@cdkd/cli 0.324.0 → 0.326.1

package/dist/{provider-classes-CZnJcera.js → provider-classes-Cvc4LfXM.js}

@@ -1,14 +1,14 @@
-import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWpHZk2l.js";
+import { d as withApiGatewayPacing, l as s3ClientDefaults, r as getAwsClients } from "./aws-clients-ez_oXu6x.js";
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
-import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-CmrPwGge.js";
+import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-DMf6WEao.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as isTtlRateLimited, $i as stringifyIfAssigned, A as resolvedResourceTimeoutMs, Aa as reEnableInstanceApiTermination, Ac as sameLambdaFunctionAddress, B as DELETE_INDEX_WAIT_PROCEED_NOTE, C as planContributorInsightsOp, Ca as withIndeterminateGuard, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Cl as recoverMaskedOutput, D as reverseMapTableContributorInsights, Da as isTerminationProtectionPropagationError, Dc as emrClusterInstancesReplaced, Dt as enclosingDeadlineRemainingMs, E as reverseMapIndexContributorInsights, Ea as ec2InstanceProtectionSite, Ec as ecsServiceLaunchTypeSetOrChanged, Et as enclosingDeadlineExpired, F as beginDeleteWait, Fi as earliestDefined, G as relayedIndexBusyDelete, Ga as s3BucketRegionalDomainName, Gi as DBPROXY_TAGS_WHAT, Gn as getCurrentProducerRegions, Gs as withheldAccountClause, H as TABLE_INDEX_NOUN, Ha as s3BucketArn, Hc as passedNoEchoParametersOf, Hr as awaitInFlightSibling, I as compensateRemovedDeletionProtection, Id as describeFileReadFailure, J as readbackVectorIndexes, Jc as markSameGenerationBag, Ji as readTagList, Jn as isRedactedRecordedValue, Js as findSdkUnwiredProperties, K as waitForIndexesSettled, Ka as s3BucketWebsiteUrl, Ki as DBPROXY_TAG_OPTIONS, Kr as replacedDeleteFailureVerdict, L as deleteBudgetKey, Ld as displayAssemblyPath, Li as reserveStackCreateToken, M as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Na as isUsableAttemptedName, Ns as refuseMalformedResourcesForDestroy, O as stripIndexContributorInsights, Oa as observeThenDisableInstanceApiTermination, Oc as canonicalLambdaFunctionName, Ol as carriesSecretMask, Oo as parseWebACLArn, P as DYNAMODB_DELETE_POLL_COST_MS, Q as isTtlAlreadyDisabled, Qi as definedAttributes, Qt as withNestedStackContext, R as resolveDynamoDbDeleteBudgetClock, Rd as renderAssemblyPathEscape, Ro as accountArgs, S as indexDeclaresContributorInsights, Sa as deleteSkipReason, Sd as canonicalizeRegion, Si as secretNamedAttributeNamesOf, T as readContributorInsightsSpec, Tl as recordAttributeIdCopy, U as deleteTableWithIndexBusyRetry, Ua as s3BucketDomainName, Ui as isRefusedByName, V as INDEX_SETTLE_POLL_INTERVAL_MS, Va as isSettledInstanceState, Vr as refuseRestoreFromItself, W as maskedLogger, Wa as s3BucketDualStackDomainName, Wi as markDeleteStarted, Wr as getStackRecords, Wt as getNestedRevertRun, X as vectorIndexesSettled, Xc as recordReferenceProvenanceEntry, Xi as tagMapAsList, Xn as redactedDeleteAddressSkip, Xs as withoutSdkUnwiredProperties, Y as vectorIndexesForCreate, Yc as redactForState, Yi as refuseMalformedDesiredTags, Yn as redactedDeleteAddressFields, Z as vectorIndexesShapeDetail, Za as outputReferenceProvenanceOf, Zc as snapshotPassProvenance, Zi as tagPlanWarning, Zt as getCurrentNestedStackContext, _ as streamMemberRefusals, _a as unchangedBehindSecretReference, _c as requireConfigArray, _o as getAccountInfo, _t as findNestedTemplateTreeDefect, aa as waitForLambdaFunctionActive, ac as WARM_THROUGHPUT_MEMBERS, at as hasCdkAutoDeleteTag, b as CONTRIBUTOR_INSIGHTS_KEY, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, c as DynamoDBGlobalTableProvider, cc as toCfnInteger, cn as chunks, ct as markRefusedBeforeApplying, d as declaredStreamPolicyMember, dc as coerceCfnInteger, dn as withApiLimit, el as hasMaskableValues, et as planTimeToLive, f as declaredStreamTagsMember, fc as configBooleanRefusal, fu as timePhase, g as streamDeclaresTags, ga as onlySecretReferencesDiffer, gc as replayWarn, gl as dynamicReferenceTokens, h as streamDeclaresPolicy, ha as slowCcOperationTimeoutMs, hc as readConfigString, hu as stringifyValue, it as S3_AUTO_DELETE_OBJECTS_TAG, jo as passedParameterClassesOf, k as waitForGoneAfterDelete, ka as reDisableInstanceApiTermination, kc as lambdaFunctionNameForMask, l as STREAM_POLICY_KEY, la as getCurrentResourceSecrets, lc as toFiniteNumber, ln as isAccessDeniedError, m as reverseMapStreamPolicy, mc as configStringRefusal, ml as withoutPhysicalNameCopies, nt as sendTtlWaitingOutRateLimit, oc as coerceWarmThroughput$1, ot as isTruthyCfnBoolean, p as planStreamMemberOps, pc as configIntegerRefusal, ps as refuseMalformedNestedChildOutputs, q as planVectorIndexUpdates, qi as planTagDiff, qn as REDACTED_DELETE_ADDRESS_SKIP_REASON, qt as revertNestedChildFromJournal, rt as ECR_AUTO_DELETE_IMAGES_TAG, sc as isWarmThroughputDecrease, st as getPriorAttempts, t as DeployEngine, tt as readTtlSpec, u as STREAM_TAGS_KEY, uc as coerceCfnBoolean, un as lookupEachName, v as streamPolicyMatchesDeclared, vc as requireConfigObject, vt as isAbsoluteAssetPath, w as planIndexContributorInsightsOps, wc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, wl as physicalNameCopiesOf, x as contributorInsightsRefusals, y as streamTagsMatchDeclared, yc as requireConfigString, yd as decodeListingKey, yt as listNestedTemplateRows, z as resolveDynamoDbDeleteBudgetMs, zd as resolveAssemblyPath, zi as acquireIdempotencyToken } from "./deploy-engine-B32kQ3SO.js";
-import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-D3th06lJ.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, t as canonicalizeIpv4Cidr } from "./program-CcdJAeR0.js";
-import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DCLA_p9I.js";
-import { RDSProvider } from "./rds-provider-YcTAhlgr.js";
-import { NeptuneProvider } from "./neptune-provider-CN7ptfAK.js";
-import { ASGProvider } from "./asg-provider-D8-GEE_f.js";
+import { $ as isTtlRateLimited, $i as stringifyIfAssigned, A as resolvedResourceTimeoutMs, Aa as reEnableInstanceApiTermination, Ac as sameLambdaFunctionAddress, B as DELETE_INDEX_WAIT_PROCEED_NOTE, C as planContributorInsightsOp, Ca as withIndeterminateGuard, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Cl as recoverMaskedOutput, D as reverseMapTableContributorInsights, Da as isTerminationProtectionPropagationError, Dc as emrClusterInstancesReplaced, Dt as enclosingDeadlineRemainingMs, E as reverseMapIndexContributorInsights, Ea as ec2InstanceProtectionSite, Ec as ecsServiceLaunchTypeSetOrChanged, Et as enclosingDeadlineExpired, F as beginDeleteWait, Fi as earliestDefined, G as relayedIndexBusyDelete, Ga as s3BucketRegionalDomainName, Gi as DBPROXY_TAGS_WHAT, Gn as getCurrentProducerRegions, Gs as withheldAccountClause, H as TABLE_INDEX_NOUN, Ha as s3BucketArn, Hc as passedNoEchoParametersOf, Hr as awaitInFlightSibling, I as compensateRemovedDeletionProtection, Id as describeFileReadFailure, J as readbackVectorIndexes, Jc as markSameGenerationBag, Ji as readTagList, Jn as isRedactedRecordedValue, Js as findSdkUnwiredProperties, K as waitForIndexesSettled, Ka as s3BucketWebsiteUrl, Ki as DBPROXY_TAG_OPTIONS, Kr as replacedDeleteFailureVerdict, L as deleteBudgetKey, Ld as displayAssemblyPath, Li as reserveStackCreateToken, M as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Na as isUsableAttemptedName, Ns as refuseMalformedResourcesForDestroy, O as stripIndexContributorInsights, Oa as observeThenDisableInstanceApiTermination, Oc as canonicalLambdaFunctionName, Ol as carriesSecretMask, Oo as parseWebACLArn, P as DYNAMODB_DELETE_POLL_COST_MS, Q as isTtlAlreadyDisabled, Qi as definedAttributes, Qt as withNestedStackContext, R as resolveDynamoDbDeleteBudgetClock, Rd as renderAssemblyPathEscape, Ro as accountArgs, S as indexDeclaresContributorInsights, Sa as deleteSkipReason, Sd as canonicalizeRegion, Si as secretNamedAttributeNamesOf, T as readContributorInsightsSpec, Tl as recordAttributeIdCopy, U as deleteTableWithIndexBusyRetry, Ua as s3BucketDomainName, Ui as isRefusedByName, V as INDEX_SETTLE_POLL_INTERVAL_MS, Va as isSettledInstanceState, Vr as refuseRestoreFromItself, W as maskedLogger, Wa as s3BucketDualStackDomainName, Wi as markDeleteStarted, Wr as getStackRecords, Wt as getNestedRevertRun, X as vectorIndexesSettled, Xc as recordReferenceProvenanceEntry, Xi as tagMapAsList, Xn as redactedDeleteAddressSkip, Xs as withoutSdkUnwiredProperties, Y as vectorIndexesForCreate, Yc as redactForState, Yi as refuseMalformedDesiredTags, Yn as redactedDeleteAddressFields, Z as vectorIndexesShapeDetail, Za as outputReferenceProvenanceOf, Zc as snapshotPassProvenance, Zi as tagPlanWarning, Zt as getCurrentNestedStackContext, _ as streamMemberRefusals, _a as unchangedBehindSecretReference, _c as requireConfigArray, _o as getAccountInfo, _t as findNestedTemplateTreeDefect, aa as waitForLambdaFunctionActive, ac as WARM_THROUGHPUT_MEMBERS, at as hasCdkAutoDeleteTag, b as CONTRIBUTOR_INSIGHTS_KEY, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, c as DynamoDBGlobalTableProvider, cc as toCfnInteger, cn as chunks, ct as markRefusedBeforeApplying, d as declaredStreamPolicyMember, dc as coerceCfnInteger, dn as withApiLimit, el as hasMaskableValues, et as planTimeToLive, f as declaredStreamTagsMember, fc as configBooleanRefusal, fu as timePhase, g as streamDeclaresTags, ga as onlySecretReferencesDiffer, gc as replayWarn, gl as dynamicReferenceTokens, h as streamDeclaresPolicy, ha as slowCcOperationTimeoutMs, hc as readConfigString, hu as stringifyValue, it as S3_AUTO_DELETE_OBJECTS_TAG, jo as passedParameterClassesOf, k as waitForGoneAfterDelete, ka as reDisableInstanceApiTermination, kc as lambdaFunctionNameForMask, l as STREAM_POLICY_KEY, la as getCurrentResourceSecrets, lc as toFiniteNumber, ln as isAccessDeniedError, m as reverseMapStreamPolicy, mc as configStringRefusal, ml as withoutPhysicalNameCopies, nt as sendTtlWaitingOutRateLimit, oc as coerceWarmThroughput$1, ot as isTruthyCfnBoolean, p as planStreamMemberOps, pc as configIntegerRefusal, ps as refuseMalformedNestedChildOutputs, q as planVectorIndexUpdates, qi as planTagDiff, qn as REDACTED_DELETE_ADDRESS_SKIP_REASON, qt as revertNestedChildFromJournal, rt as ECR_AUTO_DELETE_IMAGES_TAG, sc as isWarmThroughputDecrease, st as getPriorAttempts, t as DeployEngine, tt as readTtlSpec, u as STREAM_TAGS_KEY, uc as coerceCfnBoolean, un as lookupEachName, v as streamPolicyMatchesDeclared, vc as requireConfigObject, vt as isAbsoluteAssetPath, w as planIndexContributorInsightsOps, wc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, wl as physicalNameCopiesOf, x as contributorInsightsRefusals, y as streamTagsMatchDeclared, yc as requireConfigString, yd as decodeListingKey, yt as listNestedTemplateRows, z as resolveDynamoDbDeleteBudgetMs, zd as resolveAssemblyPath, zi as acquireIdempotencyToken } from "./deploy-engine-D75VMGMz.js";
+import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-Cbn0l18B.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, t as canonicalizeIpv4Cidr } from "./program-DXF0ILBM.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-2tRANTVg.js";
+import { RDSProvider } from "./rds-provider-DrH1T4n5.js";
+import { NeptuneProvider } from "./neptune-provider-mblWF8Dn.js";
+import { ASGProvider } from "./asg-provider-ClmDsAE5.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -16,7 +16,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionConfigurationCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionScalingConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PublishVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutFunctionScalingConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, GetIpamPoolAllocationsCommand, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, GetIpamPoolAllocationsCommand, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifyPrivateDnsNameOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateDeploymentCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -3720,6 +3720,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const holder = this.createClientHolder;
 		holder.client ??= this.s3Client.config.region().then((region) => withoutServerErrorRetries(new S3Client({
 			...clientDefaultsFor(this.credentialConfig),
+			...s3ClientDefaults(),
 			region
 		})), (error) => {
 			holder.client = void 0;
@@ -10033,6 +10034,11 @@ const ARN_SERVICE_TO_EVENT_SOURCE_KIND = {
 	mq: "mq",
 	rds: "documentdb"
 };
+function enabledFromState(state, properties) {
+	if (state === "Enabled" || state === "Enabling") return true;
+	if (state === "Disabled" || state === "Disabling") return false;
+	return coerceCfnBoolean(properties?.["Enabled"]) ?? true;
+}
 function classifyEventSource(resp) {
 	if (resp.SelfManagedEventSource !== void 0) return "kafka";
 	if (resp.SelfManagedKafkaEventSourceConfig !== void 0) return "kafka";
@@ -10589,7 +10595,7 @@ var LambdaEventSourceMappingProvider = class {
 			const date = raw instanceof Date ? raw : new Date(raw);
 			result["StartingPositionTimestamp"] = Math.floor(date.getTime() / 1e3);
 		}
-		if (resp.State !== void 0) result["Enabled"] = resp.State === "Enabled" || resp.State === "Enabling" || resp.State === "Updating";
+		if (resp.State !== void 0) result["Enabled"] = enabledFromState(resp.State, properties);
 		let tags = [];
 		if (resp.EventSourceMappingArn) try {
 			const tagMap = (await this.lambdaClient.send(new ListTagsCommand({ Resource: resp.EventSourceMappingArn }))).Tags ?? {};
@@ -17281,6 +17287,13 @@ const STOPPABLE_INSTANCE_STATES = /* @__PURE__ */ new Set([
 ]);
 const instancesLeftStoppedByCdkd = /* @__PURE__ */ new Set();
 const instanceStoppedAfterStart = /* @__PURE__ */ new WeakSet();
+function instanceStopMembers(plan) {
+	return [
+		plan.instanceType !== void 0 ? "InstanceType" : "",
+		plan.userData !== void 0 ? "UserData" : "",
+		plan.privateDnsNameOptions?.PrivateDnsHostnameType !== void 0 ? "PrivateDnsNameOptions.HostnameType" : ""
+	].filter(Boolean);
+}
 function isRecordedStandIn$1(value) {
 	if (Array.isArray(value)) return value.some(isRecordedStandIn$1);
 	if (value !== null && typeof value === "object") return Object.values(value).some(isRecordedStandIn$1);
@@ -17575,6 +17588,7 @@ function readbackNatZoneAddresses(live, recorded) {
 }
 const EIP_ALLOCATION_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidAllocationID.NotFound"]);
 const INSTANCE_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidInstanceID.NotFound"]);
+const LAUNCHED_INSTANCE_VISIBILITY_ATTEMPTS = 8;
 const VPC_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidVpcID.NotFound"]);
 const IPAM_POOL_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidIpamPoolId.NotFound"]);
 const SUBNET_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidSubnetID.NotFound"]);
@@ -17620,7 +17634,42 @@ const VPC_CREATE_ONLY_SENT = [
 	"Ipv4NetmaskLength",
 	"VpcEncryptionControl"
 ];
-const INSTANCE_CREATE_ONLY_SENT = ["CpuOptions", "HibernationOptions"];
+const INSTANCE_CREATE_ONLY_SENT = [
+	"CpuOptions",
+	"HibernationOptions",
+	"PlacementGroupName",
+	"PrivateIpAddress",
+	"Ipv6AddressCount",
+	"Ipv6Addresses"
+];
+function instanceIpv6AddressesRefusal(value, resourceType) {
+	if (value === void 0 || value === null) return void 0;
+	if (!Array.isArray(value)) return `${resourceType}.Ipv6Addresses must be a list of { Ipv6Address } entries (got ${typeof value === "object" ? "an object" : `a ${typeof value}`})`;
+	for (const [i, item] of value.entries()) {
+		const path = `${resourceType}.Ipv6Addresses[${i}]`;
+		const refusal = item === void 0 || item === null ? `${path} must be an object (got ${item === null ? "null" : "undefined"})` : configStringRefusal(item, "Ipv6Address", "", path);
+		if (refusal !== void 0) return refusal;
+		const address = item["Ipv6Address"];
+		if (typeof address !== "string" || address === "") return `${path}.Ipv6Address is required (the address to assign)`;
+	}
+}
+function privateDnsNameOptionsRefusal(value, resourceType) {
+	const path = `${resourceType}.PrivateDnsNameOptions`;
+	if (value !== null && typeof value === "object" && !Array.isArray(value) && value["HostnameType"] === "") return `${path}.HostnameType must not be empty`;
+	return configStringRefusal(value, "HostnameType", "", path) ?? configBooleanRefusal(value, "EnableResourceNameDnsARecord", path) ?? configBooleanRefusal(value, "EnableResourceNameDnsAAAARecord", path);
+}
+function privateDnsNameOptionsRequest(value) {
+	if (value === void 0 || value === null) return void 0;
+	const block = value;
+	const hostnameType = block["HostnameType"];
+	const aRecord = coerceCfnBoolean(block["EnableResourceNameDnsARecord"]);
+	const aaaaRecord = coerceCfnBoolean(block["EnableResourceNameDnsAAAARecord"]);
+	return {
+		...typeof hostnameType === "string" && hostnameType !== "" && { HostnameType: hostnameType },
+		...aRecord !== void 0 && { EnableResourceNameDnsARecord: aRecord },
+		...aaaaRecord !== void 0 && { EnableResourceNameDnsAAAARecord: aaaaRecord }
+	};
+}
 function foldCreateOnlySent(key, value) {
 	const asRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 	if (key === "Ipv4NetmaskLength") return coerceCfnInteger(value) ?? value;
@@ -17764,7 +17813,16 @@ var EC2Provider = class {
 			"CreditSpecification",
 			"CpuOptions",
 			"HibernationOptions",
-			"InstanceInitiatedShutdownBehavior"
+			"InstanceInitiatedShutdownBehavior",
+			"SourceDestCheck",
+			"Tenancy",
+			"PlacementGroupName",
+			"PrivateIpAddress",
+			"PropagateTagsToVolumeOnCreation",
+			"AdditionalInfo",
+			"Ipv6AddressCount",
+			"Ipv6Addresses",
+			"PrivateDnsNameOptions"
 		])],
 		["AWS::EC2::NetworkAcl", /* @__PURE__ */ new Set(["VpcId", "Tags"])],
 		["AWS::EC2::NetworkAclEntry", /* @__PURE__ */ new Set([
@@ -17780,7 +17838,7 @@ var EC2Provider = class {
 		])],
 		["AWS::EC2::SubnetNetworkAclAssociation", /* @__PURE__ */ new Set(["SubnetId", "NetworkAclId"])]
 	]);
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])], ["AWS::EC2::Instance", /* @__PURE__ */ new Map([["Monitoring", false]])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])], ["AWS::EC2::Instance", /* @__PURE__ */ new Map([["Monitoring", false], ["SourceDestCheck", true]])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([
 		["AWS::EC2::Instance", /* @__PURE__ */ new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
 		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
@@ -20091,8 +20149,12 @@ var EC2Provider = class {
 				scope: "RunInstances",
 				logicalId
 			});
+			const propagateToVolumes = coerceCfnBoolean(properties["PropagateTagsToVolumeOnCreation"]) === true;
 			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "instance", desiredTags, (TagSpecifications) => this.ec2Client.send(new RunInstancesCommand({
-				...TagSpecifications && { TagSpecifications },
+				...TagSpecifications && { TagSpecifications: propagateToVolumes ? [...TagSpecifications, ...TagSpecifications.map((spec) => ({
+					...spec,
+					ResourceType: "volume"
+				}))] : TagSpecifications },
 				ClientToken: runInstancesToken.value,
 				ImageId: imageId,
 				InstanceType: instanceType,
@@ -20122,7 +20184,7 @@ var EC2Provider = class {
 			const instanceId = instance.InstanceId;
 			reportCreatedResource(logicalId, resourceType, instanceId);
 			try {
-				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
+				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets), (call) => this.whileLaunchedInstanceNotVisible(logicalId, instanceId, call));
 				if (process.env["CDKD_NO_WAIT"] !== "true") {
 					this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
 					await waitUntilInstanceRunning({
@@ -20139,7 +20201,16 @@ var EC2Provider = class {
 						this.logger.warn(`Skipped the IAM instance profile association check for ${logicalId} (${instanceId}) because --no-wait leaves the instance in 'pending', where AssociateIamInstanceProfile is rejected. RunInstances associates the profile asynchronously and can complete with NO profile attached when the profile was created moments earlier. Verify with: ${aws`aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=${instanceId}`.render()} — and if it is missing, re-associate with: ` + (profileRef.includes(",") ? WITHHELD_AWS_COMMAND : aws`aws ec2 associate-iam-instance-profile --instance-id ${instanceId} --iam-instance-profile ${iamInstanceProfile.arn ? aws`Arn=${profileRef}` : aws`Name=${profileRef}`}`.render()));
 					} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
 				}
-				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
+				if (coerceCfnBoolean(properties["SourceDestCheck"]) === false) await this.whileLaunchedInstanceNotVisible(logicalId, instanceId, () => this.ec2Client.send(new ModifyInstanceAttributeCommand({
+					InstanceId: instanceId,
+					SourceDestCheck: { Value: false }
+				})));
+				const runningInstance = (await this.whileLaunchedInstanceNotVisible(logicalId, instanceId, () => this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] })))).Reservations?.[0]?.Instances?.[0];
+				if (propagateToVolumes && !tagsApplied && desiredTags.length > 0) {
+					const volumeIds = (runningInstance?.BlockDeviceMappings ?? []).map((m) => m.Ebs?.VolumeId).filter((id) => typeof id === "string" && id !== "");
+					if (volumeIds.length === 0) this.logger.warn(safeMsg`${logicalId}: PropagateTagsToVolumeOnCreation is set, but the launch went out without tags (the tagged RunInstances was refused) and DescribeInstances reported no attached volume for ${instanceId} yet (under --no-wait the instance may still be pending), so its volumes were not tagged. Tag them with ec2:CreateTags once they are attached.`);
+					for (const volumeId of volumeIds) await this.applyTags(volumeId, desiredTags, logicalId, maskerOrIdentity(context?.maskSecrets));
+				}
 				const attributes = describedInstanceAttributes(instanceId, runningInstance);
 				this.logger.debug(`Successfully created EC2 Instance ${logicalId}: ${instanceId}`);
 				runInstancesToken.release();
@@ -20331,12 +20402,38 @@ var EC2Provider = class {
 		}
 		const createOnlyChanged = INSTANCE_CREATE_ONLY_SENT.filter((key) => changed(key, (a, b) => sameCreateOnlySent(key, a, b)));
 		if (createOnlyChanged.length > 0) throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `replace the instance (cdkd deploy --replace). ${createOnlyChanged.join(", ")} can be set only when the instance is launched, and CloudFormation creates a new instance for this change`));
+		if (changed("Tenancy", (a, b) => a === b) && !standInSkips("Tenancy")) {
+			const before = previousProperties["Tenancy"];
+			const after = properties["Tenancy"];
+			const refusal = configStringRefusal(properties, "Tenancy", "", resourceType);
+			if (refusal !== void 0) throw refusedBeforeApplying(new ProvisioningError(`${refusal}. The instance ${logicalId} was not updated.`, resourceType, logicalId, physicalId));
+			if (before == null && typeof after === "string") plan.tenancyAddition = {
+				value: after,
+				replaying: context?.replayingState === true
+			};
+			else if (typeof before === "string" && typeof after === "string" && before !== "default" && after !== "default") {
+				if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the rollback would change Tenancy ${before} -> ${after}, which cdkd does not apply; the instance keeps its current tenancy.`);
+				else throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, safeMsg`cdkd does not change Tenancy ${before} -> ${after}. How CloudFormation applies a change between two non-default tenancies has not been measured (it may stop the instance and move it rather than replace it), so cdkd neither replaces the instance nor applies the change. Keep the current tenancy, or replace the instance explicitly with cdkd deploy --replace`));
+			} else if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the rollback would change Tenancy (${before === void 0 ? "unset" : before} -> ${after === void 0 ? "unset" : after}), which needs a new instance; the instance keeps its current tenancy.`);
+			else throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, "replace the instance (cdkd deploy --replace). CloudFormation creates a new instance for a Tenancy change to or from default"));
+		}
 		if (changed("InstanceInitiatedShutdownBehavior", (a, b) => a === b)) {
 			if (properties["InstanceInitiatedShutdownBehavior"] === void 0) {
 				if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare InstanceInitiatedShutdownBehavior; the rollback leaves it at its current AWS value.`);
 				else throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): InstanceInitiatedShutdownBehavior was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared (set it to stop, the default, to leave the behavior at AWS's default). The instance was not updated.`, resourceType, logicalId, physicalId));
 			} else if (!standInSkips("InstanceInitiatedShutdownBehavior")) plan.shutdownBehavior = requireConfigString(properties["InstanceInitiatedShutdownBehavior"], "", "AWS::EC2::Instance InstanceInitiatedShutdownBehavior");
 		}
+		const sourceDestCheckOf = (v) => v === void 0 ? true : coerceCfnBoolean(v);
+		if (changed("SourceDestCheck", (a, b) => sourceDestCheckOf(a) === sourceDestCheckOf(b)) && !standInSkips("SourceDestCheck")) {
+			const raw = properties["SourceDestCheck"];
+			const want = raw === void 0 ? true : coerceCfnBoolean(raw);
+			if (want === void 0) {
+				const refusal = configBooleanRefusal(properties, "SourceDestCheck", resourceType);
+				if (context?.replayingState === true || context?.desiredFromAwsReadback === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${refusal ?? "SourceDestCheck is not a boolean"}; it is left at its current AWS value.`);
+				else throw refusedBeforeApplying(new ProvisioningError(`${refusal ?? `${resourceType}.SourceDestCheck must be a boolean`}. The instance ${logicalId} was not updated.`, resourceType, logicalId, physicalId));
+			} else plan.sourceDestCheck = want;
+		}
+		this.planPrivateDnsNameOptions(logicalId, physicalId, resourceType, properties, previousProperties, context, plan, changed, standInSkips);
 		if (changed("UserData", (a, b) => a === b)) {
 			const userData = properties["UserData"];
 			if (userData === void 0) plan.userData = /* @__PURE__ */ new Uint8Array(0);
@@ -20389,14 +20486,64 @@ var EC2Provider = class {
 		}
 		return plan;
 	}
+	planPrivateDnsNameOptions(logicalId, physicalId, resourceType, properties, previousProperties, context, plan, changed, standInSkips) {
+		const KEY = "PrivateDnsNameOptions";
+		const readable = (v) => v != null && privateDnsNameOptionsRefusal(v, resourceType) === void 0 ? privateDnsNameOptionsRequest(v) ?? {} : {};
+		const sameOptions = (a, b) => a != null && b != null && privateDnsNameOptionsRefusal(a, resourceType) === void 0 && privateDnsNameOptionsRefusal(b, resourceType) === void 0 && isDeepStrictEqual(readable(a), readable(b));
+		if (!changed(KEY, sameOptions)) return;
+		const replaying = context?.replayingState === true;
+		const after = properties[KEY];
+		if (after === void 0 || after === null) {
+			if (replaying) {
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare PrivateDnsNameOptions, which needs a new instance; the rollback leaves the instance's hostname options as they are.`);
+				return;
+			}
+			throw refusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, "replace the instance (cdkd deploy --replace). CloudFormation creates a new instance when PrivateDnsNameOptions is removed"));
+		}
+		if (standInSkips(KEY)) return;
+		const refusal = privateDnsNameOptionsRefusal(after, resourceType);
+		if (refusal !== void 0) {
+			if (replaying || context?.desiredFromAwsReadback === true) {
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${refusal}; the hostname options are left at their current AWS value.`);
+				return;
+			}
+			throw refusedBeforeApplying(new ProvisioningError(`${refusal}. The instance ${logicalId} was not updated.`, resourceType, logicalId, physicalId));
+		}
+		const want = readable(after);
+		const had = readable(previousProperties[KEY]);
+		const request = {};
+		if (want.HostnameType !== void 0 && want.HostnameType !== had.HostnameType) request.PrivateDnsHostnameType = want.HostnameType;
+		for (const member of ["EnableResourceNameDnsARecord", "EnableResourceNameDnsAAAARecord"]) if (want[member] !== void 0 && want[member] !== had[member]) request[member] = want[member];
+		const removedMembers = context?.desiredFromAwsReadback === true ? "" : Object.keys(had).filter((m) => want[m] === void 0).join(", ");
+		if (removedMembers !== "") {
+			if (!replaying) throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): PrivateDnsNameOptions ${removedMembers} was removed from the template, and CloudFormation fails that update ("No valid attributes specified"). Keep it declared (set it to the value the instance has to leave it unchanged), or remove the whole PrivateDnsNameOptions block, which replaces the instance. The instance was not updated.`, resourceType, logicalId, physicalId));
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare PrivateDnsNameOptions ${removedMembers}; the rollback leaves it at its current AWS value.`);
+		}
+		if (Object.keys(request).length > 0) plan.privateDnsNameOptions = request;
+	}
 	async prepareInstanceMemberUpdates(logicalId, physicalId, resourceType, plan) {
-		const needsStop = plan.instanceType !== void 0 || plan.userData !== void 0;
 		const needsDefaultGroup = plan.securityGroups?.kind === "vpc-default";
-		if (!needsStop && !needsDefaultGroup) return;
+		const tenancy = plan.tenancyAddition;
+		if (instanceStopMembers(plan).length === 0 && !needsDefaultGroup && tenancy === void 0) return;
 		const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
+		const dns = plan.privateDnsNameOptions;
+		if (dns?.PrivateDnsHostnameType !== void 0 && instance?.PrivateDnsNameOptions?.HostnameType === dns.PrivateDnsHostnameType) {
+			const { PrivateDnsHostnameType: _sameAsLive, ...rest } = dns;
+			if (Object.keys(rest).length > 0) plan.privateDnsNameOptions = rest;
+			else delete plan.privateDnsNameOptions;
+		}
+		const stopMembers = instanceStopMembers(plan);
+		const needsStop = stopMembers.length > 0;
+		if (tenancy !== void 0) {
+			const live = instance?.Placement?.Tenancy;
+			if (live !== tenancy.value) {
+				if (tenancy.replaying) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored declares Tenancy ${tenancy.value}, but the instance has ${live ?? "an unreadable tenancy"}; the rollback leaves it as it is.`);
+				else throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, safeMsg`the template declares Tenancy ${tenancy.value}, the instance has ${live ?? "a tenancy DescribeInstances did not report"}, and the state record does not say which tenancy it was launched with. Changing it needs a new instance: replace it with cdkd deploy --replace, or declare Tenancy ${live ?? "as the instance has it"}`));
+			}
+		}
 		if (needsStop) {
-			const members = [plan.instanceType !== void 0 ? "InstanceType" : "", plan.userData !== void 0 ? "UserData" : ""].filter(Boolean).join(" and ");
-			if (instance?.RootDeviceType === "instance-store") throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `${members} can change only on a stopped instance, and an instance-store-backed instance cannot be stopped; CloudFormation replaces it. Re-deploy with cdkd deploy --replace.`));
+			const members = stopMembers.join(" and ");
+			if (instance?.RootDeviceType === "instance-store") throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `${members} can change only on a stopped instance, and an instance-store-backed instance cannot be stopped; ${plan.instanceType !== void 0 || plan.userData !== void 0 ? "CloudFormation replaces it" : "it needs a new instance"}. Re-deploy with cdkd deploy --replace.`));
 			const state = instance?.State?.Name;
 			if (!STOPPABLE_INSTANCE_STATES.has(state ?? "")) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} is ${state ?? "not returned by DescribeInstances"}, so its ${members} cannot be changed. The instance was not updated.`, resourceType, logicalId, physicalId));
 		}
@@ -20435,7 +20582,24 @@ var EC2Provider = class {
 			}));
 			applied.push("the new InstanceInitiatedShutdownBehavior");
 		}
-		if (plan.instanceType === void 0 && plan.userData === void 0) {
+		if (plan.sourceDestCheck !== void 0) {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				SourceDestCheck: { Value: plan.sourceDestCheck }
+			}));
+			applied.push("the new SourceDestCheck");
+		}
+		const dns = plan.privateDnsNameOptions;
+		if (dns !== void 0 && dns.PrivateDnsHostnameType === void 0) {
+			await this.ec2Client.send(new ModifyPrivateDnsNameOptionsCommand({
+				InstanceId: physicalId,
+				...dns
+			}));
+			applied.push("the new PrivateDnsNameOptions");
+		}
+		const stopMembers = instanceStopMembers(plan);
+		const stopWhat = stopMembers.join(" / ");
+		if (stopMembers.length === 0) {
 			if (instancesLeftStoppedByCdkd.has(physicalId)) {
 				let state = await this.readInstanceState(physicalId);
 				if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
@@ -20447,13 +20611,13 @@ var EC2Provider = class {
 		let state = await this.readInstanceState(physicalId);
 		if (state === "pending") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "running");
 		else if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
-		if (state !== "stopped" && state !== "running") throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} became ${state ?? "not returned by DescribeInstances"} during the update, so its InstanceType / UserData were not changed`, resourceType, logicalId, physicalId));
+		if (state !== "stopped" && state !== "running") throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} became ${state ?? "not returned by DescribeInstances"} during the update, so its ${stopWhat} were not changed`, resourceType, logicalId, physicalId));
 		const startAfter = state === "running" || instancesLeftStoppedByCdkd.has(physicalId);
 		let phase = "stop";
 		let stopIssued = false;
 		try {
 			if (state === "running") {
-				this.logger.info(safeMsg`Stopping EC2 Instance ${logicalId} (${physicalId}) to change its ${plan.instanceType !== void 0 ? "InstanceType" : ""}${plan.instanceType !== void 0 && plan.userData !== void 0 ? " and " : ""}${plan.userData !== void 0 ? "UserData" : ""}; it is started again afterwards`);
+				this.logger.info(safeMsg`Stopping EC2 Instance ${logicalId} (${physicalId}) to change its ${stopMembers.join(" and ")}; it is started again afterwards`);
 				await this.ec2Client.send(new StopInstancesCommand({ InstanceIds: [physicalId] }));
 				stopIssued = true;
 				await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
@@ -20473,6 +20637,13 @@ var EC2Provider = class {
 				}));
 				applied.push("the new UserData");
 			}
+			if (dns?.PrivateDnsHostnameType !== void 0) {
+				await this.ec2Client.send(new ModifyPrivateDnsNameOptionsCommand({
+					InstanceId: physicalId,
+					...dns
+				}));
+				applied.push("the new PrivateDnsNameOptions");
+			}
 			if (!startAfter) return;
 			phase = "start";
 			await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
@@ -20504,15 +20675,15 @@ var EC2Provider = class {
 				}
 				if (startFailure === void 0) {
 					instancesLeftStoppedByCdkd.delete(physicalId);
-					this.logger.warn(safeMsg`${logicalId}: the InstanceType / UserData change failed after instance ${physicalId} was stopped; cdkd started it again, with ${carries}.`);
+					this.logger.warn(safeMsg`${logicalId}: the ${stopWhat} change failed after instance ${physicalId} was stopped; cdkd started it again, with ${carries}.`);
 				} else {
 					instancesLeftStoppedByCdkd.add(physicalId);
-					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} was stopped for an InstanceType / UserData change that failed, and starting it again failed too (${describeAwsFailure(startFailure).summary}); it is stopped, with ${carries}. Start it with: ${startCommand}`);
+					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} was stopped for a ${stopWhat} change that failed, and starting it again failed too (${describeAwsFailure(startFailure).summary}); it is stopped, with ${carries}. Start it with: ${startCommand}`);
 				}
 				throw error;
 			}
 			instancesLeftStoppedByCdkd.add(physicalId);
-			this.logger.warn(phase === "stop" ? safeMsg`${logicalId}: instance ${physicalId} was being stopped for an InstanceType / UserData change that did not finish. Once it is stopped, start it with: ${startCommand}` : safeMsg`${logicalId}: instance ${physicalId} is stopped, with ${carries}; cdkd did not start it again. Start it with: ${startCommand}`);
+			this.logger.warn(phase === "stop" ? safeMsg`${logicalId}: instance ${physicalId} was being stopped for a ${stopWhat} change that did not finish. Once it is stopped, start it with: ${startCommand}` : safeMsg`${logicalId}: instance ${physicalId} is stopped, with ${carries}; cdkd did not start it again. Start it with: ${startCommand}`);
 			throw error;
 		}
 	}
@@ -20726,9 +20897,14 @@ var EC2Provider = class {
 		return Object.keys(result).length > 0 ? result : void 0;
 	}
 	buildPlacement(properties) {
+		const out = {};
 		const az = properties["AvailabilityZone"];
-		if (typeof az !== "string" || az === "") return void 0;
-		return { AvailabilityZone: az };
+		if (typeof az === "string" && az !== "") out.AvailabilityZone = az;
+		const tenancy = properties["Tenancy"];
+		if (typeof tenancy === "string" && tenancy !== "") out.Tenancy = tenancy;
+		const group = properties["PlacementGroupName"];
+		if (typeof group === "string" && group !== "") out.GroupName = group;
+		return Object.keys(out).length > 0 ? out : void 0;
 	}
 	buildNetworkInterfaces(properties) {
 		const raw = properties["NetworkInterfaces"];
@@ -20789,7 +20965,7 @@ var EC2Provider = class {
 	buildLaunchOnlyInstanceOptions(properties, resourceType, logicalId) {
 		const cpu = properties["CpuOptions"];
 		const hibernation = properties["HibernationOptions"];
-		const refusal = configIntegerRefusal(cpu, "CoreCount", `${resourceType} CpuOptions`, 1) ?? configIntegerRefusal(cpu, "ThreadsPerCore", `${resourceType} CpuOptions`, 1) ?? configBooleanRefusal(hibernation, "Configured", `${resourceType} HibernationOptions`) ?? configStringRefusal(properties, "InstanceInitiatedShutdownBehavior", "", resourceType);
+		const refusal = configIntegerRefusal(cpu, "CoreCount", `${resourceType} CpuOptions`, 1) ?? configIntegerRefusal(cpu, "ThreadsPerCore", `${resourceType} CpuOptions`, 1) ?? configBooleanRefusal(hibernation, "Configured", `${resourceType} HibernationOptions`) ?? configStringRefusal(properties, "InstanceInitiatedShutdownBehavior", "", resourceType) ?? configStringRefusal(properties, "Tenancy", "", resourceType) ?? configStringRefusal(properties, "PlacementGroupName", "", resourceType) ?? configStringRefusal(properties, "PrivateIpAddress", "", resourceType) ?? configBooleanRefusal(properties, "SourceDestCheck", resourceType) ?? configBooleanRefusal(properties, "PropagateTagsToVolumeOnCreation", resourceType) ?? configStringRefusal(properties, "AdditionalInfo", "", resourceType) ?? configIntegerRefusal(properties, "Ipv6AddressCount", resourceType, 0) ?? instanceIpv6AddressesRefusal(properties["Ipv6Addresses"], resourceType) ?? privateDnsNameOptionsRefusal(properties["PrivateDnsNameOptions"], resourceType);
 		if (refusal !== void 0) throw markNonRetryable(new ProvisioningError(`${refusal}. The instance ${logicalId} was not launched.`, resourceType, logicalId));
 		const out = {};
 		if (cpu !== void 0 && cpu !== null) {
@@ -20807,6 +20983,16 @@ var EC2Provider = class {
 		}
 		const shutdown = properties["InstanceInitiatedShutdownBehavior"];
 		if (typeof shutdown === "string" && shutdown !== "") out.InstanceInitiatedShutdownBehavior = shutdown;
+		const privateIp = properties["PrivateIpAddress"];
+		if (typeof privateIp === "string" && privateIp !== "") out.PrivateIpAddress = privateIp;
+		const additionalInfo = properties["AdditionalInfo"];
+		if (typeof additionalInfo === "string" && additionalInfo !== "") out.AdditionalInfo = additionalInfo;
+		const ipv6Count = coerceCfnInteger(properties["Ipv6AddressCount"]);
+		if (ipv6Count !== void 0) out.Ipv6AddressCount = ipv6Count;
+		const ipv6Addresses = properties["Ipv6Addresses"];
+		if (Array.isArray(ipv6Addresses)) out.Ipv6Addresses = ipv6Addresses.map((a) => ({ Ipv6Address: a["Ipv6Address"] }));
+		const dnsOptions = privateDnsNameOptionsRequest(properties["PrivateDnsNameOptions"]);
+		if (dnsOptions !== void 0) out.PrivateDnsNameOptions = dnsOptions;
 		return out;
 	}
 	buildIpPermission(properties, direction = "ingress", inline = false) {
@@ -21137,15 +21323,15 @@ var EC2Provider = class {
 			}
 		}
 	}
-	async applyTags(resourceId, tags, logicalId, mask) {
+	async applyTags(resourceId, tags, logicalId, mask, wrapSend = (call) => call()) {
 		if (tags.length > 0) try {
-			await this.ec2Client.send(new CreateTagsCommand({
+			await wrapSend(() => this.ec2Client.send(new CreateTagsCommand({
 				Resources: [resourceId],
 				Tags: tags.map((t) => ({
 					Key: t.Key,
 					Value: t.Value
 				}))
-			}));
+			})));
 			this.logger.debug(`Applied ${tags.length} tag(s) to ${logicalId}`);
 		} catch (error) {
 			const tagHead = `Failed to apply tags to ${logicalId}: `;
@@ -21239,6 +21425,15 @@ var EC2Provider = class {
 		if (code === "IncorrectInstanceState" || name === "IncorrectInstanceState") return true;
 		return error.message.includes("IncorrectInstanceState");
 	}
+	async whileLaunchedInstanceNotVisible(logicalId, instanceId, call) {
+		for (let attempt = 1;; attempt++) try {
+			return await call();
+		} catch (error) {
+			if (attempt >= LAUNCHED_INSTANCE_VISIBILITY_ATTEMPTS || !isNamedError(error, INSTANCE_NOT_FOUND_NAMES)) throw error;
+			this.logger.debug(safeMsg`EC2 Instance ${logicalId} (${instanceId}) is not visible yet after launch (attempt ${String(attempt)}); retrying`);
+			await this.sleep(Math.min(1e3 * 2 ** (attempt - 1), 8e3));
+		}
+	}
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
@@ -21290,7 +21485,13 @@ var EC2Provider = class {
 	}
 	getDriftUnknownPaths(resourceType, properties) {
 		switch (resourceType) {
-			case "AWS::EC2::Instance": return ["NetworkInterfaces"];
+			case "AWS::EC2::Instance": return [
+				"NetworkInterfaces",
+				"PropagateTagsToVolumeOnCreation",
+				"AdditionalInfo",
+				"Ipv6AddressCount",
+				"Ipv6Addresses"
+			];
 			case "AWS::EC2::VPC": {
 				const control = properties?.["VpcEncryptionControl"];
 				return ["Ipv4IpamPoolId", ...control !== null && typeof control === "object" && control["Mode"] === "monitor" ? VPC_ENCRYPTION_CONTROL_EXCLUSIONS.map((key) => `VpcEncryptionControl.${key}`) : []];
@@ -21459,7 +21660,16 @@ var EC2Provider = class {
 			if (Object.keys(cpu).length > 0) result["CpuOptions"] = cpu;
 		}
 		if (instance.HibernationOptions?.Configured !== void 0) result["HibernationOptions"] = { Configured: instance.HibernationOptions.Configured };
+		const dnsOptions = instance.PrivateDnsNameOptions;
+		if (dnsOptions !== void 0) {
+			const dns = {};
+			if (dnsOptions.HostnameType !== void 0) dns["HostnameType"] = dnsOptions.HostnameType;
+			if (dnsOptions.EnableResourceNameDnsARecord !== void 0) dns["EnableResourceNameDnsARecord"] = dnsOptions.EnableResourceNameDnsARecord;
+			if (dnsOptions.EnableResourceNameDnsAAAARecord !== void 0) dns["EnableResourceNameDnsAAAARecord"] = dnsOptions.EnableResourceNameDnsAAAARecord;
+			if (Object.keys(dns).length > 0) result["PrivateDnsNameOptions"] = dns;
+		}
 		if (instance.Placement?.Tenancy !== void 0) result["Tenancy"] = instance.Placement.Tenancy;
+		if (typeof instance.Placement?.GroupName === "string" && instance.Placement.GroupName !== "") result["PlacementGroupName"] = instance.Placement.GroupName;
 		if (instance.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = instance.IamInstanceProfile.Arn;
 		else if (process.env["CDKD_NO_WAIT"] === "true" && instance.State?.Name === "pending") try {
 			const live = (await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
@@ -26948,6 +27158,7 @@ var StepFunctionsProvider = class {
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -37933,6 +38144,7 @@ var AppSyncProvider = class {
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -51465,6 +51677,7 @@ var CodeCommitRepositoryProvider = class {
 	getS3Client() {
 		if (!this.s3Client) this.s3Client = new S3Client({
 			...ambientClientDefaults(),
+			...s3ClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.s3Client;
@@ -52834,6 +53047,7 @@ var S3DirectoryBucketProvider = class {
 	getCreateClient() {
 		this.createClient ??= this.s3Client.config.region().then((region) => withoutServerErrorRetries(new S3Client({
 			...clientDefaultsFor(this.credentialConfig),
+			...s3ClientDefaults(),
 			region
 		})), (error) => {
 			this.createClient = void 0;
@@ -55539,4 +55753,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CZnJcera.js.map
+//# sourceMappingURL=provider-classes-Cvc4LfXM.js.map