@go-to-k/cdkd 0.221.7 → 0.221.8

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { A as AssetPublisher, B as getLegacyStateBucketName, C as DiffCalculator, D as S3StateBackend, E as LockManager, F as getDockerCmd, G as resolveStateBucketWithDefaultAndSource, H as resolveCaptureObservedState, I as runDockerForeground, J as CFN_TEMPLATE_URL_LIMIT, K as warnDeprecatedNoPrefixCliFlag, L as runDockerStreaming, M as WorkGraph, N as buildDockerImage, O as rebuildClientForBucketRegion, P as formatDockerLoginError, Q as AssemblyReader, R as Synthesizer, S as applyRoleArnIfSet, T as TemplateParser, U as resolveSkipPrefix, V as resolveApp, W as resolveStateBucketWithDefault, X as findLargeInlineResources, Y as MIGRATE_TMP_PREFIX, Z as uploadCfnTemplate, _ as collectInlinePolicyNamesManagedBySiblings, a as withRetry, b as CloudControlProvider, c as extractDeploymentEventError, d as cyan, et as resolveBucketRegion, f as gray, g as IAMRoleProvider, h as yellow, i as withResourceDeadline, j as stringifyValue, k as shouldRetainResource, l as formatResourceLine, m as red, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as green, q as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as bold, v as ProviderRegistry, w as DagBuilder, x as IntrinsicFunctionResolver, y as findActionableSilentDrops, z as getDefaultStateBucketName } from "./deploy-engine-cBd5QvfA.js";
+import { A as AssetPublisher, B as getLegacyStateBucketName, C as DiffCalculator, D as S3StateBackend, E as LockManager, F as getDockerCmd, G as resolveStateBucketWithDefaultAndSource, H as resolveCaptureObservedState, I as runDockerForeground, J as CFN_TEMPLATE_URL_LIMIT, K as warnDeprecatedNoPrefixCliFlag, L as runDockerStreaming, M as WorkGraph, N as buildDockerImage, O as rebuildClientForBucketRegion, P as formatDockerLoginError, Q as AssemblyReader, R as Synthesizer, S as applyRoleArnIfSet, T as TemplateParser, U as resolveSkipPrefix, V as resolveApp, W as resolveStateBucketWithDefault, X as findLargeInlineResources, Y as MIGRATE_TMP_PREFIX, Z as uploadCfnTemplate, _ as collectInlinePolicyNamesManagedBySiblings, a as withRetry, b as CloudControlProvider, c as extractDeploymentEventError, d as cyan, et as resolveBucketRegion, f as gray, g as IAMRoleProvider, h as yellow, i as withResourceDeadline, j as stringifyValue, k as shouldRetainResource, l as formatResourceLine, m as red, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as green, q as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as bold, v as ProviderRegistry, w as DagBuilder, x as IntrinsicFunctionResolver, y as findActionableSilentDrops, z as getDefaultStateBucketName } from "./deploy-engine-DCkhw7i7.js";
 import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -11,7 +11,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTablesCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, DescribeTypeCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.221.7";
+	return "0.221.8";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -14405,7 +14405,7 @@ var EC2Provider = class {
 		try {
 			const securityGroupIds = properties["SecurityGroupIds"];
 			const securityGroups = properties["SecurityGroups"];
-			const iamInstanceProfile = properties["IamInstanceProfile"];
+			const iamInstanceProfile = this.normalizeIamInstanceProfile(properties["IamInstanceProfile"]);
 			const instance = (await this.ec2Client.send(new RunInstancesCommand({
 				ImageId: imageId,
 				InstanceType: instanceType,
@@ -14417,8 +14417,8 @@ var EC2Provider = class {
 				MinCount: 1,
 				MaxCount: 1,
 				IamInstanceProfile: iamInstanceProfile ? {
-					Arn: iamInstanceProfile["Arn"],
-					Name: iamInstanceProfile["Name"]
+					Arn: iamInstanceProfile.arn,
+					Name: iamInstanceProfile.name
 				} : void 0,
 				BlockDeviceMappings: this.buildBlockDeviceMappings(properties),
 				DisableApiTermination: this.coerceBool(properties["DisableApiTermination"]),
@@ -14436,6 +14436,7 @@ var EC2Provider = class {
 					client: this.ec2Client,
 					maxWaitTime: 300
 				}, { InstanceIds: [instanceId] });
+				if (iamInstanceProfile) await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
 				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
 				const attributes = {
 					InstanceId: instanceId,
@@ -14465,6 +14466,139 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create EC2 Instance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* Normalize the CFn `AWS::EC2::Instance.IamInstanceProfile` property into a
+	* `{ arn?, name? }` pair the `RunInstances` / `AssociateIamInstanceProfile`
+	* SDK inputs accept.
+	*
+	* The CFn-canonical shape is a plain STRING — the instance-profile NAME
+	* (what `instanceProfile.ref` resolves to in CDK). cdkd's intrinsic
+	* resolver hands us that resolved string. For robustness we ALSO accept an
+	* ARN string (classified by the `arn:` prefix) and the `{Arn,Name}` object
+	* shape (defensive for hand-written / SDK-shaped templates). Returns
+	* `undefined` when no profile is requested.
+	*/
+	normalizeIamInstanceProfile(raw) {
+		if (raw == null) return void 0;
+		if (typeof raw === "string") {
+			const value = raw.trim();
+			if (value === "") return void 0;
+			return value.startsWith("arn:") ? { arn: value } : { name: value };
+		}
+		if (typeof raw === "object") {
+			const obj = raw;
+			const arn = typeof obj["Arn"] === "string" ? obj["Arn"] : void 0;
+			const name = typeof obj["Name"] === "string" ? obj["Name"] : void 0;
+			if (!arn && !name) return void 0;
+			const normalized = {};
+			if (arn) normalized.arn = arn;
+			if (name) normalized.name = name;
+			return normalized;
+		}
+	}
+	/**
+	* Guarantee the requested IAM instance profile is actually associated with
+	* the just-launched instance, closing the fresh-profile propagation race.
+	*
+	* cdkd's fast SDK path creates the `AWS::IAM::InstanceProfile` only ~1s
+	* before `RunInstances`. The instance profile (and the role membership the
+	* `IAMInstanceProfileProvider` attached to it) takes a few seconds to
+	* propagate to EC2's view. `RunInstances` does not synchronously validate
+	* the supplied `IamInstanceProfile` — when the profile is not yet visible it
+	* can launch the instance WITHOUT the profile and return success with no
+	* error. The result is a running instance whose `IamInstanceProfile` is
+	* empty even though the template requested one (the `propagation-races-2`
+	* integ caught exactly this).
+	*
+	* Strategy (always run when a profile was requested):
+	*  - `DescribeIamInstanceProfileAssociations` for the instance. Only a
+	*    fully `associated` association counts as bound — an `associating`
+	*    state may never complete when the profile wasn't visible at launch, so
+	*    we do NOT treat it as done; we fall through and poll.
+	*  - When no `associated` association exists, call
+	*    `AssociateIamInstanceProfile`, retrying through the IAM propagation
+	*    window on the `Invalid IAM Instance Profile ...` / `NoSuchEntity` /
+	*    `not authorized` / `InvalidParameterValue` signals AWS raises while the
+	*    just-created profile is still propagating.
+	*  - After associating, POLL `DescribeIamInstanceProfileAssociations` until
+	*    the association reaches `associated` (bounded) so the profile is
+	*    genuinely bound by the time `createInstance` returns — the verify.sh
+	*    `describe-instances .IamInstanceProfile` check sees it immediately.
+	*    This mirrors the settle CloudFormation gets for free via its latency.
+	*/
+	async ensureIamInstanceProfileAssociated(instanceId, arn, name, logicalId) {
+		if (!arn && !name) return;
+		if (await this.isInstanceProfileAssociated(instanceId)) {
+			this.logger.debug(`IAM instance profile already associated with instance ${instanceId} (${logicalId})`);
+			return;
+		}
+		this.logger.debug(`IAM instance profile not bound at launch for instance ${instanceId} (${logicalId}); associating ${arn ?? name} explicitly`);
+		const maxAttempts = 10;
+		let associated = false;
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+			await this.ec2Client.send(new AssociateIamInstanceProfileCommand({
+				InstanceId: instanceId,
+				IamInstanceProfile: {
+					Arn: arn,
+					Name: name
+				}
+			}));
+			this.logger.debug(`AssociateIamInstanceProfile issued for instance ${instanceId} (${logicalId}) on attempt ${attempt}`);
+			associated = true;
+			break;
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			if (msg.includes("IncorrectState") || msg.includes("already associated")) {
+				this.logger.debug(`IAM instance profile already associated with instance ${instanceId} (${logicalId})`);
+				associated = true;
+				break;
+			}
+			if (this.isInstanceProfilePropagationError(msg) && attempt < maxAttempts) {
+				this.logger.debug(`IAM instance profile not yet propagated for instance ${instanceId} (associate attempt ${attempt}/${maxAttempts}: ${msg}), retrying in ${attempt}s...`);
+				await this.sleep(attempt * 1e3);
+				continue;
+			}
+			throw error;
+		}
+		if (!associated) return;
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+			if (await this.isInstanceProfileAssociated(instanceId)) {
+				this.logger.debug(`IAM instance profile is now associated with instance ${instanceId} (${logicalId})`);
+				return;
+			}
+			if (attempt < maxAttempts) {
+				this.logger.debug(`Waiting for IAM instance profile association to reach 'associated' for instance ${instanceId} (${logicalId}) (poll ${attempt}/${maxAttempts})...`);
+				await this.sleep(attempt * 1e3);
+			}
+		}
+		this.logger.warn(`IAM instance profile association for instance ${instanceId} (${logicalId}) did not reach 'associated' within the propagation window; the instance may still be missing its profile`);
+	}
+	/**
+	* True iff the instance currently has a fully-`associated` IAM instance
+	* profile association. An `associating` state is intentionally NOT counted —
+	* a launch-time association that never completes can sit in `associating`
+	* forever, so the caller must poll for the terminal `associated` state.
+	* A describe failure is treated as "not yet associated" so the caller falls
+	* through to the associate/poll path (the real fix), not a false positive.
+	*/
+	async isInstanceProfileAssociated(instanceId) {
+		try {
+			return (await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
+				Name: "instance-id",
+				Values: [instanceId]
+			}] }))).IamInstanceProfileAssociations?.some((a) => a.State === "associated") ?? false;
+		} catch (err) {
+			this.logger.debug(`DescribeIamInstanceProfileAssociations failed for ${instanceId}: ${err instanceof Error ? err.message : String(err)}`);
+			return false;
+		}
+	}
+	/**
+	* Classify an AssociateIamInstanceProfile error as a fresh-profile
+	* propagation signal worth retrying (vs a hard failure to surface).
+	*/
+	isInstanceProfilePropagationError(msg) {
+		return msg.includes("Invalid IAM Instance Profile") || msg.includes("NoSuchEntity") || msg.includes("not authorized") || msg.includes("InvalidParameterValue") && msg.includes("instance profile");
+	}
 	async updateInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating EC2 Instance ${logicalId}: ${physicalId}`);
 		try {
@@ -53879,7 +54013,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.221.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.221.8");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());