@go-to-k/cdkd 0.278.41 → 0.278.42

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-CiMIsVFt.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DxexHYwK.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CoBHZKJt.js";
+import { t as ASGProvider } from "./asg-provider-mwqciloR.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3688,11 +3688,11 @@ var IAMAccessKeyProvider = class {
 	* exist on AWS without a cdkd state record, and the next deploy's re-CREATE
 	* would burn the user's 2-keys-per-user quota.
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating IAM access key ${logicalId}`);
 		const userName = properties["UserName"];
 		if (!userName) throw new ProvisioningError(`AccessKey ${logicalId} requires UserName`, resourceType, logicalId);
-		const status = properties["Status"] ?? "Active";
+		const status = requireConfigString(properties["Status"], "Active", "AWS::IAM::AccessKey Status", replayWarn(this.logger, context));
 		try {
 			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
 			const accessKeyId = response.AccessKey?.AccessKeyId;
@@ -3747,10 +3747,11 @@ var IAMAccessKeyProvider = class {
 	* that REMOVES `Status` resets to the CFn default `Active` (absent-field
 	* removal semantics), so the desired status is always sent explicitly.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating IAM access key ${logicalId}: ${physicalId}`);
 		const userName = properties["UserName"];
-		const status = properties["Status"] ?? "Active";
+		const previousStatus = previousProperties["Status"] === "Inactive" ? "Inactive" : "Active";
+		const status = properties["Status"] === void 0 ? "Active" : requireConfigString(properties["Status"], previousStatus, "AWS::IAM::AccessKey Status", { onUnusable: (message) => this.logger.warn(message) });
 		try {
 			await this.iamClient.send(new UpdateAccessKeyCommand({
 				UserName: userName,
@@ -10792,7 +10793,10 @@ var LambdaEventInvokeConfigProvider = class {
 	}
 	buildPutInput(properties) {
 		const functionName = properties["FunctionName"];
-		const qualifier = properties["Qualifier"] ?? "$LATEST";
+		const qualifier = requireConfigString(properties["Qualifier"], "$LATEST", "AWS::Lambda::EventInvokeConfig Qualifier", {
+			coerceNumber: true,
+			onUnusable: (message) => this.logger.warn(message)
+		});
 		const input = { FunctionName: functionName };
 		if (qualifier !== "$LATEST") input.Qualifier = qualifier;
 		if (properties["MaximumEventAgeInSeconds"] !== void 0) input.MaximumEventAgeInSeconds = Number(properties["MaximumEventAgeInSeconds"]);
@@ -10801,11 +10805,14 @@ var LambdaEventInvokeConfigProvider = class {
 		if (dest) input.DestinationConfig = dest;
 		return input;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Lambda EventInvokeConfig ${logicalId}`);
 		const functionName = properties["FunctionName"];
 		if (!functionName) throw new ProvisioningError(`FunctionName is required for Lambda EventInvokeConfig ${logicalId}`, resourceType, logicalId);
-		const qualifier = properties["Qualifier"] ?? "$LATEST";
+		const qualifier = requireConfigString(properties["Qualifier"], "$LATEST", "AWS::Lambda::EventInvokeConfig Qualifier", {
+			coerceNumber: true,
+			...replayWarn(this.logger, context)
+		});
 		try {
 			await this.lambdaClient.send(new PutFunctionEventInvokeConfigCommand(this.buildPutInput(properties)));
 			const physicalId = this.buildPhysicalId(functionName, qualifier);
@@ -17241,20 +17248,20 @@ var EC2Provider = class {
 		const awsClients = getAwsClients();
 		this.ec2Client = awsClients.ec2;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.createVpc(logicalId, resourceType, properties);
 			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties);
 			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties);
-			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties);
+			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
 			case "AWS::EC2::RouteTable": return this.createRouteTable(logicalId, resourceType, properties);
 			case "AWS::EC2::Route": return this.createRoute(logicalId, resourceType, properties);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.createSubnetRouteTableAssociation(logicalId, resourceType, properties);
 			case "AWS::EC2::SecurityGroup": return this.createSecurityGroup(logicalId, resourceType, properties);
-			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties);
-			case "AWS::EC2::Instance": return this.createInstance(logicalId, resourceType, properties);
+			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
+			case "AWS::EC2::Instance": return this.createInstance(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NetworkAcl": return this.createNetworkAcl(logicalId, resourceType, properties);
 			case "AWS::EC2::NetworkAclEntry": return this.createNetworkAclEntry(logicalId, resourceType, properties);
 			case "AWS::EC2::SubnetNetworkAclAssociation": return this.createSubnetNetworkAclAssociation(logicalId, resourceType, properties);
@@ -17702,11 +17709,11 @@ var EC2Provider = class {
 		if (physicalId.startsWith("eipalloc-")) return { allocationId: physicalId };
 		return { publicIp: physicalId };
 	}
-	async createEip(logicalId, resourceType, properties) {
+	async createEip(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating EIP ${logicalId}`);
 		try {
 			const response = await this.ec2Client.send(new AllocateAddressCommand({
-				Domain: properties["Domain"] ?? "vpc",
+				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
 				NetworkBorderGroup: properties["NetworkBorderGroup"],
 				PublicIpv4Pool: properties["PublicIpv4Pool"]
 			}));
@@ -18254,17 +18261,32 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async createSecurityGroupIngress(logicalId, resourceType, properties) {
+	/**
+	* @param onUnusableProtocol When supplied, a malformed `IpProtocol` WARNS and
+	*   defaults instead of throwing. Passed by `updateSecurityGroupIngress`,
+	*   which reaches this method as the re-create half of a delete-then-create
+	*   replacement: by then `RevokeSecurityGroupIngress` has already committed,
+	*   so a refusal would leave the rule deleted from AWS with the op failed —
+	*   and on a rollback replay the value comes from a STATE record, which no
+	*   template edit can fix. Absent (the plain CREATE dispatch) it throws.
+	*/
+	async createSecurityGroupIngress(logicalId, resourceType, properties, onUnusableProtocol) {
 		this.logger.debug(`Creating SecurityGroupIngress ${logicalId}`);
 		const groupId = properties["GroupId"];
 		if (!groupId) throw new ProvisioningError(`GroupId is required for SecurityGroupIngress ${logicalId}`, resourceType, logicalId);
-		const ipProtocol = properties["IpProtocol"] ?? "-1";
+		const ipProtocol = requireConfigString(properties["IpProtocol"], "-1", "AWS::EC2::SecurityGroupIngress IpProtocol", {
+			coerceNumber: true,
+			...onUnusableProtocol && { onUnusable: onUnusableProtocol }
+		});
 		const fromPort = properties["FromPort"];
 		const toPort = properties["ToPort"];
 		try {
 			await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
-				IpPermissions: [this.buildIpPermission(properties)]
+				IpPermissions: [{
+					...this.buildIpPermission(properties),
+					IpProtocol: ipProtocol
+				}]
 			}));
 			const physicalId = `${groupId}|${ipProtocol}|${fromPort ?? "-1"}|${toPort ?? "-1"}`;
 			this.logger.debug(`Successfully created SecurityGroupIngress ${logicalId}: ${physicalId}`);
@@ -18293,7 +18315,7 @@ var EC2Provider = class {
 		};
 		try {
 			await this.deleteSecurityGroupIngress(logicalId, physicalId, resourceType, previousProperties);
-			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties);
+			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties, (message) => this.logger.warn(message));
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
@@ -18331,11 +18353,11 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to delete SecurityGroupIngress ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createInstance(logicalId, resourceType, properties) {
+	async createInstance(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating EC2 Instance ${logicalId}`);
 		const imageId = properties["ImageId"];
 		if (!imageId) throw new ProvisioningError(`ImageId is required for EC2 Instance ${logicalId}`, resourceType, logicalId);
-		const instanceType = properties["InstanceType"] ?? "t3.micro";
+		const instanceType = requireConfigString(properties["InstanceType"], "t3.micro", "AWS::EC2::Instance InstanceType", replayWarn(this.logger, context));
 		try {
 			const securityGroupIds = properties["SecurityGroupIds"];
 			const securityGroups = properties["SecurityGroups"];
@@ -19988,14 +20010,14 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	/**
 	* Create a resource
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::ApiGateway::Account": return this.createAccount(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Authorizer": return this.createAuthorizer(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Resource": return this.createResource(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Deployment": return this.createDeployment(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Stage": return this.createStage(logicalId, resourceType, properties);
-			case "AWS::ApiGateway::Method": return this.createMethod(logicalId, resourceType, properties);
+			case "AWS::ApiGateway::Method": return this.createMethod(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -20623,12 +20645,12 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	* fixed in PR #373; this cleanup makes any future shape of
 	* post-`PutMethod` failure self-healing on the next redeploy.
 	*/
-	async createMethod(logicalId, resourceType, properties) {
+	async createMethod(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating API Gateway Method ${logicalId}`);
 		const restApiId = properties["RestApiId"];
 		const resourceId = properties["ResourceId"];
 		const httpMethod = properties["HttpMethod"];
-		const authorizationType = properties["AuthorizationType"] ?? "NONE";
+		const authorizationType = requireConfigString(properties["AuthorizationType"], "NONE", "AWS::ApiGateway::Method AuthorizationType", replayWarn(this.logger, context));
 		const authorizerId = properties["AuthorizerId"];
 		const apiKeyRequired = properties["ApiKeyRequired"];
 		const operationName = properties["OperationName"];
@@ -28690,10 +28712,10 @@ var RDSDBProxyTargetGroupProvider = class {
 		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.rdsClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		const dbProxyName = properties["DBProxyName"];
 		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyTargetGroup ${logicalId}`, resourceType, logicalId);
-		const targetGroupName = properties["TargetGroupName"] ?? "default";
+		const targetGroupName = requireConfigString(properties["TargetGroupName"], "default", "AWS::RDS::DBProxyTargetGroup TargetGroupName", replayWarn(this.logger, context));
 		const dbClusterIdentifiers = properties["DBClusterIdentifiers"];
 		const dbInstanceIdentifiers = properties["DBInstanceIdentifiers"];
 		const connectionPoolConfig = properties["ConnectionPoolConfigurationInfo"];
@@ -28752,10 +28774,10 @@ var RDSDBProxyTargetGroupProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const dbProxyName = properties["DBProxyName"];
 		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyTargetGroup ${logicalId} update`, resourceType, logicalId, physicalId);
-		const targetGroupName = properties["TargetGroupName"] ?? "default";
+		const targetGroupName = requireConfigString(properties["TargetGroupName"], "default", "AWS::RDS::DBProxyTargetGroup TargetGroupName", { onUnusable: (message) => this.logger.warn(message) });
 		for (const field of ["DBProxyName", "TargetGroupName"]) {
 			const oldVal = previousProperties[field];
-			const newVal = properties[field];
+			const newVal = field === "TargetGroupName" ? targetGroupName : properties[field];
 			const normalize = (v) => field === "TargetGroupName" && (v === void 0 || v === "default") ? "default" : v;
 			if (JSON.stringify(normalize(oldVal)) !== JSON.stringify(normalize(newVal))) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${field} is immutable on AWS::RDS::DBProxyTargetGroup — destroy + redeploy to change it`);
 		}
@@ -67329,7 +67351,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.41");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.42");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;