@go-to-k/cdkd 0.278.37 → 0.278.38

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-bEhHOGVR.js";
+import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-DIvnBeMj.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BTeSlton.js";
+import { t as ASGProvider } from "./asg-provider-CaulrRij.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
+import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRoleCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -49069,6 +49069,208 @@ function isPlainObject(value) {
 	return typeof value === "object" && value !== null;
 }
 
+//#endregion
+//#region src/analyzer/drift-principal-normalize.ts
+/**
+* IAM principal-form canonicalization for the drift comparator (issue #1515).
+*
+* AWS renders an IAM role / user principal inside a resource policy in TWO
+* forms and picks between them on its own schedule:
+*
+*   - the ARN — `arn:aws:iam::<acct>:role/<name>`
+*   - the principal's UNIQUE ID — `AROA…` (role) / `AIDA…` (user)
+*
+* The unique-id form is substituted when the referenced principal is
+* transiently unresolvable at write time (it is being created or replaced) and
+* AWS re-renders the ARN once it resolves. cdkd's deploy-time
+* `observedProperties` capture stores whichever form the read returned at that
+* moment, so a later `cdkd drift` can compare `AROA…` against the ARN for the
+* very same principal and report PERMANENT phantom drift — `--revert` writes
+* the recorded form back, AWS re-canonicalizes on write, and the next run
+* reports the identical difference (the class of issues #1096 / #1498, on a
+* different property).
+*
+* Unlike the order-normalization passes in `drift-normalize.ts`, this one
+* CANNOT be pure: the mapping between the two forms is not derivable from the
+* string. So the shape detection here is pure and an injected
+* {@link PrincipalUniqueIdResolver} does the one lookup, which lets the whole
+* pass be unit-tested without AWS and keeps the API cost at zero for the
+* overwhelmingly common case — a policy with no unique-id principal makes NO
+* AWS call at all.
+*
+* Both sides are rewritten to the ARN form, never one side only. The race that
+* produces the mismatch is symmetric (the 2026-08-10 evidence on the
+* `drift-revert` fixture had the baseline holding `AROA…` and AWS the ARN, but
+* the reverse ordering is equally reachable), and normalizing a single side is
+* the mistake `drift-normalize.ts`'s header already records for the unordered
+* passes — it manufactures drift on the `properties`-fallback baseline.
+*
+* FAILING IS VISIBLE, never silent: when the resolver cannot answer (the role
+* was deleted — which is exactly when AWS keeps the unique id forever — the
+* caller lacks `iam:GetRole`, or the ARN names another ACCOUNT / IAM PATH, for
+* which the name-only `GetRole` API would otherwise answer about the caller's
+* own same-named role), both sides are left untouched and the drift is still
+* reported. This pass only ever removes a difference it has PROVEN to be two
+* spellings of one principal; it can never hide a real principal change.
+*
+* One downstream note: because the comparator's inputs are canonicalized,
+* `cdkd drift --accept` records the ARN form for a policy subtree that drifts
+* for some OTHER reason while also carrying a canonicalized principal — i.e.
+* the accepted baseline can hold a spelling AWS did not literally return. That
+* is benign (it is the form AWS re-canonicalizes to, and a later run
+* normalizes either way) but it is a real difference from "state records
+* exactly what AWS said", so it is written down rather than left to be
+* rediscovered.
+*
+* Known bound: a policy carried as a JSON STRING rather than a parsed object is
+* not walked. Re-serializing a parsed string would risk changing its formatting
+* and manufacturing a different phantom drift, so the pass is scoped to the
+* object shape — which is what `AWS::S3::BucketPolicy` and the other
+* `PolicyDocument`-typed properties carry in cdkd state.
+*/
+/**
+* An IAM unique id as it appears in a rendered policy. The prefix set is
+* deliberately narrow — `AROA` (role) and `AIDA` (user) are the only two that
+* can stand in for an ARN at a `Principal.AWS` position; `AGPA` (group),
+* `AKIA` (access key) and friends are never rendered there.
+*/
+const PRINCIPAL_UNIQUE_ID_RE = /^A(?:ROA|IDA)[A-Z0-9]{6,}$/;
+/** An IAM role / user ARN — the two shapes a unique id can stand in for. */
+const IAM_PRINCIPAL_ARN_RE = /^arn:[a-z0-9-]+:iam::\d{12}:(role|user)\/(.+)$/;
+/**
+* Split an IAM role / user principal ARN into what the lookup API needs, or
+* `undefined` when the string is not one (a service principal, an
+* `assumed-role` STS ARN, `*`, …).
+*
+* Exported so the resolver in `drift.ts` recognizes exactly the ARNs
+* {@link collectPrincipalArns} collects — one regex, so the collector and the
+* lookup cannot drift apart and leave an ARN gathered but never resolvable.
+*/
+function parseIamPrincipalArn(arn) {
+	const match = IAM_PRINCIPAL_ARN_RE.exec(arn);
+	if (!match) return void 0;
+	const name = match[2].split("/").pop();
+	if (!name) return void 0;
+	return {
+		kind: match[1],
+		name
+	};
+}
+/** Every string at a `Principal` / `NotPrincipal` position, at any depth. */
+function collectPrincipalStrings(value, out) {
+	if (Array.isArray(value)) {
+		for (const element of value) collectPrincipalStrings(element, out);
+		return;
+	}
+	if (!value || typeof value !== "object") return;
+	for (const [key, member] of Object.entries(value)) {
+		if (key === "Principal" || key === "NotPrincipal") pushPrincipalValue(member, out);
+		collectPrincipalStrings(member, out);
+	}
+}
+/**
+* The strings a `Principal` / `NotPrincipal` value contributes: the bare string
+* form, and the `AWS` member of the object form (string or array). `Service` /
+* `Federated` / `CanonicalUser` are deliberately NOT read — none of them can
+* carry an IAM unique id or a role ARN.
+*/
+function pushPrincipalValue(value, out) {
+	if (typeof value === "string") {
+		out.push(value);
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const element of value) if (typeof element === "string") out.push(element);
+		return;
+	}
+	if (!value || typeof value !== "object") return;
+	const awsMember = value["AWS"];
+	if (typeof awsMember === "string") out.push(awsMember);
+	else if (Array.isArray(awsMember)) {
+		for (const element of awsMember) if (typeof element === "string") out.push(element);
+	}
+}
+/**
+* Both interesting principal kinds in ONE walk — the pass runs per resource on
+* both comparison sides, so walking the bag twice to answer two questions about
+* the same strings is pure cost.
+*/
+function collectPrincipalForms(value) {
+	const strings = [];
+	collectPrincipalStrings(value, strings);
+	const uniqueIds = /* @__PURE__ */ new Set();
+	const arns = /* @__PURE__ */ new Set();
+	for (const s of strings) if (PRINCIPAL_UNIQUE_ID_RE.test(s)) uniqueIds.add(s);
+	else if (IAM_PRINCIPAL_ARN_RE.test(s)) arns.add(s);
+	return {
+		uniqueIds,
+		arns
+	};
+}
+/**
+* Replace every principal string that is a KNOWN unique id with the ARN it was
+* proven to stand for. Only `Principal` / `NotPrincipal` positions are touched
+* — a unique id appearing in, say, a `Condition` value is left alone, where the
+* two forms are NOT interchangeable.
+*/
+function rewritePrincipalUniqueIds(value, arnByUniqueId) {
+	if (Array.isArray(value)) return value.map((el) => rewritePrincipalUniqueIds(el, arnByUniqueId));
+	if (!value || typeof value !== "object") return value;
+	const out = {};
+	for (const [key, member] of Object.entries(value)) out[key] = key === "Principal" || key === "NotPrincipal" ? rewritePrincipalValue(member, arnByUniqueId) : rewritePrincipalUniqueIds(member, arnByUniqueId);
+	return out;
+}
+function rewritePrincipalValue(value, arnByUniqueId) {
+	const swap = (s) => typeof s === "string" ? arnByUniqueId.get(s) ?? s : rewritePrincipalUniqueIds(s, arnByUniqueId);
+	if (typeof value === "string") return swap(value);
+	if (Array.isArray(value)) return value.map(swap);
+	if (!value || typeof value !== "object") return value;
+	const out = {};
+	for (const [key, member] of Object.entries(value)) {
+		if (key !== "AWS") {
+			out[key] = rewritePrincipalUniqueIds(member, arnByUniqueId);
+			continue;
+		}
+		out[key] = Array.isArray(member) ? member.map(swap) : swap(member);
+	}
+	return out;
+}
+/**
+* Canonicalize the two comparison sides so that a principal AWS rendered as a
+* unique id on one side and as an ARN on the other stops reading as drift.
+*
+* Short-circuits — with NO resolver call — unless BOTH a unique id and an IAM
+* ARN are present across the two sides, since a unique id with no candidate ARN
+* opposite it has nothing to be equal to.
+*/
+async function canonicalizePrincipalUniqueIds(baseline, aws, resolve) {
+	const baselineForms = collectPrincipalForms(baseline);
+	const awsForms = collectPrincipalForms(aws);
+	const uniqueIds = /* @__PURE__ */ new Set([...baselineForms.uniqueIds, ...awsForms.uniqueIds]);
+	if (uniqueIds.size === 0) return {
+		baseline,
+		aws
+	};
+	const arns = /* @__PURE__ */ new Set([...baselineForms.arns, ...awsForms.arns]);
+	if (arns.size === 0) return {
+		baseline,
+		aws
+	};
+	const arnByUniqueId = /* @__PURE__ */ new Map();
+	for (const arn of arns) {
+		const uniqueId = await resolve(arn);
+		if (uniqueId !== void 0 && uniqueIds.has(uniqueId)) arnByUniqueId.set(uniqueId, arn);
+	}
+	if (arnByUniqueId.size === 0) return {
+		baseline,
+		aws
+	};
+	return {
+		baseline: rewritePrincipalUniqueIds(baseline, arnByUniqueId),
+		aws: rewritePrincipalUniqueIds(aws, arnByUniqueId)
+	};
+}
+
 //#endregion
 //#region src/analyzer/drift-cc-api-deny-list.ts
 /**
@@ -49283,11 +49485,12 @@ async function driftCommand(stacks, options) {
 		registerAllProviders(providerRegistry);
 		providerRegistry.setCustomResourceResponseBucket(bucket);
 		const ccApiFallback = new CloudControlProvider();
+		const resolvePrincipalUniqueId = createIamPrincipalUniqueIdResolver(awsClients);
 		const targetRefs = resolveTargetRefs(stacks, await stateBackend.listStacks(), options);
 		const reports = [];
 		for (const ref of targetRefs) {
 			if (!ref.region) throw new Error(`Stack '${ref.stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${ref.stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run drift detection.`);
-			const report = await runDriftForStack(ref.stackName, ref.region, stateBackend, providerRegistry, ccApiFallback);
+			const report = await runDriftForStack(ref.stackName, ref.region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId);
 			reports.push(report);
 		}
 		if (options.json) writeJsonReport(reports);
@@ -49349,13 +49552,75 @@ function resolveTargetRefs(stacks, stateRefs, options) {
 	return out;
 }
 /**
+* The live half of the #1515 principal canonicalization: resolve an IAM role /
+* user ARN to that principal's unique id (`AROA…` / `AIDA…`).
+*
+* Results are cached per ARN for the whole command — INCLUDING the failures, so
+* a deleted role (the case where AWS keeps the unique id forever, and therefore
+* the likeliest one to appear here) costs exactly one API call rather than one
+* per resource that references it.
+*
+* Every failure resolves to `undefined` rather than throwing: a missing
+* `iam:GetRole` permission, a cross-account principal, or a deleted role must
+* leave the comparison exactly as it was — the drift is then reported, which is
+* the safe direction. Drift detection must never fail because a cosmetic
+* normalization could not run.
+*
+* **The response ARN is compared back to the requested one, and that check is
+* what makes the "never hides a real change" claim true rather than aspirational.**
+* `GetRole` / `GetUser` are account-local and take a NAME, not an ARN, so the
+* lookup silently answers about the CALLER's account and about the wrong IAM
+* path: `arn:aws:iam::<other-acct>:role/Foo` and
+* `arn:aws:iam::<self>:role/prod/Foo` would both come back as this account's
+* root-path `Foo`, and the pass would then "prove" two DIFFERENT principals
+* equal and collapse a genuine drift. Round-tripping the ARN costs nothing and
+* turns both cases into an unresolved lookup, i.e. drift reported.
+*/
+function createIamPrincipalUniqueIdResolver(awsClients) {
+	const cache = /* @__PURE__ */ new Map();
+	let warnedOnDenied = false;
+	return async (arn) => {
+		if (cache.has(arn)) return cache.get(arn);
+		let uniqueId;
+		const principal = parseIamPrincipalArn(arn);
+		if (principal) try {
+			let entityArn;
+			let entityId;
+			if (principal.kind === "role") {
+				const role = (await awsClients.iam.send(new GetRoleCommand({ RoleName: principal.name }))).Role;
+				entityArn = role?.Arn;
+				entityId = role?.RoleId;
+			} else {
+				const user = (await awsClients.iam.send(new GetUserCommand({ UserName: principal.name }))).User;
+				entityArn = user?.Arn;
+				entityId = user?.UserId;
+			}
+			if (entityArn !== void 0 && entityArn.toLowerCase() === arn.toLowerCase()) uniqueId = entityId;
+			else getLogger().debug(`Principal ${arn} resolved to ${entityArn ?? "no entity"} — same name in this account or under another IAM path; leaving the policy principal comparison untouched.`);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			const name = error instanceof Error ? error.name : "";
+			const status = error?.$metadata?.httpStatusCode;
+			const denied = /^AccessDenied|^NotAuthorized/i.test(name) || status === 403;
+			if (!warnedOnDenied && denied) {
+				warnedOnDenied = true;
+				getLogger().warn(`Cannot read IAM principals (${name || "access denied"}). A resource policy whose principal AWS rendered as a unique id (AROA…/AIDA…) may therefore report drift that is only a spelling difference; grant iam:GetRole / iam:GetUser to resolve it, or re-run with --verbose for the full error.`);
+			}
+			getLogger().debug(`Could not resolve the unique id of principal ${arn} (${message}); leaving the policy principal comparison untouched.`);
+			if (isThrottlingError(error)) return void 0;
+		}
+		cache.set(arn, uniqueId);
+		return uniqueId;
+	};
+}
+/**
 * Run drift detection for one stack and shape the per-resource outcomes
 * into a {@link StackDriftReport}. The state object + etag are stored on
 * the report so `--accept` can write back without a re-read, and
 * `--revert` can pass the captured AWS-current snapshot to
 * `provider.update` as the `previousProperties` argument.
 */
-async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback) {
+async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId) {
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
 	return await withStackName(stackName, async () => {
@@ -49421,7 +49686,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			const useObserved = resource.observedProperties !== void 0;
 			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
 			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
-			const changes = calculateResourceDrift(baseline, aws, {
+			const normalized = await canonicalizePrincipalUniqueIds(baseline, aws, resolvePrincipalUniqueId);
+			const changes = calculateResourceDrift(normalized.baseline, normalized.aws, {
 				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 				unionWalkObjects: useObserved,
 				unorderedPaths
@@ -66897,7 +67163,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.37");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.38");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;