@go-to-k/cdkd 0.296.2 → 0.296.3

package/dist/{provider-classes-CtsCylnp.js → provider-classes-Ca6o5by0.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-Dvc7ddKe.js";
 import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $a as recoverMaskedOutput, $i as findSilentDropProperties, $n as observeThenDisableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, Aa as lambdaFunctionNameForMask, An as tagMapAsList, B as getPriorAttempts, Bi as refuseMalformedResourcesForDestroy, Br as passedParameterClassesOf, Ca as requireConfigObject, Cr as s3BucketWebsiteUrl, Ct as getStackRecords, D as beginDeleteWait, Dn as planTagDiff, Dr as getAccountInfo, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, En as DBPROXY_TAG_OPTIONS, F as waitForIndexesSettled, Gs as canonicalizeRegion, Gt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ho as rewriteTemplateAssetReferences, Hs as decodeListingKey, I as ECR_AUTO_DELETE_IMAGES_TAG, Jn as isWaitAbandonedError, Jt as redactedDeleteAddressSkip, Kn as deleteSkipReason, Ks as derivePartitionAndUrlSuffix, Kt as isRedactedRecordedValue, L as S3_AUTO_DELETE_OBJECTS_TAG, Lo as stringifyValue, Lr as parseWebACLArn, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as definedAttributes, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as stringifyIfAssigned, O as compensateRemovedDeletionProtection, Oa as withRetry, On as readTagList, P as deleteTableWithIndexBusyRetry, Pt as getCurrentProducerRegions, Qn as isTerminationProtectionPropagationError, R as hasCdkAutoDeleteTag, Sa as requireConfigArray, Sn as reserveStackCreateToken, Sr as s3BucketRegionalDomainName, T as DynamoDBGlobalTableProvider, Tn as DBPROXY_TAGS_WHAT, Un as unchangedBehindSecretReference, V as markRefusedBeforeApplying, Vn as slowCcOperationTimeoutMs, Xa as markSameGenerationBag, Yn as markWaitAbandoned, Za as redactSecretsForState, Zn as ec2InstanceProtectionSite, _a as configBooleanRefusal, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ac as resolveAssemblyPath, ao as carriesSecretMask, ba as readConfigString, bi as refuseMalformedNestedChildOutputs, bn as earliestDefined, br as s3BucketDomainName, c as renderNestedTemplateTreeDefect, da as coerceWarmThroughput$1, dt as getNestedRevertRun, er as reDisableInstanceApiTermination, fa as isWarmThroughputDecrease, ga as coerceCfnInteger, ha as coerceCfnBoolean, ic as renderAssemblyPathEscape, j as resolveDynamoDbDeleteBudgetMs, ja as sameLambdaFunctionAddress, jn as tagPlanWarning, k as deleteBudgetKey, ka as canonicalLambdaFunctionName, kn as refuseMalformedDesiredTags, ma as toFiniteNumber, mt as revertNestedChildFromJournal, nc as describeFileReadFailure, o as isAbsoluteAssetPath, pa as toCfnInteger, qn as withIndeterminateGuard, qt as redactedDeleteAddressFields, rc as displayAssemblyPath, s as listNestedTemplateRows, t as DeployEngine, ta as withoutSilentDropProperties, to as dynamicReferenceTokens, tr as reEnableInstanceApiTermination, ua as WARM_THROUGHPUT_MEMBERS, va as configIntegerRefusal, vr as isSettledInstanceState, vt as withNestedStackContext, wa as requireConfigString, wn as acquireIdempotencyToken, xa as replayWarn, xr as s3BucketDualStackDomainName, xt as awaitInFlightSibling, ya as configStringRefusal, yr as s3BucketArn, z as isTruthyCfnBoolean, za as hasMaskableValues, zn as getCurrentResourceSecrets } from "./deploy-engine-C_Eg-RHm.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-COoTgydF.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CiMVZi4n.js";
-import { RDSProvider } from "./rds-provider-DQwvPJXB.js";
-import { NeptuneProvider } from "./neptune-provider-D2SmeISr.js";
-import { ASGProvider } from "./asg-provider-DedWRf1j.js";
+import { $a as recoverMaskedOutput, $i as findSilentDropProperties, $n as observeThenDisableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, Aa as lambdaFunctionNameForMask, An as tagMapAsList, B as getPriorAttempts, Bi as refuseMalformedResourcesForDestroy, Br as passedParameterClassesOf, Ca as requireConfigObject, Cr as s3BucketWebsiteUrl, Ct as getStackRecords, D as beginDeleteWait, Dn as planTagDiff, Dr as getAccountInfo, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, En as DBPROXY_TAG_OPTIONS, F as waitForIndexesSettled, Gs as canonicalizeRegion, Gt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ho as rewriteTemplateAssetReferences, Hs as decodeListingKey, I as ECR_AUTO_DELETE_IMAGES_TAG, Jn as isWaitAbandonedError, Jt as redactedDeleteAddressSkip, Kn as deleteSkipReason, Ks as derivePartitionAndUrlSuffix, Kt as isRedactedRecordedValue, L as S3_AUTO_DELETE_OBJECTS_TAG, Lo as stringifyValue, Lr as parseWebACLArn, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mn as definedAttributes, N as INDEX_SETTLE_POLL_INTERVAL_MS, Nn as stringifyIfAssigned, O as compensateRemovedDeletionProtection, Oa as withRetry, On as readTagList, P as deleteTableWithIndexBusyRetry, Pt as getCurrentProducerRegions, Qn as isTerminationProtectionPropagationError, R as hasCdkAutoDeleteTag, Sa as requireConfigArray, Sn as reserveStackCreateToken, Sr as s3BucketRegionalDomainName, T as DynamoDBGlobalTableProvider, Tn as DBPROXY_TAGS_WHAT, Un as unchangedBehindSecretReference, V as markRefusedBeforeApplying, Vn as slowCcOperationTimeoutMs, Xa as markSameGenerationBag, Yn as markWaitAbandoned, Za as redactSecretsForState, Zn as ec2InstanceProtectionSite, _a as configBooleanRefusal, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ac as resolveAssemblyPath, ao as carriesSecretMask, ba as readConfigString, bi as refuseMalformedNestedChildOutputs, bn as earliestDefined, br as s3BucketDomainName, c as renderNestedTemplateTreeDefect, da as coerceWarmThroughput$1, dt as getNestedRevertRun, er as reDisableInstanceApiTermination, fa as isWarmThroughputDecrease, ga as coerceCfnInteger, ha as coerceCfnBoolean, ic as renderAssemblyPathEscape, j as resolveDynamoDbDeleteBudgetMs, ja as sameLambdaFunctionAddress, jn as tagPlanWarning, k as deleteBudgetKey, ka as canonicalLambdaFunctionName, kn as refuseMalformedDesiredTags, ma as toFiniteNumber, mt as revertNestedChildFromJournal, nc as describeFileReadFailure, o as isAbsoluteAssetPath, pa as toCfnInteger, qn as withIndeterminateGuard, qt as redactedDeleteAddressFields, rc as displayAssemblyPath, s as listNestedTemplateRows, t as DeployEngine, ta as withoutSilentDropProperties, to as dynamicReferenceTokens, tr as reEnableInstanceApiTermination, ua as WARM_THROUGHPUT_MEMBERS, va as configIntegerRefusal, vr as isSettledInstanceState, vt as withNestedStackContext, wa as requireConfigString, wn as acquireIdempotencyToken, xa as replayWarn, xr as s3BucketDualStackDomainName, xt as awaitInFlightSibling, ya as configStringRefusal, yr as s3BucketArn, z as isTruthyCfnBoolean, za as hasMaskableValues, zn as getCurrentResourceSecrets } from "./deploy-engine-Dre6eDNJ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-D9wk9Bnh.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-DFehMfoh.js";
+import { RDSProvider } from "./rds-provider-Dl--9uQU.js";
+import { NeptuneProvider } from "./neptune-provider-B1GRQ6UO.js";
+import { ASGProvider } from "./asg-provider-CksS_6jO.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -5591,8 +5591,8 @@ var SQSQueuePolicyProvider = class {
 	async queuesCarryingDocument(candidates, document, logicalId) {
 		if (candidates.length === 0) return [];
 		let reference;
-		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy(document);
-		else if (document !== null && typeof document === "object") reference = canonicalJson$1(document);
+		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy$1(document);
+		else if (document !== null && typeof document === "object") reference = canonicalJson$2(document);
 		if (reference === void 0) {
 			this.logger.warn(safeMsg`The queues ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`);
 			return [];
@@ -5600,7 +5600,7 @@ var SQSQueuePolicyProvider = class {
 		const carrying = [];
 		for (const queueUrl of candidates) {
 			const current = await this.readPolicyForWidening(queueUrl);
-			if (current.kind === "policy" && canonicalPolicy(current.policy) === reference) carrying.push(queueUrl);
+			if (current.kind === "policy" && canonicalPolicy$1(current.policy) === reference) carrying.push(queueUrl);
 			else if (current.kind === "unreadable") this.logger.warn(safeMsg`Could not read the policy of queue ${queueUrl} (${current.reason}), so it is not cleared: it may still carry the policy of ${logicalId}.`);
 			else this.logger.debug(safeMsg`Queue ${queueUrl} does not carry the policy of ${logicalId}; left as is`);
 		}
@@ -5696,7 +5696,7 @@ function listedQueues(bag) {
 function isListedQueueUrl(value) {
 	return isSqsQueueUrl(value) && !value.includes(",") && !value.includes("*");
 }
-function canonicalJson$1(value) {
+function canonicalJson$2(value) {
 	const sortKeys = (v) => {
 		if (Array.isArray(v)) return v.map(sortKeys);
 		if (v !== null && typeof v === "object") {
@@ -5709,9 +5709,9 @@ function canonicalJson$1(value) {
 	const sorted = sortKeys(value);
 	return JSON.stringify(sorted);
 }
-function canonicalPolicy(text) {
+function canonicalPolicy$1(text) {
 	try {
-		return canonicalJson$1(JSON.parse(text));
+		return canonicalJson$2(JSON.parse(text));
 	} catch {
 		return `raw:${text}`;
 	}
@@ -6467,15 +6467,27 @@ var SNSTopicPolicyProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating SNS topic policy ${logicalId}: ${physicalId}`);
 		const topics = properties["Topics"];
 		const policyDocument = properties["PolicyDocument"];
 		if (!topics || topics.length === 0) throw new ProvisioningError(`Topics is required for SNS topic policy ${logicalId}`, resourceType, logicalId, physicalId);
 		if (!policyDocument) throw new ProvisioningError(`PolicyDocument is required for SNS topic policy ${logicalId}`, resourceType, logicalId, physicalId);
 		const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
+		const mask = context?.maskSecrets ?? ((t) => t);
+		const written = splitTopicArns(physicalId);
+		const listedOnly = await this.topicsCarryingDocument(listedTopics(previousProperties).filter((arn) => !written.includes(arn) && !topics.includes(arn)), previousProperties["PolicyDocument"], logicalId, mask);
+		const dropped = written.filter((arn) => !topics.includes(arn));
+		const unaddressable = dropped.filter((arn) => !isSnsTopicArn(arn));
+		if (unaddressable.length > 0) {
+			const message = mask(safeMsg`The recorded id segment(s) ${unaddressable.join(", ")} of ${logicalId} are not topic ARNs; ` + (listedTopics(previousProperties).length > 0 ? "the topics its previous Topics listed were checked instead." : "its previous Topics lists no topic ARN either, so a topic it was attached to may still carry its policy."));
+			if (listedTopics(previousProperties).length > 0) this.logger.debug(message);
+			else this.logger.warn(message);
+		}
+		const removed = [...dropped.filter((arn) => isSnsTopicArn(arn)), ...listedOnly];
 		try {
 			for (const topicArn of topics) await this.setTopicPolicy(topicArn, policyDoc);
+			for (const topicArn of removed) await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion, "not-found", mask);
 			this.logger.debug(`Successfully updated SNS topic policy ${logicalId}`);
 			return {
 				physicalId: topics.join(","),
@@ -6483,28 +6495,77 @@ var SNSTopicPolicyProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SNS topic policy ${logicalId}: ${physicalId}`);
-		const topicArns = physicalId.split(",");
+		const named = splitTopicArns(physicalId);
+		if (named.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id is empty, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
+		const topicArns = named.every((arn) => isSnsTopicArn(arn)) ? named : [.../* @__PURE__ */ new Set([...named.filter((arn) => isSnsTopicArn(arn)), ...listedTopics(properties ?? {})])];
+		if (topicArns.length === 0) throw markNonRetryable(new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: its physical id names no SNS topic ARN and its Topics lists none either, so cdkd changed no topic. Set each topic the policy is attached to back to its default policy by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId));
 		for (const topicArn of topicArns) try {
-			await this.setTopicPolicy(topicArn, "");
-			this.logger.debug(`Removed policy from topic ${topicArn}`);
+			await this.resetTopicPolicy(topicArn, resourceType, logicalId, context?.expectedRegion);
 		} catch (error) {
-			if (error instanceof Error && (error.name === "NotFoundException" || error.name === "NotFound" || error.message.includes("not found") || error.message.includes("does not exist") || error.message.includes("Invalid parameter"))) {
-				const clientRegion = await getAwsClients().sns.config.region();
-				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, topicArn);
-				this.logger.debug(`Topic ${topicArn} not found or policy already removed, skipping`);
-				continue;
-			}
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to delete SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 		this.logger.debug(`Successfully deleted SNS topic policy ${logicalId}`);
 	}
+	async resetTopicPolicy(topicArn, resourceType, logicalId, expectedRegion, phase = "not-found", mask = (t) => t) {
+		const defaultPolicy = defaultTopicPolicy(topicArn);
+		if (defaultPolicy === void 0) throw new ProvisioningError(`Cannot remove SNS topic policy ${logicalId} from ${topicArn}: not an SNS topic ARN`, resourceType, logicalId, topicArn);
+		try {
+			await this.setTopicPolicy(topicArn, defaultPolicy);
+			this.logger.debug(mask(safeMsg`Reset the policy of topic ${topicArn} to the default`));
+		} catch (error) {
+			const name = error?.name;
+			if (name === "NotFoundException" || name === "NotFound") {
+				const clientRegion = await getAwsClients().sns.config.region();
+				assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, topicArn, phase);
+				this.logger.debug(mask(safeMsg`Topic ${topicArn} not found, skipping policy removal`));
+				return;
+			}
+			throw error;
+		}
+	}
+	async topicsCarryingDocument(candidates, document, logicalId, mask) {
+		if (candidates.length === 0) return [];
+		let reference;
+		if (typeof document === "string" && document.length > 0) reference = canonicalPolicy(document);
+		else if (document !== null && typeof document === "object") reference = canonicalJson$1(document);
+		if (reference === void 0) {
+			this.logger.warn(mask(safeMsg`The topics ${candidates.join(", ")} listed by ${logicalId} were not checked (no policy document recorded to compare with) and may still carry its policy.`));
+			return [];
+		}
+		const carrying = [];
+		for (const topicArn of candidates) {
+			const current = await this.readPolicyForWidening(topicArn);
+			if (current.kind === "policy" && canonicalPolicy(current.policy) === reference) carrying.push(topicArn);
+			else if (current.kind === "unreadable") this.logger.warn(mask(safeMsg`Could not read the policy of topic ${topicArn} (${current.reason}), so it is not reset: it may still carry the policy of ${logicalId}.`));
+			else this.logger.debug(mask(safeMsg`Topic ${topicArn} does not carry the policy of ${logicalId}; left as is`));
+		}
+		return carrying;
+	}
+	async readPolicyForWidening(topicArn) {
+		try {
+			const policy = (await getAwsClients().sns.send(new GetTopicAttributesCommand({ TopicArn: topicArn }))).Attributes?.["Policy"];
+			return policy ? {
+				kind: "policy",
+				policy
+			} : { kind: "none" };
+		} catch (err) {
+			const name = err.name;
+			if (name === "NotFoundException" || name === "NotFound") return { kind: "none" };
+			return {
+				kind: "unreadable",
+				reason: name ?? "error"
+			};
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		const topics = physicalId.split(",").filter((t) => t.length > 0);
 		if (topics.length === 0) return void 0;
@@ -6557,6 +6618,60 @@ function isSnsTopicArnList(value) {
 	if (segments.length === 0) return false;
 	return segments.every((s) => isSnsTopicArn(s));
 }
+function splitTopicArns(physicalId) {
+	return physicalId.split(",").filter((arn) => arn.length > 0);
+}
+function listedTopics(bag) {
+	const listed = bag["Topics"];
+	if (!Array.isArray(listed)) return [];
+	const out = [];
+	for (const entry of listed) if (typeof entry === "string" && isSnsTopicArn(entry) && !out.includes(entry)) out.push(entry);
+	return out;
+}
+function defaultTopicPolicy(topicArn) {
+	if (!isSnsTopicArn(topicArn)) return void 0;
+	const account = topicArn.split(":")[4];
+	return JSON.stringify({
+		Version: "2008-10-17",
+		Id: "__default_policy_ID",
+		Statement: [{
+			Sid: "__default_statement_ID",
+			Effect: "Allow",
+			Principal: { AWS: "*" },
+			Action: [
+				"SNS:GetTopicAttributes",
+				"SNS:SetTopicAttributes",
+				"SNS:AddPermission",
+				"SNS:RemovePermission",
+				"SNS:DeleteTopic",
+				"SNS:Subscribe",
+				"SNS:ListSubscriptionsByTopic",
+				"SNS:Publish"
+			],
+			Resource: topicArn,
+			Condition: { StringEquals: { "AWS:SourceOwner": account } }
+		}]
+	});
+}
+function canonicalJson$1(value) {
+	const sortKeys = (v) => {
+		if (Array.isArray(v)) return v.map(sortKeys);
+		if (v !== null && typeof v === "object") {
+			const out = Object.create(null);
+			for (const key of Object.keys(v).sort()) out[key] = sortKeys(v[key]);
+			return out;
+		}
+		return v;
+	};
+	return JSON.stringify(sortKeys(value));
+}
+function canonicalPolicy(text) {
+	try {
+		return canonicalJson$1(JSON.parse(text));
+	} catch {
+		return `raw:${text}`;
+	}
+}
 
 //#endregion
 //#region src/provisioning/providers/lambda-function-provider.ts
@@ -43240,4 +43355,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CtsCylnp.js.map
+//# sourceMappingURL=provider-classes-Ca6o5by0.js.map