@go-to-k/cdkd 0.294.8 → 0.294.9

package/dist/{provider-classes-DlVxBF89.js → provider-classes-DCbt28RB.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-B46YMG0h.js";
 import { $ as compositeIdFormatMessage, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, Ct as injectiveKeyPrefix, D as ProtectionFlipRegistry, Dn as markNameCollision, Dt as withPasteableAwsProfile, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, J as isInterruptedWaitError, Jt as ProvisioningError, L as userPoolProtectionSite, Ln as isAwsAuthoredFailure, M as observeThenDisableProtection, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, On as markReplayMayCollide, Ot as ambientClientDefaults, P as rdsFamilyProtectionSite, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, Rn as safeStringify, S as quotedRemedyLogicalId, St as injectiveKey, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as markRedactedCause, V as isAwsCliLiteral, Vn as isThrottlingError, W as renderDisableCommand, Wn as wrapMaskedAwsError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, _ as VALUE_NOT_SHOWN, _n as shellQuote, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, c as recordedPrincipalsRepair, ct as isSecretDerivedValue, dn as isInertUnquoted, dt as withDerivedNameMasks, et as compositeIdSeparatorRefusal, fn as pasteableCommand, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, j as logGroupProtectionSite, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kt as ambientCredentialConfig, ln as commandHole, lt as maskDeep, mn as plainOrDescribed, nt as logicalIdShown, o as readPrincipalLists, ot as createMaskedLogSinks, p as withRemovalDefaults, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedRetryLogger, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, un as hasClauseBreak, ut as maskerOrIdentity, v as isPlainImportJson, vn as withheldTargetClause, w as remedyLogicalId, x as normalizeAwsTagsToCfn, y as isPlainImportValue, z as UNNAMEABLE_ID_CLAUSE, zn as THROTTLING_ERROR_NAMES } from "./iam-policy-targets-CMSQGQnm.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $i as markAuxiliaryFailure, $t as DBPROXY_TAGS_WHAT, A as deleteTableWithIndexBusyRetry, Aa as carriesSecretMask, Bi as coerceCfnInteger, C as beginDeleteWait, Cn as markWaitAbandoned, Cs as resolveAssemblyPath, D as resolveDynamoDbDeleteBudgetMs, Dn as observeThenDisableInstanceApiTermination, E as resolveDynamoDbDeleteBudgetClock, Ea as dynamicReferenceTokens, En as isTerminationProtectionPropagationError, F as isTruthyCfnBoolean, Fi as coerceWarmThroughput$1, Gi as replayWarn, Hi as configIntegerRefusal, Ii as isWarmThroughputDecrease, Ji as requireConfigString, Jn as s3BucketDomainName, Jt as earliestDefined, Ki as requireConfigArray, Kn as isSettledInstanceState, Kr as refuseMalformedNestedChildOutputs, Li as toCfnInteger, M as ECR_AUTO_DELETE_IMAGES_TAG, N as S3_AUTO_DELETE_OBJECTS_TAG, O as DELETE_INDEX_WAIT_PROCEED_NOTE, On as reDisableInstanceApiTermination, P as hasCdkAutoDeleteTag, Pi as WARM_THROUGHPUT_MEMBERS, Q as getNestedRevertRun, Qi as withRetry, Qt as acquireIdempotencyToken, Ri as toFiniteNumber, S as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Sa as redactSecretsForState, Sn as isWaitAbandonedError, Ss as renderAssemblyPathEscape, T as deleteBudgetKey, Ti as withoutSilentDropProperties, Tn as ec2InstanceProtectionSite, Ui as configStringRefusal, Vi as configBooleanRefusal, Wi as readConfigString, Xn as s3BucketRegionalDomainName, Xt as reserveStackCreateToken, Yn as s3BucketDualStackDomainName, Zn as s3BucketWebsiteUrl, _n as unchangedBehindSecretReference, an as tagPlanWarning, bn as deleteSkipReason, bs as describeFileReadFailure, di as refuseMalformedResourcesForDestroy, dr as parseWebACLArn, ea as canonicalLambdaFunctionName, en as DBPROXY_TAG_OPTIONS, et as revertNestedChildFromJournal, f as getPriorAttempts, hn as slowCcOperationTimeoutMs, ht as getCurrentProducerRegions, in as tagMapAsList, it as withNestedStackContext, j as waitForIndexesSettled, k as INDEX_SETTLE_POLL_INTERVAL_MS, kn as reEnableInstanceApiTermination, ls as canonicalizeRegion, lt as getStackRecords, na as sameLambdaFunctionAddress, nn as readTagList, no as stringifyValue, on as definedAttributes, os as decodeListingKey, p as markRefusedBeforeApplying, pn as getCurrentResourceSecrets, qi as requireConfigObject, qn as s3BucketArn, rn as refuseMalformedDesiredTags, rt as getCurrentNestedStackContext, sn as stringifyIfAssigned, so as rewriteTemplateAssetReferences, st as awaitInFlightSibling, t as DeployEngine, ta as lambdaFunctionNameForMask, tn as planTagDiff, tr as getAccountInfo, ua as hasMaskableValues, us as derivePartitionAndUrlSuffix, w as compensateRemovedDeletionProtection, wa as recoverMaskedOutput, wi as findSilentDropProperties, x as DynamoDBGlobalTableProvider, xa as markSameGenerationBag, xn as withIndeterminateGuard, xs as displayAssemblyPath, zi as coerceCfnBoolean } from "./deploy-engine-C5kAhscq.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CPn7nqoS.js";
-import { a as canonicalizeIpProtocolValue, c as isAbsoluteAssetPath, i as resolveSecretDerivedPrincipals, l as listNestedTemplateRows, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, s as findNestedTemplateTreeDefect, t as canonicalizeIpv4Cidr, u as renderNestedTemplateTreeDefect } from "./program-CVOLJJ2z.js";
-import { RDSProvider } from "./rds-provider-a-vZsR9L.js";
-import { NeptuneProvider } from "./neptune-provider-DlFQdgwe.js";
-import { ASGProvider } from "./asg-provider-CsajFK4_.js";
+import { $t as acquireIdempotencyToken, A as ECR_AUTO_DELETE_IMAGES_TAG, An as reEnableInstanceApiTermination, Bi as toFiniteNumber, C as deleteBudgetKey, Ca as markSameGenerationBag, Cn as isWaitAbandonedError, D as INDEX_SETTLE_POLL_INTERVAL_MS, Di as withoutSilentDropProperties, Dn as isTerminationProtectionPropagationError, Ds as resolveAssemblyPath, E as DELETE_INDEX_WAIT_PROCEED_NOTE, Ea as recoverMaskedOutput, En as ec2InstanceProtectionSite, Es as renderAssemblyPathEscape, F as markRefusedBeforeApplying, Gi as configStringRefusal, Hi as coerceCfnInteger, Ii as WARM_THROUGHPUT_MEMBERS, Ji as requireConfigArray, Jn as s3BucketArn, Ki as readConfigString, Li as coerceWarmThroughput$1, M as hasCdkAutoDeleteTag, Ma as carriesSecretMask, N as isTruthyCfnBoolean, O as deleteTableWithIndexBusyRetry, Oa as dynamicReferenceTokens, On as observeThenDisableInstanceApiTermination, P as getPriorAttempts, Q as getNestedRevertRun, Qn as s3BucketWebsiteUrl, Ri as isWarmThroughputDecrease, S as compensateRemovedDeletionProtection, Sn as withIndeterminateGuard, T as resolveDynamoDbDeleteBudgetMs, Ti as findSilentDropProperties, Ts as displayAssemblyPath, Ui as configBooleanRefusal, Vi as coerceCfnBoolean, Wi as configIntegerRefusal, Xi as requireConfigString, Xn as s3BucketDualStackDomainName, Yi as requireConfigObject, Yn as s3BucketDomainName, Yt as earliestDefined, Zn as s3BucketRegionalDomainName, Zt as reserveStackCreateToken, an as tagMapAsList, b as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, cn as stringifyIfAssigned, do as rewriteTemplateAssetReferences, ea as withRetry, en as DBPROXY_TAGS_WHAT, et as revertNestedChildFromJournal, fa as hasMaskableValues, fi as refuseMalformedResourcesForDestroy, fr as parseWebACLArn, gn as slowCcOperationTimeoutMs, gt as getCurrentProducerRegions, ia as sameLambdaFunctionAddress, in as refuseMalformedDesiredTags, it as withNestedStackContext, j as S3_AUTO_DELETE_OBJECTS_TAG, k as waitForIndexesSettled, kn as reDisableInstanceApiTermination, lt as getStackRecords, mn as getCurrentResourceSecrets, ms as derivePartitionAndUrlSuffix, na as canonicalLambdaFunctionName, nn as planTagDiff, nr as getAccountInfo, on as tagPlanWarning, oo as stringifyValue, ps as canonicalizeRegion, qi as replayWarn, qn as isSettledInstanceState, qr as refuseMalformedNestedChildOutputs, ra as lambdaFunctionNameForMask, rn as readTagList, rt as getCurrentNestedStackContext, sn as definedAttributes, st as awaitInFlightSibling, t as DeployEngine, ta as markAuxiliaryFailure, tn as DBPROXY_TAG_OPTIONS, us as decodeListingKey, vn as unchangedBehindSecretReference, w as resolveDynamoDbDeleteBudgetClock, wa as redactSecretsForState, wn as markWaitAbandoned, ws as describeFileReadFailure, x as beginDeleteWait, xn as deleteSkipReason, y as DynamoDBGlobalTableProvider, zi as toCfnInteger } from "./deploy-engine-BTOCDCWf.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CBT2LPe1.js";
+import { a as canonicalizeIpProtocolValue, c as isAbsoluteAssetPath, i as resolveSecretDerivedPrincipals, l as listNestedTemplateRows, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, s as findNestedTemplateTreeDefect, t as canonicalizeIpv4Cidr, u as renderNestedTemplateTreeDefect } from "./program-DMJnrQOG.js";
+import { RDSProvider } from "./rds-provider-J6zl27x3.js";
+import { NeptuneProvider } from "./neptune-provider-BQ-CGoYJ.js";
+import { ASGProvider } from "./asg-provider-3uLGAhIx.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -45,7 +45,7 @@ import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsFor
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
-import { AlreadyExistsException, ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
@@ -15388,7 +15388,7 @@ var EC2Provider = class {
 		if (input.knownPhysicalId) return this.verifyExplicit(input.logicalId, input.resourceType, input.knownPhysicalId, input.properties ?? {});
 		return null;
 	}
-	async readCurrentState(physicalId, logicalId, resourceType, properties) {
+	async readCurrentState(physicalId, logicalId, resourceType, properties, context) {
 		try {
 			switch (resourceType) {
 				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId);
@@ -15399,10 +15399,11 @@ var EC2Provider = class {
 				case "AWS::EC2::SecurityGroup": return await this.readSecurityGroupCurrentState(physicalId, properties);
 				case "AWS::EC2::Instance": return await this.readInstanceCurrentState(physicalId);
 				case "AWS::EC2::NetworkAcl": return await this.readNetworkAclCurrentState(physicalId);
+				case "AWS::EC2::EIP": return await this.readEipCurrentState(physicalId, properties, context?.afterOwnWrite === true);
 				case "AWS::EC2::VPCGatewayAttachment": return await this.readVpcGatewayAttachmentCurrentState(physicalId);
 				case "AWS::EC2::Route": return await this.readRouteCurrentState(physicalId);
 				case "AWS::EC2::SubnetRouteTableAssociation": return await this.readSubnetRouteTableAssociationCurrentState(physicalId);
-				case "AWS::EC2::SecurityGroupIngress": return await this.readSecurityGroupIngressCurrentState(physicalId, properties);
+				case "AWS::EC2::SecurityGroupIngress": return await this.readSecurityGroupIngressCurrentState(physicalId, properties, context);
 				case "AWS::EC2::NetworkAclEntry": return await this.readNetworkAclEntryCurrentState(physicalId);
 				case "AWS::EC2::SubnetNetworkAclAssociation": return await this.readSubnetNetworkAclAssociationCurrentState(physicalId);
 				default:
@@ -15488,6 +15489,22 @@ var EC2Provider = class {
 		if (primary?.PrivateIp !== void 0) result["PrivateIpAddress"] = primary.PrivateIp;
 		return result;
 	}
+	async readEipCurrentState(physicalId, properties, afterOwnWrite) {
+		const { allocationId, publicIp } = this.parseEipPhysicalId(physicalId);
+		if (!allocationId && !publicIp) return void 0;
+		const addr = (await this.ec2Client.send(new DescribeAddressesCommand(allocationId ? { AllocationIds: [allocationId] } : { PublicIps: [publicIp] }))).Addresses?.find((a) => allocationId ? a.AllocationId === allocationId : a.PublicIp === publicIp);
+		if (!addr) return RESOURCE_NOT_FOUND;
+		const result = {};
+		if (addr.Domain !== void 0) result["Domain"] = addr.Domain;
+		if (addr.InstanceId !== void 0 && properties?.["InstanceId"] != null) result["InstanceId"] = addr.InstanceId;
+		if (addr.NetworkBorderGroup !== void 0) result["NetworkBorderGroup"] = addr.NetworkBorderGroup;
+		if (addr.PublicIpv4Pool !== void 0) result["PublicIpv4Pool"] = addr.PublicIpv4Pool;
+		const tags = normalizeAwsTagsToCfn(addr.Tags);
+		const declared = properties?.["Tags"];
+		const bag = afterOwnWrite && Array.isArray(declared) && !tagListsMatch(tags, declared) ? declared : tags;
+		if (bag.length > 0) result["Tags"] = bag;
+		return result;
+	}
 	async readRouteTableCurrentState(physicalId) {
 		const rt = (await this.ec2Client.send(new DescribeRouteTablesCommand({ RouteTableIds: [physicalId] }))).RouteTables?.[0];
 		if (!rt) return RESOURCE_NOT_FOUND;
@@ -15657,7 +15674,7 @@ var EC2Provider = class {
 		}
 		return RESOURCE_NOT_FOUND;
 	}
-	async readSecurityGroupIngressCurrentState(physicalId, properties) {
+	async readSecurityGroupIngressCurrentState(physicalId, properties, context) {
 		const parts = physicalId.split("|");
 		if (parts.length < 4) return void 0;
 		const groupId = parts[0];
@@ -15678,13 +15695,50 @@ var EC2Provider = class {
 				GroupId: groupId,
 				...match
 			};
-			return;
+			const fallback = await this.readSgIngressByIdentity(groupId, flat, properties, context);
+			return fallback === void 0 ? void 0 : {
+				GroupId: groupId,
+				...fallback
+			};
 		}
 		return {
 			GroupId: groupId,
 			...flat[0]
 		};
 	}
+	async readSgIngressByIdentity(groupId, flat, properties, context) {
+		if (context?.afterOwnWrite === true) return void 0;
+		const recordedId = recordedSgRuleId(context?.attributes);
+		if (recordedId === void 0) return void 0;
+		if (!Number.isFinite(cfnIngressPortValue(properties["FromPort"])) || !Number.isFinite(cfnIngressPortValue(properties["ToPort"]))) return;
+		const identity = (rule) => {
+			const key = JSON.parse(sgRuleKey(rule, "ingress"));
+			delete key["d"];
+			if (properties["SourceSecurityGroupOwnerId"] == null) delete key["peerOwner"];
+			key["f"] = cfnIngressPortValue(rule["FromPort"]);
+			key["t"] = cfnIngressPortValue(rule["ToPort"]);
+			return JSON.stringify(key);
+		};
+		const wanted = identity(properties);
+		const matches = flat.filter((r) => identity(r) === wanted);
+		if (matches.length !== 1) return void 0;
+		const match = matches[0];
+		const siblings = Object.entries(context?.siblings ?? {});
+		if (stackIngressRuleHolder(siblings, "", groupId, properties) !== void 0 || siblings.some(([, sibling]) => sibling.resourceType === "AWS::EC2::SecurityGroupIngress" && recordedSgRuleId(sibling.attributes) === recordedId)) return;
+		let owned;
+		try {
+			owned = (await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({ SecurityGroupRuleIds: [recordedId] }))).SecurityGroupRules?.find((r) => r.SecurityGroupRuleId === recordedId);
+		} catch (err) {
+			this.logger.debug(safeMsg`readCurrentState: recorded rule ${recordedId} could not be read (${describeAwsFailure(err).summary}); the ingress rule stays unknown`);
+			return;
+		}
+		if (owned === void 0 || owned.IsEgress === true || owned.GroupId !== groupId || !securityGroupRuleMatchesCfnIngress(owned, properties) || descriptionKey(owned.Description) !== descriptionKey(match["Description"])) return;
+		return {
+			...match,
+			...properties["FromPort"] != null && { FromPort: properties["FromPort"] },
+			...properties["ToPort"] != null && { ToPort: properties["ToPort"] }
+		};
+	}
 	async readNetworkAclEntryCurrentState(physicalId) {
 		const parts = physicalId.split("|");
 		if (parts.length < 3) return void 0;
@@ -16061,6 +16115,15 @@ function stackIngressRuleHolder(records, selfLogicalId, groupId, rule, idCheck)
 		}
 	}
 }
+function tagListsMatch(live, declared) {
+	const pairs = (list) => list.every((entry) => isPlainRecord$1(entry) && typeof entry["Key"] === "string") ? list.map((entry) => {
+		const tag = entry;
+		return JSON.stringify([tag["Key"], tag["Value"] ?? ""]);
+	}).sort() : void 0;
+	const a = pairs(live);
+	const b = pairs(declared);
+	return a !== void 0 && b !== void 0 && JSON.stringify(a) === JSON.stringify(b);
+}
 function isPlainRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -28554,6 +28617,8 @@ const createGraphqlApiLatch = new AmbiguousCreateLatch("CreateGraphqlApi");
 const graphqlApisCreatedByThisProcess = new RecentIdSet();
 const MAX_GRAPHQL_API_LIST_PAGES = 40;
 const MAX_REPORTED_ORPHAN_APIS = 5;
+const createApiKeyLatch = new AmbiguousCreateLatch("CreateApiKey");
+const apiKeysCreatedByThisProcess = new RecentIdSet();
 const APPSYNC_DATASOURCE_ID_FORMAT = {
 	label: "AppSync DataSource",
 	segments: ["apiId", "name"]
@@ -29755,7 +29820,18 @@ var AppSyncProvider = class {
 			const input = { apiId };
 			if (properties["Description"]) input.description = properties["Description"];
 			if (properties["Expires"]) input.expires = properties["Expires"];
-			apiKeyId = (await this.getClient().send(new CreateApiKeyCommand(input))).apiKey.id;
+			const orphanWindow = createApiKeyLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanApiKeys(logicalId, input, orphanWindow, createMaskedLogSinks(this.logger, context?.maskSecrets));
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await this.getCreateClient().send(new CreateApiKeyCommand(input));
+			} catch (error) {
+				createApiKeyLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			apiKeyId = response.apiKey.id;
+			apiKeysCreatedByThisProcess.add(injectiveKey(apiId, apiKeyId));
 			this.logger.debug(`Successfully created ApiKey ${logicalId}: ${apiKeyId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -29780,6 +29856,31 @@ var AppSyncProvider = class {
 			}
 		};
 	}
+	async reportPossibleOrphanApiKeys(logicalId, input, window, log) {
+		const apiId = String(input.apiId);
+		const description = input.description ?? "";
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.getClient(), aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: "CreateApiKey",
+			service: "AppSync",
+			listAction: "ListApiKeys",
+			subject: `an API key on GraphQL API ${log.value(apiId)}${description === "" ? "" : ` described ${log.value(description)}`}`,
+			noun: "API key(s)",
+			list: () => collectOrphanIds(async (nextToken) => {
+				const page = await this.getClient().send(new ListApiKeysCommand({
+					apiId,
+					maxResults: 25,
+					...nextToken && { nextToken }
+				}));
+				return {
+					items: page.apiKeys ?? [],
+					next: page.nextToken
+				};
+			}, (key) => key.id && (key.description ?? "") === description && !apiKeysCreatedByThisProcess.has(injectiveKey(apiId, key.id)) ? `****${key.id.slice(-4)}${key.expires === void 0 || !Number.isFinite(key.expires) ? "" : ` (expires ${(/* @__PURE__ */ new Date(key.expires * 1e3)).toISOString()})`}` : void 0),
+			inspect: () => aws`aws appsync list-api-keys --api-id ${apiId}${regionArg}`.render()
+		});
+	}
 	async deleteApiKey(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting ApiKey ${logicalId}: ${physicalId}`);
 		const [apiId, apiKeyId] = physicalId.split("|");
@@ -30526,7 +30627,6 @@ var GlueProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			if (error instanceof AlreadyExistsException) throw markNonRetryable(new ProvisioningError(`Failed to create Glue Table ${logicalId}: a table named '${v(tableName)}' is present in database '${v(databaseName)}' (${describeCatalog(catalogId, log.mask)}), so cdkd did not create it and left that table untouched. Choose a TableInput.Name no table holds, or remove that table yourself if it is unwanted. If it is the table this resource already manages, the planned replacement keeps its address: revert the change that planned it.`, resourceType, logicalId, void 0, error));
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create Glue Table ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
@@ -42163,4 +42263,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DlVxBF89.js.map
+//# sourceMappingURL=provider-classes-DCbt28RB.js.map