@go-to-k/cdkd 0.296.10 → 0.296.12

package/dist/{provider-classes-DbpGX0KN.js → provider-classes-D76dAHvV.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger } from "./logger-DAaB7GFO.js";
-import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-BREzwsG6.js";
+import { A as refusalTypeShown, An as pasteableCommand, B as protectionFlipKey, Bt as injectiveKey, C as assertRegionMatch, D as isQuotableImportValue, Dn as commandHole, E as isPlainImportValue, Fn as shellQuote, Gn as markNameCollision, Gt as withPasteableAwsProfile, I as deleteWithProtectionCompensation, In as withheldTargetClause, J as isAwsCliLiteral, Jt as clientDefaultsFor, K as UNNAMEABLE_ID_CLAUSE, Kn as markReplayMayCollide, Kt as ambientClientDefaults, L as isTerminalDeleteFailure, M as resolveExplicitPhysicalId, Mn as plainOrDescribed, O as normalizeAwsTagsToCfn, On as hasClauseBreak, Ot as markAuxiliaryFailure, P as ProtectionFlipRegistry, Qn as isTransientServerError, Qt as CdkdError, R as logGroupProtectionSite, S as RESOURCE_NOT_FOUND, St as clearCreatedBeforeFailure, T as isPlainImportJson, V as rdsFamilyProtectionSite, Vt as injectiveKeyPrefix, W as userPoolProtectionSite, X as protectedReplacementAdvice, Xt as AccountIdUnavailableError, Y as pasteableAwsCommand, Yn as isAmbiguousOutcomeError, Yt as credentialFingerprint, Z as renderDisableCommand, Zn as isRetryableTransientError, _ as RecentIdSet, _t as maskDeep, a as onlySecretDerived, ar as isThrottlingError, at as canonicalizeRoute53QueryName, b as setBounded, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as compositeIdSkipResult, er as describeAwsFailure, fn as ProvisioningError, ft as segmentAfterAnchor, g as AmbiguousCreateLatch, gt as isSecretDerivedValue, h as AMBIGUOUS_LATCH_TTL_MS, ht as createMaskedRetryLogger, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, j as remedyLogicalId, k as quotedRemedyLogicalId, kn as isInertUnquoted, kt as markCreatedBeforeFailure, lt as logicalIdShown, mn as ResourceUpdateNotSupportedError, mt as createMaskedLogSinks, nr as safeStringify, nt as startInterruptWatch, o as readPrincipalLists, or as markNonRetryable, ot as compositeIdFormatMessage, p as withRemovalDefaults, pt as stateOrphanRecordRemedy, q as WITHHELD_AWS_COMMAND, qt as ambientCredentialConfig, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, rt as ElapsedBudgetRegistry, sr as markRedactedCause, st as compositeIdSeparatorRefusal, tr as isAwsAuthoredFailure, tt as isInterruptedWaitError, u as clearOnUpdateRemoval, ut as packCompositeId, v as createAttemptKey, vt as maskerOrIdentity, w as VALUE_NOT_SHOWN, x as withoutServerErrorRetries, y as isInsideWindow, yt as withDerivedNameMasks, z as observeThenDisableProtection } from "./iam-policy-targets-elNafvpb.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $n as deleteSkipReason, $r as accountArgs, A as resolveDynamoDbDeleteBudgetClock, Aa as replayWarn, An as acquireIdempotencyToken, Ar as s3BucketWebsiteUrl, B as getPriorAttempts, Ba as sameLambdaFunctionAddress, Ca as toFiniteNumber, Ct as getStackRecords, D as beginDeleteWait, Da as configIntegerRefusal, Dr as s3BucketDomainName, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as configBooleanRefusal, En as earliestDefined, Er as s3BucketArn, F as waitForIndexesSettled, Fn as refuseMalformedDesiredTags, Gn as getCurrentResourceSecrets, I as ECR_AUTO_DELETE_IMAGES_TAG, In as tagMapAsList, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ji as refuseMalformedResourcesForDestroy, Jn as slowCcOperationTimeoutMs, Ka as hasMaskableValues, Ko as stringifyValue, L as S3_AUTO_DELETE_OBJECTS_TAG, La as withRetry, Ln as tagPlanWarning, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Ma as requireConfigObject, Mn as DBPROXY_TAG_OPTIONS, N as INDEX_SETTLE_POLL_INTERVAL_MS, Na as requireConfigString, Nn as planTagDiff, O as compensateRemovedDeletionProtection, Oa as configStringRefusal, Oi as refuseMalformedNestedChildOutputs, On as reserveStackCreateToken, Or as s3BucketDualStackDomainName, P as deleteTableWithIndexBusyRetry, Pn as readTagList, Pr as getAccountInfo, Pt as getCurrentProducerRegions, R as hasCdkAutoDeleteTag, Ra as canonicalLambdaFunctionName, Rn as definedAttributes, Rt as redactedDeleteAddressFields, Sa as toCfnInteger, T as DynamoDBGlobalTableProvider, Ta as coerceCfnInteger, Tr as isSettledInstanceState, V as markRefusedBeforeApplying, Wr as parseWebACLArn, Xn as unchangedBehindSecretReference, Zo as rewriteTemplateAssetReferences, Zs as decodeListingKey, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ar as isTerminationProtectionPropagationError, ba as coerceWarmThroughput$1, c as renderNestedTemplateTreeDefect, ca as findSilentDropProperties, cr as reEnableInstanceApiTermination, dc as describeFileReadFailure, dt as getNestedRevertRun, ec as canonicalizeRegion, er as withIndeterminateGuard, fc as displayAssemblyPath, fo as recoverMaskedOutput, io as redactSecretsForState, ir as ec2InstanceProtectionSite, j as resolveDynamoDbDeleteBudgetMs, ja as requireConfigArray, jn as DBPROXY_TAGS_WHAT, k as deleteBudgetKey, ka as readConfigString, kr as s3BucketRegionalDomainName, mc as resolveAssemblyPath, mo as carriesSecretMask, mt as revertNestedChildFromJournal, nr as markWaitAbandoned, o as isAbsoluteAssetPath, oa as withheldAccountClause, or as observeThenDisableInstanceApiTermination, pc as renderAssemblyPathEscape, qr as passedParameterClassesOf, ro as markSameGenerationBag, s as listNestedTemplateRows, so as dynamicReferenceTokens, sr as reDisableInstanceApiTermination, t as DeployEngine, tc as derivePartitionAndUrlSuffix, tr as isWaitAbandonedError, ua as withoutSilentDropProperties, vt as withNestedStackContext, wa as coerceCfnBoolean, xa as isWarmThroughputDecrease, xt as awaitInFlightSibling, ya as WARM_THROUGHPUT_MEMBERS, z as isTruthyCfnBoolean, za as lambdaFunctionNameForMask, zn as stringifyIfAssigned, zt as redactedDeleteAddressSkip } from "./deploy-engine-CpI6zpP3.js";
-import { a as AmbiguousCreateLatch, c as isInsideWindow, i as AMBIGUOUS_LATCH_TTL_MS, l as setBounded, n as collectInlinePolicyNamesManagedBySiblings, o as RecentIdSet, r as IamCreateClientCache, s as createAttemptKey, t as IAMRoleProvider, u as withoutServerErrorRetries } from "./iam-role-provider-DwUk13DS.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CXEHAcOO.js";
-import { RDSProvider } from "./rds-provider-C6t144QY.js";
-import { NeptuneProvider } from "./neptune-provider-Br7yS2dy.js";
-import { ASGProvider } from "./asg-provider-Dxc7pRNy.js";
+import { $r as passedParameterClassesOf, Aa as coerceCfnBoolean, Bn as planTagDiff, Br as getAccountInfo, Ct as INDEX_SETTLE_POLL_INTERVAL_MS, Da as isWarmThroughputDecrease, Dc as renderAssemblyPathEscape, Dt as S3_AUTO_DELETE_OBJECTS_TAG, Ea as coerceWarmThroughput$1, Ec as displayAssemblyPath, Eo as recoverMaskedOutput, Et as ECR_AUTO_DELETE_IMAGES_TAG, Fa as readConfigString, Fn as reserveStackCreateToken, Fr as s3BucketRegionalDomainName, Ga as lambdaFunctionNameForMask, Gn as definedAttributes, Gt as redactedDeleteAddressFields, Hn as refuseMalformedDesiredTags, Ia as replayWarn, Ir as s3BucketWebsiteUrl, Ka as sameLambdaFunctionAddress, Kn as stringifyIfAssigned, Kt as redactedDeleteAddressSkip, La as requireConfigArray, Ln as acquireIdempotencyToken, Ma as configBooleanRefusal, Mr as s3BucketArn, Na as configIntegerRefusal, Nn as earliestDefined, Nr as s3BucketDomainName, Oa as toCfnInteger, Oc as resolveAssemblyPath, Oo as carriesSecretMask, Ot as hasCdkAutoDeleteTag, Pa as configStringRefusal, Pi as refuseMalformedNestedChildOutputs, Pr as s3BucketDualStackDomainName, Qn as getCurrentResourceSecrets, Ra as requireConfigObject, Rn as DBPROXY_TAGS_WHAT, St as DELETE_INDEX_WAIT_PROCEED_NOTE, T as markRefusedBeforeApplying, Ta as WARM_THROUGHPUT_MEMBERS, Tc as describeFileReadFailure, Tt as waitForIndexesSettled, Ua as withRetry, Un as tagMapAsList, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, Vn as readTagList, Vt as getCurrentProducerRegions, Wa as canonicalLambdaFunctionName, Wn as tagPlanWarning, Wt as isRedactedRecordedValue, Xr as parseWebACLArn, Z as getNestedRevertRun, _o as markSameGenerationBag, _t as beginDeleteWait, a as findNestedTemplateTreeDefect, ai as accountArgs, ar as deleteSkipReason, bt as resolveDynamoDbDeleteBudgetClock, c as renderNestedTemplateTreeDefect, cr as markWaitAbandoned, dc as decodeListingKey, dr as isTerminationProtectionPropagationError, ds as rewriteTemplateAssetReferences, ea as refuseMalformedResourcesForDestroy, et as revertNestedChildFromJournal, fa as withheldAccountClause, fr as observeThenDisableInstanceApiTermination, ga as withoutSilentDropProperties, gt as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, hc as derivePartitionAndUrlSuffix, ht as DynamoDBGlobalTableProvider, it as withNestedStackContext, ja as coerceCfnInteger, jr as isSettledInstanceState, ka as toFiniteNumber, kt as isTruthyCfnBoolean, lt as getStackRecords, ma as findSilentDropProperties, mc as canonicalizeRegion, mr as reEnableInstanceApiTermination, nr as unchangedBehindSecretReference, o as isAbsoluteAssetPath, oo as hasMaskableValues, or as withIndeterminateGuard, os as stringifyValue, pr as reDisableInstanceApiTermination, rt as getCurrentNestedStackContext, s as listNestedTemplateRows, sr as isWaitAbandonedError, st as awaitInFlightSibling, t as DeployEngine, to as passedNoEchoParametersOf, tr as slowCcOperationTimeoutMs, ur as ec2InstanceProtectionSite, vo as redactSecretsForState, vt as compensateRemovedDeletionProtection, w as getPriorAttempts, wt as deleteTableWithIndexBusyRetry, xo as dynamicReferenceTokens, xt as resolveDynamoDbDeleteBudgetMs, yt as deleteBudgetKey, za as requireConfigString, zn as DBPROXY_TAG_OPTIONS } from "./deploy-engine-CrYi7ta5.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ClAgHnkh.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-epAinsMQ.js";
+import { RDSProvider } from "./rds-provider-V_uJHUSX.js";
+import { NeptuneProvider } from "./neptune-provider-ppi8nIX-.js";
+import { ASGProvider } from "./asg-provider-DoaukzYL.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -3053,8 +3053,31 @@ function noRecordedRegionCause() {
 function shownLifecycleRuleId(id) {
 	return id === void 0 || id === null || id === "" ? "(no Id)" : displayIdent(id);
 }
+const createBucketLatch = new AmbiguousCreateLatch("CreateBucket");
+const heldCreateBucketWindows = /* @__PURE__ */ new Map();
+function takeCreateBucketWindow(logicalId) {
+	const latched = createBucketLatch.take(logicalId);
+	const key = createAttemptKey("CreateBucket", logicalId);
+	const held = heldCreateBucketWindows.get(key);
+	heldCreateBucketWindows.delete(key);
+	const kept = held !== void 0 && Date.now() - held.heldAtMs <= 18e5 ? held.window : void 0;
+	if (latched === void 0) return kept;
+	if (kept === void 0) return latched;
+	return {
+		floorMs: Math.min(latched.floorMs, kept.floorMs),
+		ceilingMs: Math.max(latched.ceilingMs, kept.ceilingMs)
+	};
+}
+function holdCreateBucketWindow(logicalId, window) {
+	setBounded(heldCreateBucketWindows, createAttemptKey("CreateBucket", logicalId), {
+		window,
+		heldAtMs: Date.now()
+	});
+}
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
+	createClientHolder = {};
+	credentialConfig;
 	logger = getLogger().child("S3BucketProvider");
 	opMask = void 0;
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Set([
@@ -3082,6 +3105,27 @@ var S3BucketProvider = class S3BucketProvider {
 	constructor() {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
+		this.credentialConfig = awsClients.credentialConfig ?? {};
+	}
+	getCreateClient() {
+		const holder = this.createClientHolder;
+		holder.client ??= this.s3Client.config.region().then((region) => withoutServerErrorRetries(new S3Client({
+			...clientDefaultsFor(this.credentialConfig),
+			region
+		})), (error) => {
+			holder.client = void 0;
+			throw error;
+		});
+		return holder.client;
+	}
+	refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, region, via) {
+		const aws = pasteableAwsCommand(this.shownMask);
+		const regionArg = region ? aws` --region ${region}` : aws``;
+		const owned = aws`aws s3api list-buckets --prefix ${bucketName}`.render();
+		const versions = aws`aws s3api list-object-versions --bucket ${bucketName} --max-items 10${regionArg}`.render();
+		const deletion = aws`aws s3api delete-bucket --bucket ${bucketName}${regionArg}`.render();
+		const presence = "preflight" in via && via.preflight === "indeterminate" ? "a bucket of that name may exist (cdkd could not read its location)" : "the bucket now exists";
+		throw markNonRetryable(new ProvisioningError(`Refusing to adopt S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}): an earlier attempt of this create ended without a definite answer (a server error or a lost response) after it may have created the bucket, and ${presence}, so cdkd cannot tell whether this deploy or someone else created it. Check whether this account owns it: ${owned} (it lists only this account's buckets; its CreationDate is a hint, not proof, since some bucket changes update it), and whether it holds any object or object version: ${versions}. If it is listed there, its CreationDate matches the failed attempt, it is empty, and nobody else on your team uses this name, it is this deploy's orphan: delete it with ${deletion} (S3 refuses with BucketNotEmpty if anything is left in it) and re-run the deploy. If it is a bucket you mean this stack to own, re-run the deploy to adopt it.`, resourceType, logicalId, bucketName, "cause" in via ? via.cause : void 0));
 	}
 	async getRegion() {
 		return await this.s3Client.config.region() || "us-east-1";
@@ -3827,6 +3871,7 @@ var S3BucketProvider = class S3BucketProvider {
 	noWriteProbe() {
 		const probe = Object.create(this);
 		probe.s3Client = { send: async () => ({}) };
+		Object.defineProperty(probe, "createClientHolder", { value: { client: Promise.resolve(probe.s3Client) } });
 		const silent = () => {};
 		probe.logger = Object.assign(Object.create(this.logger), {
 			debug: silent,
@@ -4241,6 +4286,8 @@ var S3BucketProvider = class S3BucketProvider {
 			allowedPattern: /[^a-z0-9.-]/g
 		});
 		let bucketLeftBehind = false;
+		let ambiguousWindow;
+		let windowSpent = false;
 		try {
 			const createParams = { Bucket: bucketName };
 			const region = await this.getRegion();
@@ -4249,17 +4296,35 @@ var S3BucketProvider = class S3BucketProvider {
 			if (declaresBucketObjectLock(properties)) createParams.ObjectLockEnabledForBucket = true;
 			const preflight = canonicalizeRegion(region) === "us-east-1" ? await this.probeBucketRegion(bucketName) : { kind: "absent" };
 			let createdNewBucket = false;
+			const createClient = await this.getCreateClient();
+			ambiguousWindow = takeCreateBucketWindow(logicalId);
+			if (ambiguousWindow !== void 0 && (preflight.kind === "indeterminate" || preflight.kind === "region" && preflight.region === "us-east-1")) {
+				windowSpent = true;
+				this.refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, canonicalRegion, { preflight: preflight.kind });
+			}
 			try {
-				await this.s3Client.send(new CreateBucketCommand(createParams));
+				const attemptStartMs = Date.now();
+				try {
+					await createClient.send(new CreateBucketCommand(createParams));
+				} catch (sendError) {
+					createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
+					throw sendError;
+				}
 				createdNewBucket = preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
+				if (createdNewBucket) windowSpent = true;
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
 				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${this.shown(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
 				this.logger.debug(`Created S3 bucket: ${this.shown(bucketName)}`);
 			} catch (createError) {
 				if (createError instanceof ProvisioningError) throw createError;
+				if (createError instanceof Error && createError.name === "BucketAlreadyExists") windowSpent = true;
 				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) {
 					await this.assertExistingBucketRegion(logicalId, resourceType, bucketName, region, createError);
+					if (ambiguousWindow !== void 0) {
+						windowSpent = true;
+						this.refuseAmbiguousCreateAdopt(logicalId, resourceType, bucketName, canonicalRegion, { cause: createError });
+					}
 					this.logger.debug(`S3 bucket ${this.shown(bucketName)} already exists and is owned by you`);
 				} else throw createError;
 			}
@@ -4294,6 +4359,7 @@ var S3BucketProvider = class S3BucketProvider {
 				...effectiveProperties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
+			if (ambiguousWindow !== void 0 && !windowSpent) holdCreateBucketWindow(logicalId, ambiguousWindow);
 			const thrown = this.wrapOperationError("create", logicalId, resourceType, bucketName, error);
 			if (bucketLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, bucketName);
 			throw thrown;
@@ -10177,6 +10243,8 @@ function maskLeafValue(value, maskSecrets) {
 }
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
+	createClient;
+	credentialConfig;
 	logger = getLogger().child("DynamoDBTableProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Set([
 		"TableName",
@@ -10205,6 +10273,17 @@ var DynamoDBTableProvider = class {
 	constructor() {
 		const awsClients = getAwsClients();
 		this.dynamoDBClient = awsClients.dynamoDB;
+		this.credentialConfig = awsClients.credentialConfig ?? {};
+	}
+	getCreateClient() {
+		this.createClient ??= this.dynamoDBClient.config.region().then((region) => withoutServerErrorRetries(new DynamoDBClient({
+			...clientDefaultsFor(this.credentialConfig),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
 	}
 	getMinResourceTimeoutMs() {
 		return DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS;
@@ -10268,7 +10347,7 @@ var DynamoDBTableProvider = class {
 			if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
 			const createResourcePolicyDoc = this.extractResourcePolicyDocument(properties["ResourcePolicy"]);
 			if (createResourcePolicyDoc !== void 0) createParams.ResourcePolicy = createResourcePolicyDoc;
-			await this.dynamoDBClient.send(new CreateTableCommand(createParams));
+			await (await this.getCreateClient()).send(new CreateTableCommand(createParams));
 			tableCreated = true;
 			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
 			const tableInfo = await this.waitForTableActive(tableName);
@@ -12727,6 +12806,8 @@ var SecretsManagerSecretProvider = class {
 //#region src/provisioning/providers/ssm-parameter-provider.ts
 var SSMParameterProvider = class SSMParameterProvider {
 	ssmClient;
+	createClient;
+	credentialConfig;
 	logger = getLogger().child("SSMParameterProvider");
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
@@ -12745,6 +12826,19 @@ var SSMParameterProvider = class SSMParameterProvider {
 	constructor() {
 		const awsClients = getAwsClients();
 		this.ssmClient = awsClients.ssm;
+		this.credentialConfig = awsClients.credentialConfig ?? {};
+	}
+	getCreateClient() {
+		const shared = this.ssmClient;
+		if (!(shared instanceof SSMClient)) return Promise.resolve(shared);
+		this.createClient ??= shared.config.region().then((region) => withoutServerErrorRetries(new SSMClient({
+			...clientDefaultsFor(this.credentialConfig),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
 	}
 	static userTags(tags) {
 		return tags.filter((t) => !t.Key.startsWith("aws:"));
@@ -12793,7 +12887,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 			if (properties["Tier"]) putParams.Tier = properties["Tier"];
 			if (properties["Policies"]) putParams.Policies = properties["Policies"];
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
-			await this.ssmClient.send(new PutParameterCommand(putParams));
+			await (await this.getCreateClient()).send(new PutParameterCommand(putParams));
 			leftBehind = true;
 			try {
 				if (ssmTags.length > 0) await this.ssmClient.send(new AddTagsToResourceCommand({
@@ -13737,10 +13831,18 @@ function isNamedError(error, names) {
 }
 const NAT_GATEWAY_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["NatGatewayNotFound"]);
 const EIP_ALLOCATION_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidAllocationID.NotFound"]);
+const INSTANCE_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidInstanceID.NotFound"]);
+const VPC_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidVpcID.NotFound"]);
+const SUBNET_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidSubnetID.NotFound"]);
+const SECURITY_GROUP_NOT_FOUND_NAMES = /* @__PURE__ */ new Set(["InvalidGroup.NotFound"]);
 const NAT_GATEWAY_ID_PATTERN = /^nat-[0-9a-f]+$/;
 const EIP_ALLOCATION_ID_PATTERN = /^eipalloc-[0-9a-f]+$/;
-function natGatewayIdentity(physicalId) {
-	return NAT_GATEWAY_ID_PATTERN.test(physicalId) ? physicalId : void 0;
+const INSTANCE_ID_PATTERN = /^i-[0-9a-f]+$/;
+const VPC_ID_PATTERN = /^vpc-[0-9a-f]+$/;
+const SUBNET_ID_PATTERN = /^subnet-[0-9a-f]+$/;
+const SECURITY_GROUP_ID_PATTERN = /^sg-[0-9a-f]+$/;
+function generatedIdIdentity(pattern, physicalId) {
+	return pattern.test(physicalId) ? physicalId : void 0;
 }
 function eipAllocationIdentity(physicalId) {
 	const segments = physicalId.split("|");
@@ -14080,17 +14182,28 @@ var EC2Provider = class {
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
 		let read;
-		let journaledId;
-		let recordId;
+		let identity;
 		if (resourceType === "AWS::EC2::NatGateway") {
-			journaledId = natGatewayIdentity(journaledPhysicalId);
-			recordId = natGatewayIdentity(record.physicalId);
+			identity = (id) => generatedIdIdentity(NAT_GATEWAY_ID_PATTERN, id);
 			read = (id) => this.readNatGatewayIdIfLive(id);
 		} else if (resourceType === "AWS::EC2::EIP") {
-			journaledId = eipAllocationIdentity(journaledPhysicalId);
-			recordId = eipAllocationIdentity(record.physicalId);
+			identity = eipAllocationIdentity;
 			read = (id) => this.readEipAllocationIdIfExists(id);
+		} else if (resourceType === "AWS::EC2::Instance") {
+			identity = (id) => generatedIdIdentity(INSTANCE_ID_PATTERN, id);
+			read = (id) => this.readInstanceIdIfLive(id);
+		} else if (resourceType === "AWS::EC2::VPC") {
+			identity = (id) => generatedIdIdentity(VPC_ID_PATTERN, id);
+			read = (id) => this.readVpcIdIfLive(id);
+		} else if (resourceType === "AWS::EC2::Subnet") {
+			identity = (id) => generatedIdIdentity(SUBNET_ID_PATTERN, id);
+			read = (id) => this.readSubnetIdIfLive(id);
+		} else if (resourceType === "AWS::EC2::SecurityGroup") {
+			identity = (id) => generatedIdIdentity(SECURITY_GROUP_ID_PATTERN, id);
+			read = (id) => this.readSecurityGroupIdIfExists(id);
 		} else return "unknown";
+		const journaledId = identity(journaledPhysicalId);
+		const recordId = identity(record.physicalId);
 		if (journaledId === void 0 || recordId === void 0) return "unknown";
 		if (journaledId === recordId) return "same";
 		if (resourceType === "AWS::EC2::EIP" && journaledPhysicalId === journaledId) return "unknown";
@@ -14111,6 +14224,65 @@ var EC2Provider = class {
 		const gateway = gateways[0];
 		return gateway.State === "pending" || gateway.State === "available" ? gateway.NatGatewayId : void 0;
 	}
+	async readInstanceIdIfLive(instanceId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }));
+		} catch (error) {
+			if (isNamedError(error, INSTANCE_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const instances = (response.Reservations ?? []).flatMap((r) => r.Instances ?? []);
+		if (instances.length !== 1 || typeof instances[0]?.InstanceId !== "string") throw new Error("DescribeInstances did not return exactly the instance asked for");
+		const instance = instances[0];
+		const state = instance.State?.Name;
+		if (state === "shutting-down" || state === "terminated") return void 0;
+		if (state === "pending" || state === "running" || state === "stopping" || state === "stopped") return instance.InstanceId;
+		throw new Error("DescribeInstances returned an instance in no known state");
+	}
+	async readVpcIdIfLive(vpcId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [vpcId] }));
+		} catch (error) {
+			if (isNamedError(error, VPC_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const vpcs = response.Vpcs ?? [];
+		if (vpcs.length !== 1 || typeof vpcs[0]?.VpcId !== "string") throw new Error("DescribeVpcs did not return exactly the VPC asked for");
+		const vpc = vpcs[0];
+		if (vpc.State === "deleting") return void 0;
+		if (vpc.State === "pending" || vpc.State === "available") return vpc.VpcId;
+		throw new Error("DescribeVpcs returned a VPC in no known state");
+	}
+	async readSubnetIdIfLive(subnetId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeSubnetsCommand({ SubnetIds: [subnetId] }));
+		} catch (error) {
+			if (isNamedError(error, SUBNET_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const subnets = response.Subnets ?? [];
+		if (subnets.length !== 1 || typeof subnets[0]?.SubnetId !== "string") throw new Error("DescribeSubnets did not return exactly the subnet asked for");
+		const subnet = subnets[0];
+		const state = subnet.State;
+		if (state === "pending" || state === "available") return subnet.SubnetId;
+		if (state === "failed" || state === "failed-insufficient-capacity" || state === "unavailable") return;
+		throw new Error("DescribeSubnets returned a subnet in no known state");
+	}
+	async readSecurityGroupIdIfExists(groupId) {
+		let response;
+		try {
+			response = await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [groupId] }));
+		} catch (error) {
+			if (isNamedError(error, SECURITY_GROUP_NOT_FOUND_NAMES)) return void 0;
+			throw error;
+		}
+		const groups = response.SecurityGroups ?? [];
+		if (groups.length !== 1 || typeof groups[0]?.GroupId !== "string") throw new Error("DescribeSecurityGroups did not return exactly the group asked for");
+		return groups[0].GroupId;
+	}
 	async readEipAllocationIdIfExists(allocationId) {
 		let response;
 		try {
@@ -14238,10 +14410,11 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted VPC ${logicalId}`);
 			return;
 		} catch (error) {
-			if (this.isNotFoundError(error)) {
+			if (this.isNotFoundError(error) && (context?.failedCreateOrphan !== true || isNamedError(error, VPC_NOT_FOUND_NAMES))) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`VPC ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  VPC ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`VPC ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const msg = describeAwsFailure(error).detail;
@@ -14402,10 +14575,11 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted Subnet ${logicalId}`);
 			return;
 		} catch (error) {
-			if (this.isNotFoundError(error)) {
+			if (this.isNotFoundError(error) && (context?.failedCreateOrphan !== true || isNamedError(error, SUBNET_NOT_FOUND_NAMES))) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Subnet ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Subnet ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`Subnet ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const msg = describeAwsFailure(error).detail;
@@ -15086,10 +15260,11 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted SecurityGroup ${logicalId}`);
 			return;
 		} catch (error) {
-			if (this.isNotFoundError(error)) {
+			if (this.isNotFoundError(error) && (context?.failedCreateOrphan !== true || isNamedError(error, SECURITY_GROUP_NOT_FOUND_NAMES))) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`SecurityGroup ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  Security group ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`SecurityGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const msg = describeAwsFailure(error).detail;
@@ -15759,7 +15934,8 @@ var EC2Provider = class {
 			if (this.isNotFoundError(error)) {
 				const clientRegion = await this.ec2Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`EC2 Instance ${physicalId} already terminated (not found), treating as success`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  EC2 instance ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`EC2 Instance ${physicalId} already terminated (not found), treating as success`);
 				return;
 			}
 			const msg = describeAwsFailure(error).detail;
@@ -19907,16 +20083,31 @@ var CloudFrontOAIProvider = class {
 //#region src/provisioning/providers/cloudfront-oac-provider.ts
 var CloudFrontOACProvider = class {
 	cloudFrontClient;
+	createClient;
+	credentialConfig;
 	logger = getLogger().child("CloudFrontOACProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFront::OriginAccessControl", /* @__PURE__ */ new Set(["OriginAccessControlConfig"])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudFrontClient = awsClients.cloudFront;
+		this.credentialConfig = awsClients.credentialConfig ?? {};
+	}
+	getCreateClient() {
+		const shared = this.cloudFrontClient;
+		if (!(shared instanceof CloudFrontClient)) return Promise.resolve(shared);
+		this.createClient ??= shared.config.region().then((region) => withoutServerErrorRetries(new CloudFrontClient({
+			...clientDefaultsFor(this.credentialConfig),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
 	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CloudFront Origin Access Control ${logicalId}`);
 		try {
-			const oacId = (await this.cloudFrontClient.send(new CreateOriginAccessControlCommand({ OriginAccessControlConfig: this.toSdkConfig(properties["OriginAccessControlConfig"], logicalId, resourceType) }))).OriginAccessControl?.Id;
+			const oacId = (await (await this.getCreateClient()).send(new CreateOriginAccessControlCommand({ OriginAccessControlConfig: this.toSdkConfig(properties["OriginAccessControlConfig"], logicalId, resourceType) }))).OriginAccessControl?.Id;
 			if (!oacId) throw new Error("CreateOriginAccessControl returned no OriginAccessControl.Id");
 			this.logger.debug(`Created CloudFront Origin Access Control: ${oacId}`);
 			return {
@@ -23111,6 +23302,15 @@ function isElbv2NotFoundName(error) {
 	const name = error?.name;
 	return name === "LoadBalancerNotFoundException" || name === "TargetGroupNotFoundException" || name === "ListenerNotFoundException";
 }
+const ELBV2_ARN_PATTERNS = /* @__PURE__ */ new Map([
+	["AWS::ElasticLoadBalancingV2::LoadBalancer", /^arn:(aws[a-z-]*):elasticloadbalancing:([a-z0-9-]+):(\d{12}):loadbalancer\/(?:app|net|gwy)\/[A-Za-z0-9-]+\/[0-9a-f]+$/],
+	["AWS::ElasticLoadBalancingV2::TargetGroup", /^arn:(aws[a-z-]*):elasticloadbalancing:([a-z0-9-]+):(\d{12}):targetgroup\/[A-Za-z0-9-]+\/[0-9a-f]+$/],
+	["AWS::ElasticLoadBalancingV2::Listener", /^arn:(aws[a-z-]*):elasticloadbalancing:([a-z0-9-]+):(\d{12}):listener\/(?:app|net|gwy)\/[A-Za-z0-9-]+\/[0-9a-f]+\/[0-9a-f]+$/]
+]);
+function elbv2ArnScope(resourceType, physicalId) {
+	const match = ELBV2_ARN_PATTERNS.get(resourceType)?.exec(physicalId);
+	return match ? `${match[1]}:${match[2]}:${match[3]}` : void 0;
+}
 var ELBv2Provider = class {
 	elbv2Client;
 	providerRegion = ambientRegion();
@@ -23164,7 +23364,8 @@ var ELBv2Provider = class {
 			"SslPolicy",
 			"AlpnPolicy",
 			"MutualAuthentication",
-			"ListenerAttributes"
+			"ListenerAttributes",
+			"Tags"
 		])]
 	]);
 	getClient() {
@@ -23180,6 +23381,13 @@ var ELBv2Provider = class {
 	maskErrorMessage(error, maskSecrets) {
 		return maskerOrIdentity(maskSecrets)(error instanceof Error ? error.message : String(error));
 	}
+	isDeleteTargetGone(error, context, notFoundName) {
+		return context?.failedCreateOrphan === true ? hasErrorName(error, [notFoundName]) : this.isNotFoundError(error);
+	}
+	logDeleteTargetGone(context, what, physicalId, logicalId, debugText) {
+		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  ${what} ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+		else this.logger.debug(debugText);
+	}
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
 	}
@@ -23217,6 +23425,47 @@ var ELBv2Provider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		const journaledScope = elbv2ArnScope(resourceType, journaledPhysicalId);
+		const recordScope = elbv2ArnScope(resourceType, record.physicalId);
+		if (journaledScope === void 0 || journaledScope !== recordScope) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledScope.split(":")[1] !== context.expectedRegion) return "unknown";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		if (await this.readElbv2ArnIfExists(resourceType, record.physicalId) !== record.physicalId) return "unknown";
+		const journaledLive = await this.readElbv2ArnIfExists(resourceType, journaledPhysicalId);
+		if (journaledLive === record.physicalId) return "same";
+		return journaledLive === void 0 || journaledLive === journaledPhysicalId ? "different" : "unknown";
+	}
+	async readElbv2ArnIfExists(resourceType, arn) {
+		let notFoundName;
+		let read;
+		switch (resourceType) {
+			case "AWS::ElasticLoadBalancingV2::LoadBalancer":
+				notFoundName = "LoadBalancerNotFoundException";
+				read = async () => (await this.getClient().send(new DescribeLoadBalancersCommand({ LoadBalancerArns: [arn] }))).LoadBalancers?.map((lb) => lb.LoadBalancerArn);
+				break;
+			case "AWS::ElasticLoadBalancingV2::TargetGroup":
+				notFoundName = "TargetGroupNotFoundException";
+				read = async () => (await this.getClient().send(new DescribeTargetGroupsCommand({ TargetGroupArns: [arn] }))).TargetGroups?.map((tg) => tg.TargetGroupArn);
+				break;
+			case "AWS::ElasticLoadBalancingV2::Listener":
+				notFoundName = "ListenerNotFoundException";
+				read = async () => (await this.getClient().send(new DescribeListenersCommand({ ListenerArns: [arn] }))).Listeners?.map((l) => l.ListenerArn);
+				break;
+			default: throw new Error(`No ELBv2 identity read for ${resourceType}`);
+		}
+		let arns;
+		try {
+			arns = await read();
+		} catch (error) {
+			if (error?.name === notFoundName) return void 0;
+			throw error;
+		}
+		const found = arns ?? [];
+		if (found.length !== 1 || typeof found[0] !== "string" || found[0] === "") throw new Error("ELBv2 did not return exactly the resource asked for");
+		return found[0];
+	}
 	async createLoadBalancer(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating LoadBalancer ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -23490,10 +23739,10 @@ var ELBv2Provider = class {
 			flip.deleteAccepted = true;
 			this.logger.debug(`Successfully deleted LoadBalancer ${logicalId}`);
 		} catch (error) {
-			if (this.isNotFoundError(error)) {
+			if (this.isDeleteTargetGone(error, context, "LoadBalancerNotFoundException")) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`LoadBalancer ${physicalId} does not exist, skipping deletion`);
+				this.logDeleteTargetGone(context, "Load balancer", physicalId, logicalId, `LoadBalancer ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -23657,10 +23906,10 @@ var ELBv2Provider = class {
 			await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: physicalId }));
 			this.logger.debug(`Successfully deleted TargetGroup ${logicalId}`);
 		} catch (error) {
-			if (this.isNotFoundError(error)) {
+			if (this.isDeleteTargetGone(error, context, "TargetGroupNotFoundException")) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`TargetGroup ${physicalId} does not exist, skipping deletion`);
+				this.logDeleteTargetGone(context, "Target group", physicalId, logicalId, `TargetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -23801,10 +24050,10 @@ var ELBv2Provider = class {
 			await this.getClient().send(new DeleteListenerCommand({ ListenerArn: physicalId }));
 			this.logger.debug(`Successfully deleted Listener ${logicalId}`);
 		} catch (error) {
-			if (this.isNotFoundError(error)) {
+			if (this.isDeleteTargetGone(error, context, "ListenerNotFoundException")) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Listener ${physicalId} does not exist, skipping deletion`);
+				this.logDeleteTargetGone(context, "Listener", physicalId, logicalId, `Listener ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -24221,6 +24470,7 @@ const RETAINED_ON_REMOVAL = [
 ];
 var RDSDBProxyProvider = class {
 	rdsClient;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("RDSDBProxyProvider");
 	attributeCache = /* @__PURE__ */ new Map();
@@ -24237,12 +24487,22 @@ var RDSDBProxyProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.rdsClient) {
+			this.rdsClient = new RDSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new RDSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.rdsClient;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const dbProxyName = properties["DBProxyName"] ?? generateResourceName(logicalId, { maxLength: 64 });
@@ -24257,7 +24517,7 @@ var RDSDBProxyProvider = class {
 		const client = this.getClient();
 		this.logger.debug(`Creating DBProxy ${dbProxyName} (${engineFamily})`);
 		try {
-			await client.send(new CreateDBProxyCommand({
+			await this.getCreateClient().send(new CreateDBProxyCommand({
 				DBProxyName: dbProxyName,
 				EngineFamily: engineFamily,
 				Auth: auth,
@@ -24535,6 +24795,7 @@ const POLL_INTERVAL_MS = 5e3;
 const POLL_TIMEOUT_MS = 18e5;
 var RDSDBProxyEndpointProvider = class {
 	rdsClient;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("RDSDBProxyEndpointProvider");
 	attributeCache = /* @__PURE__ */ new Map();
@@ -24547,12 +24808,22 @@ var RDSDBProxyEndpointProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.rdsClient) this.rdsClient = new RDSClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.rdsClient) {
+			this.rdsClient = new RDSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new RDSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.rdsClient;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const dbProxyName = properties["DBProxyName"];
@@ -24563,7 +24834,7 @@ var RDSDBProxyEndpointProvider = class {
 		const client = this.getClient();
 		this.logger.debug(`Creating DBProxyEndpoint ${dbProxyEndpointName} (proxy=${dbProxyName})`);
 		try {
-			await client.send(new CreateDBProxyEndpointCommand({
+			await this.getCreateClient().send(new CreateDBProxyEndpointCommand({
 				DBProxyName: dbProxyName,
 				DBProxyEndpointName: dbProxyEndpointName,
 				VpcSubnetIds: vpcSubnetIds,
@@ -25374,6 +25645,7 @@ function instanceAttributes(instance) {
 }
 var DocDBProvider = class {
 	docdbClient;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("DocDBProvider");
 	protectionFlips = new ProtectionFlipRegistry();
@@ -25405,12 +25677,22 @@ var DocDBProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.docdbClient) this.docdbClient = new DocDBClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.docdbClient) {
+			this.docdbClient = new DocDBClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new DocDBClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.docdbClient;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::DocDB::DBCluster": return this.createDBCluster(logicalId, resourceType, properties);
@@ -25442,7 +25724,7 @@ var DocDBProvider = class {
 		});
 		let clusterCreated = false;
 		try {
-			const response = await this.getClient().send(new CreateDBClusterCommand$1({
+			const response = await this.getCreateClient().send(new CreateDBClusterCommand$1({
 				DBClusterIdentifier: dbClusterIdentifier,
 				Engine: "docdb",
 				EngineVersion: properties["EngineVersion"],
@@ -25588,7 +25870,7 @@ var DocDBProvider = class {
 		});
 		let instanceCreated = false;
 		try {
-			const response = await this.getClient().send(new CreateDBInstanceCommand$1({
+			const response = await this.getCreateClient().send(new CreateDBInstanceCommand$1({
 				DBInstanceIdentifier: dbInstanceIdentifier,
 				DBInstanceClass: properties["DBInstanceClass"],
 				Engine: "docdb",
@@ -25816,6 +26098,7 @@ var DocDBProvider = class {
 //#region src/provisioning/providers/docdb-subnet-group-provider.ts
 var DocDBSubnetGroupProvider = class {
 	docdbClient;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("DocDBSubnetGroupProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBSubnetGroup", /* @__PURE__ */ new Set([
@@ -25825,12 +26108,22 @@ var DocDBSubnetGroupProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.docdbClient) this.docdbClient = new DocDBClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.docdbClient) {
+			this.docdbClient = new DocDBClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new DocDBClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.docdbClient;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	assertType(resourceType, logicalId, physicalId) {
 		if (resourceType !== "AWS::DocDB::DBSubnetGroup") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 	}
@@ -25843,7 +26136,7 @@ var DocDBSubnetGroupProvider = class {
 			lowercase: true
 		});
 		try {
-			await this.getClient().send(new CreateDBSubnetGroupCommand$1({
+			await this.getCreateClient().send(new CreateDBSubnetGroupCommand$1({
 				DBSubnetGroupName: dbSubnetGroupName,
 				DBSubnetGroupDescription: properties["DBSubnetGroupDescription"] || `Subnet group for ${logicalId}`,
 				SubnetIds: properties["SubnetIds"],
@@ -27176,6 +27469,7 @@ function collectSdkUnsupportedRuleKeys(value, found) {
 }
 var WAFv2WebACLProvider = class {
 	wafv2Client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("WAFv2WebACLProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
@@ -27193,12 +27487,22 @@ var WAFv2WebACLProvider = class {
 		"AssociationConfig"
 	])]]);
 	getClient() {
-		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.wafv2Client) {
+			this.wafv2Client = new WAFV2Client({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new WAFV2Client({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.wafv2Client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -27210,7 +27514,7 @@ var WAFv2WebACLProvider = class {
 				Key: tag.Key,
 				Value: tag.Value
 			}));
-			const summary = (await this.getClient().send(new CreateWebACLCommand({
+			const summary = (await this.getCreateClient().send(new CreateWebACLCommand({
 				Name: name,
 				Scope: scope,
 				DefaultAction: properties["DefaultAction"],
@@ -28392,6 +28696,7 @@ var CognitoUserPoolProvider = class {
 const CACHE_DELETE_WAIT_MS = Math.max(6e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "DELETE"));
 var ElastiCacheProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ElastiCacheProvider");
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["AutoMinorVersionUpgrade", true]])]]);
@@ -28428,12 +28733,22 @@ var ElastiCacheProvider = class {
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
 	getClient() {
-		if (!this.client) this.client = new ElastiCacheClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new ElastiCacheClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new ElastiCacheClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::ElastiCache::SubnetGroup": return this.createSubnetGroup(logicalId, resourceType, properties);
@@ -28464,7 +28779,7 @@ var ElastiCacheProvider = class {
 			lowercase: true
 		});
 		try {
-			await this.getClient().send(new CreateCacheSubnetGroupCommand({
+			await this.getCreateClient().send(new CreateCacheSubnetGroupCommand({
 				CacheSubnetGroupName: cacheSubnetGroupName,
 				CacheSubnetGroupDescription: properties["Description"] ?? properties["CacheSubnetGroupDescription"] ?? `Subnet group for ${logicalId}`,
 				SubnetIds: properties["SubnetIds"],
@@ -28532,7 +28847,7 @@ var ElastiCacheProvider = class {
 		});
 		let clusterCreated = false;
 		try {
-			await this.getClient().send(new CreateCacheClusterCommand({
+			await this.getCreateClient().send(new CreateCacheClusterCommand({
 				CacheClusterId: cacheClusterId,
 				Engine: properties["Engine"],
 				CacheNodeType: properties["CacheNodeType"],
@@ -31450,8 +31765,21 @@ function makeCallerAccountResolver(region) {
 		return cached;
 	};
 }
+function newGlueClients(region) {
+	return {
+		client: new GlueClient({
+			...ambientClientDefaults(),
+			...region ? { region } : {}
+		}),
+		createClient: withoutServerErrorRetries(new GlueClient({
+			...ambientClientDefaults(),
+			...region ? { region } : {}
+		}))
+	};
+}
 var GlueProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueProvider");
@@ -31470,12 +31798,13 @@ var GlueProvider = class {
 		"OpenTableFormatInput"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::Glue::Database": return this.createDatabase(logicalId, resourceType, properties, context);
@@ -31511,7 +31840,7 @@ var GlueProvider = class {
 		if (!databaseName) throw new ProvisioningError(`DatabaseInput.Name or top-level DatabaseName is required for Glue Database ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
-			await this.getClient().send(new CreateDatabaseCommand({
+			await this.getCreateClient().send(new CreateDatabaseCommand({
 				CatalogId: catalogId,
 				DatabaseInput: this.buildDatabaseInput(databaseInput, databaseName, { ...replayWarn(log, context) })
 			}));
@@ -31632,7 +31961,7 @@ var GlueProvider = class {
 		for (const [field, value] of [["DatabaseName", databaseName], ["TableInput.Name", tableName]]) if (typeof value !== "string") throw new ProvisioningError(`Glue Table ${logicalId}: ${field} must be a string, got ${describeUnresolvedName(value, log.mask)}. Set it to the ${field === "DatabaseName" ? "database" : "table"} name.`, resourceType, logicalId);
 		const physicalId = `${databaseName}|${tableName}`;
 		try {
-			await this.getClient().send(new CreateTableCommand$1({
+			await this.getCreateClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
 				DatabaseName: databaseName,
 				TableInput: this.buildTableInput(tableInput, tableName),
@@ -32117,6 +32446,7 @@ var GlueProvider = class {
 };
 var GlueWorkflowProvider = class {
 	client;
+	createClient;
 	stsClient;
 	cachedAccountId;
 	providerRegion = ambientRegion();
@@ -32132,12 +32462,13 @@ var GlueWorkflowProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
@@ -32146,7 +32477,7 @@ var GlueWorkflowProvider = class {
 		if (!name) throw new ProvisioningError(`Name is required for Glue Workflow ${logicalId}`, resourceType, logicalId);
 		const tags = desiredGlueTags(properties["Tags"], resourceType, logicalId);
 		try {
-			await this.getClient().send(new CreateWorkflowCommand({
+			await this.getCreateClient().send(new CreateWorkflowCommand({
 				Name: name,
 				...properties["Description"] !== void 0 && { Description: properties["Description"] },
 				...properties["DefaultRunProperties"] !== void 0 && { DefaultRunProperties: properties["DefaultRunProperties"] },
@@ -32271,6 +32602,7 @@ var GlueWorkflowProvider = class {
 };
 var GlueSecurityConfigurationProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueSecurityConfigurationProvider");
 	wrapMaskedError(mask, error, build) {
@@ -32278,12 +32610,13 @@ var GlueSecurityConfigurationProvider = class {
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([properties["Name"]]));
 		const { value: v } = log;
@@ -32293,7 +32626,7 @@ var GlueSecurityConfigurationProvider = class {
 		const encryptionConfiguration = properties["EncryptionConfiguration"];
 		if (!encryptionConfiguration) throw new ProvisioningError(`EncryptionConfiguration is required for Glue SecurityConfiguration ${logicalId}`, resourceType, logicalId);
 		try {
-			await this.getClient().send(new CreateSecurityConfigurationCommand({
+			await this.getCreateClient().send(new CreateSecurityConfigurationCommand({
 				Name: name,
 				EncryptionConfiguration: buildEncryptionConfiguration(encryptionConfiguration)
 			}));
@@ -32457,6 +32790,7 @@ async function fetchGlueTags(client, stsClient, resource, name, accountId, logge
 }
 var GlueJobProvider = class {
 	client;
+	createClient;
 	stsClient;
 	cachedAccountId;
 	providerRegion = ambientRegion();
@@ -32491,12 +32825,13 @@ var GlueJobProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	getStsClient() {
 		if (!this.stsClient) this.stsClient = new STSClient({
 			...ambientClientDefaults(),
@@ -32515,7 +32850,7 @@ var GlueJobProvider = class {
 		if (!command) throw new ProvisioningError(`Command is required for Glue Job ${logicalId}`, resourceType, logicalId);
 		const tags = desiredGlueTags(properties["Tags"], resourceType, logicalId);
 		try {
-			await this.getClient().send(new CreateJobCommand({
+			await this.getCreateClient().send(new CreateJobCommand({
 				Name: name,
 				Role: role,
 				Command: buildJobCommand(command),
@@ -32748,6 +33083,7 @@ function pickDefined(obj) {
 }
 var GlueCrawlerProvider = class {
 	client;
+	createClient;
 	stsClient;
 	cachedAccountId;
 	providerRegion = ambientRegion();
@@ -32773,12 +33109,13 @@ var GlueCrawlerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	getStsClient() {
 		if (!this.stsClient) this.stsClient = new STSClient({
 			...ambientClientDefaults(),
@@ -32797,7 +33134,7 @@ var GlueCrawlerProvider = class {
 		if (!targets) throw new ProvisioningError(`Targets is required for Glue Crawler ${logicalId}`, resourceType, logicalId);
 		const tags = desiredGlueTags(properties["Tags"], resourceType, logicalId);
 		try {
-			await this.getClient().send(new CreateCrawlerCommand({
+			await this.getCreateClient().send(new CreateCrawlerCommand({
 				Name: name,
 				Role: role,
 				Targets: toSdkCrawlerTargets(targets),
@@ -33006,6 +33343,7 @@ function toCfnCrawlerTargets(targets) {
 }
 var GlueConnectionProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueConnectionProvider");
@@ -33014,12 +33352,13 @@ var GlueConnectionProvider = class {
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		const log = glueOperationSinks(this.logger, context?.maskSecrets, secretNamePairs([asRecord$1(properties["ConnectionInput"])?.["Name"], properties["CatalogId"]]));
 		const { value: v } = log;
@@ -33029,7 +33368,7 @@ var GlueConnectionProvider = class {
 		const name = connectionInput["Name"] ?? logicalId;
 		const catalogId = properties["CatalogId"];
 		try {
-			await this.getClient().send(new CreateConnectionCommand({
+			await this.getCreateClient().send(new CreateConnectionCommand({
 				...catalogId && { CatalogId: catalogId },
 				ConnectionInput: buildConnectionInput(connectionInput, name)
 			}));
@@ -33177,6 +33516,7 @@ function buildConnectionInput(ci, fallbackName) {
 }
 var GlueTriggerProvider = class {
 	client;
+	createClient;
 	stsClient;
 	cachedAccountId;
 	providerRegion = ambientRegion();
@@ -33197,12 +33537,13 @@ var GlueTriggerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new GlueClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	getStsClient() {
 		if (!this.stsClient) this.stsClient = new STSClient({
 			...ambientClientDefaults(),
@@ -33221,7 +33562,7 @@ var GlueTriggerProvider = class {
 		if (!actions) throw new ProvisioningError(`Actions is required for Glue Trigger ${logicalId}`, resourceType, logicalId);
 		const tags = desiredGlueTags(properties["Tags"], resourceType, logicalId);
 		try {
-			await this.getClient().send(new CreateTriggerCommand({
+			await this.getCreateClient().send(new CreateTriggerCommand({
 				Name: name,
 				Type: type,
 				Actions: actions,
@@ -33957,6 +34298,7 @@ function removableRecorded(kind, items) {
 }
 var BudgetsBudgetProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("BudgetsBudgetProvider");
 	accountIdPromise;
@@ -33966,12 +34308,26 @@ var BudgetsBudgetProvider = class {
 		"ResourceTags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new BudgetsClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new BudgetsClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new BudgetsClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	wrapBudgetError(mask, error, verb, logicalId, resourceType, physicalId) {
+		const cause = error instanceof Error ? error : void 0;
+		return wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`Failed to ${verb} budget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	resolveAccountId() {
 		if (!this.accountIdPromise) this.accountIdPromise = (async () => {
 			try {
@@ -34092,7 +34448,7 @@ var BudgetsBudgetProvider = class {
 			const notifications = this.toSdkNotificationsWithSubscribers(lists.NotificationsWithSubscribers);
 			const resourceTags = this.toSdkResourceTags(lists.ResourceTags);
 			const arn = await this.budgetArn(accountId, name);
-			await this.getClient().send(new CreateBudgetCommand({
+			await this.getCreateClient().send(new CreateBudgetCommand({
 				AccountId: accountId,
 				Budget: this.toSdkBudget(properties["Budget"], name, logicalId, resourceType, mask),
 				...notifications.length > 0 && { NotificationsWithSubscribers: notifications },
@@ -34105,8 +34461,7 @@ var BudgetsBudgetProvider = class {
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create budget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapBudgetError(mask, error, "create", logicalId, resourceType, void 0);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -34151,8 +34506,7 @@ var BudgetsBudgetProvider = class {
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update budget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapBudgetError(mask, error, "update", logicalId, resourceType, physicalId);
 		}
 	}
 	readDesiredLists(logicalId, resourceType, values, physicalId) {
@@ -34782,6 +35136,22 @@ var KinesisStreamProvider = class {
 		if (journaledArn === void 0) return "different";
 		return journaledArn === recordArn ? "same" : "different";
 	}
+	async resourceIdentity(physicalId, _resourceType, context) {
+		if (!isStreamName(physicalId)) return void 0;
+		if (await this.getClient().config.region() !== context.expectedRegion) return void 0;
+		let response;
+		try {
+			response = await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$10) return RESOURCE_NOT_FOUND;
+			throw error;
+		}
+		const arn = response.StreamDescriptionSummary?.StreamARN;
+		const created = response.StreamDescriptionSummary?.StreamCreationTimestamp;
+		if (typeof arn !== "string" || arn === "") return void 0;
+		if (!(created instanceof Date) || Number.isNaN(created.getTime())) return void 0;
+		return `${arn}@${created.getTime()}`;
+	}
 	async readStreamArnIfExists(streamName) {
 		let response;
 		try {
@@ -34934,6 +35304,7 @@ function consumerArnParts(consumerArn) {
 }
 var KinesisStreamConsumerProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("KinesisStreamConsumerProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Kinesis::StreamConsumer", /* @__PURE__ */ new Set([
@@ -34942,12 +35313,22 @@ var KinesisStreamConsumerProvider = class {
 		"Tags"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new KinesisClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new KinesisClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new KinesisClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const consumerName = properties["ConsumerName"];
@@ -34958,7 +35339,7 @@ var KinesisStreamConsumerProvider = class {
 		const tagMap = tagListToMap(tagList);
 		let createdArn;
 		try {
-			const consumer = (await this.getClient().send(new RegisterStreamConsumerCommand({
+			const consumer = (await this.getCreateClient().send(new RegisterStreamConsumerCommand({
 				StreamARN: streamArn,
 				ConsumerName: consumerName,
 				...tagMap && Object.keys(tagMap).length > 0 ? { Tags: tagMap } : {}
@@ -35716,6 +36097,7 @@ function deleteFailureClassifier(resourceType, logicalId, physicalId) {
 }
 var PipesPipeProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("PipesPipeProvider");
 	options;
@@ -35748,19 +36130,29 @@ var PipesPipeProvider = class {
 		this.options = options;
 	}
 	getClient() {
-		if (!this.client) this.client = new PipesClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new PipesClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new PipesClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const name = properties["Name"] ?? generateResourceName(logicalId, { maxLength: 64 });
 		const tags = desiredTagMap(properties["Tags"], logicalId);
 		this.logger.debug(mask(`Creating Pipe ${logicalId}: ${name}`));
 		try {
-			await this.getClient().send(new CreatePipeCommand({
+			await this.getCreateClient().send(new CreatePipeCommand({
 				Name: name,
 				RoleArn: properties["RoleArn"],
 				Source: properties["Source"],
@@ -35777,7 +36169,7 @@ var PipesPipeProvider = class {
 			}));
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Pipe ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create Pipe ${logicalId}: ${mask(cause?.message ?? String(error))}`, resourceType, logicalId, void 0, cause);
 		}
 		let settled;
 		try {
@@ -35849,7 +36241,7 @@ var PipesPipeProvider = class {
 			if (error instanceof ProvisioningError) throw error;
 			if (error instanceof NotFoundException$6) assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Pipe ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Pipe ${logicalId}: ${mask(cause?.message ?? String(error))}`, resourceType, logicalId, physicalId, cause);
 		}
 		return {
 			physicalId,
@@ -36112,6 +36504,7 @@ function sameRootDirectory(requested, described) {
 }
 var EFSProvider = class {
 	client;
+	mountTargetCreateClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("EFSProvider");
 	unconfirmedCreationTokens = /* @__PURE__ */ new Map();
@@ -36144,12 +36537,22 @@ var EFSProvider = class {
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]])]]);
 	getClient() {
-		if (!this.client) this.client = new EFSClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new EFSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.mountTargetCreateClient = withoutServerErrorRetries(new EFSClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getMountTargetCreateClient() {
+		this.getClient();
+		return this.mountTargetCreateClient;
+	}
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
 	}
@@ -36479,7 +36882,7 @@ var EFSProvider = class {
 		const securityGroups = properties["SecurityGroups"];
 		let createdMountTargetId;
 		try {
-			const mountTargetId = (await this.getClient().send(new CreateMountTargetCommand({
+			const mountTargetId = (await this.getMountTargetCreateClient().send(new CreateMountTargetCommand({
 				FileSystemId: fileSystemId,
 				SubnetId: subnetId,
 				SecurityGroups: securityGroups
@@ -36822,6 +37225,8 @@ var EFSProvider = class {
 //#region src/provisioning/providers/fsx-filesystem-provider.ts
 const DEFAULT_MAX_WAIT_MS$3 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$3 = 15e3;
+const FILE_SYSTEM_ID_PATTERN = /^fs-[0-9a-f]+$/;
+const FILE_SYSTEM_NOT_LIVE_LIFECYCLES = /* @__PURE__ */ new Set(["DELETING", "FAILED"]);
 const LUSTRE_MUTABLE_SUBPROPS = /* @__PURE__ */ new Set([
 	"WeeklyMaintenanceStartTime",
 	"DailyAutomaticBackupStartTime",
@@ -37474,7 +37879,8 @@ var FSxFileSystemProvider = class {
 			if (error instanceof FileSystemNotFound$1) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`FSx FileSystem ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  FSx file system ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`FSx FileSystem ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -37483,6 +37889,30 @@ var FSxFileSystemProvider = class {
 		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType);
 		this.logger.debug(`Successfully deleted FSx FileSystem ${logicalId}`);
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::FSx::FileSystem") return "unknown";
+		if (!FILE_SYSTEM_ID_PATTERN.test(journaledPhysicalId) || !FILE_SYSTEM_ID_PATTERN.test(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordRead = await this.readFileSystemForIdentity(record.physicalId);
+		if (recordRead === void 0 || recordRead.id !== record.physicalId || FILE_SYSTEM_NOT_LIVE_LIFECYCLES.has(recordRead.lifecycle ?? "")) return "unknown";
+		return (await this.readFileSystemForIdentity(journaledPhysicalId))?.id === record.physicalId ? "same" : "different";
+	}
+	async readFileSystemForIdentity(fileSystemId) {
+		let response;
+		try {
+			response = await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [fileSystemId] }));
+		} catch (error) {
+			if (error instanceof FileSystemNotFound$1) return void 0;
+			throw error;
+		}
+		const fileSystems = response.FileSystems ?? [];
+		if (fileSystems.length !== 1 || typeof fileSystems[0]?.FileSystemId !== "string") throw new Error("DescribeFileSystems did not return exactly the file system asked for");
+		return {
+			id: fileSystems[0].FileSystemId,
+			lifecycle: fileSystems[0].Lifecycle
+		};
+	}
 	async describeForPoll(fileSystemId, transientState, maxConsecutiveTransient = 5) {
 		try {
 			const response = await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [fileSystemId] }));
@@ -37859,6 +38289,7 @@ const LIVE_CLUSTER_STATES = [
 	"RUNNING",
 	"WAITING"
 ];
+const CLUSTER_ID_PATTERN = /^j-[0-9A-Z]+$/;
 const runJobFlowLatch = new AmbiguousCreateLatch("emr:RunJobFlow");
 const clustersCreatedByThisProcess = new RecentIdSet();
 function emrClusterProtectionSite(physicalId, region) {
@@ -38297,7 +38728,8 @@ var EMRClusterProvider = class {
 			if (error instanceof InvalidRequestException) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`EMR Cluster ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  EMR cluster ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`EMR Cluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -38305,7 +38737,8 @@ var EMRClusterProvider = class {
 		}
 		const currentState = current?.Status?.State;
 		if (currentState && TERMINAL_STATES.has(currentState)) {
-			this.logger.debug(`EMR Cluster ${physicalId} already ${currentState}, skipping deletion`);
+			if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  EMR cluster ${physicalId} (${logicalId}), which a failed deploy created, is already ${currentState}; nothing to delete`);
+			else this.logger.debug(`EMR Cluster ${physicalId} already ${currentState}, skipping deletion`);
 			return;
 		}
 		try {
@@ -38406,6 +38839,27 @@ var EMRClusterProvider = class {
 			default: return;
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::EMR::Cluster") return "unknown";
+		if (!CLUSTER_ID_PATTERN.test(journaledPhysicalId) || !CLUSTER_ID_PATTERN.test(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recorded = await this.readClusterIdentity(record.physicalId);
+		if (recorded?.id !== record.physicalId) return "unknown";
+		return (await this.readClusterIdentity(journaledPhysicalId))?.id === recorded.id ? "same" : "different";
+	}
+	async readClusterIdentity(clusterId) {
+		let response;
+		try {
+			response = await this.getClient().send(new DescribeClusterCommand({ ClusterId: clusterId }));
+		} catch (error) {
+			if (error instanceof InvalidRequestException) return void 0;
+			throw error;
+		}
+		const id = response.Cluster?.Id;
+		if (typeof id !== "string") throw new Error("DescribeCluster did not return the cluster asked for");
+		return { id };
+	}
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, null);
 		if (explicit) {
@@ -39188,6 +39642,7 @@ const FIREHOSE_DELETE_POLL_INTERVAL_MS = 5e3;
 const FIREHOSE_DELETE_MAX_WAIT_MS = 6e5;
 var FirehoseProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("FirehoseProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::KinesisFirehose::DeliveryStream", /* @__PURE__ */ new Set([
@@ -39206,12 +39661,22 @@ var FirehoseProvider = class {
 		"DeliveryStreamEncryptionConfigurationInput"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new FirehoseClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new FirehoseClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new FirehoseClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating Firehose delivery stream ${logicalId}`);
 		const deliveryStreamName = properties["DeliveryStreamName"];
@@ -39344,7 +39809,7 @@ var FirehoseProvider = class {
 				Key: t.Key,
 				Value: t.Value
 			}));
-			const response = await this.getClient().send(new CreateDeliveryStreamCommand(input));
+			const response = await this.getCreateClient().send(new CreateDeliveryStreamCommand(input));
 			const physicalId = deliveryStreamName || input.DeliveryStreamName || response.DeliveryStreamARN?.split("/").pop() || "";
 			createdStreamName = physicalId;
 			const arn = response.DeliveryStreamARN;
@@ -40055,6 +40520,7 @@ function describeValue(value) {
 }
 var CloudTrailProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("CloudTrailProvider");
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Map([["IsMultiRegionTrail", false], ["EnableLogFileValidation", false]])]]);
@@ -40076,12 +40542,22 @@ var CloudTrailProvider = class {
 		"IsOrganizationTrail"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CloudTrailClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new CloudTrailClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new CloudTrailClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CloudTrail Trail ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
@@ -40103,7 +40579,7 @@ var CloudTrailProvider = class {
 		let trailCreated = false;
 		let createdTrailArn;
 		try {
-			const result = await this.getClient().send(new CreateTrailCommand({
+			const result = await this.getCreateClient().send(new CreateTrailCommand({
 				Name: trailName ?? logicalId,
 				S3BucketName: s3BucketName,
 				S3KeyPrefix: s3KeyPrefix,
@@ -40354,6 +40830,7 @@ var CloudTrailProvider = class {
 //#region src/provisioning/providers/codebuild-provider.ts
 var CodeBuildProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("CodeBuildProvider");
 	disableCcApiFallback = true;
@@ -40382,12 +40859,22 @@ var CodeBuildProvider = class {
 		"AutoRetryLimit"
 	])]]);
 	getClient() {
-		if (!this.client) this.client = new CodeBuildClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new CodeBuildClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new CodeBuildClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	mapSource(source, containerPath) {
 		if (source == null) return { type: "NO_SOURCE" };
 		let buildspec;
@@ -40562,7 +41049,7 @@ var CodeBuildProvider = class {
 		this.logger.debug(`Creating CodeBuild Project ${logicalId}`);
 		try {
 			const input = this.mapProperties(logicalId, properties);
-			const result = await this.getClient().send(new CreateProjectCommand(input));
+			const result = await this.getCreateClient().send(new CreateProjectCommand(input));
 			const projectName = result.project.name;
 			const projectArn = result.project.arn;
 			this.logger.debug(`Successfully created CodeBuild Project ${logicalId}: ${projectName}`);
@@ -41589,6 +42076,7 @@ var DLMLifecyclePolicyProvider = class {
 //#region src/provisioning/providers/s3-vectors-provider.ts
 var S3VectorsProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("S3VectorsProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3Vectors::VectorBucket", /* @__PURE__ */ new Set([
@@ -41600,12 +42088,22 @@ var S3VectorsProvider = class {
 		return wrapMaskedAwsError(mask, error, build);
 	}
 	getClient() {
-		if (!this.client) this.client = new S3VectorsClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new S3VectorsClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new S3VectorsClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::S3Vectors::VectorBucket": return this.createVectorBucket(logicalId, resourceType, properties);
@@ -41680,7 +42178,7 @@ var S3VectorsProvider = class {
 		const tagRecord = Object.fromEntries(desiredTags.map((t) => [t.Key, t.Value]));
 		const tags = Object.keys(tagRecord).length > 0 ? tagRecord : void 0;
 		try {
-			const result = await this.getClient().send(new CreateVectorBucketCommand({
+			const result = await this.getCreateClient().send(new CreateVectorBucketCommand({
 				vectorBucketName,
 				encryptionConfiguration: encryptionConfiguration ? {
 					sseType: encryptionConfiguration["SseType"],
@@ -41804,6 +42302,8 @@ function notEmptyRefusalMessage(bucketName) {
 }
 var S3DirectoryBucketProvider = class {
 	s3Client;
+	createClient;
+	credentialConfig;
 	stsClient;
 	logger = getLogger().child("S3DirectoryBucketProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3Express::DirectoryBucket", /* @__PURE__ */ new Set([
@@ -41819,6 +42319,17 @@ var S3DirectoryBucketProvider = class {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
 		this.stsClient = awsClients.sts;
+		this.credentialConfig = awsClients.credentialConfig ?? {};
+	}
+	getCreateClient() {
+		this.createClient ??= this.s3Client.config.region().then((region) => withoutServerErrorRetries(new S3Client({
+			...clientDefaultsFor(this.credentialConfig),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
 	}
 	getEc2Client() {
 		if (!this.ec2Client) this.ec2Client = new EC2Client({
@@ -41876,7 +42387,7 @@ var S3DirectoryBucketProvider = class {
 		const includeTags = tags.length > 0;
 		try {
 			const attributes = await this.buildAttributes(bucketName);
-			await this.s3Client.send(new CreateBucketCommand({
+			await (await this.getCreateClient()).send(new CreateBucketCommand({
 				Bucket: bucketName,
 				CreateBucketConfiguration: {
 					Bucket: {
@@ -42086,6 +42597,7 @@ function tableIdentityFromGetTable(tableARN, namespace, name) {
 }
 var S3TablesProvider = class {
 	client;
+	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("S3TablesProvider");
 	handledProperties = /* @__PURE__ */ new Map([
@@ -42102,12 +42614,22 @@ var S3TablesProvider = class {
 		])]
 	]);
 	getClient() {
-		if (!this.client) this.client = new S3TablesClient({
-			...ambientClientDefaults(),
-			...this.providerRegion ? { region: this.providerRegion } : {}
-		});
+		if (!this.client) {
+			this.client = new S3TablesClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			});
+			this.createClient = withoutServerErrorRetries(new S3TablesClient({
+				...ambientClientDefaults(),
+				...this.providerRegion ? { region: this.providerRegion } : {}
+			}));
+		}
 		return this.client;
 	}
+	getCreateClient() {
+		this.getClient();
+		return this.createClient;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::S3Tables::TableBucket": return this.createTableBucket(logicalId, resourceType, properties);
@@ -42150,7 +42672,7 @@ var S3TablesProvider = class {
 		if (!tableBucketName) throw new ProvisioningError(`TableBucketName is required for S3 Table Bucket ${logicalId}`, resourceType, logicalId);
 		const tags = this.tagListToSdkMap(desiredTags);
 		try {
-			const tableBucketARN = (await this.getClient().send(new CreateTableBucketCommand({
+			const tableBucketARN = (await this.getCreateClient().send(new CreateTableBucketCommand({
 				name: tableBucketName,
 				...tags !== void 0 && { tags }
 			}))).arn;
@@ -42247,7 +42769,7 @@ var S3TablesProvider = class {
 			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
 		});
 		try {
-			await this.getClient().send(new CreateNamespaceCommand({
+			await this.getCreateClient().send(new CreateNamespaceCommand({
 				tableBucketARN,
 				namespace: [namespaceName]
 			}));
@@ -42313,7 +42835,7 @@ var S3TablesProvider = class {
 		});
 		let tableCreated = false;
 		try {
-			const response = await this.getClient().send(new CreateTableCommand$2({
+			const response = await this.getCreateClient().send(new CreateTableCommand$2({
 				tableBucketARN,
 				namespace,
 				name,
@@ -43194,6 +43716,7 @@ var NestedStackProvider = class {
 			parameters: childParameters,
 			...inheritedSecrets && hasMaskableValues(inheritedSecrets) && { inheritedSecrets },
 			...passedClasses && { passedParameterClasses: passedClasses },
+			passedNoEchoParameters: passedNoEchoParametersOf(inheritedSecrets),
 			inheritedProducerRegions: getCurrentProducerRegions(),
 			parentStackInfo: {
 				parentStack: parentCtx.parentStackName,
@@ -43700,4 +44223,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DbpGX0KN.js.map
+//# sourceMappingURL=provider-classes-D76dAHvV.js.map