@go-to-k/cdkd 0.298.5 → 0.298.6

package/dist/{provider-classes-BvHGcxn6.js → provider-classes-BRNQRRLh.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-CwKiK9nS.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cl as renderAssemblyPathEscape, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as displayAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ai as s3BucketArn, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, dl as derivePartitionAndUrlSuffix, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, gs as carriesSecretMask, ho as requireConfigObject, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oc as rewriteTemplateAssetReferences, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, ps as recordAttributeIdCopy, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sl as decodeListingKey, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tc as stringifyValue, tt as markRefusedBeforeApplying, ul as canonicalizeRegion, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, wl as resolveAssemblyPath, x as withApiLimit, xl as describeFileReadFailure, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-Cqmlu_JG.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-j_AyoKr6.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CV-IVMYw.js";
-import { RDSProvider } from "./rds-provider-DlzTjANF.js";
-import { NeptuneProvider } from "./neptune-provider-CpEImWxf.js";
-import { ASGProvider } from "./asg-provider-Cqpxk8Pl.js";
+import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cl as renderAssemblyPathEscape, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as displayAssemblyPath, So as lambdaFunctionNameForMask, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ai as s3BucketArn, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, dl as derivePartitionAndUrlSuffix, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, gs as carriesSecretMask, ho as requireConfigObject, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oc as rewriteTemplateAssetReferences, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, ps as recordAttributeIdCopy, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sl as decodeListingKey, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tc as stringifyValue, tt as markRefusedBeforeApplying, ul as canonicalizeRegion, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, wl as resolveAssemblyPath, x as withApiLimit, xl as describeFileReadFailure, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-BhJ7GrCh.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DxbBY_JA.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BYoddGM7.js";
+import { RDSProvider } from "./rds-provider-Db42mU7e.js";
+import { NeptuneProvider } from "./neptune-provider-Cxxs8Pug.js";
+import { ASGProvider } from "./asg-provider-C_6LflRi.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -693,7 +693,7 @@ var IAMManagedPolicyProvider = class {
 			const createResult = await this.create(logicalId, resourceType, properties, { maskSecrets: log.mask });
 			let orphanReason;
 			try {
-				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties, void 0, log.mask);
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties, { maskSecrets: log.mask });
 				if (deleteResult?.outcome === "skipped") {
 					orphanReason = log.mask(`old managed policy ${v(physicalId)} was not deleted: ${deleteResult.reason}`);
 					log.warn(`Skipped deleting old managed policy ${v(physicalId)} during replacement: ${deleteResult.reason}. The old policy may be orphaned and require manual cleanup.`);
@@ -756,7 +756,8 @@ var IAMManagedPolicyProvider = class {
 			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context, mask = maskerOrIdentity(void 0)) {
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		this.logger.debug(mask(`Deleting IAM managed policy ${logicalId}: ${physicalId}`));
 		try {
 			try {
@@ -1645,9 +1646,6 @@ var IAMUserGroupProvider = class {
 	wrapMaskedError(mask, error, build) {
 		return wrapMaskedAwsError(mask, error, build);
 	}
-	unmaskedDeleteSinks() {
-		return createMaskedLogSinks(this.logger, void 0);
-	}
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::IAM::User", /* @__PURE__ */ new Set([
 			"UserName",
@@ -1866,7 +1864,9 @@ var IAMUserGroupProvider = class {
 		}
 	}
 	async deleteUser(logicalId, physicalId, resourceType, context) {
-		this.logger.debug(`Deleting IAM user ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const { value: v } = log;
+		log.debug(`Deleting IAM user ${logicalId}: ${v(physicalId)}`);
 		try {
 			try {
 				await this.iamClient.send(new GetUserCommand({ UserName: physicalId }));
@@ -1874,31 +1874,31 @@ var IAMUserGroupProvider = class {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					this.logger.debug(`User ${physicalId} does not exist, skipping deletion`);
+					log.debug(`User ${v(physicalId)} does not exist, skipping deletion`);
 					return;
 				}
 				throw error;
 			}
-			await this.removeUserFromAllGroups(physicalId, this.unmaskedDeleteSinks());
-			await this.detachAllUserPolicies(physicalId, this.unmaskedDeleteSinks());
-			await this.deleteAllUserInlinePolicies(physicalId, this.unmaskedDeleteSinks());
+			await this.removeUserFromAllGroups(physicalId, log);
+			await this.detachAllUserPolicies(physicalId, log);
+			await this.deleteAllUserInlinePolicies(physicalId, log);
 			try {
 				await this.iamClient.send(new DeleteLoginProfileCommand({ UserName: physicalId }));
-				this.logger.debug(`Deleted login profile for user ${physicalId}`);
+				log.debug(`Deleted login profile for user ${v(physicalId)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
-			await this.deleteAllAccessKeys(physicalId);
+			await this.deleteAllAccessKeys(physicalId, log);
 			try {
 				await this.iamClient.send(new DeleteUserPermissionsBoundaryCommand({ UserName: physicalId }));
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
 			await this.iamClient.send(new DeleteUserCommand({ UserName: physicalId }));
-			this.logger.debug(`Successfully deleted IAM user ${logicalId}`);
+			log.debug(`Successfully deleted IAM user ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readLiveGroups(userName) {
@@ -1932,7 +1932,8 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async deleteAllAccessKeys(userName) {
+	async deleteAllAccessKeys(userName, log) {
+		const { value: v } = log;
 		try {
 			const keys = (await this.iamClient.send(new ListAccessKeysCommand({ UserName: userName }))).AccessKeyMetadata || [];
 			for (const key of keys) if (key.AccessKeyId) {
@@ -1940,7 +1941,7 @@ var IAMUserGroupProvider = class {
 					UserName: userName,
 					AccessKeyId: key.AccessKeyId
 				}));
-				this.logger.debug(`Deleted access key ${key.AccessKeyId} for user ${userName}`);
+				log.debug(`Deleted access key ${key.AccessKeyId} for user ${v(userName)}`);
 			}
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) return;
@@ -2152,22 +2153,24 @@ var IAMUserGroupProvider = class {
 		}
 	}
 	async deleteGroup(logicalId, physicalId, resourceType, context) {
-		this.logger.debug(`Deleting IAM group ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const { value: v } = log;
+		log.debug(`Deleting IAM group ${logicalId}: ${v(physicalId)}`);
 		try {
-			await this.detachAllGroupPolicies(physicalId, this.unmaskedDeleteSinks());
-			await this.deleteAllGroupInlinePolicies(physicalId, this.unmaskedDeleteSinks());
-			await this.removeAllUsersFromGroup(physicalId);
+			await this.detachAllGroupPolicies(physicalId, log);
+			await this.deleteAllGroupInlinePolicies(physicalId, log);
+			await this.removeAllUsersFromGroup(physicalId, log);
 			await this.iamClient.send(new DeleteGroupCommand({ GroupName: physicalId }));
-			this.logger.debug(`Successfully deleted IAM group ${logicalId}`);
+			log.debug(`Successfully deleted IAM group ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
 				const clientRegion = await this.iamClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Group ${physicalId} does not exist, skipping deletion`);
+				log.debug(`Group ${v(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async detachAllGroupPolicies(groupName, log) {
@@ -2188,7 +2191,8 @@ var IAMUserGroupProvider = class {
 			throw error;
 		}
 	}
-	async removeAllUsersFromGroup(groupName) {
+	async removeAllUsersFromGroup(groupName, log) {
+		const { value: v } = log;
 		try {
 			const users = (await this.iamClient.send(new GetGroupCommand({ GroupName: groupName }))).Users || [];
 			for (const user of users) if (user.UserName) try {
@@ -2196,7 +2200,7 @@ var IAMUserGroupProvider = class {
 					GroupName: groupName,
 					UserName: user.UserName
 				}));
-				this.logger.debug(`Removed user ${user.UserName} from group ${groupName}`);
+				log.debug(`Removed user ${v(user.UserName)} from group ${v(groupName)}`);
 			} catch (error) {
 				if (!(error instanceof NoSuchEntityException)) throw error;
 			}
@@ -6884,7 +6888,10 @@ var SNSSubscriptionProvider = class {
 		let deleteResult = void 0;
 		let deleteThrew = false;
 		try {
-			deleteResult = await this.delete(logicalId, physicalId, resourceType, void 0, { expectedRegion: context?.expectedRegion });
+			deleteResult = await this.delete(logicalId, physicalId, resourceType, void 0, {
+				expectedRegion: context?.expectedRegion,
+				...context?.maskSecrets && { maskSecrets: context.maskSecrets }
+			});
 		} catch (error) {
 			deleteThrew = true;
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${safeStringify(error)}`);
@@ -6902,7 +6909,8 @@ var SNSSubscriptionProvider = class {
 		};
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting SNS subscription ${logicalId}: ${physicalId}`);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		this.logger.debug(mask(`Deleting SNS subscription ${logicalId}: ${mask(physicalId)}`));
 		if (physicalId === "PendingConfirmation" || physicalId === "pending confirmation") {
 			this.logPendingConfirmationSkip(logicalId, physicalId);
 			return;
@@ -6914,15 +6922,15 @@ var SNSSubscriptionProvider = class {
 			if (error instanceof NotFoundException) {
 				const clientRegion = await this.snsClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Subscription ${physicalId} does not exist, skipping deletion`);
+				this.logger.debug(mask(`Subscription ${mask(physicalId)} does not exist, skipping deletion`));
 				return;
 			}
 			if (isPendingConfirmationError(error)) {
-				this.logPendingConfirmationSkip(logicalId, physicalId);
+				this.logPendingConfirmationSkip(logicalId, mask(physicalId));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SNS subscription ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(mask(`Failed to delete SNS subscription ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	logPendingConfirmationSkip(logicalId, physicalId) {
@@ -26061,7 +26069,8 @@ var RDSDBProxyTargetGroupProvider = class {
 		}
 		const dbClusterIdentifiers = targets.lists.DBClusterIdentifiers;
 		const dbInstanceIdentifiers = targets.lists.DBInstanceIdentifiers;
-		this.logger.debug(`Deregistering targets from ${dbProxyName}/${targetGroupName}: clusters=[${dbClusterIdentifiers.join(",")}], instances=[${dbInstanceIdentifiers.join(",")}]`);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		this.logger.debug(mask(`Deregistering targets from ${mask(dbProxyName)}/${mask(targetGroupName)}: clusters=[${dbClusterIdentifiers.map(mask).join(",")}], instances=[${dbInstanceIdentifiers.map(mask).join(",")}]`));
 		try {
 			await this.getClient().send(new DeregisterDBProxyTargetsCommand({
 				DBProxyName: dbProxyName,
@@ -26073,7 +26082,7 @@ var RDSDBProxyTargetGroupProvider = class {
 			if (error instanceof DBProxyNotFoundFault || error instanceof DBProxyTargetGroupNotFoundFault || error instanceof DBProxyTargetNotFoundFault) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`${dbProxyName}/${targetGroupName} or its target is already gone, treating as success`);
+				this.logger.debug(mask(`${mask(dbProxyName)}/${mask(targetGroupName)} or its target is already gone, treating as success`));
 				return;
 			}
 			throw this.wrapError(error, "DELETE", resourceType, logicalId, physicalId);
@@ -32642,7 +32651,8 @@ var GlueProvider = class {
 		}
 	}
 	async deleteDatabase(logicalId, physicalId, resourceType, properties, context) {
-		this.logger.debug(`Deleting Glue Database ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		log.debug(`Deleting Glue Database ${logicalId}: ${log.value(physicalId)}`);
 		const redactedSkip = redactedDeleteAddressSkip(this.logger, logicalId, resourceType, redactedDeleteAddressFields({ CatalogId: properties?.["CatalogId"] }));
 		if (redactedSkip) return redactedSkip;
 		const target = deleteCatalogId(properties);
@@ -32657,11 +32667,11 @@ var GlueProvider = class {
 			if (error instanceof EntityNotFoundException) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				logCatalogScopedDeleteSkip(this.logger, target, "Database", logicalId, physicalId);
+				logCatalogScopedDeleteSkip(log, target, "Database", logicalId, log.value(physicalId));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createTable(logicalId, resourceType, properties, context) {
@@ -32773,10 +32783,15 @@ var GlueProvider = class {
 		}
 	}
 	async deleteTable(logicalId, physicalId, resourceType, properties, context) {
-		this.logger.debug(`Deleting Glue Table ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const shownId = physicalId.split("|").map((part) => log.value(part)).join("|");
+		log.debug(`Deleting Glue Table ${logicalId}: ${shownId}`);
 		const decoded = decodeTableId(physicalId, properties);
 		if (!decoded) {
-			this.logger.warn(tableIdDecodeFailure(logicalId, physicalId, [properties], { skipping: true }));
+			this.logger.warn(tableIdDecodeFailure(logicalId, physicalId, [properties], {
+				skipping: true,
+				mask: log.mask
+			}));
 			return compositeIdSkipResult();
 		}
 		const { databaseName, tableName } = decoded;
@@ -32795,11 +32810,11 @@ var GlueProvider = class {
 			if (error instanceof EntityNotFoundException) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				logCatalogScopedDeleteSkip(this.logger, target, "Table", logicalId, physicalId);
+				logCatalogScopedDeleteSkip(log, target, "Table", logicalId, shownId);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	preserveAwsManagedParameters(built, desiredParameters, previousParameters, liveParameters) {
@@ -33910,24 +33925,26 @@ var GlueCrawlerProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting Glue Crawler ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const { value: v } = log;
+		log.debug(`Deleting Glue Crawler ${logicalId}: ${v(physicalId)}`);
 		try {
 			await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Glue Crawler ${physicalId} does not exist, skipping deletion`);
+				log.debug(`Glue Crawler ${v(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
 			if (error instanceof CrawlerRunningException) {
-				this.logger.debug(`Glue Crawler ${physicalId} is running; stopping before delete and retrying`);
-				await this.stopCrawlerAndWait(physicalId);
+				log.debug(`Glue Crawler ${v(physicalId)} is running; stopping before delete and retrying`);
+				await this.stopCrawlerAndWait(physicalId, log);
 				await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Crawler ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Crawler ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async stopCrawlerAndWait(physicalId, log = {
@@ -34156,7 +34173,8 @@ var GlueConnectionProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
-		this.logger.debug(`Deleting Glue Connection ${logicalId}: ${physicalId}`);
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		log.debug(`Deleting Glue Connection ${logicalId}: ${log.value(physicalId)}`);
 		const redactedSkip = redactedDeleteAddressSkip(this.logger, logicalId, resourceType, redactedDeleteAddressFields({ CatalogId: properties?.["CatalogId"] }));
 		if (redactedSkip) return redactedSkip;
 		const target = deleteCatalogId(properties);
@@ -34170,11 +34188,11 @@ var GlueConnectionProvider = class {
 			if (error instanceof EntityNotFoundException) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				logCatalogScopedDeleteSkip(this.logger, target, "Connection", logicalId, physicalId);
+				logCatalogScopedDeleteSkip(log, target, "Connection", logicalId, log.value(physicalId));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Connection ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Connection ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -43049,14 +43067,16 @@ var S3VectorsProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/s3-directory-bucket-provider.ts
-function notEmptyRefusalMessage(bucketName) {
-	const command = bucketName !== "" && !bucketName.includes("/") && displaySafe(bucketName, { asciiOnly: true }) === bucketName ? renderDisableCommand({
+function notEmptyRefusalMessage(bucketName, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	const secretDerived = mask(bucketName) !== bucketName;
+	const command = bucketName !== "" && !bucketName.includes("/") && displaySafe(bucketName, { asciiOnly: true }) === bucketName && !secretDerived ? renderDisableCommand({
 		before: "aws s3 rm",
 		identifier: `s3://${bucketName}`,
 		after: "--recursive"
 	}) : "";
-	const remedy = command ? `Delete all objects first (e.g. ${command}) and destroy again.` : "Delete all objects first, via the console, and destroy again: the bucket name cdkd recorded cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.";
-	return `bucket ${displayIdent(bucketName)} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. ${remedy}`;
+	const remedy = command ? `Delete all objects first (e.g. ${command}) and destroy again.` : secretDerived ? "Delete all objects first, via the console, and destroy again: the bucket name is derived from a secret, so cdkd does not print it." : "Delete all objects first, via the console, and destroy again: the bucket name cdkd recorded cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.";
+	return mask(`bucket ${displayIdent(mask(bucketName))} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. ${remedy}`);
 }
 var S3DirectoryBucketProvider = class {
 	s3Client;
@@ -43205,22 +43225,24 @@ var S3DirectoryBucketProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
-		this.logger.debug(`Deleting S3 Express Directory Bucket ${logicalId}: ${physicalId}`);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		this.logger.debug(mask(`Deleting S3 Express Directory Bucket ${logicalId}: ${mask(physicalId)}`));
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		try {
-			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
+			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty, context?.maskSecrets);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "NoSuchBucket" || error.name === "BucketNotFound")) {
 				const clientRegion = await this.s3Client.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
+				this.logger.debug(mask(`Bucket ${mask(physicalId)} does not exist, skipping deletion`));
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(mask(`Failed to delete S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async deleteBucketWithEmptyRetry(logicalId, bucketName, allowAutoEmpty) {
+	async deleteBucketWithEmptyRetry(logicalId, bucketName, allowAutoEmpty, maskSecrets) {
+		const mask = maskerOrIdentity(maskSecrets);
 		const maxAttempts = 3;
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
@@ -43229,9 +43251,9 @@ var S3DirectoryBucketProvider = class {
 		} catch (error) {
 			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
-				if (!allowAutoEmpty) throw markNonRetryable(new Error(notEmptyRefusalMessage(bucketName)));
-				this.logger.info(`Directory bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
-				await this.emptyBucket(bucketName);
+				if (!allowAutoEmpty) throw markNonRetryable(new Error(notEmptyRefusalMessage(bucketName, maskSecrets)));
+				this.logger.info(mask(`Directory bucket ${mask(bucketName)} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`));
+				await this.emptyBucket(bucketName, mask);
 				continue;
 			}
 			throw error;
@@ -43239,7 +43261,7 @@ var S3DirectoryBucketProvider = class {
 		await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
 		this.logger.debug(`Successfully deleted S3 Express Directory Bucket ${logicalId}`);
 	}
-	async emptyBucket(bucketName) {
+	async emptyBucket(bucketName, mask) {
 		let continuationToken;
 		do {
 			const listResponse = await this.s3Client.send(new ListObjectsV2Command({
@@ -43257,7 +43279,7 @@ var S3DirectoryBucketProvider = class {
 						Quiet: true
 					}
 				}));
-				this.logger.debug(`Deleted ${objects.length} objects from bucket ${bucketName}`);
+				this.logger.debug(mask(`Deleted ${objects.length} objects from bucket ${mask(bucketName)}`));
 			}
 			continuationToken = listResponse.IsTruncated ? listResponse.NextContinuationToken : void 0;
 		} while (continuationToken);
@@ -44836,7 +44858,7 @@ var ACMCertificateProvider = class {
 			const createResult = await this.create(logicalId, resourceType, properties);
 			let orphanReason;
 			try {
-				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
 				if (deleteResult?.outcome === "skipped") {
 					orphanReason = `old certificate ${physicalId} was not deleted: ${deleteResult.reason}`;
 					this.logger.warn(`Skipped deleting old ACM certificate ${physicalId} during replacement: ${deleteResult.reason}. The old certificate may be orphaned and require manual cleanup.`);
@@ -45021,4 +45043,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-BvHGcxn6.js.map
+//# sourceMappingURL=provider-classes-BRNQRRLh.js.map