	"VpcEncryptionControl"
+];
+const INSTANCE_CREATE_ONLY_SENT = ["CpuOptions", "HibernationOptions"];
+function foldCreateOnlySent(key, value) {
+	const asRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+	if (key === "Ipv4NetmaskLength") return coerceCfnInteger(value) ?? value;
+	if (key === "CpuOptions") {
+		const cpu = asRecord(value);
+		if (cpu === void 0) return value;
+		return Object.fromEntries(Object.entries(cpu).map(([k, v]) => [k, coerceCfnInteger(v) ?? v]));
+	}
+	if (key === "HibernationOptions") {
+		const hibernation = asRecord(value);
+		if (hibernation === void 0) return value;
+		return Object.fromEntries(Object.entries(hibernation).map(([k, v]) => [k, coerceCfnBoolean(v) ?? v]));
+	}
+	return value;
+}
+function sameCreateOnlySent(key, a, b) {
+	return isDeepStrictEqual(foldCreateOnlySent(key, a), foldCreateOnlySent(key, b));
+}
 const mayBeLostCreate = (tags, sent) => tags === void 0 || tags.length === 0 || sent.length > 0 && tagListsMatch(tags, sent);
 const lostCreateNoun = (what, sent, adjective) => sent.length === 0 ? `${adjective !== void 0 ? `${adjective}, ` : ""}untagged ${what}` : `${adjective !== void 0 ? `${adjective} ` : ""}${what} with no tags or exactly the template's tags`;
 function isCreateTagsDenial(error) {
@@ -17624,7 +17666,10 @@ var EC2Provider = class {
 			"InstanceTenancy",
 			"EnableDnsHostnames",
 			"EnableDnsSupport",
-			"Tags"
+			"Tags",
+			"Ipv4IpamPoolId",
+			"Ipv4NetmaskLength",
+			"VpcEncryptionControl"
 		])],
 		["AWS::EC2::Subnet", /* @__PURE__ */ new Set([
 			"VpcId",
@@ -17716,7 +17761,10 @@ var EC2Provider = class {
 			"MetadataOptions",
 			"Monitoring",
 			"EbsOptimized",
-			"CreditSpecification"
+			"CreditSpecification",
+			"CpuOptions",
+			"HibernationOptions",
+			"InstanceInitiatedShutdownBehavior"
 		])],
 		["AWS::EC2::NetworkAcl", /* @__PURE__ */ new Set(["VpcId", "Tags"])],
 		["AWS::EC2::NetworkAclEntry", /* @__PURE__ */ new Set([
@@ -17775,27 +17823,75 @@ var EC2Provider = class {
 			inspect: (id) => lookup.inspect(aws, id, regionArg)
 		});
 	}
-	async reportPossibleOrphanVpcs(logicalId, cidrBlock, sent, window, context) {
+	async reportPossibleOrphanVpcs(logicalId, match, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
-		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
+		const wanted = "cidrBlock" in match ? canonicalizeIpv4Cidr(match.cidrBlock) ?? match.cidrBlock : void 0;
+		const listVpcs = async (inPool) => collectOrphanIds(async (token) => {
+			const page = await this.ec2Client.send(new DescribeVpcsCommand({
+				MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+				NextToken: token
+			}));
+			return {
+				items: page.Vpcs ?? [],
+				next: page.NextToken
+			};
+		}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && mayBeLostCreate(vpc.Tags, sent) && vpc.CidrBlock !== void 0 && (inPool !== void 0 ? inPool.has(vpc.VpcId) : (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted) && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0);
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateVpc",
-			listAction: "DescribeVpcs",
-			subject: `a VPC with CIDR ${log.value(cidrBlock)}`,
+			listAction: "cidrBlock" in match ? "DescribeVpcs" : "GetIpamPoolAllocations + DescribeVpcs",
+			subject: "cidrBlock" in match ? `a VPC with CIDR ${log.value(match.cidrBlock)}` : `a VPC allocated from IPAM pool ${log.value(match.ipamPoolId)}`,
 			noun: lostCreateNoun("VPC(s)", sent),
-			list: () => collectOrphanIds(async (token) => {
-				const page = await this.ec2Client.send(new DescribeVpcsCommand({
-					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
-					NextToken: token
-				}));
+			list: async () => {
+				if ("cidrBlock" in match) return listVpcs(void 0);
+				const allocated = await collectOrphanIds(async (token) => {
+					const page = await this.ec2Client.send(new GetIpamPoolAllocationsCommand({
+						IpamPoolId: match.ipamPoolId,
+						NextToken: token
+					}));
+					return {
+						items: page.IpamPoolAllocations ?? [],
+						next: page.NextToken
+					};
+				}, (allocation) => allocation.ResourceType === "vpc" && allocation.ResourceId !== void 0 ? allocation.ResourceId : void 0);
+				const vpcs = await listVpcs(new Set(allocated.ids));
 				return {
-					items: page.Vpcs ?? [],
-					next: page.NextToken
+					ids: vpcs.ids,
+					truncated: allocated.truncated || vpcs.truncated
 				};
-			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && mayBeLostCreate(vpc.Tags, sent) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
+			},
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-vpcs --vpc-ids ${id}${regionArg}`.render()
 		});
 	}
+	readVpcIpamAllocation(properties, resourceType, logicalId, context) {
+		const refusal = configStringRefusal(properties, "Ipv4IpamPoolId", "", resourceType) ?? (properties["Ipv4IpamPoolId"] === "" ? `${resourceType}.Ipv4IpamPoolId must not be blank` : void 0) ?? configIntegerRefusal(properties, "Ipv4NetmaskLength", resourceType, 0, 32);
+		if (refusal !== void 0) throw markNonRetryable(new ProvisioningError(`${refusal}. The VPC ${logicalId} was not created.${replayedRecordNote(context)}`, resourceType, logicalId));
+		const poolId = properties["Ipv4IpamPoolId"];
+		const netmaskLength = coerceCfnInteger(properties["Ipv4NetmaskLength"]);
+		return {
+			...typeof poolId === "string" && poolId !== "" && { poolId },
+			...netmaskLength !== void 0 && { netmaskLength }
+		};
+	}
+	buildVpcEncryptionControl(value, resourceType, logicalId, context) {
+		if (value === void 0 || value === null) return void 0;
+		const path = `${resourceType} VpcEncryptionControl`;
+		const refuse = (reason) => {
+			throw markNonRetryable(new ProvisioningError(`${reason}. The VPC ${logicalId} was not created.${replayedRecordNote(context)}`, resourceType, logicalId));
+		};
+		const containerRefusal = configStringRefusal(value, "Mode", "", path);
+		if (containerRefusal !== void 0) return refuse(containerRefusal);
+		const block = value;
+		const mode = block["Mode"];
+		if (mode === "") return refuse(`${path}.Mode must not be blank`);
+		const config = { Mode: typeof mode === "string" ? mode : void 0 };
+		for (const key of VPC_ENCRYPTION_CONTROL_EXCLUSIONS) {
+			const memberRefusal = configStringRefusal(block, key, "", path);
+			if (memberRefusal !== void 0) return refuse(memberRefusal);
+			const member = block[key];
+			if (typeof member === "string" && member !== "") config[key] = member;
+		}
+		return config;
+	}
 	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
@@ -17917,7 +18013,7 @@ var EC2Provider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::EC2::VPC": return this.deleteVpc(logicalId, physicalId, resourceType, context);
+			case "AWS::EC2::VPC": return this.deleteVpc(logicalId, physicalId, resourceType, context, properties);
 			case "AWS::EC2::Subnet": return this.deleteSubnet(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::InternetGateway": return this.deleteInternetGateway(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::EIP": return this.deleteEip(logicalId, physicalId, resourceType, context);
@@ -18072,18 +18168,24 @@ var EC2Provider = class {
 		this.logger.debug(`Creating VPC ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const cidrBlock = properties["CidrBlock"];
-		if (!cidrBlock) throw new ProvisioningError(`CidrBlock is required for VPC ${logicalId}`, resourceType, logicalId);
+		const ipamAllocation = this.readVpcIpamAllocation(properties, resourceType, logicalId, context);
+		if (!cidrBlock && ipamAllocation.poolId === void 0) throw new ProvisioningError(`CidrBlock or Ipv4IpamPoolId is required for VPC ${logicalId}`, resourceType, logicalId);
+		const encryptionControl = this.buildVpcEncryptionControl(properties["VpcEncryptionControl"], resourceType, logicalId, context);
+		const orphanMatch = cidrBlock ? { cidrBlock } : { ipamPoolId: ipamAllocation.poolId };
 		let leftBehindId;
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createVpcLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, orphanMatch, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
 			let tagsApplied;
 			try {
 				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "vpc", desiredTags, (TagSpecifications) => createClient.send(new CreateVpcCommand({
-					CidrBlock: cidrBlock,
+					...cidrBlock ? { CidrBlock: cidrBlock } : {},
+					...ipamAllocation.poolId !== void 0 && { Ipv4IpamPoolId: ipamAllocation.poolId },
+					...ipamAllocation.netmaskLength !== void 0 && { Ipv4NetmaskLength: ipamAllocation.netmaskLength },
+					...encryptionControl !== void 0 && { VpcEncryptionControl: encryptionControl },
 					InstanceTenancy: properties["InstanceTenancy"] ?? void 0,
 					...TagSpecifications && { TagSpecifications }
 				}))));
@@ -18095,7 +18197,7 @@ var EC2Provider = class {
 			ec2IdsCreatedByThisProcess.add(vpcId);
 			reportCreatedResource(logicalId, resourceType, vpcId);
 			const vpcReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, vpcReplayWindow, context);
+			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, orphanMatch, desiredTags, vpcReplayWindow, context);
 			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -18136,7 +18238,7 @@ var EC2Provider = class {
 				physicalId: vpcId,
 				attributes: definedAttributes({
 					VpcId: vpcId,
-					CidrBlock: cidrBlock,
+					CidrBlock: cidrBlock || response.Vpc?.CidrBlock,
 					DefaultSecurityGroup: defaultSgId
 				})
 			};
@@ -18158,10 +18260,14 @@ var EC2Provider = class {
 			const newTenancy = tenancyOf(properties["InstanceTenancy"]);
 			const oldTenancy = tenancyOf(previousProperties["InstanceTenancy"]);
 			if (newTenancy !== oldTenancy && newTenancy !== "default") throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "destroy + redeploy the VPC (and the resources that depend on it). AWS changes InstanceTenancy in place only to default, and CloudFormation creates a new VPC for this change");
+			const createOnlyChanged = VPC_CREATE_ONLY_SENT.filter((key) => !(key === "Ipv4IpamPoolId" && (properties[key] === void 0 || previousProperties[key] === void 0)) && !sameCreateOnlySent(key, properties[key], previousProperties[key]));
+			if (createOnlyChanged.length > 0) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `destroy + redeploy the VPC (and the resources that depend on it). ${createOnlyChanged.join(", ")} can be set only when the VPC is created, and CloudFormation creates a new VPC for this change`);
 			const asBool = (v) => {
 				if (v === void 0) return void 0;
 				return v === true || v === "true";
 			};
+			const declaredCidr = properties["CidrBlock"];
+			const cidrBlock = typeof declaredCidr === "string" && declaredCidr !== "" ? declaredCidr : properties["Ipv4IpamPoolId"] !== void 0 ? (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] })))?.Vpcs?.[0]?.CidrBlock : void 0;
 			const newDnsHostnames = asBool(properties["EnableDnsHostnames"]);
 			const oldDnsHostnames = asBool(previousProperties["EnableDnsHostnames"]);
 			if (newDnsHostnames !== void 0 && newDnsHostnames !== oldDnsHostnames) await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -18183,10 +18289,10 @@ var EC2Provider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
+				attributes: definedAttributes({
 					VpcId: physicalId,
-					CidrBlock: properties["CidrBlock"]
-				}
+					CidrBlock: cidrBlock
+				})
 			};
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
@@ -18194,12 +18300,13 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async deleteVpc(logicalId, physicalId, resourceType, context) {
+	async deleteVpc(logicalId, physicalId, resourceType, context, properties) {
 		this.logger.debug(`Deleting VPC ${logicalId}: ${physicalId}`);
 		const maxAttempts = 10;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.ec2Client.send(new DeleteVpcCommand({ VpcId: physicalId }));
 			this.logger.debug(`Successfully deleted VPC ${logicalId}`);
+			await this.waitForVpcIpamRelease(physicalId, resourceType, properties, context);
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error) && (context?.failedCreateOrphan !== true || isNamedError(error, VPC_NOT_FOUND_NAMES))) {
@@ -18219,6 +18326,38 @@ var EC2Provider = class {
 			throw this.wrapDeleteError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async waitForVpcIpamRelease(vpcId, resourceType, properties, context) {
+		const poolId = properties?.["Ipv4IpamPoolId"];
+		if (typeof poolId !== "string" || !/^ipam-pool-[0-9a-z]+$/.test(poolId)) return;
+		this.logger.info(maskerOrIdentity(context?.maskSecrets)(safeMsg`  Waiting for IPAM pool ${poolId} to release the allocation of deleted VPC ${vpcId}; AWS can take about 18 minutes, and the pool CIDR cannot be deprovisioned before then`));
+		await waitForGoneAfterDelete({
+			what: maskerOrIdentity(context?.maskSecrets)(`the IPAM pool ${poolId} allocation of VPC ${vpcId}`),
+			resourceType,
+			consequence: "AWS releases the allocation on its side; until it does, the pool refuses to deprovision its CIDR (\"The CIDR has one or more allocations.\"), so re-run the destroy if it stops there.",
+			describe: async () => {
+				try {
+					let token;
+					let pages = 0;
+					do {
+						const page = await this.ec2Client.send(new GetIpamPoolAllocationsCommand({
+							IpamPoolId: poolId,
+							NextToken: token
+						}));
+						if ((page.IpamPoolAllocations ?? []).some((a) => a.ResourceId === vpcId)) return "allocated";
+						token = page.NextToken;
+						pages++;
+					} while (token && pages < 20);
+					return token ? "unknown (allocation listing truncated)" : void 0;
+				} catch (error) {
+					if (isNamedError(error, IPAM_POOL_NOT_FOUND_NAMES)) return void 0;
+					throw error;
+				}
+			},
+			logger: this.logger,
+			pollIntervalMs: vpcIpamReleaseWait.pollIntervalMs,
+			maxWaitMs: vpcIpamReleaseWait.maxWaitMs
+		});
+	}
 	async getVpcAttribute(physicalId, attributeName) {
 		try {
 			switch (attributeName) {
@@ -19941,6 +20080,7 @@ var EC2Provider = class {
 		if (!imageId) throw new ProvisioningError(`ImageId is required for EC2 Instance ${logicalId}`, resourceType, logicalId);
 		const instanceType = requireConfigString(properties["InstanceType"], "t3.micro", "AWS::EC2::Instance InstanceType", replayWarn(this.logger, context));
 		const blockDeviceMappings = this.buildBlockDeviceMappings(properties, logicalId);
+		const launchOnlyOptions = this.buildLaunchOnlyInstanceOptions(properties, resourceType, logicalId);
 		let leftBehindId;
 		try {
 			const securityGroupIds = properties["SecurityGroupIds"];
@@ -19974,7 +20114,8 @@ var EC2Provider = class {
 				Monitoring: this.buildRunInstancesMonitoring(properties),
 				MetadataOptions: this.buildMetadataOptions(properties),
 				CreditSpecification: this.buildCreditSpecification(properties),
-				Placement: this.buildPlacement(properties)
+				Placement: this.buildPlacement(properties),
+				...launchOnlyOptions
 			})));
 			const instance = response.Instances?.[0];
 			if (!instance?.InstanceId) throw new Error("No instance ID returned from RunInstances");
@@ -20188,6 +20329,14 @@ var EC2Provider = class {
 				else throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): InstanceType was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared (set it to the instance's current type to leave it unchanged). The instance was not updated.`, resourceType, logicalId, physicalId));
 			} else if (!standInSkips("InstanceType")) plan.instanceType = requireConfigString(properties["InstanceType"], "", "AWS::EC2::Instance InstanceType");
 		}
+		const createOnlyChanged = INSTANCE_CREATE_ONLY_SENT.filter((key) => changed(key, (a, b) => sameCreateOnlySent(key, a, b)));
+		if (createOnlyChanged.length > 0) throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `replace the instance (cdkd deploy --replace). ${createOnlyChanged.join(", ")} can be set only when the instance is launched, and CloudFormation creates a new instance for this change`));
+		if (changed("InstanceInitiatedShutdownBehavior", (a, b) => a === b)) {
+			if (properties["InstanceInitiatedShutdownBehavior"] === void 0) {
+				if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare InstanceInitiatedShutdownBehavior; the rollback leaves it at its current AWS value.`);
+				else throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): InstanceInitiatedShutdownBehavior was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared (set it to stop, the default, to leave the behavior at AWS's default). The instance was not updated.`, resourceType, logicalId, physicalId));
+			} else if (!standInSkips("InstanceInitiatedShutdownBehavior")) plan.shutdownBehavior = requireConfigString(properties["InstanceInitiatedShutdownBehavior"], "", "AWS::EC2::Instance InstanceInitiatedShutdownBehavior");
+		}
 		if (changed("UserData", (a, b) => a === b)) {
 			const userData = properties["UserData"];
 			if (userData === void 0) plan.userData = /* @__PURE__ */ new Uint8Array(0);
@@ -20279,6 +20428,13 @@ var EC2Provider = class {
 			}));
 			applied.push("the new DeleteOnTermination");
 		}
+		if (plan.shutdownBehavior !== void 0) {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				InstanceInitiatedShutdownBehavior: { Value: plan.shutdownBehavior }
+			}));
+			applied.push("the new InstanceInitiatedShutdownBehavior");
+		}
 		if (plan.instanceType === void 0 && plan.userData === void 0) {
 			if (instancesLeftStoppedByCdkd.has(physicalId)) {
 				let state = await this.readInstanceState(physicalId);
@@ -20630,6 +20786,29 @@ var EC2Provider = class {
 		const raw = obj["CPUCredits"] ?? obj["CpuCredits"];
 		return typeof raw === "string" ? raw : void 0;
 	}
+	buildLaunchOnlyInstanceOptions(properties, resourceType, logicalId) {
+		const cpu = properties["CpuOptions"];
+		const hibernation = properties["HibernationOptions"];
+		const refusal = configIntegerRefusal(cpu, "CoreCount", `${resourceType} CpuOptions`, 1) ?? configIntegerRefusal(cpu, "ThreadsPerCore", `${resourceType} CpuOptions`, 1) ?? configBooleanRefusal(hibernation, "Configured", `${resourceType} HibernationOptions`) ?? configStringRefusal(properties, "InstanceInitiatedShutdownBehavior", "", resourceType);
+		if (refusal !== void 0) throw markNonRetryable(new ProvisioningError(`${refusal}. The instance ${logicalId} was not launched.`, resourceType, logicalId));
+		const out = {};
+		if (cpu !== void 0 && cpu !== null) {
+			const block = cpu;
+			const coreCount = coerceCfnInteger(block["CoreCount"]);
+			const threadsPerCore = coerceCfnInteger(block["ThreadsPerCore"]);
+			out.CpuOptions = {
+				...coreCount !== void 0 && { CoreCount: coreCount },
+				...threadsPerCore !== void 0 && { ThreadsPerCore: threadsPerCore }
+			};
+		}
+		if (hibernation !== void 0 && hibernation !== null) {
+			const configured = coerceCfnBoolean(hibernation["Configured"]);
+			out.HibernationOptions = configured === void 0 ? {} : { Configured: configured };
+		}
+		const shutdown = properties["InstanceInitiatedShutdownBehavior"];
+		if (typeof shutdown === "string" && shutdown !== "") out.InstanceInitiatedShutdownBehavior = shutdown;
+		return out;
+	}
 	buildIpPermission(properties, direction = "ingress", inline = false) {
 		const ipProtocol = properties["IpProtocol"] ?? "-1";
 		const fromPort = properties["FromPort"];
@@ -21084,13 +21263,13 @@ var EC2Provider = class {
 	async readCurrentStateOnce(physicalId, logicalId, resourceType, properties, context) {
 		try {
 			switch (resourceType) {
-				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId);
+				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId, properties);
 				case "AWS::EC2::Subnet": return await this.readSubnetCurrentState(physicalId);
 				case "AWS::EC2::InternetGateway": return await this.readInternetGatewayCurrentState(physicalId);
 				case "AWS::EC2::NatGateway": return await this.readNatGatewayCurrentState(physicalId, properties);
 				case "AWS::EC2::RouteTable": return await this.readRouteTableCurrentState(physicalId);
 				case "AWS::EC2::SecurityGroup": return await this.readSecurityGroupCurrentState(physicalId, properties);
-				case "AWS::EC2::Instance": return await this.readInstanceCurrentState(physicalId);
+				case "AWS::EC2::Instance": return await this.readInstanceCurrentState(physicalId, properties);
 				case "AWS::EC2::NetworkAcl": return await this.readNetworkAclCurrentState(physicalId);
 				case "AWS::EC2::EIP": return await this.readEipCurrentState(physicalId, properties, context?.afterOwnWrite === true);
 				case "AWS::EC2::VPCGatewayAttachment": return await this.readVpcGatewayAttachmentCurrentState(physicalId, properties);
@@ -21109,9 +21288,13 @@ var EC2Provider = class {
 			throw err;
 		}
 	}
-	getDriftUnknownPaths(resourceType) {
+	getDriftUnknownPaths(resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::EC2::Instance": return ["NetworkInterfaces"];
+			case "AWS::EC2::VPC": {
+				const control = properties?.["VpcEncryptionControl"];
+				return ["Ipv4IpamPoolId", ...control !== null && typeof control === "object" && control["Mode"] === "monitor" ? VPC_ENCRYPTION_CONTROL_EXCLUSIONS.map((key) => `VpcEncryptionControl.${key}`) : []];
+			}
 			case "AWS::EC2::Route":
 			case "AWS::EC2::VPCGatewayAttachment":
 			case "AWS::EC2::SubnetRouteTableAssociation":
@@ -21131,12 +21314,27 @@ var EC2Provider = class {
 		const { declared, narrowed } = narrowRouteDestinations(properties);
 		return declared.length > 1 ? narrowed : properties;
 	}
-	async readVpcCurrentState(physicalId) {
+	async readVpcCurrentState(physicalId, properties) {
 		const vpc = (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0];
 		if (!vpc) return RESOURCE_NOT_FOUND;
 		const result = {};
-		if (vpc.CidrBlock !== void 0) result["CidrBlock"] = vpc.CidrBlock;
+		if (vpc.CidrBlock !== void 0) {
+			result["CidrBlock"] = vpc.CidrBlock;
+			const prefix = /\/(\d+)$/.exec(vpc.CidrBlock)?.[1];
+			if (prefix !== void 0 && properties?.["Ipv4NetmaskLength"] !== void 0) result["Ipv4NetmaskLength"] = Number(prefix);
+		}
 		if (vpc.InstanceTenancy !== void 0) result["InstanceTenancy"] = vpc.InstanceTenancy;
+		const control = vpc.EncryptionControl;
+		if (control?.Mode !== void 0) {
+			const out = { Mode: control.Mode };
+			const exclusions = control.ResourceExclusions;
+			for (const key of VPC_ENCRYPTION_CONTROL_EXCLUSIONS) {
+				const state = exclusions?.[key.slice(0, -9)]?.State;
+				if (state === "enabled" || state === "enabling") out[key] = "enable";
+				else if (state === "disabled" || state === "disabling") out[key] = "disable";
+			}
+			result["VpcEncryptionControl"] = out;
+		}
 		try {
 			const dnsHost = await this.ec2Client.send(new DescribeVpcAttributeCommand({
 				VpcId: physicalId,
@@ -21229,7 +21427,7 @@ var EC2Provider = class {
 		result["SecurityGroupEgress"] = reconcileSgRules(egressRules, stateEgress, "egress");
 		return result;
 	}
-	async readInstanceCurrentState(physicalId) {
+	async readInstanceCurrentState(physicalId, properties) {
 		const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
 		if (!instance || instance.State?.Name === "terminated" || instance.State?.Name === "shutting-down") return RESOURCE_NOT_FOUND;
 		const result = {};
@@ -21254,6 +21452,13 @@ var EC2Provider = class {
 			if (md.InstanceMetadataTags !== void 0) out["InstanceMetadataTags"] = md.InstanceMetadataTags;
 			if (Object.keys(out).length > 0) result["MetadataOptions"] = out;
 		}
+		if (instance.CpuOptions !== void 0) {
+			const cpu = {};
+			if (instance.CpuOptions.CoreCount !== void 0) cpu["CoreCount"] = instance.CpuOptions.CoreCount;
+			if (instance.CpuOptions.ThreadsPerCore !== void 0) cpu["ThreadsPerCore"] = instance.CpuOptions.ThreadsPerCore;
+			if (Object.keys(cpu).length > 0) result["CpuOptions"] = cpu;
+		}
+		if (instance.HibernationOptions?.Configured !== void 0) result["HibernationOptions"] = { Configured: instance.HibernationOptions.Configured };
 		if (instance.Placement?.Tenancy !== void 0) result["Tenancy"] = instance.Placement.Tenancy;
 		if (instance.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = instance.IamInstanceProfile.Arn;
 		else if (process.env["CDKD_NO_WAIT"] === "true" && instance.State?.Name === "pending") try {
@@ -21307,6 +21512,15 @@ var EC2Provider = class {
 		} catch (err) {
 			this.logger.debug(`DescribeInstanceAttribute(disableApiTermination, ${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
+		if (properties?.["InstanceInitiatedShutdownBehavior"] !== void 0) try {
+			const attrResp = await this.ec2Client.send(new DescribeInstanceAttributeCommand({
+				InstanceId: physicalId,
+				Attribute: "instanceInitiatedShutdownBehavior"
+			}));
+			if (attrResp.InstanceInitiatedShutdownBehavior?.Value !== void 0) result["InstanceInitiatedShutdownBehavior"] = attrResp.InstanceInitiatedShutdownBehavior.Value;
+		} catch (err) {
+			this.logger.debug(safeMsg`DescribeInstanceAttribute(instanceInitiatedShutdownBehavior, ${physicalId}) failed: ${describeAwsFailure(err).detail}`);
+		}
 		try {
 			const cpuCredits = (await this.ec2Client.send(new DescribeInstanceCreditSpecificationsCommand({ InstanceIds: [physicalId] }))).InstanceCreditSpecifications?.[0]?.CpuCredits;
 			if (cpuCredits !== void 0) result["CreditSpecification"] = { CPUCredits: cpuCredits };
@@ -21521,10 +21735,16 @@ var EC2Provider = class {
 	async verifyExplicit(logicalId, resourceType, physicalId, properties) {
 		try {
 			switch (resourceType) {
-				case "AWS::EC2::VPC": return (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0] ? {
-					physicalId,
-					attributes: {}
-				} : null;
+				case "AWS::EC2::VPC": {
+					const vpc = (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0];
+					return vpc ? {
+						physicalId,
+						attributes: definedAttributes({
+							VpcId: physicalId,
+							CidrBlock: vpc.CidrBlock
+						})
+					} : null;
+				}
 				case "AWS::EC2::Subnet": {
 					const subnet = (await this.ec2Client.send(new DescribeSubnetsCommand({ SubnetIds: [physicalId] }))).Subnets?.[0];
 					return subnet ? {
@@ -30411,14 +30631,14 @@ var RDSDBProxyProvider = class {
 						vpcId = proxy?.VpcId;
 						break;
 					}
-					if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(`DBProxy ${dbProxyName} entered terminal failure state: ${status}`, resourceType, logicalId, dbProxyName);
+					if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(mask(`DBProxy ${dbProxyName} entered terminal failure state: ${status}`), resourceType, logicalId, dbProxyName);
 				} catch (error) {
 					if (error instanceof DBProxyNotFoundFault) {} else if (error instanceof ProvisioningError) throw error;
 					else throw this.wrapCaughtError(error, "CREATE (poll)", resourceType, logicalId, dbProxyName, mask);
 				}
 				await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS$1));
 			}
-			if (!endpoint || !dbProxyArn) throw new ProvisioningError(`Timed out waiting for DBProxy ${dbProxyName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyName);
+			if (!endpoint || !dbProxyArn) throw new ProvisioningError(mask(`Timed out waiting for DBProxy ${dbProxyName} to become available (last status: ${status ?? "unknown"})`), resourceType, logicalId, dbProxyName);
 		} catch (error) {
 			markCreatedBeforeFailure(error, logicalId, resourceType, dbProxyName);
 			throw error;
@@ -30477,6 +30697,7 @@ var RDSDBProxyProvider = class {
 			} catch (error) {
 				throw this.wrapCaughtError(error, "UPDATE", resourceType, logicalId, physicalId, mask);
 			}
+			await this.waitForAvailableAfterModify(physicalId, resourceType, logicalId, mask);
 		}
 		this.invalidateAttributeCache(physicalId);
 		await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"], resourceType, logicalId, mask);
@@ -30486,6 +30707,25 @@ var RDSDBProxyProvider = class {
 			wasReplaced: false
 		};
 	}
+	async waitForAvailableAfterModify(physicalId, resourceType, logicalId, mask) {
+		const client = this.getClient();
+		const deadline = Date.now() + POLL_TIMEOUT_MS$1;
+		let status;
+		while (Date.now() < deadline) {
+			try {
+				const proxy = (await client.send(new DescribeDBProxiesCommand({ DBProxyName: physicalId }))).DBProxies?.[0];
+				if (!proxy) throw new ProvisioningError(mask(`DBProxy ${physicalId} was not found while waiting for it after modify`), resourceType, logicalId, physicalId);
+				status = proxy.Status;
+			} catch (error) {
+				if (error instanceof ProvisioningError) throw error;
+				throw this.wrapCaughtError(error, "UPDATE (poll)", resourceType, logicalId, physicalId, mask);
+			}
+			if (status === "available") return;
+			if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(mask(`DBProxy ${physicalId} entered terminal failure state after modify: ${status}`), resourceType, logicalId, physicalId);
+			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS$1));
+		}
+		throw new ProvisioningError(mask(`Timed out waiting for DBProxy ${physicalId} to become available after modify (last status: ${status ?? "unknown"})`), resourceType, logicalId, physicalId);
+	}
 	warnOnRetainedRemovals(logicalId, resourceType, properties, previousProperties, context) {
 		const retained = this.removedRetained(properties, previousProperties, context);
 		if (retained.length === 0) return;
@@ -30578,12 +30818,12 @@ var RDSDBProxyProvider = class {
 			IdleClientTimeout: p.IdleClientTimeout,
 			DebugLogging: p.DebugLogging ?? false,
 			Auth: (p.Auth ?? []).map((a) => ({
-				Description: a.Description,
-				UserName: a.UserName,
-				AuthScheme: a.AuthScheme,
-				SecretArn: a.SecretArn,
-				IAMAuth: a.IAMAuth,
-				ClientPasswordAuthType: a.ClientPasswordAuthType
+				...a.Description !== void 0 && { Description: a.Description },
+				...a.UserName !== void 0 && { UserName: a.UserName },
+				...a.AuthScheme !== void 0 && { AuthScheme: a.AuthScheme },
+				...a.SecretArn !== void 0 && { SecretArn: a.SecretArn },
+				...a.IAMAuth !== void 0 && { IAMAuth: a.IAMAuth },
+				...a.ClientPasswordAuthType !== void 0 && { ClientPasswordAuthType: a.ClientPasswordAuthType }
 			})),
 			...p.DefaultAuthScheme !== void 0 && { DefaultAuthScheme: p.DefaultAuthScheme },
 			...p.EndpointNetworkType !== void 0 && { EndpointNetworkType: p.EndpointNetworkType },
@@ -55299,4 +55539,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-KPYbVTtY.js.map
+//# sourceMappingURL=provider-classes-CZnJcera.js.map