@go-to-k/cdkd 0.274.0 → 0.275.0

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-BVpbuTRu.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-DkdxZIwS.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C1xO9Hg8.js";
+import { t as ASGProvider } from "./asg-provider-BfdF-bjF.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
+import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -3560,6 +3560,264 @@ var IAMInstanceProfileProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/iam-access-key-provider.ts
+/**
+* AWS IAM AccessKey Provider (issue #1323)
+*
+* Implements resource provisioning for AWS::IAM::AccessKey using the IAM SDK.
+* The type is NON_PROVISIONABLE in the CloudFormation registry (no Cloud
+* Control handlers), so without this provider cdkd's pre-flight rejects any
+* template that declares it — including the documented CDK pattern for CI
+* credentials (`iam.AccessKey` + piping `secretAccessKey` into a Secrets
+* Manager secret).
+*
+* `SecretAccessKey` is a CREATE-TIME-ONLY attribute: `CreateAccessKey` is the
+* only API call that ever returns the secret, and there is no read-back. The
+* provider therefore captures it from the create response into the returned
+* `attributes`, exactly like CloudFormation does — `Fn::GetAtt` resolution
+* reads the cached value from cdkd state. This means the secret is persisted
+* in the S3 state file; that is the same trust boundary as the rest of cdkd
+* state (and CloudFormation likewise embeds the resolved value into whatever
+* resource consumed the `Fn::GetAtt`). `update()` deliberately omits
+* `attributes` so the create-time secret is preserved in state (a partial
+* attribute set would REPLACE the stored attributes, not merge).
+*
+* `Serial` is a replacement trigger with no API counterpart: the registry
+* schema marks it createOnly, so the diff layer classifies any change as a
+* REPLACEMENT (a new key is minted); the integer itself is never sent to IAM
+* (see the `handledProperties` note for why it is still declared handled).
+*/
+var IAMAccessKeyProvider = class {
+	iamClient;
+	logger = getLogger().child("IAMAccessKeyProvider");
+	/**
+	* NON_PROVISIONABLE type: Cloud Control has no handlers for it, so the
+	* #614 unhandled-property auto-route must never send an AccessKey
+	* template to the CC path (it would fail at deploy time with no handler).
+	*/
+	disableCcApiFallback = true;
+	/**
+	* `Serial` is listed as HANDLED even though it is never sent to IAM: its
+	* entire CloudFormation semantic is "changing it forces a new key", which
+	* the diff layer implements via the registry-schema createOnly
+	* classification. Declaring it `unhandledByDesign` instead would put it in
+	* the silent-drop set, and on a NON_PROVISIONABLE type with
+	* `disableCcApiFallback` the #614 auto-route viability guard turns every
+	* silent drop into a pre-flight HARD REJECT — wrongly refusing any
+	* template that uses `serial`.
+	*/
+	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::AccessKey", /* @__PURE__ */ new Set([
+		"UserName",
+		"Serial",
+		"Status"
+	])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.iamClient = awsClients.iam;
+	}
+	/**
+	* Create an IAM access key via `CreateAccessKey`.
+	*
+	* `Status: Inactive` is applied with a follow-up `UpdateAccessKey` (the
+	* create API always mints Active keys). If that follow-up fails, the
+	* just-created key is deleted before rethrowing — otherwise the key would
+	* exist on AWS without a cdkd state record, and the next deploy's re-CREATE
+	* would burn the user's 2-keys-per-user quota.
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating IAM access key ${logicalId}`);
+		const userName = properties["UserName"];
+		if (!userName) throw new ProvisioningError(`AccessKey ${logicalId} requires UserName`, resourceType, logicalId);
+		const status = properties["Status"] ?? "Active";
+		try {
+			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
+			const accessKeyId = response.AccessKey?.AccessKeyId;
+			const secretAccessKey = response.AccessKey?.SecretAccessKey;
+			if (!accessKeyId || !secretAccessKey) {
+				if (accessKeyId) try {
+					await this.iamClient.send(new DeleteAccessKeyCommand({
+						UserName: userName,
+						AccessKeyId: accessKeyId
+					}));
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up IAM access key ${logicalId} (${accessKeyId}) minted by a partial CreateAccessKey response: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+				}
+				throw new Error("CreateAccessKey returned no AccessKeyId/SecretAccessKey");
+			}
+			if (status === "Inactive") try {
+				await this.iamClient.send(new UpdateAccessKeyCommand({
+					UserName: userName,
+					AccessKeyId: accessKeyId,
+					Status: "Inactive"
+				}));
+			} catch (innerError) {
+				try {
+					await this.iamClient.send(new DeleteAccessKeyCommand({
+						UserName: userName,
+						AccessKeyId: accessKeyId
+					}));
+					this.logger.debug(`Cleaned up partially-created IAM access key ${logicalId} (${accessKeyId}) after status wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created IAM access key ${logicalId} (${accessKeyId}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`);
+				}
+				throw innerError;
+			}
+			this.logger.debug(`Successfully created IAM access key ${logicalId}: ${accessKeyId}`);
+			return {
+				physicalId: accessKeyId,
+				attributes: {
+					SecretAccessKey: secretAccessKey,
+					Id: accessKeyId
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update an IAM access key.
+	*
+	* `UserName` / `Serial` are createOnly (replacement — this method never
+	* sees them change), so the only in-place change is `Status`. A template
+	* that REMOVES `Status` resets to the CFn default `Active` (absent-field
+	* removal semantics), so the desired status is always sent explicitly.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+		this.logger.debug(`Updating IAM access key ${logicalId}: ${physicalId}`);
+		const userName = properties["UserName"];
+		const status = properties["Status"] ?? "Active";
+		try {
+			await this.iamClient.send(new UpdateAccessKeyCommand({
+				UserName: userName,
+				AccessKeyId: physicalId,
+				Status: status
+			}));
+			this.logger.debug(`Successfully updated IAM access key ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update IAM access key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Delete an IAM access key via `DeleteAccessKey`.
+	*
+	* `UserName` comes from the state-recorded properties; when absent (e.g. a
+	* hand-edited state record), it is recovered via `GetAccessKeyLastUsed`,
+	* which resolves the owning user from the key id alone.
+	* `NoSuchEntityException` is treated as idempotent success (after the
+	* shared region check).
+	*/
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		this.logger.debug(`Deleting IAM access key ${logicalId}: ${physicalId}`);
+		try {
+			let userName = properties?.["UserName"];
+			if (!userName) userName = (await this.iamClient.send(new GetAccessKeyLastUsedCommand({ AccessKeyId: physicalId }))).UserName;
+			if (!userName) throw new Error(`cannot resolve the owning user for access key ${physicalId}`);
+			await this.iamClient.send(new DeleteAccessKeyCommand({
+				UserName: userName,
+				AccessKeyId: physicalId
+			}));
+			this.logger.debug(`Successfully deleted IAM access key ${logicalId}`);
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) {
+				assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`Access key ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete IAM access key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Resolve a `Fn::GetAtt` attribute.
+	*
+	* `Id` is the physical id. `SecretAccessKey` can NEVER be re-fetched from
+	* AWS (create-time-only) — deploy-time resolution reads it from the cached
+	* state attributes and never reaches this method; a live fetch (e.g.
+	* `cdkd orphan` reference rewriting on a state record missing the cached
+	* value) fails with an explicit error instead of a silent wrong answer.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+		if (attributeName === "SecretAccessKey") throw new ProvisioningError(`SecretAccessKey for ${physicalId} cannot be read back from AWS — IAM returns it only from CreateAccessKey. cdkd resolves it from the attributes cached in state at create time; this record has no cached value.`, resourceType, physicalId);
+		throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType} (only 'Id' and 'SecretAccessKey' are defined)`, resourceType, physicalId);
+	}
+	/**
+	* Read the AWS-current access key configuration in CFn-property shape.
+	*
+	* Resolves the owning user via `GetAccessKeyLastUsed(AccessKeyId)`, then
+	* finds the key's `Status` in `ListAccessKeys(UserName)`. Returns
+	* `undefined` when the key is gone.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let userName;
+		try {
+			userName = (await this.iamClient.send(new GetAccessKeyLastUsedCommand({ AccessKeyId: physicalId }))).UserName;
+		} catch (err) {
+			if (err instanceof NoSuchEntityException) return void 0;
+			throw err;
+		}
+		if (!userName) return void 0;
+		let marker;
+		do {
+			let page;
+			try {
+				page = await this.iamClient.send(new ListAccessKeysCommand({
+					UserName: userName,
+					...marker && { Marker: marker }
+				}));
+			} catch (err) {
+				if (err instanceof NoSuchEntityException) return void 0;
+				throw err;
+			}
+			for (const key of page.AccessKeyMetadata ?? []) if (key.AccessKeyId === physicalId) {
+				const result = { UserName: userName };
+				if (key.Status !== void 0) result["Status"] = key.Status;
+				return result;
+			}
+			marker = page.IsTruncated ? page.Marker : void 0;
+		} while (marker);
+	}
+	/**
+	* `Serial` has no read API (it is a template-side replacement trigger, never
+	* stored by IAM), so it can never be verified against AWS.
+	*/
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::IAM::AccessKey") return ["Serial"];
+		return [];
+	}
+	/**
+	* Adopt an existing IAM access key into cdkd state.
+	*
+	* **Explicit override only** (`--resource <logicalId>=<AccessKeyId>`): the
+	* template carries no property equal to the key id, and IAM access keys
+	* support no tags. The override is verified via `GetAccessKeyLastUsed`.
+	*
+	* The imported record has NO cached `SecretAccessKey` (IAM never returns it
+	* again), so `Fn::GetAtt [<key>, SecretAccessKey]` cannot resolve for an
+	* imported key — mint a new key via replacement if the secret is needed.
+	*/
+	async import(input) {
+		if (!input.knownPhysicalId) return null;
+		try {
+			await this.iamClient.send(new GetAccessKeyLastUsedCommand({ AccessKeyId: input.knownPhysicalId }));
+			return {
+				physicalId: input.knownPhysicalId,
+				attributes: { Id: input.knownPhysicalId }
+			};
+		} catch (err) {
+			if (err instanceof NoSuchEntityException) return null;
+			throw err;
+		}
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/iam-user-group-provider.ts
 /**
@@ -43239,6 +43497,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::IAM::Policy", new IAMPolicyProvider());
 	registry.register("AWS::IAM::ManagedPolicy", new IAMManagedPolicyProvider());
 	registry.register("AWS::IAM::InstanceProfile", new IAMInstanceProfileProvider());
+	registry.register("AWS::IAM::AccessKey", new IAMAccessKeyProvider());
 	const iamUserGroupProvider = new IAMUserGroupProvider();
 	registry.register("AWS::IAM::User", iamUserGroupProvider);
 	registry.register("AWS::IAM::Group", iamUserGroupProvider);
@@ -63224,7 +63483,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.274.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.275.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;