@go-to-k/cdkd 0.102.3 → 0.102.5

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-CuHRHcyW.js";
-import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-D4t--jpp.js";
+import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-DGKtcKF6.js";
 import { createHash, createPublicKey, createVerify, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagUserCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -1592,12 +1592,32 @@ var IAMInstanceProfileProvider = class {
 				Path: path
 			}));
 			this.logger.debug(`Created IAM instance profile: ${instanceProfileName}`);
-			if (roles && Array.isArray(roles)) for (const roleName of roles) {
-				await this.iamClient.send(new AddRoleToInstanceProfileCommand({
-					InstanceProfileName: instanceProfileName,
-					RoleName: roleName
-				}));
-				this.logger.debug(`Added role ${roleName} to instance profile ${instanceProfileName}`);
+			const attachedRoles = [];
+			try {
+				if (roles && Array.isArray(roles)) for (const roleName of roles) {
+					await this.iamClient.send(new AddRoleToInstanceProfileCommand({
+						InstanceProfileName: instanceProfileName,
+						RoleName: roleName
+					}));
+					attachedRoles.push(roleName);
+					this.logger.debug(`Added role ${roleName} to instance profile ${instanceProfileName}`);
+				}
+			} catch (innerError) {
+				try {
+					for (const roleName of attachedRoles) try {
+						await this.iamClient.send(new RemoveRoleFromInstanceProfileCommand({
+							InstanceProfileName: instanceProfileName,
+							RoleName: roleName
+						}));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: instanceProfileName }));
+					this.logger.debug(`Cleaned up partially-created IAM instance profile ${logicalId} (${instanceProfileName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM instance profile ${logicalId} (${instanceProfileName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove every role (aws iam remove-role-from-instance-profile --instance-profile-name ${instanceProfileName} --role-name <name>) then aws iam delete-instance-profile --instance-profile-name ${instanceProfileName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM instance profile ${logicalId}: ${instanceProfileName}`);
 			return {
@@ -1825,48 +1845,71 @@ var IAMUserGroupProvider = class {
 			const tags = properties["Tags"];
 			if (tags && Array.isArray(tags)) createParams.Tags = tags;
 			const response = await this.iamClient.send(new CreateUserCommand(createParams));
-			const permissionsBoundary = properties["PermissionsBoundary"];
-			if (permissionsBoundary) {
-				await this.iamClient.send(new PutUserPermissionsBoundaryCommand({
-					UserName: userName,
-					PermissionsBoundary: permissionsBoundary
-				}));
-				this.logger.debug(`Set permissions boundary on user ${userName}`);
-			}
-			const loginProfile = properties["LoginProfile"];
-			if (loginProfile) {
-				await this.iamClient.send(new CreateLoginProfileCommand({
-					UserName: userName,
-					Password: loginProfile.Password,
-					PasswordResetRequired: loginProfile.PasswordResetRequired ?? false
-				}));
-				this.logger.debug(`Created login profile for user ${userName}`);
-			}
-			const managedPolicyArns = properties["ManagedPolicyArns"];
-			if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
-				await this.iamClient.send(new AttachUserPolicyCommand({
-					UserName: userName,
-					PolicyArn: policyArn
-				}));
-				this.logger.debug(`Attached managed policy ${policyArn} to user ${userName}`);
-			}
-			const userGroups = properties["Groups"];
-			if (userGroups && Array.isArray(userGroups)) for (const groupName of userGroups) {
-				await this.iamClient.send(new AddUserToGroupCommand({
-					UserName: userName,
-					GroupName: groupName
-				}));
-				this.logger.debug(`Added user ${userName} to group ${groupName}`);
-			}
-			const policies = properties["Policies"];
-			if (policies && Array.isArray(policies)) for (const policy of policies) {
-				const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
-				await this.iamClient.send(new PutUserPolicyCommand({
-					UserName: userName,
-					PolicyName: policy.PolicyName,
-					PolicyDocument: policyDoc
-				}));
-				this.logger.debug(`Added inline policy ${policy.PolicyName} to user ${userName}`);
+			try {
+				const permissionsBoundary = properties["PermissionsBoundary"];
+				if (permissionsBoundary) {
+					await this.iamClient.send(new PutUserPermissionsBoundaryCommand({
+						UserName: userName,
+						PermissionsBoundary: permissionsBoundary
+					}));
+					this.logger.debug(`Set permissions boundary on user ${userName}`);
+				}
+				const loginProfile = properties["LoginProfile"];
+				if (loginProfile) {
+					await this.iamClient.send(new CreateLoginProfileCommand({
+						UserName: userName,
+						Password: loginProfile.Password,
+						PasswordResetRequired: loginProfile.PasswordResetRequired ?? false
+					}));
+					this.logger.debug(`Created login profile for user ${userName}`);
+				}
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachUserPolicyCommand({
+						UserName: userName,
+						PolicyArn: policyArn
+					}));
+					this.logger.debug(`Attached managed policy ${policyArn} to user ${userName}`);
+				}
+				const userGroups = properties["Groups"];
+				if (userGroups && Array.isArray(userGroups)) for (const groupName of userGroups) {
+					await this.iamClient.send(new AddUserToGroupCommand({
+						UserName: userName,
+						GroupName: groupName
+					}));
+					this.logger.debug(`Added user ${userName} to group ${groupName}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutUserPolicyCommand({
+						UserName: userName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					this.logger.debug(`Added inline policy ${policy.PolicyName} to user ${userName}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.removeUserFromAllGroups(userName);
+					await this.detachAllUserPolicies(userName);
+					await this.deleteAllUserInlinePolicies(userName);
+					try {
+						await this.iamClient.send(new DeleteLoginProfileCommand({ UserName: userName }));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					try {
+						await this.iamClient.send(new DeleteUserPermissionsBoundaryCommand({ UserName: userName }));
+					} catch (err) {
+						if (!(err instanceof NoSuchEntityException)) throw err;
+					}
+					await this.iamClient.send(new DeleteUserCommand({ UserName: userName }));
+					this.logger.debug(`Cleaned up partially-created IAM user ${logicalId} (${userName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM user ${logicalId} (${userName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: remove from groups, detach managed policies, delete inline policies, delete login profile (aws iam delete-login-profile --user-name ${userName}), remove permissions boundary (aws iam delete-user-permissions-boundary --user-name ${userName}), then aws iam delete-user --user-name ${userName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM user ${logicalId}: ${userName}`);
 			return {
@@ -2135,23 +2178,35 @@ var IAMUserGroupProvider = class {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			const response = await this.iamClient.send(new CreateGroupCommand(createParams));
-			const managedPolicyArns = properties["ManagedPolicyArns"];
-			if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
-				await this.iamClient.send(new AttachGroupPolicyCommand({
-					GroupName: groupName,
-					PolicyArn: policyArn
-				}));
-				this.logger.debug(`Attached managed policy ${policyArn} to group ${groupName}`);
-			}
-			const policies = properties["Policies"];
-			if (policies && Array.isArray(policies)) for (const policy of policies) {
-				const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
-				await this.iamClient.send(new PutGroupPolicyCommand({
-					GroupName: groupName,
-					PolicyName: policy.PolicyName,
-					PolicyDocument: policyDoc
-				}));
-				this.logger.debug(`Added inline policy ${policy.PolicyName} to group ${groupName}`);
+			try {
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachGroupPolicyCommand({
+						GroupName: groupName,
+						PolicyArn: policyArn
+					}));
+					this.logger.debug(`Attached managed policy ${policyArn} to group ${groupName}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutGroupPolicyCommand({
+						GroupName: groupName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					this.logger.debug(`Added inline policy ${policy.PolicyName} to group ${groupName}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.detachAllGroupPolicies(groupName);
+					await this.deleteAllGroupInlinePolicies(groupName);
+					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
+					this.logger.debug(`Cleaned up partially-created IAM group ${logicalId} (${groupName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM group ${logicalId} (${groupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: detach managed policies + delete inline policies, then aws iam delete-group --group-name ${groupName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM group ${logicalId}: ${groupName}`);
 			return {
@@ -9789,27 +9844,37 @@ var EC2Provider = class {
 				CidrBlock: cidrBlock,
 				InstanceTenancy: properties["InstanceTenancy"] ?? void 0
 			}))).Vpc.VpcId;
-			if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
-				VpcId: vpcId,
-				EnableDnsHostnames: { Value: true }
-			}));
-			if (properties["EnableDnsSupport"] === false || properties["EnableDnsSupport"] === "false") await this.ec2Client.send(new ModifyVpcAttributeCommand({
-				VpcId: vpcId,
-				EnableDnsSupport: { Value: false }
-			}));
-			await this.applyTags(vpcId, properties, logicalId);
-			await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [vpcId] }));
 			let defaultSgId = "";
 			try {
-				defaultSgId = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [{
-					Name: "vpc-id",
-					Values: [vpcId]
-				}, {
-					Name: "group-name",
-					Values: ["default"]
-				}] }))).SecurityGroups?.[0]?.GroupId || "";
-			} catch {
-				this.logger.debug(`Failed to get default SG for VPC ${vpcId}`);
+				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
+					VpcId: vpcId,
+					EnableDnsHostnames: { Value: true }
+				}));
+				if (properties["EnableDnsSupport"] === false || properties["EnableDnsSupport"] === "false") await this.ec2Client.send(new ModifyVpcAttributeCommand({
+					VpcId: vpcId,
+					EnableDnsSupport: { Value: false }
+				}));
+				await this.applyTags(vpcId, properties, logicalId);
+				await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [vpcId] }));
+				try {
+					defaultSgId = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [{
+						Name: "vpc-id",
+						Values: [vpcId]
+					}, {
+						Name: "group-name",
+						Values: ["default"]
+					}] }))).SecurityGroups?.[0]?.GroupId || "";
+				} catch {
+					this.logger.debug(`Failed to get default SG for VPC ${vpcId}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.ec2Client.send(new DeleteVpcCommand({ VpcId: vpcId }));
+					this.logger.debug(`Cleaned up partially-created VPC ${logicalId} (${vpcId}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created VPC ${logicalId} (${vpcId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ec2 delete-vpc --vpc-id ${vpcId}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created VPC ${logicalId}: ${vpcId}`);
 			return {
@@ -9940,12 +10005,22 @@ var EC2Provider = class {
 			}));
 			const subnetId = response.Subnet.SubnetId;
 			const availabilityZone = response.Subnet.AvailabilityZone;
-			await this.applyTags(subnetId, properties, logicalId);
-			const mapPublicIp = properties["MapPublicIpOnLaunch"];
-			if (mapPublicIp === true || mapPublicIp === "true") await this.ec2Client.send(new ModifySubnetAttributeCommand({
-				SubnetId: subnetId,
-				MapPublicIpOnLaunch: { Value: true }
-			}));
+			try {
+				await this.applyTags(subnetId, properties, logicalId);
+				const mapPublicIp = properties["MapPublicIpOnLaunch"];
+				if (mapPublicIp === true || mapPublicIp === "true") await this.ec2Client.send(new ModifySubnetAttributeCommand({
+					SubnetId: subnetId,
+					MapPublicIpOnLaunch: { Value: true }
+				}));
+			} catch (innerError) {
+				try {
+					await this.ec2Client.send(new DeleteSubnetCommand({ SubnetId: subnetId }));
+					this.logger.debug(`Cleaned up partially-created Subnet ${logicalId} (${subnetId}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created Subnet ${logicalId} (${subnetId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ec2 delete-subnet --subnet-id ${subnetId}`);
+				}
+				throw innerError;
+			}
 			this.logger.debug(`Successfully created Subnet ${logicalId}: ${subnetId}`);
 			return {
 				physicalId: subnetId,
@@ -10324,29 +10399,39 @@ var EC2Provider = class {
 				Description: groupDescription,
 				VpcId: properties["VpcId"] ?? void 0
 			}))).GroupId;
-			await this.applyTags(groupId, properties, logicalId);
-			const ingressRules = properties["SecurityGroupIngress"];
-			if (ingressRules && Array.isArray(ingressRules)) for (const rule of ingressRules) await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
-				GroupId: groupId,
-				IpPermissions: [this.buildIpPermission(rule)]
-			}));
-			const egressRules = properties["SecurityGroupEgress"];
-			if (egressRules && Array.isArray(egressRules)) {
-				try {
-					await this.ec2Client.send(new RevokeSecurityGroupEgressCommand({
+			try {
+				await this.applyTags(groupId, properties, logicalId);
+				const ingressRules = properties["SecurityGroupIngress"];
+				if (ingressRules && Array.isArray(ingressRules)) for (const rule of ingressRules) await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
+					GroupId: groupId,
+					IpPermissions: [this.buildIpPermission(rule)]
+				}));
+				const egressRules = properties["SecurityGroupEgress"];
+				if (egressRules && Array.isArray(egressRules)) {
+					try {
+						await this.ec2Client.send(new RevokeSecurityGroupEgressCommand({
+							GroupId: groupId,
+							IpPermissions: [{
+								IpProtocol: "-1",
+								IpRanges: [{ CidrIp: "0.0.0.0/0" }]
+							}]
+						}));
+					} catch (error) {
+						if (!this.isNotFoundError(error)) throw error;
+					}
+					for (const rule of egressRules) await this.ec2Client.send(new AuthorizeSecurityGroupEgressCommand({
 						GroupId: groupId,
-						IpPermissions: [{
-							IpProtocol: "-1",
-							IpRanges: [{ CidrIp: "0.0.0.0/0" }]
-						}]
+						IpPermissions: [this.buildIpPermission(rule, "egress")]
 					}));
-				} catch (error) {
-					if (!this.isNotFoundError(error)) throw error;
 				}
-				for (const rule of egressRules) await this.ec2Client.send(new AuthorizeSecurityGroupEgressCommand({
-					GroupId: groupId,
-					IpPermissions: [this.buildIpPermission(rule, "egress")]
-				}));
+			} catch (innerError) {
+				try {
+					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
+					this.logger.debug(`Cleaned up partially-created SecurityGroup ${logicalId} (${groupId}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created SecurityGroup ${logicalId} (${groupId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ec2 delete-security-group --group-id ${groupId}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created SecurityGroup ${logicalId}: ${groupId}`);
 			return {
@@ -10551,26 +10636,36 @@ var EC2Provider = class {
 			}))).Instances?.[0];
 			if (!instance?.InstanceId) throw new Error("No instance ID returned from RunInstances");
 			const instanceId = instance.InstanceId;
-			await this.applyTags(instanceId, properties, logicalId);
-			this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
-			await waitUntilInstanceRunning({
-				client: this.ec2Client,
-				maxWaitTime: 300
-			}, { InstanceIds: [instanceId] });
-			const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
-			const attributes = {
-				InstanceId: instanceId,
-				PrivateIp: runningInstance?.PrivateIpAddress ?? "",
-				PublicIp: runningInstance?.PublicIpAddress ?? "",
-				PrivateDnsName: runningInstance?.PrivateDnsName ?? "",
-				PublicDnsName: runningInstance?.PublicDnsName ?? "",
-				AvailabilityZone: runningInstance?.Placement?.AvailabilityZone ?? ""
-			};
-			this.logger.debug(`Successfully created EC2 Instance ${logicalId}: ${instanceId}`);
-			return {
-				physicalId: instanceId,
-				attributes
-			};
+			try {
+				await this.applyTags(instanceId, properties, logicalId);
+				this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
+				await waitUntilInstanceRunning({
+					client: this.ec2Client,
+					maxWaitTime: 300
+				}, { InstanceIds: [instanceId] });
+				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
+				const attributes = {
+					InstanceId: instanceId,
+					PrivateIp: runningInstance?.PrivateIpAddress ?? "",
+					PublicIp: runningInstance?.PublicIpAddress ?? "",
+					PrivateDnsName: runningInstance?.PrivateDnsName ?? "",
+					PublicDnsName: runningInstance?.PublicDnsName ?? "",
+					AvailabilityZone: runningInstance?.Placement?.AvailabilityZone ?? ""
+				};
+				this.logger.debug(`Successfully created EC2 Instance ${logicalId}: ${instanceId}`);
+				return {
+					physicalId: instanceId,
+					attributes
+				};
+			} catch (innerError) {
+				try {
+					await this.ec2Client.send(new TerminateInstancesCommand({ InstanceIds: [instanceId] }));
+					this.logger.debug(`Terminate requested for partially-created EC2 Instance ${logicalId} (${instanceId}) after wiring failure (not waiting for terminated state)`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to terminate partially-created EC2 Instance ${logicalId} (${instanceId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. THE INSTANCE IS STILL RUNNING AND BILLING. Manual termination required: aws ec2 terminate-instances --instance-ids ${instanceId}`);
+				}
+				throw innerError;
+			}
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
@@ -42770,7 +42865,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.102.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.102.5");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());