@go-to-k/cdkd 0.102.3 → 0.102.5

package/dist/{deploy-engine-D4t--jpp.js → deploy-engine-DGKtcKF6.js}

@@ -7551,31 +7551,43 @@ var IAMRoleProvider = class {
 			if (properties["PermissionsBoundary"]) createParams.PermissionsBoundary = properties["PermissionsBoundary"];
 			const response = await this.iamClient.send(new CreateRoleCommand(createParams));
 			this.logger.debug(`Created IAM role: ${roleName}`);
-			const managedPolicyArns = properties["ManagedPolicyArns"];
-			if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
-				await this.iamClient.send(new AttachRolePolicyCommand({
-					RoleName: roleName,
-					PolicyArn: policyArn
-				}));
-				this.logger.debug(`Attached managed policy ${policyArn} to role ${roleName}`);
-			}
-			const policies = properties["Policies"];
-			if (policies && Array.isArray(policies)) for (const policy of policies) {
-				const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
-				await this.iamClient.send(new PutRolePolicyCommand({
-					RoleName: roleName,
-					PolicyName: policy.PolicyName,
-					PolicyDocument: policyDoc
-				}));
-				this.logger.debug(`Added inline policy ${policy.PolicyName} to role ${roleName}`);
-			}
-			const tags = properties["Tags"];
-			if (tags && Array.isArray(tags)) {
-				await this.iamClient.send(new TagRoleCommand({
-					RoleName: roleName,
-					Tags: tags
-				}));
-				this.logger.debug(`Tagged role ${roleName}`);
+			try {
+				const managedPolicyArns = properties["ManagedPolicyArns"];
+				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
+					await this.iamClient.send(new AttachRolePolicyCommand({
+						RoleName: roleName,
+						PolicyArn: policyArn
+					}));
+					this.logger.debug(`Attached managed policy ${policyArn} to role ${roleName}`);
+				}
+				const policies = properties["Policies"];
+				if (policies && Array.isArray(policies)) for (const policy of policies) {
+					const policyDoc = typeof policy.PolicyDocument === "string" ? policy.PolicyDocument : JSON.stringify(policy.PolicyDocument);
+					await this.iamClient.send(new PutRolePolicyCommand({
+						RoleName: roleName,
+						PolicyName: policy.PolicyName,
+						PolicyDocument: policyDoc
+					}));
+					this.logger.debug(`Added inline policy ${policy.PolicyName} to role ${roleName}`);
+				}
+				const tags = properties["Tags"];
+				if (tags && Array.isArray(tags)) {
+					await this.iamClient.send(new TagRoleCommand({
+						RoleName: roleName,
+						Tags: tags
+					}));
+					this.logger.debug(`Tagged role ${roleName}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.detachAllManagedPolicies(roleName);
+					await this.deleteAllInlinePolicies(roleName);
+					await this.iamClient.send(new DeleteRoleCommand({ RoleName: roleName }));
+					this.logger.debug(`Cleaned up partially-created IAM role ${logicalId} (${roleName}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM role ${logicalId} (${roleName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: detach managed policies (aws iam list-attached-role-policies --role-name ${roleName} then aws iam detach-role-policy --role-name ${roleName} --policy-arn <arn>), delete inline policies (aws iam list-role-policies --role-name ${roleName} then aws iam delete-role-policy --role-name ${roleName} --policy-name <name>), then aws iam delete-role --role-name ${roleName}`);
+				}
+				throw innerError;
 			}
 			this.logger.debug(`Successfully created IAM role ${logicalId}: ${roleName}`);
 			return {
@@ -9534,4 +9546,4 @@ var DeployEngine = class {
 
 //#endregion
 export { SynthesisError as $, resolveApp as A, CdkdError as B, AssetPublisher as C, Synthesizer as D, buildDockerImage as E, warnDeprecatedNoPrefixCliFlag as F, PartialFailureError as G, DependencyError as H, AssemblyReader as I, ResourceUpdateNotSupportedError as J, ProvisioningError as K, clearBucketRegionCache as L, resolveSkipPrefix as M, resolveStateBucketWithDefault as N, getDefaultStateBucketName as O, resolveStateBucketWithDefaultAndSource as P, StateError as Q, resolveBucketRegion as R, shouldRetainResource as S, WorkGraph as T, LocalInvokeBuildError as U, ConfigError as V, LockError as W, StackHasActiveImportsError as X, RouteDiscoveryError as Y, StackTerminationProtectionError as Z, DiffCalculator as _, withRetry as a, getLogger as at, LockManager as b, collectInlinePolicyNamesManagedBySiblings as c, getLiveRenderer as ct, normalizeAwsTagsToCfn as d, generateResourceName as dt, formatError as et, resolveExplicitPhysicalId as f, generateResourceNameWithFallback as ft, IntrinsicFunctionResolver as g, assertRegionMatch as h, withResourceDeadline as i, ConsoleLogger as it, resolveCaptureObservedState as j, getLegacyStateBucketName as k, CDK_PATH_TAG as l, PATTERN_B_NAME_PROPERTIES as lt, CloudControlProvider as m, withStackName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as nt, IMPLICIT_DELETE_DEPENDENCIES as o, setLogger as ot, ProviderRegistry as p, withSkipPrefix as pt, ResourceTimeoutError as q, DeployEngine as r, withErrorHandling as rt, IAMRoleProvider as s, runStackBuffered as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as tt, matchesCdkPath as u, PATTERN_B_RESOURCE_TYPES as ut, DagBuilder as v, stringifyValue as w, S3StateBackend as x, TemplateParser as y, AssetError as z };
-//# sourceMappingURL=deploy-engine-D4t--jpp.js.map
+//# sourceMappingURL=deploy-engine-DGKtcKF6.js.map