@go-to-k/cdkd 0.278.20 → 0.278.22

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-Bv3IEbrU.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-CkuG2VD5.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-OB2CvUwn.js";
+import { t as ASGProvider } from "./asg-provider-BBsW05cu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -4868,7 +4868,7 @@ function coerceCfnBoolean(value) {
 * S3's CreateBucket is synchronous - no polling needed, unlike CC API which
 * requires async polling (1s→1.5s→2.25s...) adding seconds per resource.
 */
-var S3BucketProvider = class {
+var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	logger = getLogger().child("S3BucketProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Set([
@@ -5142,6 +5142,7 @@ var S3BucketProvider = class {
 	* - BucketKeyEnabled
 	*/
 	async applyBucketEncryption(bucketName, encryptionConfig) {
+		if (!Array.isArray(encryptionConfig?.ServerSideEncryptionConfiguration)) throw new Error(`BucketEncryption.ServerSideEncryptionConfiguration must be an array (got ${encryptionConfig?.ServerSideEncryptionConfiguration === void 0 ? "undefined" : typeof encryptionConfig.ServerSideEncryptionConfiguration}) — check for an unresolved intrinsic or a mis-nested template value`);
 		const rules = encryptionConfig.ServerSideEncryptionConfiguration.map((rule) => {
 			const byDefault = rule["ServerSideEncryptionByDefault"];
 			return {
@@ -5525,30 +5526,91 @@ var S3BucketProvider = class {
 		this.logger.debug(`Applied object lock configuration to bucket ${bucketName}`);
 	}
 	/**
-	* Apply additional bucket configuration after creation
+	* Apply additional bucket configuration after creation.
+	*
+	* `options.skipDiffManaged` is passed by `update()` for the three
+	* sub-configs that moved onto the diff path (`VersioningConfiguration` /
+	* `OwnershipControls` / `BucketEncryption`, issue #1466). They stay here for
+	* CREATE — where there is no previous side to diff against — but on UPDATE
+	* they must go through `applySubConfigDiffs` so a REMOVED property is reset
+	* to the CloudFormation default instead of silently surviving. Applying them
+	* in both places would double-PUT.
 	*/
-	async applyConfiguration(bucketName, properties, skipTags = false) {
+	async applyConfiguration(bucketName, properties, options = {}) {
+		const { skipTags = false, skipDiffManaged = false } = options;
 		const versioningConfig = properties["VersioningConfiguration"];
-		if (versioningConfig) await this.applyVersioning(bucketName, versioningConfig);
+		if (!skipDiffManaged && versioningConfig) await this.applyVersioning(bucketName, versioningConfig);
 		const tags = properties["Tags"];
 		if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) await this.applyTags(bucketName, tags);
 		const ownershipControls = properties["OwnershipControls"];
-		if (ownershipControls?.Rules) {
-			await this.s3Client.send(new PutBucketOwnershipControlsCommand({
-				Bucket: bucketName,
-				OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
-			}));
-			this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
-		}
+		const normalizedOwnership = S3BucketProvider.emptyListConfigToUndefined(ownershipControls, "Rules");
+		if (!skipDiffManaged && normalizedOwnership !== void 0) await this.applyOwnershipControls(bucketName, normalizedOwnership);
 		const publicAccessBlock = properties["PublicAccessBlockConfiguration"];
 		if (publicAccessBlock) await this.applyPublicAccessBlockConfiguration(bucketName, publicAccessBlock);
-		const bucketEncryption = properties["BucketEncryption"];
-		if (bucketEncryption?.ServerSideEncryptionConfiguration && Array.isArray(bucketEncryption.ServerSideEncryptionConfiguration) && bucketEncryption.ServerSideEncryptionConfiguration.length > 0) await this.applyBucketEncryption(bucketName, bucketEncryption);
+		const normalizedEncryption = S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration");
+		if (!skipDiffManaged && normalizedEncryption !== void 0) await this.applyBucketEncryption(bucketName, normalizedEncryption);
+	}
+	/**
+	* CFn property: OwnershipControls
+	* SDK: PutBucketOwnershipControls
+	*/
+	async applyOwnershipControls(bucketName, ownershipControls) {
+		if (!Array.isArray(ownershipControls?.Rules)) throw new Error(`OwnershipControls.Rules must be an array (got ${ownershipControls?.Rules === void 0 ? "undefined" : typeof ownershipControls.Rules}) — check for an unresolved intrinsic or a mis-nested template value`);
+		await this.s3Client.send(new PutBucketOwnershipControlsCommand({
+			Bucket: bucketName,
+			OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
+		}));
+		this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
+	}
+	/**
+	* Normalize an "empty container" sub-config value to `undefined` so the diff
+	* path cannot mistake a placeholder for a real value.
+	*
+	* `readCurrentState` always-emits placeholder shapes for un-configured
+	* features (`BucketEncryption: { ServerSideEncryptionConfiguration: [] }`,
+	* and the `OwnershipControls: { Rules: [] }` added with issue #1466), and a
+	* `cdkd drift --revert` round-trip feeds those back through `update()`.
+	*
+	* The rule is "empty container == not declared", applied to BOTH sides. Per
+	* pairing that means:
+	*   empty desired  + absent previous -> no call (without this, a Put with an
+	*                                      empty list, which both APIs reject)
+	*   absent desired + empty previous  -> no call (without this, a Delete
+	*                                      against a bucket that never had it)
+	*   empty desired  + REAL previous   -> Delete. This one is NOT suppressed
+	*                                      and must not be: it is a genuine
+	*                                      declared -> not-declared transition,
+	*                                      which is exactly what CloudFormation
+	*                                      removes.
+	*
+	* "Empty" is deliberately NARROW. Only two shapes fold to `undefined`:
+	* a block with NO keys at all (`{}`), and a block whose list key holds an
+	* empty array. Everything else — a non-object, an array where the object
+	* belongs (wrong nesting), a block whose list key is absent but which
+	* carries OTHER keys, or a non-array list (an unresolved intrinsic) — is
+	* MALFORMED, not empty, and passes through so the apply call refuses it by
+	* name. Folding any of those to `undefined` would emit a Delete and
+	* silently downgrade a live bucket (KMS -> AES256) while the template still
+	* declares the config.
+	*
+	* NOTE this helper does NOT cover `VersioningConfiguration` (it has no list
+	* key), and that property is NOT malformed-shape-refused anywhere: a
+	* malformed value there still resolves to 'Suspended', matching `main`.
+	* That pre-existing gap is tracked in issue #1471 — see the note in
+	* `applySubConfigDiffs` for why guarding it is not as simple as it looks.
+	*/
+	static emptyListConfigToUndefined(config, listKey) {
+		if (config === void 0 || config === null) return void 0;
+		if (typeof config !== "object" || Array.isArray(config)) return config;
+		const list = config[listKey];
+		if (list === void 0 || list === null) return Object.keys(config).length === 0 ? void 0 : config;
+		if (Array.isArray(list) && list.length === 0) return void 0;
+		return config;
 	}
 	/**
 	* Diff CFn-shape sub-config values between previous and new state.
 	*
-	* Three transitions:
+	* Four transitions:
 	* - undefined -> defined  (value differs from previous, OR previous undefined): Put
 	* - defined -> undefined: Delete
 	* - defined -> defined (different): Put
@@ -5593,13 +5655,33 @@ var S3BucketProvider = class {
 	* Apply the diff between previous and new sub-configs, issuing Put / Delete
 	* SDK calls only for differing keys. Called from `update()`.
 	*
-	* Versioning / PublicAccessBlock / Tags / OwnershipControls / BucketEncryption
-	* stay on `applyConfiguration` (the unconditional always-PUT path) because
-	* their AWS APIs don't have a clean "delete" counterpart and they
-	* round-trip safely as no-ops when state == AWS-current. The 12 sub-configs
-	* below DO have proper Put/Delete pairs so the diff path is preferable.
+	* PublicAccessBlockConfiguration and Tags stay on `applyConfiguration` /
+	* `applyTagDiff`. `PublicAccessBlockConfiguration` is deliberately NOT on the
+	* diff path: a live CloudFormation A/B (issue #1466) confirmed CFn ALSO
+	* leaves the block in place when the property is removed, so cdkd is at
+	* parity and adding an `onRemove` here would CREATE a divergence.
+	*
+	* VersioningConfiguration / OwnershipControls / BucketEncryption used to sit
+	* on that always-PUT path too, on the assumption that their APIs had no clean
+	* "delete" counterpart. That was wrong in all three cases and made removal a
+	* silent no-op (issue #1466): the same A/B showed CFn suspends versioning,
+	* deletes ownership controls, and resets encryption to the SSE-S3 default.
+	* They are now diffed here like every other Put/Delete pair.
 	*/
 	async applySubConfigDiffs(bucketName, properties, previousProperties) {
+		const previousVersioning = previousProperties["VersioningConfiguration"];
+		const nextVersioning = properties["VersioningConfiguration"];
+		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
+		const desiredVersioningStatus = nextVersioning == null ? "Suspended" : nextVersioning["Status"] || "Suspended";
+		if (versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") await this.applyVersioning(bucketName, nextVersioning);
+		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["OwnershipControls"], "Rules"), S3BucketProvider.emptyListConfigToUndefined(properties["OwnershipControls"], "Rules"), async (cfg) => this.applyOwnershipControls(bucketName, cfg), async () => {
+			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
+			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
+		});
+		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["BucketEncryption"], "ServerSideEncryptionConfiguration"), S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration"), async (cfg) => this.applyBucketEncryption(bucketName, cfg), async () => {
+			await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
+			this.logger.debug(`Deleted bucket encryption on bucket ${bucketName}`);
+		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) return;
 			await this.applyLifecycleConfiguration(bucketName, cfg);
@@ -5660,6 +5742,14 @@ var S3BucketProvider = class {
 			}));
 			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
 		});
+		if (versioningChanged && desiredVersioningStatus === "Suspended") {
+			const hasObjectLock = (p) => {
+				if (p["ObjectLockEnabled"] === true || p["ObjectLockEnabled"] === "true") return true;
+				return p["ObjectLockConfiguration"]?.["ObjectLockEnabled"] === "Enabled";
+			};
+			if (hasObjectLock(properties) || hasObjectLock(previousProperties)) this.logger.warn(`Bucket ${bucketName}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
+			else await this.applyVersioning(bucketName, { Status: "Suspended" });
+		}
 	}
 	/**
 	* Apply ALL sub-configs unconditionally on initial create. Used by
@@ -5752,7 +5842,10 @@ var S3BucketProvider = class {
 			};
 		}
 		try {
-			await this.applyConfiguration(physicalId, properties, true);
+			await this.applyConfiguration(physicalId, properties, {
+				skipTags: true,
+				skipDiffManaged: true
+			});
 			await this.applySubConfigDiffs(physicalId, properties, previousProperties);
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const attributes = await this.buildAttributes(physicalId);
@@ -5804,7 +5897,8 @@ var S3BucketProvider = class {
 	* returns `undefined`.
 	*
 	* Coverage: `BucketName`, `VersioningConfiguration`, `BucketEncryption`,
-	* `PublicAccessBlockConfiguration`, `Tags`, plus all 12 sub-configs:
+	* `OwnershipControls`, `PublicAccessBlockConfiguration`, `Tags`, plus all 12
+	* sub-configs:
 	* `LifecycleConfiguration`, `CorsConfiguration`, `WebsiteConfiguration`,
 	* `LoggingConfiguration`, `NotificationConfiguration`,
 	* `ReplicationConfiguration`, `ObjectLockConfiguration`,
@@ -5820,9 +5914,10 @@ var S3BucketProvider = class {
 			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) return;
 			throw err;
 		}
-		const [versioning, encryption, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
+		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
 			this.readVersioning(physicalId),
 			this.readEncryption(physicalId),
+			this.readOwnershipControls(physicalId),
 			this.readPublicAccessBlock(physicalId),
 			this.readTags(physicalId),
 			this.readLifecycle(physicalId),
@@ -5842,6 +5937,7 @@ var S3BucketProvider = class {
 			BucketName: physicalId,
 			VersioningConfiguration: versioning,
 			BucketEncryption: encryption,
+			OwnershipControls: ownership,
 			PublicAccessBlockConfiguration: pab,
 			Tags: tags,
 			LifecycleConfiguration: lifecycle,
@@ -5861,6 +5957,22 @@ var S3BucketProvider = class {
 	async readVersioning(bucket) {
 		return { Status: (await this.s3Client.send(new GetBucketVersioningCommand({ Bucket: bucket }))).Status ?? "Suspended" };
 	}
+	/**
+	* OwnershipControls { Rules: [{ ObjectOwnership }] }. Always emit a
+	* placeholder (empty `Rules`) so a console-side change on a bucket that
+	* declares the property surfaces as drift. Added with issue #1466 — without
+	* a read here, `cdkd drift` could not see ownership controls at all, which
+	* is why the removal bug that issue fixes produced no signal from ANY
+	* command.
+	*/
+	async readOwnershipControls(bucket) {
+		try {
+			return { Rules: ((await this.s3Client.send(new GetBucketOwnershipControlsCommand({ Bucket: bucket }))).OwnershipControls?.Rules ?? []).map((r) => ({ ObjectOwnership: r.ObjectOwnership })) };
+		} catch (err) {
+			if (err.name === "OwnershipControlsNotFoundError") return { Rules: [] };
+			throw err;
+		}
+	}
 	async readEncryption(bucket) {
 		try {
 			return { ServerSideEncryptionConfiguration: ((await this.s3Client.send(new GetBucketEncryptionCommand({ Bucket: bucket }))).ServerSideEncryptionConfiguration?.Rules ?? []).map((rule) => {
@@ -33019,13 +33131,14 @@ var GlueProvider = class {
 		const tableName = tableInput["Name"] ?? properties["Name"];
 		if (!tableName) throw new ProvisioningError(`TableInput.Name or top-level Name is required for Glue Table ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
+		assertIcebergTableInputAbsent(logicalId, resourceType, properties);
 		const openTableFormatInput = properties["OpenTableFormatInput"];
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
 				DatabaseName: databaseName,
 				TableInput: this.buildTableInput(tableInput, tableName),
-				...openTableFormatInput !== void 0 && { OpenTableFormatInput: toSdkOpenTableFormatInput(openTableFormatInput) }
+				...openTableFormatInput !== void 0 && { OpenTableFormatInput: openTableFormatInput }
 			}));
 			const physicalId = `${databaseName}|${tableName}`;
 			this.logger.debug(`Successfully created Glue Table ${logicalId}: ${physicalId}`);
@@ -33045,6 +33158,8 @@ var GlueProvider = class {
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
+		const updateIcebergKey = findIcebergTableInputKey(properties);
+		if (updateIcebergKey !== void 0) this.logger.warn(icebergTableInputRefusalMessage(logicalId, updateIcebergKey, "update"));
 		try {
 			await this.getClient().send(new UpdateTableCommand$1({
 				CatalogId: catalogId,
@@ -33600,32 +33715,100 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /**
-* Convert the CFn `AWS::Glue::Table.OpenTableFormatInput` blob to the SDK
-* `OpenTableFormatInput` shape.
-*
-* Every key matches the SDK model except one: CFn's
-* `IcebergInput.IcebergTableInput` is the SDK's
-* `IcebergInput.CreateIcebergTableInput` (@aws-sdk/client-glue `models_1.d.ts`
-* `IcebergInput`). The AWS SDK v3 serializer drops unknown members, so leaving
-* the CFn spelling in place silently discarded the ENTIRE Iceberg table spec
-* (`Location` / `Schema` / `PartitionSpec` / `WriteOrder` / `Properties`) while
-* `CreateTable` still reported success. The renamed object's own members match
-* CFn 1:1, so this is a single key rename.
-*
-* Non-object inputs (an unresolved intrinsic) pass through untouched so AWS
-* surfaces the real validation error.
-*/
-function toSdkOpenTableFormatInput(input) {
-	const iceberg = input["IcebergInput"];
-	if (typeof iceberg !== "object" || iceberg === null || Array.isArray(iceberg) || !("IcebergTableInput" in iceberg)) return input;
-	const { IcebergTableInput: icebergTableInput, ...rest } = iceberg;
-	return {
-		...input,
-		IcebergInput: {
-			...rest,
-			CreateIcebergTableInput: icebergTableInput
-		}
-	};
+* Both spellings of the Iceberg table spec cdkd refuses inside
+* `OpenTableFormatInput.IcebergInput`: the CFn registry schema's
+* `IcebergTableInput` and `@aws-sdk/client-glue`'s `CreateIcebergTableInput`.
+* A hand-written template can carry either, and neither is deployable, so the
+* pre-flight matches both and names whichever it found.
+*/
+const ICEBERG_TABLE_INPUT_KEYS = ["IcebergTableInput", "CreateIcebergTableInput"];
+/**
+* Return whichever {@link ICEBERG_TABLE_INPUT_KEYS} spelling the template
+* carries under `OpenTableFormatInput.IcebergInput`, or `undefined`.
+*
+* Non-object shapes at either level (an unresolved intrinsic) are treated as
+* "absent" so AWS surfaces the real validation error rather than this refusal.
+*/
+function findIcebergTableInputKey(properties) {
+	const openTableFormatInput = properties["OpenTableFormatInput"];
+	if (typeof openTableFormatInput !== "object" || openTableFormatInput === null || Array.isArray(openTableFormatInput)) return;
+	const iceberg = openTableFormatInput["IcebergInput"];
+	if (typeof iceberg !== "object" || iceberg === null || Array.isArray(iceberg)) return;
+	return ICEBERG_TABLE_INPUT_KEYS.find((key) => key in iceberg);
+}
+/**
+* PRE-FLIGHT REFUSAL of `AWS::Glue::Table`
+* `OpenTableFormatInput.IcebergInput.IcebergTableInput` (issue #1454).
+*
+* **This is a deliberate PARITY DIVERGENCE, and it was a conscious choice.**
+* cdkd's compatibility target is CloudFormation, and CloudFormation does not
+* validate this property — it forwards it and lets the deploy roll back. cdkd
+* refuses it EARLIER and with a better message instead. The justification is
+* that no user is losing a working deployment: the live probe on issue #1408
+* (2026-08-09, us-east-1 — 5 raw `glue:CreateTable` shapes plus 5
+* `AWS::Glue::Table` CloudFormation stacks) proved the property is undeployable
+* on BOTH paths.
+*
+* - **The raw `glue:CreateTable` API — the call cdkd itself makes** — rejects
+*   every `CreateIcebergTableInput` shape: without a
+*   `TableInput.StorageDescriptor` it fails `Location information cannot be
+*   null while creating an iceberg table`, and with one it fails `Table
+*   metadata information present at multiple parts of input request`. The
+*   spec's own `Location` is never read. So this is NOT merely cdkd declining
+*   what CloudFormation declines — cdkd's own path cannot deploy it either.
+* - **CloudFormation** rolls back all three variants with `Table metadata is
+*   expected only via TableInput or via IcebergTableInputProperties inside
+*   OpenTableFormatInput` — naming a property that exists in NEITHER the CFn
+*   registry schema (`IcebergInput.IcebergTableInput`) NOR
+*   `@aws-sdk/client-glue` (`IcebergInput.CreateIcebergTableInput`). That
+*   three-way contract mismatch is an AWS-side bug.
+*
+* Because there is no shape in which the property works, forwarding it can only
+* produce a late, cryptic AWS error. Failing fast with the working shape spelled
+* out is strictly more useful.
+*
+* **CREATE only — update WARNS instead.** See the comment at the `updateTable`
+* call site: rollback replays from cdkd STATE, and a table created by a
+* pre-#1390 build carries the key in its state record, so refusing on update
+* would make such a table unrollbackable with no template-side remedy. cdkd
+* does not wire Glue's update-only `UpdateOpenTableFormatInput` shape and
+* `buildTableInput` is an explicit allow-list, so warning there forwards
+* nothing and loses no protection. One rollback arm is still exposed — the
+* reverse-replacement re-create replays a state record through `create()`;
+* see issue #1463 and the note at the `updateTable` call site.
+*
+* **Known bypass: the sticky Cloud Control route.** This is a GlueProvider
+* pre-flight, so it only runs on the SDK route. When a table's state record
+* carries `provisionedBy: 'cc-api'`, `ProviderRegistry.getProviderFor` sticky-
+* routes it to `CloudControlProvider`, which forwards the property to
+* CloudFormation and gets AWS's rollback instead of this message. That route is
+* opt-in only (`--recreate-via-cc-api`, or a legacy state record) —
+* `AWS::Glue::Table` has an empty `silentDrop` map, so no ordinary deploy takes
+* it. The outcome there is still a failure, just a later and less helpful one,
+* which is why this is documented rather than duplicated into the CC provider.
+*
+* **WARNING before relaxing this refusal.** cdkd used to RENAME the CFn
+* `IcebergTableInput` to the SDK's `CreateIcebergTableInput` (issue #1390); that
+* rename existed because the AWS SDK v3 serializer DROPS unknown members, so the
+* CFn spelling silently discarded the entire Iceberg spec while `CreateTable`
+* reported success. The rename was removed here as unreachable once this
+* refusal landed. If AWS ever ships a deployable shape and this check is
+* relaxed, the rename MUST be restored in the same change — otherwise the
+* silent-drop bug of #1390 comes straight back.
+*/
+function assertIcebergTableInputAbsent(logicalId, resourceType, properties, physicalId) {
+	const key = findIcebergTableInputKey(properties);
+	if (key === void 0) return;
+	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId, physicalId);
+}
+/**
+* The shared #1454 message body, so the CREATE refusal and the UPDATE warning
+* cannot drift apart. `mode` only changes the lead clause — everything after it
+* (the probe evidence and the working shape) is identical, because the user's
+* next action is the same either way.
+*/
+function icebergTableInputRefusalMessage(logicalId, key, mode) {
+	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
 }
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
@@ -65415,7 +65598,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.20");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.22");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;