@go-to-k/cdkd 0.102.3 → 0.102.4

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-CuHRHcyW.js";
-import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-D4t--jpp.js";
+import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-DGKtcKF6.js";
 import { createHash, createPublicKey, createVerify, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagUserCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -1592,12 +1592,32 @@ var IAMInstanceProfileProvider = class {
 				Path: path
 			}));
 			this.logger.debug(`Created IAM instance profile: ${instanceProfileName}`);
-			if (roles && Array.isArray(roles)) for (const roleName of roles) {
-				await this.iamClient.send(new AddRoleToInstanceProfileCommand({
-					InstanceProfileName: instanceProfileName,
-					RoleName: roleName
-				}));
-				this.logger.debug(`Added role ${roleName} to instance profile ${instanceProfileName}`);
+			const attachedRoles = [];
+			try {
+				if (roles && Array.isArray(roles)) for (const roleName of roles) {
+					await this.iamClient.send(new AddRoleToInstanceProfileCommand({
+						InstanceProfileName: instanceProfileName,
+						RoleName: roleName
+					}));
+					attachedRoles.push(roleName);
+					this.logger.debug(`Added role ${roleName} to instance profile ${instanceProfileName}`);
+				}
+			} catch (innerError) {
+				try {
+					for (const roleName of attachedRoles) try {
+						await this.iamClient.send(new RemoveRoleFromInstanceProfileCommand({
+							InstanceProfileName: instanceProfileName,
+							RoleName: roleName
+						}));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: instanceProfileName }));
+					this.logger.debug(`Cleaned up partially-created IAM instance profile ${logicalId} (${instanceProfileName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM instance profile ${logicalId} (${instanceProfileName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove every role (aws iam remove-role-from-instance-profile --instance-profile-name ${instanceProfileName} --role-name <name>) then aws iam delete-instance-profile --instance-profile-name ${instanceProfileName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM instance profile ${logicalId}: ${instanceProfileName}`);
 			return {
@@ -1825,48 +1845,71 @@ var IAMUserGroupProvider = class {
 			const tags = properties["Tags"];
 			if (tags && Array.isArray(tags)) createParams.Tags = tags;
 			const response = await this.iamClient.send(new CreateUserCommand(createParams));
-			const permissionsBoundary = properties["PermissionsBoundary"];
-			if (permissionsBoundary) {
-				await this.iamClient.send(new PutUserPermissionsBoundaryCommand({
-					UserName: userName,
-					PermissionsBoundary: permissionsBoundary
-				}));
-				this.logger.debug(`Set permissions boundary on user ${userName}`);
-			}
-			const loginProfile = properties["LoginProfile"];
-			if (loginProfile) {
-				await this.iamClient.send(new CreateLoginProfileCommand({
-					UserName: userName,
-					Password: loginProfile.Password,
-					PasswordResetRequired: loginProfile.PasswordResetRequired ?? false
-				}));
-				this.logger.debug(`Created login profile for user ${userName}`);
-			}
-			const managedPolicyArns = properties["ManagedPolicyArns"];
-			if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
-				await this.iamClient.send(new AttachUserPolicyCommand({
-					UserName: userName,
-					PolicyArn: policyArn
-				}));
-				this.logger.debug(`Attached managed policy ${policyArn} to user ${userName}`);
-			}
-			const userGroups = properties["Groups"];
-			if (userGroups && Array.isArray(userGroups)) for (const groupName of userGroups) {
-				await this.iamClient.send(new AddUserToGroupCommand({
-					UserName: userName,
-					GroupName: groupName
-				}));
-				this.logger.debug(`Added user ${userName} to group ${groupName}`);
-			}
-			const policies = properties["Policies"];
-			if (policies && Array.isArray(policies)) for (const policy of policies) {
-				const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
-				await this.iamClient.send(new PutUserPolicyCommand({
-					UserName: userName,
-					PolicyName: policy.PolicyName,
-					PolicyDocument: policyDoc
-				}));
-				this.logger.debug(`Added inline policy ${policy.PolicyName} to user ${userName}`);
+			try {
+				const permissionsBoundary = properties["PermissionsBoundary"];
+				if (permissionsBoundary) {
+					await this.iamClient.send(new PutUserPermissionsBoundaryCommand({
+						UserName: userName,
+						PermissionsBoundary: permissionsBoundary
+					}));
+					this.logger.debug(`Set permissions boundary on user ${userName}`);
+				}
+				const loginProfile = properties["LoginProfile"];
+				if (loginProfile) {
+					await this.iamClient.send(new CreateLoginProfileCommand({
+						UserName: userName,
+						Password: loginProfile.Password,
+						PasswordResetRequired: loginProfile.PasswordResetRequired ?? false
+					}));
+					this.logger.debug(`Created login profile for user ${userName}`);
+				}
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachUserPolicyCommand({
+						UserName: userName,
+						PolicyArn: policyArn
+					}));
+					this.logger.debug(`Attached managed policy ${policyArn} to user ${userName}`);
+				}
+				const userGroups = properties["Groups"];
+				if (userGroups && Array.isArray(userGroups)) for (const groupName of userGroups) {
+					await this.iamClient.send(new AddUserToGroupCommand({
+						UserName: userName,
+						GroupName: groupName
+					}));
+					this.logger.debug(`Added user ${userName} to group ${groupName}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutUserPolicyCommand({
+						UserName: userName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					this.logger.debug(`Added inline policy ${policy.PolicyName} to user ${userName}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.removeUserFromAllGroups(userName);
+					await this.detachAllUserPolicies(userName);
+					await this.deleteAllUserInlinePolicies(userName);
+					try {
+						await this.iamClient.send(new DeleteLoginProfileCommand({ UserName: userName }));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					try {
+						await this.iamClient.send(new DeleteUserPermissionsBoundaryCommand({ UserName: userName }));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					await this.iamClient.send(new DeleteUserCommand({ UserName: userName }));
+					this.logger.debug(`Cleaned up partially-created IAM user ${logicalId} (${userName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM user ${logicalId} (${userName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove from groups, detach managed policies, delete inline policies, delete login profile (aws iam delete-login-profile --user-name ${userName}), remove permissions boundary (aws iam delete-user-permissions-boundary --user-name ${userName}), then aws iam delete-user --user-name ${userName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM user ${logicalId}: ${userName}`);
 			return {
@@ -2135,23 +2178,35 @@ var IAMUserGroupProvider = class {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			const response = await this.iamClient.send(new CreateGroupCommand(createParams));
-			const managedPolicyArns = properties["ManagedPolicyArns"];
-			if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
-				await this.iamClient.send(new AttachGroupPolicyCommand({
-					GroupName: groupName,
-					PolicyArn: policyArn
-				}));
-				this.logger.debug(`Attached managed policy ${policyArn} to group ${groupName}`);
-			}
-			const policies = properties["Policies"];
-			if (policies && Array.isArray(policies)) for (const policy of policies) {
-				const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
-				await this.iamClient.send(new PutGroupPolicyCommand({
-					GroupName: groupName,
-					PolicyName: policy.PolicyName,
-					PolicyDocument: policyDoc
-				}));
-				this.logger.debug(`Added inline policy ${policy.PolicyName} to group ${groupName}`);
+			try {
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachGroupPolicyCommand({
+						GroupName: groupName,
+						PolicyArn: policyArn
+					}));
+					this.logger.debug(`Attached managed policy ${policyArn} to group ${groupName}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutGroupPolicyCommand({
+						GroupName: groupName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					this.logger.debug(`Added inline policy ${policy.PolicyName} to group ${groupName}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.detachAllGroupPolicies(groupName);
+					await this.deleteAllGroupInlinePolicies(groupName);
+					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
+					this.logger.debug(`Cleaned up partially-created IAM group ${logicalId} (${groupName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM group ${logicalId} (${groupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: detach managed policies + delete inline policies, then aws iam delete-group --group-name ${groupName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM group ${logicalId}: ${groupName}`);
 			return {
@@ -42770,7 +42825,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.102.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.102.4");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());