@cdkd/cli 0.323.0 → 0.326.0

package/dist/{provider-classes-KPYbVTtY.js → provider-classes-D60y4umw.js}

@@ -1,14 +1,14 @@
-import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWpHZk2l.js";
+import { d as withApiGatewayPacing, l as s3ClientDefaults, r as getAwsClients } from "./aws-clients-ez_oXu6x.js";
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
-import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-CmrPwGge.js";
+import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-DMf6WEao.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as isTtlRateLimited, $i as stringifyIfAssigned, A as resolvedResourceTimeoutMs, Aa as reEnableInstanceApiTermination, Ac as sameLambdaFunctionAddress, B as DELETE_INDEX_WAIT_PROCEED_NOTE, C as planContributorInsightsOp, Ca as withIndeterminateGuard, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Cl as recoverMaskedOutput, D as reverseMapTableContributorInsights, Da as isTerminationProtectionPropagationError, Dc as emrClusterInstancesReplaced, Dt as enclosingDeadlineRemainingMs, E as reverseMapIndexContributorInsights, Ea as ec2InstanceProtectionSite, Ec as ecsServiceLaunchTypeSetOrChanged, Et as enclosingDeadlineExpired, F as beginDeleteWait, Fi as earliestDefined, G as relayedIndexBusyDelete, Ga as s3BucketRegionalDomainName, Gi as DBPROXY_TAGS_WHAT, Gn as getCurrentProducerRegions, Gs as withheldAccountClause, H as TABLE_INDEX_NOUN, Ha as s3BucketArn, Hc as passedNoEchoParametersOf, Hr as awaitInFlightSibling, I as compensateRemovedDeletionProtection, Id as describeFileReadFailure, J as readbackVectorIndexes, Jc as markSameGenerationBag, Ji as readTagList, Jn as isRedactedRecordedValue, Js as findSdkUnwiredProperties, K as waitForIndexesSettled, Ka as s3BucketWebsiteUrl, Ki as DBPROXY_TAG_OPTIONS, Kr as replacedDeleteFailureVerdict, L as deleteBudgetKey, Ld as displayAssemblyPath, Li as reserveStackCreateToken, M as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Na as isUsableAttemptedName, Ns as refuseMalformedResourcesForDestroy, O as stripIndexContributorInsights, Oa as observeThenDisableInstanceApiTermination, Oc as canonicalLambdaFunctionName, Ol as carriesSecretMask, Oo as parseWebACLArn, P as DYNAMODB_DELETE_POLL_COST_MS, Q as isTtlAlreadyDisabled, Qi as definedAttributes, Qt as withNestedStackContext, R as resolveDynamoDbDeleteBudgetClock, Rd as renderAssemblyPathEscape, Ro as accountArgs, S as indexDeclaresContributorInsights, Sa as deleteSkipReason, Sd as canonicalizeRegion, Si as secretNamedAttributeNamesOf, T as readContributorInsightsSpec, Tl as recordAttributeIdCopy, U as deleteTableWithIndexBusyRetry, Ua as s3BucketDomainName, Ui as isRefusedByName, V as INDEX_SETTLE_POLL_INTERVAL_MS, Va as isSettledInstanceState, Vr as refuseRestoreFromItself, W as maskedLogger, Wa as s3BucketDualStackDomainName, Wi as markDeleteStarted, Wr as getStackRecords, Wt as getNestedRevertRun, X as vectorIndexesSettled, Xc as recordReferenceProvenanceEntry, Xi as tagMapAsList, Xn as redactedDeleteAddressSkip, Xs as withoutSdkUnwiredProperties, Y as vectorIndexesForCreate, Yc as redactForState, Yi as refuseMalformedDesiredTags, Yn as redactedDeleteAddressFields, Z as vectorIndexesShapeDetail, Za as outputReferenceProvenanceOf, Zc as snapshotPassProvenance, Zi as tagPlanWarning, Zt as getCurrentNestedStackContext, _ as streamMemberRefusals, _a as unchangedBehindSecretReference, _c as requireConfigArray, _o as getAccountInfo, _t as findNestedTemplateTreeDefect, aa as waitForLambdaFunctionActive, ac as WARM_THROUGHPUT_MEMBERS, at as hasCdkAutoDeleteTag, b as CONTRIBUTOR_INSIGHTS_KEY, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, c as DynamoDBGlobalTableProvider, cc as toCfnInteger, cn as chunks, ct as markRefusedBeforeApplying, d as declaredStreamPolicyMember, dc as coerceCfnInteger, dn as withApiLimit, el as hasMaskableValues, et as planTimeToLive, f as declaredStreamTagsMember, fc as configBooleanRefusal, fu as timePhase, g as streamDeclaresTags, ga as onlySecretReferencesDiffer, gc as replayWarn, gl as dynamicReferenceTokens, h as streamDeclaresPolicy, ha as slowCcOperationTimeoutMs, hc as readConfigString, hu as stringifyValue, it as S3_AUTO_DELETE_OBJECTS_TAG, jo as passedParameterClassesOf, k as waitForGoneAfterDelete, ka as reDisableInstanceApiTermination, kc as lambdaFunctionNameForMask, l as STREAM_POLICY_KEY, la as getCurrentResourceSecrets, lc as toFiniteNumber, ln as isAccessDeniedError, m as reverseMapStreamPolicy, mc as configStringRefusal, ml as withoutPhysicalNameCopies, nt as sendTtlWaitingOutRateLimit, oc as coerceWarmThroughput$1, ot as isTruthyCfnBoolean, p as planStreamMemberOps, pc as configIntegerRefusal, ps as refuseMalformedNestedChildOutputs, q as planVectorIndexUpdates, qi as planTagDiff, qn as REDACTED_DELETE_ADDRESS_SKIP_REASON, qt as revertNestedChildFromJournal, rt as ECR_AUTO_DELETE_IMAGES_TAG, sc as isWarmThroughputDecrease, st as getPriorAttempts, t as DeployEngine, tt as readTtlSpec, u as STREAM_TAGS_KEY, uc as coerceCfnBoolean, un as lookupEachName, v as streamPolicyMatchesDeclared, vc as requireConfigObject, vt as isAbsoluteAssetPath, w as planIndexContributorInsightsOps, wc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, wl as physicalNameCopiesOf, x as contributorInsightsRefusals, y as streamTagsMatchDeclared, yc as requireConfigString, yd as decodeListingKey, yt as listNestedTemplateRows, z as resolveDynamoDbDeleteBudgetMs, zd as resolveAssemblyPath, zi as acquireIdempotencyToken } from "./deploy-engine-dYZ0v6Kz.js";
-import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-Bp4osNrj.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, t as canonicalizeIpv4Cidr } from "./program-BYT8z2ca.js";
-import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DCLA_p9I.js";
-import { RDSProvider } from "./rds-provider-C8enyD9d.js";
-import { NeptuneProvider } from "./neptune-provider-BqtKFZaE.js";
-import { ASGProvider } from "./asg-provider-4rNFSmz9.js";
+import { $ as isTtlRateLimited, $i as stringifyIfAssigned, A as resolvedResourceTimeoutMs, Aa as reEnableInstanceApiTermination, Ac as sameLambdaFunctionAddress, B as DELETE_INDEX_WAIT_PROCEED_NOTE, C as planContributorInsightsOp, Ca as withIndeterminateGuard, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Cl as recoverMaskedOutput, D as reverseMapTableContributorInsights, Da as isTerminationProtectionPropagationError, Dc as emrClusterInstancesReplaced, Dt as enclosingDeadlineRemainingMs, E as reverseMapIndexContributorInsights, Ea as ec2InstanceProtectionSite, Ec as ecsServiceLaunchTypeSetOrChanged, Et as enclosingDeadlineExpired, F as beginDeleteWait, Fi as earliestDefined, G as relayedIndexBusyDelete, Ga as s3BucketRegionalDomainName, Gi as DBPROXY_TAGS_WHAT, Gn as getCurrentProducerRegions, Gs as withheldAccountClause, H as TABLE_INDEX_NOUN, Ha as s3BucketArn, Hc as passedNoEchoParametersOf, Hr as awaitInFlightSibling, I as compensateRemovedDeletionProtection, Id as describeFileReadFailure, J as readbackVectorIndexes, Jc as markSameGenerationBag, Ji as readTagList, Jn as isRedactedRecordedValue, Js as findSdkUnwiredProperties, K as waitForIndexesSettled, Ka as s3BucketWebsiteUrl, Ki as DBPROXY_TAG_OPTIONS, Kr as replacedDeleteFailureVerdict, L as deleteBudgetKey, Ld as displayAssemblyPath, Li as reserveStackCreateToken, M as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Na as isUsableAttemptedName, Ns as refuseMalformedResourcesForDestroy, O as stripIndexContributorInsights, Oa as observeThenDisableInstanceApiTermination, Oc as canonicalLambdaFunctionName, Ol as carriesSecretMask, Oo as parseWebACLArn, P as DYNAMODB_DELETE_POLL_COST_MS, Q as isTtlAlreadyDisabled, Qi as definedAttributes, Qt as withNestedStackContext, R as resolveDynamoDbDeleteBudgetClock, Rd as renderAssemblyPathEscape, Ro as accountArgs, S as indexDeclaresContributorInsights, Sa as deleteSkipReason, Sd as canonicalizeRegion, Si as secretNamedAttributeNamesOf, T as readContributorInsightsSpec, Tl as recordAttributeIdCopy, U as deleteTableWithIndexBusyRetry, Ua as s3BucketDomainName, Ui as isRefusedByName, V as INDEX_SETTLE_POLL_INTERVAL_MS, Va as isSettledInstanceState, Vr as refuseRestoreFromItself, W as maskedLogger, Wa as s3BucketDualStackDomainName, Wi as markDeleteStarted, Wr as getStackRecords, Wt as getNestedRevertRun, X as vectorIndexesSettled, Xc as recordReferenceProvenanceEntry, Xi as tagMapAsList, Xn as redactedDeleteAddressSkip, Xs as withoutSdkUnwiredProperties, Y as vectorIndexesForCreate, Yc as redactForState, Yi as refuseMalformedDesiredTags, Yn as redactedDeleteAddressFields, Z as vectorIndexesShapeDetail, Za as outputReferenceProvenanceOf, Zc as snapshotPassProvenance, Zi as tagPlanWarning, Zt as getCurrentNestedStackContext, _ as streamMemberRefusals, _a as unchangedBehindSecretReference, _c as requireConfigArray, _o as getAccountInfo, _t as findNestedTemplateTreeDefect, aa as waitForLambdaFunctionActive, ac as WARM_THROUGHPUT_MEMBERS, at as hasCdkAutoDeleteTag, b as CONTRIBUTOR_INSIGHTS_KEY, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, c as DynamoDBGlobalTableProvider, cc as toCfnInteger, cn as chunks, ct as markRefusedBeforeApplying, d as declaredStreamPolicyMember, dc as coerceCfnInteger, dn as withApiLimit, el as hasMaskableValues, et as planTimeToLive, f as declaredStreamTagsMember, fc as configBooleanRefusal, fu as timePhase, g as streamDeclaresTags, ga as onlySecretReferencesDiffer, gc as replayWarn, gl as dynamicReferenceTokens, h as streamDeclaresPolicy, ha as slowCcOperationTimeoutMs, hc as readConfigString, hu as stringifyValue, it as S3_AUTO_DELETE_OBJECTS_TAG, jo as passedParameterClassesOf, k as waitForGoneAfterDelete, ka as reDisableInstanceApiTermination, kc as lambdaFunctionNameForMask, l as STREAM_POLICY_KEY, la as getCurrentResourceSecrets, lc as toFiniteNumber, ln as isAccessDeniedError, m as reverseMapStreamPolicy, mc as configStringRefusal, ml as withoutPhysicalNameCopies, nt as sendTtlWaitingOutRateLimit, oc as coerceWarmThroughput$1, ot as isTruthyCfnBoolean, p as planStreamMemberOps, pc as configIntegerRefusal, ps as refuseMalformedNestedChildOutputs, q as planVectorIndexUpdates, qi as planTagDiff, qn as REDACTED_DELETE_ADDRESS_SKIP_REASON, qt as revertNestedChildFromJournal, rt as ECR_AUTO_DELETE_IMAGES_TAG, sc as isWarmThroughputDecrease, st as getPriorAttempts, t as DeployEngine, tt as readTtlSpec, u as STREAM_TAGS_KEY, uc as coerceCfnBoolean, un as lookupEachName, v as streamPolicyMatchesDeclared, vc as requireConfigObject, vt as isAbsoluteAssetPath, w as planIndexContributorInsightsOps, wc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, wl as physicalNameCopiesOf, x as contributorInsightsRefusals, y as streamTagsMatchDeclared, yc as requireConfigString, yd as decodeListingKey, yt as listNestedTemplateRows, z as resolveDynamoDbDeleteBudgetMs, zd as resolveAssemblyPath, zi as acquireIdempotencyToken } from "./deploy-engine-l-wZygYT.js";
+import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-CJBhHr7l.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, t as canonicalizeIpv4Cidr } from "./program-ml6yCB64.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-2tRANTVg.js";
+import { RDSProvider } from "./rds-provider-C6299G23.js";
+import { NeptuneProvider } from "./neptune-provider-D4a9cJ2i.js";
+import { ASGProvider } from "./asg-provider-D1KLOLzB.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -16,7 +16,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionConfigurationCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionScalingConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PublishVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutFunctionScalingConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, GetIpamPoolAllocationsCommand, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifyPrivateDnsNameOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateDeploymentCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -3720,6 +3720,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const holder = this.createClientHolder;
 		holder.client ??= this.s3Client.config.region().then((region) => withoutServerErrorRetries(new S3Client({
 			...clientDefaultsFor(this.credentialConfig),
+			...s3ClientDefaults(),
 			region
 		})), (error) => {
 			holder.client = void 0;
@@ -10033,6 +10034,11 @@ const ARN_SERVICE_TO_EVENT_SOURCE_KIND = {
 	mq: "mq",
 	rds: "documentdb"
 };
+function enabledFromState(state, properties) {
+	if (state === "Enabled" || state === "Enabling") return true;
+	if (state === "Disabled" || state === "Disabling") return false;
+	return coerceCfnBoolean(properties?.["Enabled"]) ?? true;
+}
 function classifyEventSource(resp) {
 	if (resp.SelfManagedEventSource !== void 0) return "kafka";
 	if (resp.SelfManagedKafkaEventSourceConfig !== void 0) return "kafka";
@@ -10589,7 +10595,7 @@ var LambdaEventSourceMappingProvider = class {
 			const date = raw instanceof Date ? raw : new Date(raw);
 			result["StartingPositionTimestamp"] = Math.floor(date.getTime() / 1e3);
 		}
-		if (resp.State !== void 0) result["Enabled"] = resp.State === "Enabled" || resp.State === "Enabling" || resp.State === "Updating";
+		if (resp.State !== void 0) result["Enabled"] = enabledFromState(resp.State, properties);
 		let tags = [];
 		if (resp.EventSourceMappingArn) try {
 			const tagMap = (await this.lambdaClient.send(new ListTagsCommand({ Resource: resp.EventSourceMappingArn }))).Tags ?? {};
@@ -17281,6 +17287,13 @@ const STOPPABLE_INSTANCE_STATES = /* @__PURE__ */ new Set([
 ]);
 const instancesLeftStoppedByCdkd = /* @__PURE__ */ new Set();
 const instanceStoppedAfterStart = /* @__PURE__ */ new WeakSet();
+function instanceStopMembers(plan) {
+	return [
+		plan.instanceType !== void 0 ? "InstanceType" : "",
+		plan.userData !== void 0 ? "UserData" : "",
+		plan.privateDnsNameOptions?.PrivateDnsHostnameType !== void 0 ? "PrivateDnsNameOptions.HostnameType" : ""
+	].filter(Boolean);
+}
 function isRecordedStandIn$1(value) {
 	if (Array.isArray(value)) return value.some(isRecordedStandIn$1);
 	if (value !== null && typeof value === "object") return Object.values(value).some(isRecordedStandIn$1);
@@ -17575,7 +17588,9 @@ function readbackNatZoneAddresses(live, recorded) {
 }
 const EIP_ALLOCATION_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidAllocationID.NotFound"]);
 const INSTANCE_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidInstanceID.NotFound"]);
+const LAUNCHED_INSTANCE_VISIBILITY_ATTEMPTS = 8;
 const VPC_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidVpcID.NotFound"]);
+const IPAM_POOL_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidIpamPoolId.NotFound"]);
 const SUBNET_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidSubnetID.NotFound"]);
 const SECURITY_GROUP_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidGroup.NotFound"]);
 const NAT_GATEWAY_ID_PATTERN = /^nat-[0-9a-f]+$/;
@@ -17597,6 +17612,82 @@ const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
 const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
 const allocateAddressLatch = new AmbiguousCreateLatch("ec2:AllocateAddress");
 const ec2IdsCreatedByThisProcess = new RecentIdSet();
+const vpcIpamReleaseWait = {
+	pollIntervalMs: 1e4,
+	maxWaitMs: 15e5
+};
+const VPC_ENCRYPTION_CONTROL_EXCLUSIONS = [
+	"InternetGatewayExclusion",
+	"EgressOnlyInternetGatewayExclusion",
+	"NatGatewayExclusion",
+	"VirtualPrivateGatewayExclusion",
+	"VpcPeeringExclusion",
+	"LambdaExclusion",
+	"VpcLatticeExclusion",
+	"ElasticFileSystemExclusion"
+];
+function replayedRecordNote(context) {
+	return context?.replayingState === true ? " The value comes from the state record being restored." : "";
+}
+const VPC_CREATE_ONLY_SENT = [
+	"Ipv4IpamPoolId",
+	"Ipv4NetmaskLength",
+	"VpcEncryptionControl"
+];
+const INSTANCE_CREATE_ONLY_SENT = [
+	"CpuOptions",
+	"HibernationOptions",
+	"PlacementGroupName",
+	"PrivateIpAddress",
+	"Ipv6AddressCount",
+	"Ipv6Addresses"
+];
+function instanceIpv6AddressesRefusal(value, resourceType) {
+	if (value === void 0 || value === null) return void 0;
+	if (!Array.isArray(value)) return `${resourceType}.Ipv6Addresses must be a list of { Ipv6Address } entries (got ${typeof value === "object" ? "an object" : `a ${typeof value}`})`;
+	for (const [i, item] of value.entries()) {
+		const path = `${resourceType}.Ipv6Addresses[${i}]`;
+		const refusal = item === void 0 || item === null ? `${path} must be an object (got ${item === null ? "null" : "undefined"})` : configStringRefusal(item, "Ipv6Address", "", path);
+		if (refusal !== void 0) return refusal;
+		const address = item["Ipv6Address"];
+		if (typeof address !== "string" || address === "") return `${path}.Ipv6Address is required (the address to assign)`;
+	}
+}
+function privateDnsNameOptionsRefusal(value, resourceType) {
+	const path = `${resourceType}.PrivateDnsNameOptions`;
+	if (value !== null && typeof value === "object" && !Array.isArray(value) && value["HostnameType"] === "") return `${path}.HostnameType must not be empty`;
+	return configStringRefusal(value, "HostnameType", "", path) ?? configBooleanRefusal(value, "EnableResourceNameDnsARecord", path) ?? configBooleanRefusal(value, "EnableResourceNameDnsAAAARecord", path);
+}
+function privateDnsNameOptionsRequest(value) {
+	if (value === void 0 || value === null) return void 0;
+	const block = value;
+	const hostnameType = block["HostnameType"];
+	const aRecord = coerceCfnBoolean(block["EnableResourceNameDnsARecord"]);
+	const aaaaRecord = coerceCfnBoolean(block["EnableResourceNameDnsAAAARecord"]);
+	return {
+		...typeof hostnameType === "string" && hostnameType !== "" && { HostnameType: hostnameType },
+		...aRecord !== void 0 && { EnableResourceNameDnsARecord: aRecord },
+		...aaaaRecord !== void 0 && { EnableResourceNameDnsAAAARecord: aaaaRecord }
+	};
+}
+function foldCreateOnlySent(key, value) {
+	const asRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+	if (key === "Ipv4NetmaskLength") return coerceCfnInteger(value) ?? value;
+	if (key === "CpuOptions") {
+		const cpu = asRecord(value);
+		if (cpu === void 0) return value;
+		return Object.fromEntries(Object.entries(cpu).map(([k, v]) => [k, coerceCfnInteger(v) ?? v]));
+	}
+	if (key === "HibernationOptions") {
+		const hibernation = asRecord(value);
+		if (hibernation === void 0) return value;
+		return Object.fromEntries(Object.entries(hibernation).map(([k, v]) => [k, coerceCfnBoolean(v) ?? v]));
+	}
+	return value;
+}
+function sameCreateOnlySent(key, a, b) {
+	return isDeepStrictEqual(foldCreateOnlySent(key, a), foldCreateOnlySent(key, b));
+}
 const mayBeLostCreate = (tags, sent) => tags === void 0 || tags.length === 0 || sent.length > 0 && tagListsMatch(tags, sent);
 const lostCreateNoun = (what, sent, adjective) => sent.length === 0 ? `${adjective !== void 0 ? `${adjective}, ` : ""}untagged ${what}` : `${adjective !== void 0 ? `${adjective} ` : ""}${what} with no tags or exactly the template's tags`;
 function isCreateTagsDenial(error) {
@@ -17624,7 +17715,10 @@ var EC2Provider = class {
 			"InstanceTenancy",
 			"EnableDnsHostnames",
 			"EnableDnsSupport",
-			"Tags"
+			"Tags",
+			"Ipv4IpamPoolId",
+			"Ipv4NetmaskLength",
+			"VpcEncryptionControl"
 		])],
 		["AWS::EC2::Subnet", /* @__PURE__ */ new Set([
 			"VpcId",
@@ -17716,7 +17810,19 @@ var EC2Provider = class {
 			"MetadataOptions",
 			"Monitoring",
 			"EbsOptimized",
-			"CreditSpecification"
+			"CreditSpecification",
+			"CpuOptions",
+			"HibernationOptions",
+			"InstanceInitiatedShutdownBehavior",
+			"SourceDestCheck",
+			"Tenancy",
+			"PlacementGroupName",
+			"PrivateIpAddress",
+			"PropagateTagsToVolumeOnCreation",
+			"AdditionalInfo",
+			"Ipv6AddressCount",
+			"Ipv6Addresses",
+			"PrivateDnsNameOptions"
 		])],
 		["AWS::EC2::NetworkAcl", /* @__PURE__ */ new Set(["VpcId", "Tags"])],
 		["AWS::EC2::NetworkAclEntry", /* @__PURE__ */ new Set([
@@ -17732,7 +17838,7 @@ var EC2Provider = class {
 		])],
 		["AWS::EC2::SubnetNetworkAclAssociation", /* @__PURE__ */ new Set(["SubnetId", "NetworkAclId"])]
 	]);
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])], ["AWS::EC2::Instance", /* @__PURE__ */ new Map([["Monitoring", false]])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])], ["AWS::EC2::Instance", /* @__PURE__ */ new Map([["Monitoring", false], ["SourceDestCheck", true]])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([
 		["AWS::EC2::Instance", /* @__PURE__ */ new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
 		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
@@ -17775,27 +17881,75 @@ var EC2Provider = class {
 			inspect: (id) => lookup.inspect(aws, id, regionArg)
 		});
 	}
-	async reportPossibleOrphanVpcs(logicalId, cidrBlock, sent, window, context) {
+	async reportPossibleOrphanVpcs(logicalId, match, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
-		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
+		const wanted = "cidrBlock" in match ? canonicalizeIpv4Cidr(match.cidrBlock) ?? match.cidrBlock : void 0;
+		const listVpcs = async (inPool) => collectOrphanIds(async (token) => {
+			const page = await this.ec2Client.send(new DescribeVpcsCommand({
+				MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+				NextToken: token
+			}));
+			return {
+				items: page.Vpcs ?? [],
+				next: page.NextToken
+			};
+		}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && mayBeLostCreate(vpc.Tags, sent) && vpc.CidrBlock !== void 0 && (inPool !== void 0 ? inPool.has(vpc.VpcId) : (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted) && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0);
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateVpc",
-			listAction: "DescribeVpcs",
-			subject: `a VPC with CIDR ${log.value(cidrBlock)}`,
+			listAction: "cidrBlock" in match ? "DescribeVpcs" : "GetIpamPoolAllocations + DescribeVpcs",
+			subject: "cidrBlock" in match ? `a VPC with CIDR ${log.value(match.cidrBlock)}` : `a VPC allocated from IPAM pool ${log.value(match.ipamPoolId)}`,
 			noun: lostCreateNoun("VPC(s)", sent),
-			list: () => collectOrphanIds(async (token) => {
-				const page = await this.ec2Client.send(new DescribeVpcsCommand({
-					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
-					NextToken: token
-				}));
+			list: async () => {
+				if ("cidrBlock" in match) return listVpcs(void 0);
+				const allocated = await collectOrphanIds(async (token) => {
+					const page = await this.ec2Client.send(new GetIpamPoolAllocationsCommand({
+						IpamPoolId: match.ipamPoolId,
+						NextToken: token
+					}));
+					return {
+						items: page.IpamPoolAllocations ?? [],
+						next: page.NextToken
+					};
+				}, (allocation) => allocation.ResourceType === "vpc" && allocation.ResourceId !== void 0 ? allocation.ResourceId : void 0);
+				const vpcs = await listVpcs(new Set(allocated.ids));
 				return {
-					items: page.Vpcs ?? [],
-					next: page.NextToken
+					ids: vpcs.ids,
+					truncated: allocated.truncated || vpcs.truncated
 				};
-			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && mayBeLostCreate(vpc.Tags, sent) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
+			},
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-vpcs --vpc-ids ${id}${regionArg}`.render()
 		});
 	}
+	readVpcIpamAllocation(properties, resourceType, logicalId, context) {
+		const refusal = configStringRefusal(properties, "Ipv4IpamPoolId", "", resourceType) ?? (properties["Ipv4IpamPoolId"] === "" ? `${resourceType}.Ipv4IpamPoolId must not be blank` : void 0) ?? configIntegerRefusal(properties, "Ipv4NetmaskLength", resourceType, 0, 32);
+		if (refusal !== void 0) throw markNonRetryable(new ProvisioningError(`${refusal}. The VPC ${logicalId} was not created.${replayedRecordNote(context)}`, resourceType, logicalId));
+		const poolId = properties["Ipv4IpamPoolId"];
+		const netmaskLength = coerceCfnInteger(properties["Ipv4NetmaskLength"]);
+		return {
+			...typeof poolId === "string" && poolId !== "" && { poolId },
+			...netmaskLength !== void 0 && { netmaskLength }
+		};
+	}
+	buildVpcEncryptionControl(value, resourceType, logicalId, context) {
+		if (value === void 0 || value === null) return void 0;
+		const path = `${resourceType} VpcEncryptionControl`;
+		const refuse = (reason) => {
+			throw markNonRetryable(new ProvisioningError(`${reason}. The VPC ${logicalId} was not created.${replayedRecordNote(context)}`, resourceType, logicalId));
+		};
+		const containerRefusal = configStringRefusal(value, "Mode", "", path);
+		if (containerRefusal !== void 0) return refuse(containerRefusal);
+		const block = value;
+		const mode = block["Mode"];
+		if (mode === "") return refuse(`${path}.Mode must not be blank`);
+		const config = { Mode: typeof mode === "string" ? mode : void 0 };
+		for (const key of VPC_ENCRYPTION_CONTROL_EXCLUSIONS) {
+			const memberRefusal = configStringRefusal(block, key, "", path);
+			if (memberRefusal !== void 0) return refuse(memberRefusal);
+			const member = block[key];
+			if (typeof member === "string" && member !== "") config[key] = member;
+		}
+		return config;
+	}
 	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
@@ -17917,7 +18071,7 @@ var EC2Provider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::EC2::VPC": return this.deleteVpc(logicalId, physicalId, resourceType, context);
+			case "AWS::EC2::VPC": return this.deleteVpc(logicalId, physicalId, resourceType, context, properties);
 			case "AWS::EC2::Subnet": return this.deleteSubnet(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::InternetGateway": return this.deleteInternetGateway(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::EIP": return this.deleteEip(logicalId, physicalId, resourceType, context);
@@ -18072,18 +18226,24 @@ var EC2Provider = class {
 		this.logger.debug(`Creating VPC ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const cidrBlock = properties["CidrBlock"];
-		if (!cidrBlock) throw new ProvisioningError(`CidrBlock is required for VPC ${logicalId}`, resourceType, logicalId);
+		const ipamAllocation = this.readVpcIpamAllocation(properties, resourceType, logicalId, context);
+		if (!cidrBlock && ipamAllocation.poolId === void 0) throw new ProvisioningError(`CidrBlock or Ipv4IpamPoolId is required for VPC ${logicalId}`, resourceType, logicalId);
+		const encryptionControl = this.buildVpcEncryptionControl(properties["VpcEncryptionControl"], resourceType, logicalId, context);
+		const orphanMatch = cidrBlock ? { cidrBlock } : { ipamPoolId: ipamAllocation.poolId };
 		let leftBehindId;
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createVpcLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, orphanMatch, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
 			let tagsApplied;
 			try {
 				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "vpc", desiredTags, (TagSpecifications) => createClient.send(new CreateVpcCommand({
-					CidrBlock: cidrBlock,
+					...cidrBlock ? { CidrBlock: cidrBlock } : {},
+					...ipamAllocation.poolId !== void 0 && { Ipv4IpamPoolId: ipamAllocation.poolId },
+					...ipamAllocation.netmaskLength !== void 0 && { Ipv4NetmaskLength: ipamAllocation.netmaskLength },
+					...encryptionControl !== void 0 && { VpcEncryptionControl: encryptionControl },
 					InstanceTenancy: properties["InstanceTenancy"] ?? void 0,
 					...TagSpecifications && { TagSpecifications }
 				}))));
@@ -18095,7 +18255,7 @@ var EC2Provider = class {
 			ec2IdsCreatedByThisProcess.add(vpcId);
 			reportCreatedResource(logicalId, resourceType, vpcId);
 			const vpcReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, vpcReplayWindow, context);
+			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, orphanMatch, desiredTags, vpcReplayWindow, context);
 			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -18136,7 +18296,7 @@ var EC2Provider = class {
 				physicalId: vpcId,
 				attributes: definedAttributes({
 					VpcId: vpcId,
-					CidrBlock: cidrBlock,
+					CidrBlock: cidrBlock || response.Vpc?.CidrBlock,
 					DefaultSecurityGroup: defaultSgId
 				})
 			};
@@ -18158,10 +18318,14 @@ var EC2Provider = class {
 			const newTenancy = tenancyOf(properties["InstanceTenancy"]);
 			const oldTenancy = tenancyOf(previousProperties["InstanceTenancy"]);
 			if (newTenancy !== oldTenancy && newTenancy !== "default") throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "destroy + redeploy the VPC (and the resources that depend on it). AWS changes InstanceTenancy in place only to default, and CloudFormation creates a new VPC for this change");
+			const createOnlyChanged = VPC_CREATE_ONLY_SENT.filter((key) => !(key === "Ipv4IpamPoolId" && (properties[key] === void 0 || previousProperties[key] === void 0)) && !sameCreateOnlySent(key, properties[key], previousProperties[key]));
+			if (createOnlyChanged.length > 0) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `destroy + redeploy the VPC (and the resources that depend on it). ${createOnlyChanged.join(", ")} can be set only when the VPC is created, and CloudFormation creates a new VPC for this change`);
 			const asBool = (v) => {
 				if (v === void 0) return void 0;
 				return v === true || v === "true";
 			};
+			const declaredCidr = properties["CidrBlock"];
+			const cidrBlock = typeof declaredCidr === "string" && declaredCidr !== "" ? declaredCidr : properties["Ipv4IpamPoolId"] !== void 0 ? (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] })))?.Vpcs?.[0]?.CidrBlock : void 0;
 			const newDnsHostnames = asBool(properties["EnableDnsHostnames"]);
 			const oldDnsHostnames = asBool(previousProperties["EnableDnsHostnames"]);
 			if (newDnsHostnames !== void 0 && newDnsHostnames !== oldDnsHostnames) await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -18183,10 +18347,10 @@ var EC2Provider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
+				attributes: definedAttributes({
 					VpcId: physicalId,
-					CidrBlock: properties["CidrBlock"]
-				}
+					CidrBlock: cidrBlock
+				})
 			};
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
@@ -18194,12 +18358,13 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async deleteVpc(logicalId, physicalId, resourceType, context) {
+	async deleteVpc(logicalId, physicalId, resourceType, context, properties) {
 		this.logger.debug(`Deleting VPC ${logicalId}: ${physicalId}`);
 		const maxAttempts = 10;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.ec2Client.send(new DeleteVpcCommand({ VpcId: physicalId }));
 			this.logger.debug(`Successfully deleted VPC ${logicalId}`);
+			await this.waitForVpcIpamRelease(physicalId, resourceType, properties, context);
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error) && (context?.failedCreateOrphan !== true || isNamedError(error, VPC_NOT_FOUND_NAMES))) {
@@ -18219,6 +18384,38 @@ var EC2Provider = class {
 			throw this.wrapDeleteError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async waitForVpcIpamRelease(vpcId, resourceType, properties, context) {
+		const poolId = properties?.["Ipv4IpamPoolId"];
+		if (typeof poolId !== "string" || !/^ipam-pool-[0-9a-z]+$/.test(poolId)) return;
+		this.logger.info(maskerOrIdentity(context?.maskSecrets)(safeMsg`  Waiting for IPAM pool ${poolId} to release the allocation of deleted VPC ${vpcId}; AWS can take about 18 minutes, and the pool CIDR cannot be deprovisioned before then`));
+		await waitForGoneAfterDelete({
+			what: maskerOrIdentity(context?.maskSecrets)(`the IPAM pool ${poolId} allocation of VPC ${vpcId}`),
+			resourceType,
+			consequence: "AWS releases the allocation on its side; until it does, the pool refuses to deprovision its CIDR (\"The CIDR has one or more allocations.\"), so re-run the destroy if it stops there.",
+			describe: async () => {
+				try {
+					let token;
+					let pages = 0;
+					do {
+						const page = await this.ec2Client.send(new GetIpamPoolAllocationsCommand({
+							IpamPoolId: poolId,
+							NextToken: token
+						}));
+						if ((page.IpamPoolAllocations ?? []).some((a) => a.ResourceId === vpcId)) return "allocated";
+						token = page.NextToken;
+						pages++;
+					} while (token && pages < 20);
+					return token ? "unknown (allocation listing truncated)" : void 0;
+				} catch (error) {
+					if (isNamedError(error, IPAM_POOL_NOT_FOUND_NAMES)) return void 0;
+					throw error;
+				}
+			},
+			logger: this.logger,
+			pollIntervalMs: vpcIpamReleaseWait.pollIntervalMs,
+			maxWaitMs: vpcIpamReleaseWait.maxWaitMs
+		});
+	}
 	async getVpcAttribute(physicalId, attributeName) {
 		try {
 			switch (attributeName) {
@@ -19941,6 +20138,7 @@ var EC2Provider = class {
 		if (!imageId) throw new ProvisioningError(`ImageId is required for EC2 Instance ${logicalId}`, resourceType, logicalId);
 		const instanceType = requireConfigString(properties["InstanceType"], "t3.micro", "AWS::EC2::Instance InstanceType", replayWarn(this.logger, context));
 		const blockDeviceMappings = this.buildBlockDeviceMappings(properties, logicalId);
+		const launchOnlyOptions = this.buildLaunchOnlyInstanceOptions(properties, resourceType, logicalId);
 		let leftBehindId;
 		try {
 			const securityGroupIds = properties["SecurityGroupIds"];
@@ -19951,8 +20149,12 @@ var EC2Provider = class {
 				scope: "RunInstances",
 				logicalId
 			});
+			const propagateToVolumes = coerceCfnBoolean(properties["PropagateTagsToVolumeOnCreation"]) === true;
 			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "instance", desiredTags, (TagSpecifications) => this.ec2Client.send(new RunInstancesCommand({
-				...TagSpecifications && { TagSpecifications },
+				...TagSpecifications && { TagSpecifications: propagateToVolumes ? [...TagSpecifications, ...TagSpecifications.map((spec) => ({
+					...spec,
+					ResourceType: "volume"
+				}))] : TagSpecifications },
 				ClientToken: runInstancesToken.value,
 				ImageId: imageId,
 				InstanceType: instanceType,
@@ -19974,14 +20176,15 @@ var EC2Provider = class {
 				Monitoring: this.buildRunInstancesMonitoring(properties),
 				MetadataOptions: this.buildMetadataOptions(properties),
 				CreditSpecification: this.buildCreditSpecification(properties),
-				Placement: this.buildPlacement(properties)
+				Placement: this.buildPlacement(properties),
+				...launchOnlyOptions
 			})));
 			const instance = response.Instances?.[0];
 			if (!instance?.InstanceId) throw new Error("No instance ID returned from RunInstances");
 			const instanceId = instance.InstanceId;
 			reportCreatedResource(logicalId, resourceType, instanceId);
 			try {
-				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
+				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets), (call) => this.whileLaunchedInstanceNotVisible(logicalId, instanceId, call));
 				if (process.env["CDKD_NO_WAIT"] !== "true") {
 					this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
 					await waitUntilInstanceRunning({
@@ -19998,7 +20201,16 @@ var EC2Provider = class {
 						this.logger.warn(`Skipped the IAM instance profile association check for ${logicalId} (${instanceId}) because --no-wait leaves the instance in 'pending', where AssociateIamInstanceProfile is rejected. RunInstances associates the profile asynchronously and can complete with NO profile attached when the profile was created moments earlier. Verify with: ${aws`aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=${instanceId}`.render()} — and if it is missing, re-associate with: ` + (profileRef.includes(",") ? WITHHELD_AWS_COMMAND : aws`aws ec2 associate-iam-instance-profile --instance-id ${instanceId} --iam-instance-profile ${iamInstanceProfile.arn ? aws`Arn=${profileRef}` : aws`Name=${profileRef}`}`.render()));
 					} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
 				}
-				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
+				if (coerceCfnBoolean(properties["SourceDestCheck"]) === false) await this.whileLaunchedInstanceNotVisible(logicalId, instanceId, () => this.ec2Client.send(new ModifyInstanceAttributeCommand({
+					InstanceId: instanceId,
+					SourceDestCheck: { Value: false }
+				})));
+				const runningInstance = (await this.whileLaunchedInstanceNotVisible(logicalId, instanceId, () => this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] })))).Reservations?.[0]?.Instances?.[0];
+				if (propagateToVolumes && !tagsApplied && desiredTags.length > 0) {
+					const volumeIds = (runningInstance?.BlockDeviceMappings ?? []).map((m) => m.Ebs?.VolumeId).filter((id) => typeof id === "string" && id !== "");
+					if (volumeIds.length === 0) this.logger.warn(safeMsg`${logicalId}: PropagateTagsToVolumeOnCreation is set, but the launch went out without tags (the tagged RunInstances was refused) and DescribeInstances reported no attached volume for ${instanceId} yet (under --no-wait the instance may still be pending), so its volumes were not tagged. Tag them with ec2:CreateTags once they are attached.`);
+					for (const volumeId of volumeIds) await this.applyTags(volumeId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
+				}
 				const attributes = describedInstanceAttributes(instanceId, runningInstance);
 				this.logger.debug(`Successfully created EC2 Instance ${logicalId}: ${instanceId}`);
 				runInstancesToken.release();
@@ -20188,6 +20400,40 @@ var EC2Provider = class {
 				else throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): InstanceType was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared (set it to the instance's current type to leave it unchanged). The instance was not updated.`, resourceType, logicalId, physicalId));
 			} else if (!standInSkips("InstanceType")) plan.instanceType = requireConfigString(properties["InstanceType"], "", "AWS::EC2::Instance InstanceType");
 		}
+		const createOnlyChanged = INSTANCE_CREATE_ONLY_SENT.filter((key) => changed(key, (a, b) => sameCreateOnlySent(key, a, b)));
+		if (createOnlyChanged.length > 0) throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `replace the instance (cdkd deploy --replace). ${createOnlyChanged.join(", ")} can be set only when the instance is launched, and CloudFormation creates a new instance for this change`));
+		if (changed("Tenancy", (a, b) => a === b) && !standInSkips("Tenancy")) {
+			const before = previousProperties["Tenancy"];
+			const after = properties["Tenancy"];
+			const refusal = configStringRefusal(properties, "Tenancy", "", resourceType);
+			if (refusal !== void 0) throw refusedBeforeApplying(new ProvisioningError(`${refusal}. The instance ${logicalId} was not updated.`, resourceType, logicalId, physicalId));
+			if (before == null && typeof after === "string") plan.tenancyAddition = {
+				value: after,
+				replaying: context?.replayingState === true
+			};
+			else if (typeof before === "string" && typeof after === "string" && before !== "default" && after !== "default") {
+				if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the rollback would change Tenancy ${before} -> ${after}, which cdkd does not apply; the instance keeps its current tenancy.`);
+				else throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, safeMsg`cdkd does not change Tenancy ${before} -> ${after}. How CloudFormation applies a change between two non-default tenancies has not been measured (it may stop the instance and move it rather than replace it), so cdkd neither replaces the instance nor applies the change. Keep the current tenancy, or replace the instance explicitly with cdkd deploy --replace`));
+			} else if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the rollback would change Tenancy (${before === void 0 ? "unset" : before} -> ${after === void 0 ? "unset" : after}), which needs a new instance; the instance keeps its current tenancy.`);
+			else throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, "replace the instance (cdkd deploy --replace). CloudFormation creates a new instance for a Tenancy change to or from default"));
+		}
+		if (changed("InstanceInitiatedShutdownBehavior", (a, b) => a === b)) {
+			if (properties["InstanceInitiatedShutdownBehavior"] === void 0) {
+				if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare InstanceInitiatedShutdownBehavior; the rollback leaves it at its current AWS value.`);
+				else throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): InstanceInitiatedShutdownBehavior was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared (set it to stop, the default, to leave the behavior at AWS's default). The instance was not updated.`, resourceType, logicalId, physicalId));
+			} else if (!standInSkips("InstanceInitiatedShutdownBehavior")) plan.shutdownBehavior = requireConfigString(properties["InstanceInitiatedShutdownBehavior"], "", "AWS::EC2::Instance InstanceInitiatedShutdownBehavior");
+		}
+		const sourceDestCheckOf = (v) => v === void 0 ? true : coerceCfnBoolean(v);
+		if (changed("SourceDestCheck", (a, b) => sourceDestCheckOf(a) === sourceDestCheckOf(b)) && !standInSkips("SourceDestCheck")) {
+			const raw = properties["SourceDestCheck"];
+			const want = raw === void 0 ? true : coerceCfnBoolean(raw);
+			if (want === void 0) {
+				const refusal = configBooleanRefusal(properties, "SourceDestCheck", resourceType);
+				if (context?.replayingState === true || context?.desiredFromAwsReadback === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${refusal ?? "SourceDestCheck is not a boolean"}; it is left at its current AWS value.`);
+				else throw refusedBeforeApplying(new ProvisioningError(`${refusal ?? `${resourceType}.SourceDestCheck must be a boolean`}. The instance ${logicalId} was not updated.`, resourceType, logicalId, physicalId));
+			} else plan.sourceDestCheck = want;
+		}
+		this.planPrivateDnsNameOptions(logicalId, physicalId, resourceType, properties, previousProperties, context, plan, changed, standInSkips);
 		if (changed("UserData", (a, b) => a === b)) {
 			const userData = properties["UserData"];
 			if (userData === void 0) plan.userData = /* @__PURE__ */ new Uint8Array(0);
@@ -20240,14 +20486,64 @@ var EC2Provider = class {
 		}
 		return plan;
 	}
+	planPrivateDnsNameOptions(logicalId, physicalId, resourceType, properties, previousProperties, context, plan, changed, standInSkips) {
+		const KEY = "PrivateDnsNameOptions";
+		const readable = (v) => v != null && privateDnsNameOptionsRefusal(v, resourceType) === void 0 ? privateDnsNameOptionsRequest(v) ?? {} : {};
+		const sameOptions = (a, b) => a != null && b != null && privateDnsNameOptionsRefusal(a, resourceType) === void 0 && privateDnsNameOptionsRefusal(b, resourceType) === void 0 && isDeepStrictEqual(readable(a), readable(b));
+		if (!changed(KEY, sameOptions)) return;
+		const replaying = context?.replayingState === true;
+		const after = properties[KEY];
+		if (after === void 0 || after === null) {
+			if (replaying) {
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare PrivateDnsNameOptions, which needs a new instance; the rollback leaves the instance's hostname options as they are.`);
+				return;
+			}
+			throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, "replace the instance (cdkd deploy --replace). CloudFormation creates a new instance when PrivateDnsNameOptions is removed"));
+		}
+		if (standInSkips(KEY)) return;
+		const refusal = privateDnsNameOptionsRefusal(after, resourceType);
+		if (refusal !== void 0) {
+			if (replaying || context?.desiredFromAwsReadback === true) {
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${refusal}; the hostname options are left at their current AWS value.`);
+				return;
+			}
+			throw refusedBeforeApplying(new ProvisioningError(`${refusal}. The instance ${logicalId} was not updated.`, resourceType, logicalId, physicalId));
+		}
+		const want = readable(after);
+		const had = readable(previousProperties[KEY]);
+		const request = {};
+		if (want.HostnameType !== void 0 && want.HostnameType !== had.HostnameType) request.PrivateDnsHostnameType = want.HostnameType;
+		for (const member of ["EnableResourceNameDnsARecord", "EnableResourceNameDnsAAAARecord"]) if (want[member] !== void 0 && want[member] !== had[member]) request[member] = want[member];
+		const removedMembers = context?.desiredFromAwsReadback === true ? "" : Object.keys(had).filter((m) => want[m] === void 0).join(", ");
+		if (removedMembers !== "") {
+			if (!replaying) throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): PrivateDnsNameOptions ${removedMembers} was removed from the template, and CloudFormation fails that update ("No valid attributes specified"). Keep it declared (set it to the value the instance has to leave it unchanged), or remove the whole PrivateDnsNameOptions block, which replaces the instance. The instance was not updated.`, resourceType, logicalId, physicalId));
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare PrivateDnsNameOptions ${removedMembers}; the rollback leaves it at its current AWS value.`);
+		}
+		if (Object.keys(request).length > 0) plan.privateDnsNameOptions = request;
+	}
 	async prepareInstanceMemberUpdates(logicalId, physicalId, resourceType, plan) {
-		const needsStop = plan.instanceType !== void 0 || plan.userData !== void 0;
 		const needsDefaultGroup = plan.securityGroups?.kind === "vpc-default";
-		if (!needsStop && !needsDefaultGroup) return;
+		const tenancy = plan.tenancyAddition;
+		if (instanceStopMembers(plan).length === 0 && !needsDefaultGroup && tenancy === void 0) return;
 		const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
+		const dns = plan.privateDnsNameOptions;
+		if (dns?.PrivateDnsHostnameType !== void 0 && instance?.PrivateDnsNameOptions?.HostnameType === dns.PrivateDnsHostnameType) {
+			const { PrivateDnsHostnameType: _sameAsLive, ...rest } = dns;
+			if (Object.keys(rest).length > 0) plan.privateDnsNameOptions = rest;
+			else delete plan.privateDnsNameOptions;
+		}
+		const stopMembers = instanceStopMembers(plan);
+		const needsStop = stopMembers.length > 0;
+		if (tenancy !== void 0) {
+			const live = instance?.Placement?.Tenancy;
+			if (live !== tenancy.value) {
+				if (tenancy.replaying) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored declares Tenancy ${tenancy.value}, but the instance has ${live ?? "an unreadable tenancy"}; the rollback leaves it as it is.`);
+				else throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, safeMsg`the template declares Tenancy ${tenancy.value}, the instance has ${live ?? "a tenancy DescribeInstances did not report"}, and the state record does not say which tenancy it was launched with. Changing it needs a new instance: replace it with cdkd deploy --replace, or declare Tenancy ${live ?? "as the instance has it"}`));
+			}
+		}
 		if (needsStop) {
-			const members = [plan.instanceType !== void 0 ? "InstanceType" : "", plan.userData !== void 0 ? "UserData" : ""].filter(Boolean).join(" and ");
-			if (instance?.RootDeviceType === "instance-store") throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `${members} can change only on a stopped instance, and an instance-store-backed instance cannot be stopped; CloudFormation replaces it. Re-deploy with cdkd deploy --replace.`));
+			const members = stopMembers.join(" and ");
+			if (instance?.RootDeviceType === "instance-store") throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `${members} can change only on a stopped instance, and an instance-store-backed instance cannot be stopped; ${plan.instanceType !== void 0 || plan.userData !== void 0 ? "CloudFormation replaces it" : "it needs a new instance"}. Re-deploy with cdkd deploy --replace.`));
 			const state = instance?.State?.Name;
 			if (!STOPPABLE_INSTANCE_STATES.has(state ?? "")) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} is ${state ?? "not returned by DescribeInstances"}, so its ${members} cannot be changed. The instance was not updated.`, resourceType, logicalId, physicalId));
 		}
@@ -20279,7 +20575,31 @@ var EC2Provider = class {
 			}));
 			applied.push("the new DeleteOnTermination");
 		}
-		if (plan.instanceType === void 0 && plan.userData === void 0) {
+		if (plan.shutdownBehavior !== void 0) {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				InstanceInitiatedShutdownBehavior: { Value: plan.shutdownBehavior }
+			}));
+			applied.push("the new InstanceInitiatedShutdownBehavior");
+		}
+		if (plan.sourceDestCheck !== void 0) {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				SourceDestCheck: { Value: plan.sourceDestCheck }
+			}));
+			applied.push("the new SourceDestCheck");
+		}
+		const dns = plan.privateDnsNameOptions;
+		if (dns !== void 0 && dns.PrivateDnsHostnameType === void 0) {
+			await this.ec2Client.send(new ModifyPrivateDnsNameOptionsCommand({
+				InstanceId: physicalId,
+				...dns
+			}));
+			applied.push("the new PrivateDnsNameOptions");
+		}
+		const stopMembers = instanceStopMembers(plan);
+		const stopWhat = stopMembers.join(" / ");
+		if (stopMembers.length === 0) {
 			if (instancesLeftStoppedByCdkd.has(physicalId)) {
 				let state = await this.readInstanceState(physicalId);
 				if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
@@ -20291,13 +20611,13 @@ var EC2Provider = class {
 		let state = await this.readInstanceState(physicalId);
 		if (state === "pending") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "running");
 		else if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
-		if (state !== "stopped" && state !== "running") throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} became ${state ?? "not returned by DescribeInstances"} during the update, so its InstanceType / UserData were not changed`, resourceType, logicalId, physicalId));
+		if (state !== "stopped" && state !== "running") throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} became ${state ?? "not returned by DescribeInstances"} during the update, so its ${stopWhat} were not changed`, resourceType, logicalId, physicalId));
 		const startAfter = state === "running" || instancesLeftStoppedByCdkd.has(physicalId);
 		let phase = "stop";
 		let stopIssued = false;
 		try {
 			if (state === "running") {
-				this.logger.info(safeMsg`Stopping EC2 Instance ${logicalId} (${physicalId}) to change its ${plan.instanceType !== void 0 ? "InstanceType" : ""}${plan.instanceType !== void 0 && plan.userData !== void 0 ? " and " : ""}${plan.userData !== void 0 ? "UserData" : ""}; it is started again afterwards`);
+				this.logger.info(safeMsg`Stopping EC2 Instance ${logicalId} (${physicalId}) to change its ${stopMembers.join(" and ")}; it is started again afterwards`);
 				await this.ec2Client.send(new StopInstancesCommand({ InstanceIds: [physicalId] }));
 				stopIssued = true;
 				await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
@@ -20317,6 +20637,13 @@ var EC2Provider = class {
 				}));
 				applied.push("the new UserData");
 			}
+			if (dns?.PrivateDnsHostnameType !== void 0) {
+				await this.ec2Client.send(new ModifyPrivateDnsNameOptionsCommand({
+					InstanceId: physicalId,
+					...dns
+				}));
+				applied.push("the new PrivateDnsNameOptions");
+			}
 			if (!startAfter) return;
 			phase = "start";
 			await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
@@ -20348,15 +20675,15 @@ var EC2Provider = class {
 				}
 				if (startFailure === void 0) {
 					instancesLeftStoppedByCdkd.delete(physicalId);
-					this.logger.warn(safeMsg`${logicalId}: the InstanceType / UserData change failed after instance ${physicalId} was stopped; cdkd started it again, with ${carries}.`);
+					this.logger.warn(safeMsg`${logicalId}: the ${stopWhat} change failed after instance ${physicalId} was stopped; cdkd started it again, with ${carries}.`);
 				} else {
 					instancesLeftStoppedByCdkd.add(physicalId);
-					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} was stopped for an InstanceType / UserData change that failed, and starting it again failed too (${describeAwsFailure(startFailure).summary}); it is stopped, with ${carries}. Start it with: ${startCommand}`);
+					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} was stopped for a ${stopWhat} change that failed, and starting it again failed too (${describeAwsFailure(startFailure).summary}); it is stopped, with ${carries}. Start it with: ${startCommand}`);
 				}
 				throw error;
 			}
 			instancesLeftStoppedByCdkd.add(physicalId);
-			this.logger.warn(phase === "stop" ? safeMsg`${logicalId}: instance ${physicalId} was being stopped for an InstanceType / UserData change that did not finish. Once it is stopped, start it with: ${startCommand}` : safeMsg`${logicalId}: instance ${physicalId} is stopped, with ${carries}; cdkd did not start it again. Start it with: ${startCommand}`);
+			this.logger.warn(phase === "stop" ? safeMsg`${logicalId}: instance ${physicalId} was being stopped for a ${stopWhat} change that did not finish. Once it is stopped, start it with: ${startCommand}` : safeMsg`${logicalId}: instance ${physicalId} is stopped, with ${carries}; cdkd did not start it again. Start it with: ${startCommand}`);
 			throw error;
 		}
 	}
@@ -20570,9 +20897,14 @@ var EC2Provider = class {
 		return Object.keys(result).length > 0 ? result : void 0;
 	}
 	buildPlacement(properties) {
+		const out = {};
 		const az = properties["AvailabilityZone"];
-		if (typeof az !== "string" || az === "") return void 0;
-		return { AvailabilityZone: az };
+		if (typeof az === "string" && az !== "") out.AvailabilityZone = az;
+		const tenancy = properties["Tenancy"];
+		if (typeof tenancy === "string" && tenancy !== "") out.Tenancy = tenancy;
+		const group = properties["PlacementGroupName"];
+		if (typeof group === "string" && group !== "") out.GroupName = group;
+		return Object.keys(out).length > 0 ? out : void 0;
 	}
 	buildNetworkInterfaces(properties) {
 		const raw = properties["NetworkInterfaces"];
@@ -20630,6 +20962,39 @@ var EC2Provider = class {
 		const raw = obj["CPUCredits"] ?? obj["CpuCredits"];
 		return typeof raw === "string" ? raw : void 0;
 	}
+	buildLaunchOnlyInstanceOptions(properties, resourceType, logicalId) {
+		const cpu = properties["CpuOptions"];
+		const hibernation = properties["HibernationOptions"];
+		const refusal = configIntegerRefusal(cpu, "CoreCount", `${resourceType} CpuOptions`, 1) ?? configIntegerRefusal(cpu, "ThreadsPerCore", `${resourceType} CpuOptions`, 1) ?? configBooleanRefusal(hibernation, "Configured", `${resourceType} HibernationOptions`) ?? configStringRefusal(properties, "InstanceInitiatedShutdownBehavior", "", resourceType) ?? configStringRefusal(properties, "Tenancy", "", resourceType) ?? configStringRefusal(properties, "PlacementGroupName", "", resourceType) ?? configStringRefusal(properties, "PrivateIpAddress", "", resourceType) ?? configBooleanRefusal(properties, "SourceDestCheck", resourceType) ?? configBooleanRefusal(properties, "PropagateTagsToVolumeOnCreation", resourceType) ?? configStringRefusal(properties, "AdditionalInfo", "", resourceType) ?? configIntegerRefusal(properties, "Ipv6AddressCount", resourceType, 0) ?? instanceIpv6AddressesRefusal(properties["Ipv6Addresses"], resourceType) ?? privateDnsNameOptionsRefusal(properties["PrivateDnsNameOptions"], resourceType);
+		if (refusal !== void 0) throw markNonRetryable(new ProvisioningError(`${refusal}. The instance ${logicalId} was not launched.`, resourceType, logicalId));
+		const out = {};
+		if (cpu !== void 0 && cpu !== null) {
+			const block = cpu;
+			const coreCount = coerceCfnInteger(block["CoreCount"]);
+			const threadsPerCore = coerceCfnInteger(block["ThreadsPerCore"]);
+			out.CpuOptions = {
+				...coreCount !== void 0 && { CoreCount: coreCount },
+				...threadsPerCore !== void 0 && { ThreadsPerCore: threadsPerCore }
+			};
+		}
+		if (hibernation !== void 0 && hibernation !== null) {
+			const configured = coerceCfnBoolean(hibernation["Configured"]);
+			out.HibernationOptions = configured === void 0 ? {} : { Configured: configured };
+		}
+		const shutdown = properties["InstanceInitiatedShutdownBehavior"];
+		if (typeof shutdown === "string" && shutdown !== "") out.InstanceInitiatedShutdownBehavior = shutdown;
+		const privateIp = properties["PrivateIpAddress"];
+		if (typeof privateIp === "string" && privateIp !== "") out.PrivateIpAddress = privateIp;
+		const additionalInfo = properties["AdditionalInfo"];
+		if (typeof additionalInfo === "string" && additionalInfo !== "") out.AdditionalInfo = additionalInfo;
+		const ipv6Count = coerceCfnInteger(properties["Ipv6AddressCount"]);
+		if (ipv6Count !== void 0) out.Ipv6AddressCount = ipv6Count;
+		const ipv6Addresses = properties["Ipv6Addresses"];
+		if (Array.isArray(ipv6Addresses)) out.Ipv6Addresses = ipv6Addresses.map((a) => ({ Ipv6Address: a["Ipv6Address"] }));
+		const dnsOptions = privateDnsNameOptionsRequest(properties["PrivateDnsNameOptions"]);
+		if (dnsOptions !== void 0) out.PrivateDnsNameOptions = dnsOptions;
+		return out;
+	}
 	buildIpPermission(properties, direction = "ingress", inline = false) {
 		const ipProtocol = properties["IpProtocol"] ?? "-1";
 		const fromPort = properties["FromPort"];
@@ -20958,15 +21323,15 @@ var EC2Provider = class {
 			}
 		}
 	}
-	async applyTags(resourceId, tags, logicalId, mask) {
+	async applyTags(resourceId, tags, logicalId, mask, wrapSend = (call) => call()) {
 		if (tags.length > 0) try {
-			await this.ec2Client.send(new CreateTagsCommand({
+			await wrapSend(() => this.ec2Client.send(new CreateTagsCommand({
 				Resources: [resourceId],
 				Tags: tags.map((t) => ({
 					Key: t.Key,
 					Value: t.Value
 				}))
-			}));
+			})));
 			this.logger.debug(`Applied ${tags.length} tag(s) to ${logicalId}`);
 		} catch (error) {
 			const tagHead = `Failed to apply tags to ${logicalId}: `;
@@ -21060,6 +21425,15 @@ var EC2Provider = class {
 		if (code === "IncorrectInstanceState" || name === "IncorrectInstanceState") return true;
 		return error.message.includes("IncorrectInstanceState");
 	}
+	async whileLaunchedInstanceNotVisible(logicalId, instanceId, call) {
+		for (let attempt = 1;; attempt++) try {
+			return await call();
+		} catch (error) {
+			if (attempt >= LAUNCHED_INSTANCE_VISIBILITY_ATTEMPTS || !isNamedError(error, INSTANCE_NOT_FOUND_NAMES)) throw error;
+			this.logger.debug(safeMsg`EC2 Instance ${logicalId} (${instanceId}) is not visible yet after launch (attempt ${String(attempt)}); retrying`);
+			await this.sleep(Math.min(1e3 * 2 ** (attempt - 1), 8e3));
+		}
+	}
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
@@ -21084,13 +21458,13 @@ var EC2Provider = class {
 	async readCurrentStateOnce(physicalId, logicalId, resourceType, properties, context) {
 		try {
 			switch (resourceType) {
-				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId);
+				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId, properties);
 				case "AWS::EC2::Subnet": return await this.readSubnetCurrentState(physicalId);
 				case "AWS::EC2::InternetGateway": return await this.readInternetGatewayCurrentState(physicalId);
 				case "AWS::EC2::NatGateway": return await this.readNatGatewayCurrentState(physicalId, properties);
 				case "AWS::EC2::RouteTable": return await this.readRouteTableCurrentState(physicalId);
 				case "AWS::EC2::SecurityGroup": return await this.readSecurityGroupCurrentState(physicalId, properties);
-				case "AWS::EC2::Instance": return await this.readInstanceCurrentState(physicalId);
+				case "AWS::EC2::Instance": return await this.readInstanceCurrentState(physicalId, properties);
 				case "AWS::EC2::NetworkAcl": return await this.readNetworkAclCurrentState(physicalId);
 				case "AWS::EC2::EIP": return await this.readEipCurrentState(physicalId, properties, context?.afterOwnWrite === true);
 				case "AWS::EC2::VPCGatewayAttachment": return await this.readVpcGatewayAttachmentCurrentState(physicalId, properties);
@@ -21109,9 +21483,19 @@ var EC2Provider = class {
 			throw err;
 		}
 	}
-	getDriftUnknownPaths(resourceType) {
+	getDriftUnknownPaths(resourceType, properties) {
 		switch (resourceType) {
-			case "AWS::EC2::Instance": return ["NetworkInterfaces"];
+			case "AWS::EC2::Instance": return [
+				"NetworkInterfaces",
+				"PropagateTagsToVolumeOnCreation",
+				"AdditionalInfo",
+				"Ipv6AddressCount",
+				"Ipv6Addresses"
+			];
+			case "AWS::EC2::VPC": {
+				const control = properties?.["VpcEncryptionControl"];
+				return ["Ipv4IpamPoolId", ...control !== null && typeof control === "object" && control["Mode"] === "monitor" ? VPC_ENCRYPTION_CONTROL_EXCLUSIONS.map((key) => `VpcEncryptionControl.${key}`) : []];
+			}
 			case "AWS::EC2::Route":
 			case "AWS::EC2::VPCGatewayAttachment":
 			case "AWS::EC2::SubnetRouteTableAssociation":
@@ -21131,12 +21515,27 @@ var EC2Provider = class {
 		const { declared, narrowed } = narrowRouteDestinations(properties);
 		return declared.length > 1 ? narrowed : properties;
 	}
-	async readVpcCurrentState(physicalId) {
+	async readVpcCurrentState(physicalId, properties) {
 		const vpc = (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0];
 		if (!vpc) return RESOURCE_NOT_FOUND;
 		const result = {};
-		if (vpc.CidrBlock !== void 0) result["CidrBlock"] = vpc.CidrBlock;
+		if (vpc.CidrBlock !== void 0) {
+			result["CidrBlock"] = vpc.CidrBlock;
+			const prefix = /\/(\d+)$/.exec(vpc.CidrBlock)?.[1];
+			if (prefix !== void 0 && properties?.["Ipv4NetmaskLength"] !== void 0) result["Ipv4NetmaskLength"] = Number(prefix);
+		}
 		if (vpc.InstanceTenancy !== void 0) result["InstanceTenancy"] = vpc.InstanceTenancy;
+		const control = vpc.EncryptionControl;
+		if (control?.Mode !== void 0) {
+			const out = { Mode: control.Mode };
+			const exclusions = control.ResourceExclusions;
+			for (const key of VPC_ENCRYPTION_CONTROL_EXCLUSIONS) {
+				const state = exclusions?.[key.slice(0, -9)]?.State;
+				if (state === "enabled" || state === "enabling") out[key] = "enable";
+				else if (state === "disabled" || state === "disabling") out[key] = "disable";
+			}
+			result["VpcEncryptionControl"] = out;
+		}
 		try {
 			const dnsHost = await this.ec2Client.send(new DescribeVpcAttributeCommand({
 				VpcId: physicalId,
@@ -21229,7 +21628,7 @@ var EC2Provider = class {
 		result["SecurityGroupEgress"] = reconcileSgRules(egressRules, stateEgress, "egress");
 		return result;
 	}
-	async readInstanceCurrentState(physicalId) {
+	async readInstanceCurrentState(physicalId, properties) {
 		const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
 		if (!instance || instance.State?.Name === "terminated" || instance.State?.Name === "shutting-down") return RESOURCE_NOT_FOUND;
 		const result = {};
@@ -21254,7 +21653,23 @@ var EC2Provider = class {
 			if (md.InstanceMetadataTags !== void 0) out["InstanceMetadataTags"] = md.InstanceMetadataTags;
 			if (Object.keys(out).length > 0) result["MetadataOptions"] = out;
 		}
+		if (instance.CpuOptions !== void 0) {
+			const cpu = {};
+			if (instance.CpuOptions.CoreCount !== void 0) cpu["CoreCount"] = instance.CpuOptions.CoreCount;
+			if (instance.CpuOptions.ThreadsPerCore !== void 0) cpu["ThreadsPerCore"] = instance.CpuOptions.ThreadsPerCore;
+			if (Object.keys(cpu).length > 0) result["CpuOptions"] = cpu;
+		}
+		if (instance.HibernationOptions?.Configured !== void 0) result["HibernationOptions"] = { Configured: instance.HibernationOptions.Configured };
+		const dnsOptions = instance.PrivateDnsNameOptions;
+		if (dnsOptions !== void 0) {
+			const dns = {};
+			if (dnsOptions.HostnameType !== void 0) dns["HostnameType"] = dnsOptions.HostnameType;
+			if (dnsOptions.EnableResourceNameDnsARecord !== void 0) dns["EnableResourceNameDnsARecord"] = dnsOptions.EnableResourceNameDnsARecord;
+			if (dnsOptions.EnableResourceNameDnsAAAARecord !== void 0) dns["EnableResourceNameDnsAAAARecord"] = dnsOptions.EnableResourceNameDnsAAAARecord;
+			if (Object.keys(dns).length > 0) result["PrivateDnsNameOptions"] = dns;
+		}
 		if (instance.Placement?.Tenancy !== void 0) result["Tenancy"] = instance.Placement.Tenancy;
+		if (typeof instance.Placement?.GroupName === "string" && instance.Placement.GroupName !== "") result["PlacementGroupName"] = instance.Placement.GroupName;
 		if (instance.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = instance.IamInstanceProfile.Arn;
 		else if (process.env["CDKD_NO_WAIT"] === "true" && instance.State?.Name === "pending") try {
 			const live = (await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
@@ -21307,6 +21722,15 @@ var EC2Provider = class {
 		} catch (err) {
 			this.logger.debug(`DescribeInstanceAttribute(disableApiTermination, ${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
+		if (properties?.["InstanceInitiatedShutdownBehavior"] !== void 0) try {
+			const attrResp = await this.ec2Client.send(new DescribeInstanceAttributeCommand({
+				InstanceId: physicalId,
+				Attribute: "instanceInitiatedShutdownBehavior"
+			}));
+			if (attrResp.InstanceInitiatedShutdownBehavior?.Value !== void 0) result["InstanceInitiatedShutdownBehavior"] = attrResp.InstanceInitiatedShutdownBehavior.Value;
+		} catch (err) {
+			this.logger.debug(safeMsg`DescribeInstanceAttribute(instanceInitiatedShutdownBehavior, ${physicalId}) failed: ${describeAwsFailure(err).detail}`);
+		}
 		try {
 			const cpuCredits = (await this.ec2Client.send(new DescribeInstanceCreditSpecificationsCommand({ InstanceIds: [physicalId] }))).InstanceCreditSpecifications?.[0]?.CpuCredits;
 			if (cpuCredits !== void 0) result["CreditSpecification"] = { CPUCredits: cpuCredits };
@@ -21521,10 +21945,16 @@ var EC2Provider = class {
 	async verifyExplicit(logicalId, resourceType, physicalId, properties) {
 		try {
 			switch (resourceType) {
-				case "AWS::EC2::VPC": return (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0] ? {
-					physicalId,
-					attributes: {}
-				} : null;
+				case "AWS::EC2::VPC": {
+					const vpc = (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0];
+					return vpc ? {
+						physicalId,
+						attributes: definedAttributes({
+							VpcId: physicalId,
+							CidrBlock: vpc.CidrBlock
+						})
+					} : null;
+				}
 				case "AWS::EC2::Subnet": {
 					const subnet = (await this.ec2Client.send(new DescribeSubnetsCommand({ SubnetIds: [physicalId] }))).Subnets?.[0];
 					return subnet ? {
@@ -26728,6 +27158,7 @@ var StepFunctionsProvider = class {
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -30411,14 +30842,14 @@ var RDSDBProxyProvider = class {
 						vpcId = proxy?.VpcId;
 						break;
 					}
-					if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(`DBProxy ${dbProxyName} entered terminal failure state: ${status}`, resourceType, logicalId, dbProxyName);
+					if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(mask(`DBProxy ${dbProxyName} entered terminal failure state: ${status}`), resourceType, logicalId, dbProxyName);
 				} catch (error) {
 					if (error instanceof DBProxyNotFoundFault) {} else if (error instanceof ProvisioningError) throw error;
 					else throw this.wrapCaughtError(error, "CREATE (poll)", resourceType, logicalId, dbProxyName, mask);
 				}
 				await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS$1));
 			}
-			if (!endpoint || !dbProxyArn) throw new ProvisioningError(`Timed out waiting for DBProxy ${dbProxyName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyName);
+			if (!endpoint || !dbProxyArn) throw new ProvisioningError(mask(`Timed out waiting for DBProxy ${dbProxyName} to become available (last status: ${status ?? "unknown"})`), resourceType, logicalId, dbProxyName);
 		} catch (error) {
 			markCreatedBeforeFailure(error, logicalId, resourceType, dbProxyName);
 			throw error;
@@ -30477,6 +30908,7 @@ var RDSDBProxyProvider = class {
 			} catch (error) {
 				throw this.wrapCaughtError(error, "UPDATE", resourceType, logicalId, physicalId, mask);
 			}
+			await this.waitForAvailableAfterModify(physicalId, resourceType, logicalId, mask);
 		}
 		this.invalidateAttributeCache(physicalId);
 		await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"], resourceType, logicalId, mask);
@@ -30486,6 +30918,25 @@ var RDSDBProxyProvider = class {
 			wasReplaced: false
 		};
 	}
+	async waitForAvailableAfterModify(physicalId, resourceType, logicalId, mask) {
+		const client = this.getClient();
+		const deadline = Date.now() + POLL_TIMEOUT_MS$1;
+		let status;
+		while (Date.now() < deadline) {
+			try {
+				const proxy = (await client.send(new DescribeDBProxiesCommand({ DBProxyName: physicalId }))).DBProxies?.[0];
+				if (!proxy) throw new ProvisioningError(mask(`DBProxy ${physicalId} was not found while waiting for it after modify`), resourceType, logicalId, physicalId);
+				status = proxy.Status;
+			} catch (error) {
+				if (error instanceof ProvisioningError) throw error;
+				throw this.wrapCaughtError(error, "UPDATE (poll)", resourceType, logicalId, physicalId, mask);
+			}
+			if (status === "available") return;
+			if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(mask(`DBProxy ${physicalId} entered terminal failure state after modify: ${status}`), resourceType, logicalId, physicalId);
+			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS$1));
+		}
+		throw new ProvisioningError(mask(`Timed out waiting for DBProxy ${physicalId} to become available after modify (last status: ${status ?? "unknown"})`), resourceType, logicalId, physicalId);
+	}
 	warnOnRetainedRemovals(logicalId, resourceType, properties, previousProperties, context) {
 		const retained = this.removedRetained(properties, previousProperties, context);
 		if (retained.length === 0) return;
@@ -30578,12 +31029,12 @@ var RDSDBProxyProvider = class {
 			IdleClientTimeout: p.IdleClientTimeout,
 			DebugLogging: p.DebugLogging ?? false,
 			Auth: (p.Auth ?? []).map((a) => ({
-				Description: a.Description,
-				UserName: a.UserName,
-				AuthScheme: a.AuthScheme,
-				SecretArn: a.SecretArn,
-				IAMAuth: a.IAMAuth,
-				ClientPasswordAuthType: a.ClientPasswordAuthType
+				...a.Description !== void 0 && { Description: a.Description },
+				...a.UserName !== void 0 && { UserName: a.UserName },
+				...a.AuthScheme !== void 0 && { AuthScheme: a.AuthScheme },
+				...a.SecretArn !== void 0 && { SecretArn: a.SecretArn },
+				...a.IAMAuth !== void 0 && { IAMAuth: a.IAMAuth },
+				...a.ClientPasswordAuthType !== void 0 && { ClientPasswordAuthType: a.ClientPasswordAuthType }
 			})),
 			...p.DefaultAuthScheme !== void 0 && { DefaultAuthScheme: p.DefaultAuthScheme },
 			...p.EndpointNetworkType !== void 0 && { EndpointNetworkType: p.EndpointNetworkType },
@@ -37693,6 +38144,7 @@ var AppSyncProvider = class {
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -51225,6 +51677,7 @@ var CodeCommitRepositoryProvider = class {
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -52594,6 +53047,7 @@ var S3DirectoryBucketProvider = class {
 	getCreateClient() {
 		this.createClient ??= this.s3Client.config.region().then((region) => withoutServerErrorRetries(new S3Client({
 			...clientDefaultsFor(this.credentialConfig),
+			...s3ClientDefaults(),
 			region
 		})), (error) => {
 			this.createClient = void 0;
@@ -55299,4 +55753,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-KPYbVTtY.js.map
+//# sourceMappingURL=provider-classes-D60y4umw.js.map