@go-to-k/cdkd 0.295.0 → 0.295.1

package/dist/{provider-classes-DiWFkAOH.js → provider-classes-DUw5QAWI.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-B46YMG0h.js";
 import { $ as compositeIdFormatMessage, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, Ct as injectiveKeyPrefix, D as ProtectionFlipRegistry, Dn as markNameCollision, Dt as withPasteableAwsProfile, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, J as isInterruptedWaitError, Jt as ProvisioningError, L as userPoolProtectionSite, Ln as isAwsAuthoredFailure, M as observeThenDisableProtection, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, On as markReplayMayCollide, Ot as ambientClientDefaults, P as rdsFamilyProtectionSite, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, Rn as safeStringify, S as quotedRemedyLogicalId, St as injectiveKey, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as markRedactedCause, V as isAwsCliLiteral, Vn as isThrottlingError, W as renderDisableCommand, Wn as wrapMaskedAwsError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, _ as VALUE_NOT_SHOWN, _n as shellQuote, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, c as recordedPrincipalsRepair, ct as isSecretDerivedValue, dn as isInertUnquoted, dt as withDerivedNameMasks, et as compositeIdSeparatorRefusal, fn as pasteableCommand, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, j as logGroupProtectionSite, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kt as ambientCredentialConfig, ln as commandHole, lt as maskDeep, mn as plainOrDescribed, nt as logicalIdShown, o as readPrincipalLists, ot as createMaskedLogSinks, p as withRemovalDefaults, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedRetryLogger, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, un as hasClauseBreak, ut as maskerOrIdentity, v as isPlainImportJson, vn as withheldTargetClause, w as remedyLogicalId, x as normalizeAwsTagsToCfn, y as isPlainImportValue, z as UNNAMEABLE_ID_CLAUSE, zn as THROTTLING_ERROR_NAMES } from "./iam-policy-targets-CMSQGQnm.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $i as isWarmThroughputDecrease, A as resolveDynamoDbDeleteBudgetClock, Ao as rewriteTemplateAssetReferences, B as getPriorAttempts, Bi as findSilentDropProperties, Bn as isTerminationProtectionPropagationError, D as beginDeleteWait, Da as hasMaskableValues, Di as refuseMalformedResourcesForDestroy, Dn as getCurrentResourceSecrets, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, F as waitForIndexesSettled, Fn as withIndeterminateGuard, Gs as renderAssemblyPathEscape, Hi as withoutSilentDropProperties, Hn as reDisableInstanceApiTermination, I as ECR_AUTO_DELETE_IMAGES_TAG, In as isWaitAbandonedError, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ks as resolveAssemblyPath, L as S3_AUTO_DELETE_OBJECTS_TAG, Ln as markWaitAbandoned, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Ms as canonicalizeRegion, N as INDEX_SETTLE_POLL_INTERVAL_MS, Ns as derivePartitionAndUrlSuffix, O as compensateRemovedDeletionProtection, Or as passedParameterClassesOf, P as deleteTableWithIndexBusyRetry, Pn as deleteSkipReason, Qi as coerceWarmThroughput$1, R as hasCdkAutoDeleteTag, Ra as markSameGenerationBag, Rt as redactedDeleteAddressFields, T as DynamoDBGlobalTableProvider, To as stringifyValue, Tr as parseWebACLArn, Tt as getCurrentProducerRegions, Ua as dynamicReferenceTokens, Un as reEnableInstanceApiTermination, Us as describeFileReadFailure, V as markRefusedBeforeApplying, Va as recoverMaskedOutput, Vn as observeThenDisableInstanceApiTermination, Ws as displayAssemblyPath, Zi as WARM_THROUGHPUT_MEMBERS, _a as canonicalLambdaFunctionName, _n as refuseMalformedDesiredTags, a as findNestedTemplateTreeDefect, aa as configIntegerRefusal, bn as definedAttributes, c as renderNestedTemplateTreeDefect, ca as replayWarn, ci as refuseMalformedNestedChildOutputs, cn as earliestDefined, cr as s3BucketDomainName, da as requireConfigString, dr as s3BucketWebsiteUrl, ea as toCfnInteger, fn as acquireIdempotencyToken, ft as getCurrentNestedStackContext, ga as markAuxiliaryFailure, gn as readTagList, gt as awaitInFlightSibling, ha as withRetry, hn as planTagDiff, hr as getAccountInfo, ia as configBooleanRefusal, j as resolveDynamoDbDeleteBudgetMs, jn as unchangedBehindSecretReference, k as deleteBudgetKey, kn as slowCcOperationTimeoutMs, ks as decodeListingKey, la as requireConfigArray, lr as s3BucketDualStackDomainName, lt as revertNestedChildFromJournal, mn as DBPROXY_TAG_OPTIONS, na as coerceCfnBoolean, o as isAbsoluteAssetPath, oa as configStringRefusal, or as isSettledInstanceState, ot as getNestedRevertRun, pn as DBPROXY_TAGS_WHAT, pt as withNestedStackContext, qa as carriesSecretMask, ra as coerceCfnInteger, s as listNestedTemplateRows, sa as readConfigString, sr as s3BucketArn, t as DeployEngine, ta as toFiniteNumber, ua as requireConfigObject, un as reserveStackCreateToken, ur as s3BucketRegionalDomainName, va as lambdaFunctionNameForMask, vn as tagMapAsList, vt as getStackRecords, xn as stringifyIfAssigned, ya as sameLambdaFunctionAddress, yn as tagPlanWarning, z as isTruthyCfnBoolean, za as redactSecretsForState, zn as ec2InstanceProtectionSite, zt as redactedDeleteAddressSkip } from "./deploy-engine-CuI_h_Ml.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CyM-wxAp.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-Cbxe8TgI.js";
-import { RDSProvider } from "./rds-provider-D6_Rcnub.js";
-import { NeptuneProvider } from "./neptune-provider-BGVccWhg.js";
-import { ASGProvider } from "./asg-provider-DuAHOXvT.js";
+import { $i as WARM_THROUGHPUT_MEMBERS, A as resolveDynamoDbDeleteBudgetClock, Aa as hasMaskableValues, An as slowCcOperationTimeoutMs, B as getPriorAttempts, Bn as ec2InstanceProtectionSite, Bt as redactedDeleteAddressSkip, D as beginDeleteWait, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Er as parseWebACLArn, Et as getCurrentProducerRegions, F as waitForIndexesSettled, Fn as deleteSkipReason, Fs as canonicalizeRegion, Ha as redactSecretsForState, Hi as findSilentDropProperties, Hn as observeThenDisableInstanceApiTermination, I as ECR_AUTO_DELETE_IMAGES_TAG, In as withIndeterminateGuard, Is as derivePartitionAndUrlSuffix, Js as renderAssemblyPathEscape, Ka as dynamicReferenceTokens, Ks as describeFileReadFailure, L as S3_AUTO_DELETE_OBJECTS_TAG, Ln as isWaitAbandonedError, Lt as REDACTED_DELETE_ADDRESS_SKIP_REASON, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as unchangedBehindSecretReference, Ms as decodeListingKey, N as INDEX_SETTLE_POLL_INTERVAL_MS, No as rewriteTemplateAssetReferences, O as compensateRemovedDeletionProtection, On as getCurrentResourceSecrets, Oo as stringifyValue, P as deleteTableWithIndexBusyRetry, R as hasCdkAutoDeleteTag, Rn as markWaitAbandoned, Rt as isRedactedRecordedValue, Sa as sameLambdaFunctionAddress, Sn as stringifyIfAssigned, T as DynamoDBGlobalTableProvider, Un as reDisableInstanceApiTermination, V as markRefusedBeforeApplying, Va as markSameGenerationBag, Vn as isTerminationProtectionPropagationError, Wa as recoverMaskedOutput, Wi as withoutSilentDropProperties, Wn as reEnableInstanceApiTermination, Xa as carriesSecretMask, Ys as resolveAssemblyPath, _a as withRetry, _n as readTagList, a as findNestedTemplateTreeDefect, aa as coerceCfnInteger, ba as canonicalLambdaFunctionName, bn as tagPlanWarning, c as renderNestedTemplateTreeDefect, ca as configStringRefusal, cr as s3BucketArn, da as requireConfigArray, dn as reserveStackCreateToken, dr as s3BucketRegionalDomainName, ea as coerceWarmThroughput$1, fa as requireConfigObject, fr as s3BucketWebsiteUrl, ft as getCurrentNestedStackContext, gn as planTagDiff, gr as getAccountInfo, gt as awaitInFlightSibling, hn as DBPROXY_TAG_OPTIONS, ia as coerceCfnBoolean, j as resolveDynamoDbDeleteBudgetMs, k as deleteBudgetKey, ki as refuseMalformedResourcesForDestroy, kr as passedParameterClassesOf, la as readConfigString, li as refuseMalformedNestedChildOutputs, ln as earliestDefined, lr as s3BucketDomainName, lt as revertNestedChildFromJournal, mn as DBPROXY_TAGS_WHAT, na as toCfnInteger, o as isAbsoluteAssetPath, oa as configBooleanRefusal, ot as getNestedRevertRun, pa as requireConfigString, pn as acquireIdempotencyToken, pt as withNestedStackContext, qs as displayAssemblyPath, ra as toFiniteNumber, s as listNestedTemplateRows, sa as configIntegerRefusal, sr as isSettledInstanceState, t as DeployEngine, ta as isWarmThroughputDecrease, ua as replayWarn, ur as s3BucketDualStackDomainName, va as markAuxiliaryFailure, vn as refuseMalformedDesiredTags, vt as getStackRecords, xa as lambdaFunctionNameForMask, xn as definedAttributes, ya as markCreatedBeforeFailure, yn as tagMapAsList, z as isTruthyCfnBoolean, zt as redactedDeleteAddressFields } from "./deploy-engine-DG-oC9YK.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-DUZtt9lH.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DfJFegS1.js";
+import { RDSProvider } from "./rds-provider-COCDd7bS.js";
+import { NeptuneProvider } from "./neptune-provider-TnGNCeLX.js";
+import { ASGProvider } from "./asg-provider-CbwOK2TQ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -7771,6 +7771,7 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	const until = new Date(window.ceilingMs).toISOString();
 	const remove = lookup.remove;
 	const service = lookup.service ?? "API Gateway";
+	const afterward = lookup.afterward ?? "Creating a new one now.";
 	const when = remove !== void 0 ? `between ${since} and ${until}` : `at ${since}`;
 	let found;
 	try {
@@ -7793,10 +7794,10 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	const inspect = [...new Set(shown.map((id) => lookup.inspect(id)))].join(" ; ");
 	if (remove !== void 0) {
 		const deletion = [...new Set(shown.map((id) => remove(id)))].join(" ; ");
-		log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer, and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} were created ${when} that this deploy did not record: ${shown.join(", ")}${more}. cdkd does not adopt or delete them: nothing listed proves which deploy created one. Creating a new one now. First inspect each candidate: ${inspect}. Only after confirming one is this deploy's orphan and not another deploy's, ${lookup.removeVerb ?? "delete it"}: ${deletion}.${incomplete}`);
+		log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer, and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} were created ${when} that this deploy did not record: ${shown.join(", ")}${more}. cdkd does not adopt or delete them: nothing listed proves which deploy created one. ${afterward} First inspect each candidate: ${inspect}. Only after confirming one is this deploy's orphan and not another deploy's, ${lookup.removeVerb ?? "delete it"}: ${deletion}.${incomplete}`);
 		return;
 	}
-	log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. Creating a new one now. Inspect each before deleting anything: ${inspect}.${incomplete}`);
+	log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. ${afterward} Inspect each before deleting anything: ${inspect}.${incomplete}`);
 }
 
 //#endregion
@@ -13137,6 +13138,13 @@ function isEc2NotFoundCode(error) {
 	const name = error?.name;
 	return typeof name === "string" && name.endsWith(".NotFound");
 }
+const createVpcLatch = new AmbiguousCreateLatch("ec2:CreateVpc");
+const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
+const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
+const allocateAddressLatch = new AmbiguousCreateLatch("ec2:AllocateAddress");
+const ec2IdsCreatedByThisProcess = new RecentIdSet();
+const isUntagged = (tags) => tags === void 0 || tags.length === 0;
+const ORPHAN_LIST_PAGE_SIZE$2 = 1e3;
 var EC2Provider = class {
 	ec2Client;
 	ec2AuthorizeClient;
@@ -13263,11 +13271,128 @@ var EC2Provider = class {
 		this.ec2Client = awsClients.ec2;
 		this.ec2AuthorizeClient = awsClients.ec2SingleSend ?? awsClients.ec2;
 	}
+	createClient;
+	getCreateClient() {
+		const shared = this.ec2Client;
+		if (!(shared instanceof EC2Client)) return Promise.resolve(shared);
+		this.createClient ??= shared.config.region().then((region) => withoutServerErrorRetries(new EC2Client({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
+	}
+	async reportPossibleEc2Orphans(logicalId, window, log, lookup) {
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.ec2Client, aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: lookup.action,
+			service: "EC2",
+			listAction: lookup.listAction,
+			subject: lookup.subject,
+			noun: lookup.noun,
+			...lookup.afterward !== void 0 && { afterward: lookup.afterward },
+			list: lookup.list,
+			inspect: (id) => lookup.inspect(aws, id, regionArg)
+		});
+	}
+	async reportPossibleOrphanVpcs(logicalId, cidrBlock, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "CreateVpc",
+			listAction: "DescribeVpcs",
+			subject: `a VPC with CIDR ${log.value(cidrBlock)}`,
+			noun: "untagged VPC(s)",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.ec2Client.send(new DescribeVpcsCommand({
+					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+					NextToken: token
+				}));
+				return {
+					items: page.Vpcs ?? [],
+					next: page.NextToken
+				};
+			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && isUntagged(vpc.Tags) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-vpcs --vpc-ids ${id}${regionArg}`.render()
+		});
+	}
+	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "CreateSubnet",
+			listAction: "DescribeSubnets",
+			subject: `a subnet with CIDR ${log.value(cidrBlock)} in VPC ${log.value(vpcId)}`,
+			noun: "untagged subnet(s)",
+			afterward: "Creating it again, which fails with InvalidSubnet.Conflict while that subnet exists.",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.ec2Client.send(new DescribeSubnetsCommand({
+					Filters: [{
+						Name: "vpc-id",
+						Values: [vpcId]
+					}],
+					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+					NextToken: token
+				}));
+				return {
+					items: page.Subnets ?? [],
+					next: page.NextToken
+				};
+			}, (subnet) => subnet.SubnetId !== void 0 && isUntagged(subnet.Tags) && subnet.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(subnet.CidrBlock) ?? subnet.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(subnet.SubnetId) ? subnet.SubnetId : void 0),
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-subnets --subnet-ids ${id}${regionArg}`.render()
+		});
+	}
+	async reportPossibleOrphanInternetGateways(logicalId, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "CreateInternetGateway",
+			listAction: "DescribeInternetGateways",
+			subject: "an internet gateway",
+			noun: "detached, untagged internet gateway(s)",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.ec2Client.send(new DescribeInternetGatewaysCommand({
+					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+					NextToken: token
+				}));
+				return {
+					items: page.InternetGateways ?? [],
+					next: page.NextToken
+				};
+			}, (igw) => igw.InternetGatewayId !== void 0 && (igw.Attachments ?? []).length === 0 && isUntagged(igw.Tags) && !ec2IdsCreatedByThisProcess.has(igw.InternetGatewayId) ? igw.InternetGatewayId : void 0),
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-internet-gateways --internet-gateway-ids ${id}${regionArg}`.render()
+		});
+	}
+	async reportPossibleOrphanAddresses(logicalId, input, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "AllocateAddress",
+			listAction: "DescribeAddresses",
+			subject: `an Elastic IP address (domain ${log.value(input.Domain ?? "vpc")})`,
+			noun: "unassociated, untagged Elastic IP address(es)",
+			list: async () => {
+				const response = await this.ec2Client.send(new DescribeAddressesCommand({}));
+				const ids = [];
+				for (const address of response.Addresses ?? []) {
+					const id = address.AllocationId;
+					if (id === void 0 || (address.Domain ?? "vpc") !== (input.Domain ?? "vpc") || address.AssociationId !== void 0 || !isUntagged(address.Tags) || input.NetworkBorderGroup !== void 0 && address.NetworkBorderGroup !== input.NetworkBorderGroup || input.PublicIpv4Pool !== void 0 && address.PublicIpv4Pool !== input.PublicIpv4Pool || ec2IdsCreatedByThisProcess.has(id)) continue;
+					ids.push(id);
+				}
+				return {
+					ids,
+					truncated: false
+				};
+			},
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-addresses --allocation-ids ${id}${regionArg}`.render()
+		});
+	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::EC2::VPC": return this.createVpc(logicalId, resourceType, properties);
-			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties);
-			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties);
+			case "AWS::EC2::VPC": return this.createVpc(logicalId, resourceType, properties, context);
+			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties, context);
+			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties, context);
 			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
@@ -13344,16 +13469,28 @@ var EC2Provider = class {
 			default: return;
 		}
 	}
-	async createVpc(logicalId, resourceType, properties) {
+	async createVpc(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating VPC ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const cidrBlock = properties["CidrBlock"];
 		if (!cidrBlock) throw new ProvisioningError(`CidrBlock is required for VPC ${logicalId}`, resourceType, logicalId);
 		try {
-			const vpcId = (await this.ec2Client.send(new CreateVpcCommand({
-				CidrBlock: cidrBlock,
-				InstanceTenancy: properties["InstanceTenancy"] ?? void 0
-			}))).Vpc.VpcId;
+			const createClient = await this.getCreateClient();
+			const orphanWindow = createVpcLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateVpcCommand({
+					CidrBlock: cidrBlock,
+					InstanceTenancy: properties["InstanceTenancy"] ?? void 0
+				}));
+			} catch (error) {
+				createVpcLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			const vpcId = response.Vpc.VpcId;
+			ec2IdsCreatedByThisProcess.add(vpcId);
 			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -13491,19 +13628,30 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async createSubnet(logicalId, resourceType, properties) {
+	async createSubnet(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Subnet ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const vpcId = properties["VpcId"];
 		const cidrBlock = properties["CidrBlock"];
 		if (!vpcId || !cidrBlock) throw new ProvisioningError(`VpcId and CidrBlock are required for Subnet ${logicalId}`, resourceType, logicalId);
 		try {
-			const response = await this.ec2Client.send(new CreateSubnetCommand({
-				VpcId: vpcId,
-				CidrBlock: cidrBlock,
-				AvailabilityZone: properties["AvailabilityZone"] ?? void 0
-			}));
+			const createClient = await this.getCreateClient();
+			const orphanWindow = createSubnetLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateSubnetCommand({
+					VpcId: vpcId,
+					CidrBlock: cidrBlock,
+					AvailabilityZone: properties["AvailabilityZone"] ?? void 0
+				}));
+			} catch (error) {
+				createSubnetLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
 			const subnetId = response.Subnet.SubnetId;
+			ec2IdsCreatedByThisProcess.add(subnetId);
 			const availabilityZone = response.Subnet.AvailabilityZone;
 			try {
 				await this.applyTags(subnetId, desiredTags, logicalId);
@@ -13647,11 +13795,23 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async createInternetGateway(logicalId, resourceType, properties) {
+	async createInternetGateway(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating InternetGateway ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		try {
-			const igwId = (await this.ec2Client.send(new CreateInternetGatewayCommand({}))).InternetGateway.InternetGatewayId;
+			const createClient = await this.getCreateClient();
+			const orphanWindow = createInternetGatewayLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateInternetGatewayCommand({}));
+			} catch (error) {
+				createInternetGatewayLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			const igwId = response.InternetGateway.InternetGatewayId;
+			ec2IdsCreatedByThisProcess.add(igwId);
 			await this.applyTags(igwId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created InternetGateway ${logicalId}: ${igwId}`);
 			return {
@@ -13709,14 +13869,26 @@ var EC2Provider = class {
 		let publicIp;
 		let created = false;
 		try {
-			const response = await this.ec2Client.send(new AllocateAddressCommand({
+			const input = {
 				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
 				NetworkBorderGroup: properties["NetworkBorderGroup"],
 				PublicIpv4Pool: properties["PublicIpv4Pool"]
-			}));
+			};
+			const createClient = await this.getCreateClient();
+			const orphanWindow = allocateAddressLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new AllocateAddressCommand(input));
+			} catch (error) {
+				allocateAddressLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
 			created = true;
 			allocationId = response.AllocationId;
 			publicIp = response.PublicIp;
+			ec2IdsCreatedByThisProcess.add(allocationId);
 			await this.applyTags(allocationId, desiredTags, logicalId);
 			const instanceId = properties["InstanceId"];
 			if (instanceId) {
@@ -14135,7 +14307,7 @@ var EC2Provider = class {
 		const groupDescription = properties["GroupDescription"];
 		if (!groupDescription) throw new ProvisioningError(`GroupDescription is required for SecurityGroup ${logicalId}`, resourceType, logicalId);
 		try {
-			const groupId = (await this.ec2Client.send(new CreateSecurityGroupCommand({
+			const groupId = (await (await this.getCreateClient()).send(new CreateSecurityGroupCommand({
 				GroupName: properties["GroupName"] ?? logicalId,
 				Description: groupDescription,
 				VpcId: properties["VpcId"] ?? void 0
@@ -33498,6 +33670,30 @@ function readMaxRecordSize(value, mask) {
 		reason: `AWS::Kinesis::Stream MaxRecordSizeInKiB must be a number, got ${JSON.stringify(maskDeep(value, mask))}`
 	};
 }
+function readRetentionHours(value, mask) {
+	if (value == null) return { kind: "absent" };
+	if (typeof value === "number" && Number.isFinite(value)) return {
+		kind: "usable",
+		hours: value
+	};
+	if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) return {
+		kind: "usable",
+		hours: Number(value)
+	};
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream RetentionPeriodHours must be a number, got ${JSON.stringify(maskDeep(value, mask))}`
+	};
+}
+function readEncryptionKeyId(value, mask) {
+	if (!isKmsEncryption(value)) return { kind: "absent" };
+	const keyId = value?.["KeyId"];
+	if (typeof keyId === "string" && keyId.trim() !== "") return { kind: "usable" };
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream StreamEncryption selects KMS but KeyId is not a non-empty string, got ${JSON.stringify(maskDeep(keyId, mask)) ?? "undefined"}`
+	};
+}
 function comparableRecordSize(value, mask) {
 	const read = readMaxRecordSize(value, mask);
 	return read.kind === "usable" ? read.size : void 0;
@@ -33541,6 +33737,13 @@ var KinesisStreamProvider = class {
 			if (context?.replayingState === true) warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
 			else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
 		}
+		const retentionRead = readRetentionHours(properties["RetentionPeriodHours"], mask);
+		if (retentionRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(retentionRead.reason, resourceType, logicalId, streamName);
+			warn(`${retentionRead.reason}. Replaying a state record, so the retention period is left at AWS's default on ${streamName} rather than refusing the restore`);
+		}
+		const encryptionRead = readEncryptionKeyId(properties["StreamEncryption"], mask);
+		if (encryptionRead.kind === "unusable") throw new ProvisioningError(encryptionRead.reason, resourceType, logicalId, streamName);
 		let streamCreated = false;
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -33562,7 +33765,7 @@ var KinesisStreamProvider = class {
 				StreamName: streamName,
 				Tags: tags
 			}));
-			const retentionPeriodHours = properties["RetentionPeriodHours"];
+			const retentionPeriodHours = retentionRead.kind === "usable" ? retentionRead.hours : void 0;
 			if (retentionPeriodHours !== void 0 && retentionPeriodHours !== 24) {
 				this.logger.debug(`Setting retention period to ${retentionPeriodHours} hours for ${streamName}`);
 				if (retentionPeriodHours > 24) await this.getClient().send(new IncreaseStreamRetentionPeriodCommand({
@@ -33604,9 +33807,9 @@ var KinesisStreamProvider = class {
 			};
 		} catch (error) {
 			if (streamCreated) markAuxiliaryFailure(error, logicalId);
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Kinesis stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, streamName, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create Kinesis stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, streamName, error instanceof Error ? error : void 0);
+			if (streamCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, streamName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -33614,6 +33817,10 @@ var KinesisStreamProvider = class {
 		const warn = (message) => this.logger.warn(mask(message));
 		this.logger.debug(`Updating Kinesis stream ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const desiredRetention = readRetentionHours(properties["RetentionPeriodHours"], mask);
+		if (desiredRetention.kind === "unusable" && context?.replayingState !== true) throw new ProvisioningError(desiredRetention.reason, resourceType, logicalId, physicalId);
+		if (desiredRetention.kind === "unusable") warn(`${desiredRetention.reason}. Replaying a state record, so the retention period of ${physicalId} is left as it is rather than refusing the restore`);
+		const previousRetention = readRetentionHours(previousProperties["RetentionPeriodHours"], mask);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
@@ -33641,11 +33848,9 @@ var KinesisStreamProvider = class {
 					await this.waitForStreamActive(physicalId);
 				}
 			}
-			const newRetention = properties["RetentionPeriodHours"];
-			const oldRetention = previousProperties["RetentionPeriodHours"];
-			const effectiveNewRetention = newRetention ?? 24;
-			const effectiveOldRetention = oldRetention ?? 24;
-			if (effectiveNewRetention !== effectiveOldRetention) {
+			const effectiveNewRetention = desiredRetention.kind === "usable" ? desiredRetention.hours ?? 24 : 24;
+			const effectiveOldRetention = previousRetention.kind === "usable" ? previousRetention.hours ?? 24 : 24;
+			if (desiredRetention.kind !== "unusable" && effectiveNewRetention !== effectiveOldRetention) {
 				this.logger.debug(`Updating retention period for ${physicalId}: from ${effectiveOldRetention} to ${effectiveNewRetention}`);
 				if (effectiveNewRetention > effectiveOldRetention) await this.getClient().send(new IncreaseStreamRetentionPeriodCommand({
 					StreamName: physicalId,
@@ -42385,4 +42590,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DiWFkAOH.js.map
+//# sourceMappingURL=provider-classes-DUw5QAWI.js.map