@go-to-k/cdkd 0.298.8 → 0.299.1

package/dist/{provider-classes--iMwAb7q.js → provider-classes-Xrt4DIC7.js}

@@ -1,13 +1,13 @@
-import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
+import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-CwKiK9nS.js";
-import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as isTruthyCfnBoolean, $o as markSameGenerationBag, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cl as displayAssemblyPath, Co as sameLambdaFunctionAddress, Ct as revertNestedChildFromJournal, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Ei as parseWebACLArn, Er as slowCcOperationTimeoutMs, Fo as passedNoEchoParametersOf, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, Ga as findSilentDropProperties, H as compensateRemovedDeletionProtection, Ho as hasMaskableValues, Ii as accountArgs, J as deleteTableWithIndexBusyRetry, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Ot as withNestedStackContext, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, Sl as describeFileReadFailure, So as lambdaFunctionNameForMask, Tl as resolveAssemblyPath, U as deleteBudgetKey, Ua as withheldAccountClause, V as beginDeleteWait, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, a as findNestedTemplateTreeDefect, ai as s3BucketArn, an as isRedactedRecordedValue, ao as toCfnInteger, ar as planTagDiff, as as dynamicReferenceTokens, b as lookupEachName, bo as withRetry, br as getCurrentResourceSecrets, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketRegionalDomainName, cl as decodeListingKey, co as coerceCfnInteger, cr as tagMapAsList, da as refuseMalformedNestedChildOutputs, dl as canonicalizeRegion, do as configStringRefusal, dr as stringifyIfAssigned, ds as recoverMaskedOutput, er as reserveStackCreateToken, es as redactSecretsForState, et as getPriorAttempts, fl as derivePartitionAndUrlSuffix, fo as readConfigString, fs as physicalNameCopiesOf, gi as getAccountInfo, go as requireConfigString, gs as carriesSecretMask, ho as requireConfigObject, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as isWarmThroughputDecrease, ir as DBPROXY_TAG_OPTIONS, ja as refuseMalformedResourcesForDestroy, ki as passedParameterClassesOf, li as s3BucketWebsiteUrl, lo as configBooleanRefusal, lr as tagPlanWarning, mo as requireConfigArray, nn as getCurrentProducerRegions, no as WARM_THROUGHPUT_MEMBERS, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oc as rewriteTemplateAssetReferences, oi as s3BucketDomainName, on as redactedDeleteAddressFields, oo as toFiniteNumber, or as readTagList, po as replayWarn, ps as recordAttributeIdCopy, q as INDEX_SETTLE_POLL_INTERVAL_MS, qa as withoutSilentDropProperties, ro as coerceWarmThroughput$1, rr as DBPROXY_TAGS_WHAT, rs as withoutPhysicalNameCopies, s as listNestedTemplateRows, si as s3BucketDualStackDomainName, sn as redactedDeleteAddressSkip, so as coerceCfnBoolean, sr as refuseMalformedDesiredTags, t as DeployEngine, tc as stringifyValue, tt as markRefusedBeforeApplying, uo as configIntegerRefusal, ur as definedAttributes, v as chunks, wl as renderAssemblyPathEscape, x as withApiLimit, xo as canonicalLambdaFunctionName, y as isAccessDeniedError, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-HKmcD4Kn.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BiCib2zp.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-MMwB_CTT.js";
-import { RDSProvider } from "./rds-provider-BdUme0V8.js";
-import { NeptuneProvider } from "./neptune-provider-D3Qcci3J.js";
-import { ASGProvider } from "./asg-provider-B8N6UPAH.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Pn2m0R67.js";
+import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
+import { $ as isTruthyCfnBoolean, Al as displayAssemblyPath, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Bo as passedNoEchoParametersOf, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cs as carriesSecretMask, Ct as revertNestedChildFromJournal, Do as lambdaFunctionNameForMask, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Eo as canonicalLambdaFunctionName, Er as slowCcOperationTimeoutMs, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, H as compensateRemovedDeletionProtection, Ia as refuseMalformedResourcesForDestroy, J as deleteTableWithIndexBusyRetry, Ja as withheldAccountClause, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Ml as resolveAssemblyPath, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Oo as sameLambdaFunctionAddress, Ot as withNestedStackContext, Pi as passedParameterClassesOf, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qa as withoutSilentDropProperties, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, To as withRetry, U as deleteBudgetKey, V as beginDeleteWait, Vi as accountArgs, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Xa as findSilentDropProperties, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, _o as readConfigString, a as findNestedTemplateTreeDefect, an as isRedactedRecordedValue, ar as planTagDiff, as as recordReferenceProvenanceEntry, b as lookupEachName, bo as requireConfigObject, br as getCurrentResourceSecrets, bs as recordAttributeIdCopy, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, cc as stringifyValue, co as coerceWarmThroughput$1, cr as tagMapAsList, di as s3BucketDualStackDomainName, do as toFiniteNumber, dr as stringifyIfAssigned, er as reserveStackCreateToken, et as getPriorAttempts, fi as s3BucketRegionalDomainName, fo as coerceCfnBoolean, fs as dynamicReferenceTokens, ga as refuseMalformedNestedChildOutputs, go as configStringRefusal, hl as decodeListingKey, ho as configIntegerRefusal, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ir as DBPROXY_TAG_OPTIONS, is as markSameGenerationBag, ji as parseWebACLArn, jl as renderAssemblyPathEscape, kl as describeFileReadFailure, li as s3BucketArn, lo as isWarmThroughputDecrease, lr as tagPlanWarning, mo as configBooleanRefusal, nn as getCurrentProducerRegions, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as outputReferenceProvenanceOf, on as redactedDeleteAddressFields, or as readTagList, os as snapshotPassProvenance, pc as rewriteTemplateAssetReferences, pi as s3BucketWebsiteUrl, po as coerceCfnInteger, q as INDEX_SETTLE_POLL_INTERVAL_MS, qo as hasMaskableValues, rr as DBPROXY_TAGS_WHAT, s as listNestedTemplateRows, sn as redactedDeleteAddressSkip, so as WARM_THROUGHPUT_MEMBERS, sr as refuseMalformedDesiredTags, ss as redactSecretsForState, t as DeployEngine, tt as markRefusedBeforeApplying, ui as s3BucketDomainName, uo as toCfnInteger, ur as definedAttributes, us as withoutPhysicalNameCopies, v as chunks, vl as canonicalizeRegion, vo as replayWarn, vs as recoverMaskedOutput, x as withApiLimit, xi as getAccountInfo, xo as requireConfigString, y as isAccessDeniedError, yl as derivePartitionAndUrlSuffix, yo as requireConfigArray, ys as physicalNameCopiesOf, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-CZUhJ1IZ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C24I_FvR.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-w-kAH85e.js";
+import { RDSProvider } from "./rds-provider-Bz8JUYBp.js";
+import { NeptuneProvider } from "./neptune-provider-D7sAjt4U.js";
+import { ASGProvider } from "./asg-provider-BxW2FkQz.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -1587,6 +1587,15 @@ var IAMAccessKeyProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/iam-user-group-provider.ts
+function isUserOrGroupName(resourceType, id) {
+	return resourceType === "AWS::IAM::User" ? /^[\w+=,.@-]{1,64}$/.test(id) : /^[\w+=,.@-]{1,128}$/.test(id);
+}
+function isUserOrGroupType(resourceType) {
+	return resourceType === "AWS::IAM::User" || resourceType === "AWS::IAM::Group";
+}
+function userOrGroupIdentityToken(id) {
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
 const MEMBERSHIP_NO_PROPERTIES_SKIP_REASON = "no properties in state — group membership not removed";
 const MEMBERSHIP_MISSING_FIELDS_SKIP_REASON = "GroupName/Users missing from state — membership not removed";
 const MEMBERSHIP_MALFORMED_USERS_SKIP_REASON = "malformed Users in state — membership not removed";
@@ -1703,12 +1712,14 @@ var IAMUserGroupProvider = class {
 		const groups = readPrincipalLists({ Groups: properties["Groups"] });
 		if ("malformed" in groups) throw new ProvisioningError(`Groups of IAM user ${logicalId} is not a list of IAM group names — no user was created`, resourceType, logicalId);
 		let leftBehind = false;
+		let createdUserIdentity;
 		try {
 			const createParams = { UserName: userName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (properties["Tags"] !== void 0 && properties["Tags"] !== null) createParams.Tags = desiredTags;
 			const response = await (await this.createClient.get()).send(new CreateUserCommand(createParams));
 			leftBehind = true;
+			createdUserIdentity = userOrGroupIdentityToken(response.User?.UserId);
 			try {
 				const permissionsBoundary = properties["PermissionsBoundary"];
 				if (permissionsBoundary) {
@@ -1785,7 +1796,7 @@ var IAMUserGroupProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM user ${logicalId}: ${text}`, resourceType, logicalId, userName, cause));
-			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, userName);
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, userName, createdUserIdentity);
 			throw thrown;
 		}
 	}
@@ -1874,7 +1885,8 @@ var IAMUserGroupProvider = class {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					log.debug(`User ${v(physicalId)} does not exist, skipping deletion`);
+					if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  IAM user ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+					else log.debug(`User ${v(physicalId)} does not exist, skipping deletion`);
 					return;
 				}
 				throw error;
@@ -2085,11 +2097,13 @@ var IAMUserGroupProvider = class {
 		log.debug(`Creating IAM group ${logicalId}`);
 		const groupName = generateResourceNameWithFallback(properties["GroupName"], logicalId, { maxLength: GROUP_NAME_MAX_LENGTH });
 		let leftBehind = false;
+		let createdGroupIdentity;
 		try {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			const response = await (await this.createClient.get()).send(new CreateGroupCommand(createParams));
 			leftBehind = true;
+			createdGroupIdentity = userOrGroupIdentityToken(response.Group?.GroupId);
 			try {
 				const managedPolicyArns = properties["ManagedPolicyArns"];
 				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
@@ -2130,7 +2144,7 @@ var IAMUserGroupProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM group ${logicalId}: ${text}`, resourceType, logicalId, groupName, cause));
-			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, groupName);
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, groupName, createdGroupIdentity);
 			throw thrown;
 		}
 	}
@@ -2166,7 +2180,8 @@ var IAMUserGroupProvider = class {
 			if (error instanceof NoSuchEntityException) {
 				const clientRegion = await this.iamClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				log.debug(`Group ${v(physicalId)} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  IAM group ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else log.debug(`Group ${v(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -2448,6 +2463,50 @@ var IAMUserGroupProvider = class {
 			throw maskError(new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (!isUserOrGroupType(resourceType)) return "unknown";
+		if (!isUserOrGroupName(resourceType, journaledPhysicalId) || !isUserOrGroupName(resourceType, record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordId = await this.readIdIfExists(resourceType, record.physicalId);
+		if (recordId === void 0) return "unknown";
+		const journaledId = await this.readIdIfExists(resourceType, journaledPhysicalId);
+		if (journaledId === void 0) return "different";
+		return journaledId === recordId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (!isUserOrGroupType(resourceType) || !isUserOrGroupName(resourceType, physicalId)) return;
+		if (await this.iamClient.config.region() !== context.expectedRegion) return void 0;
+		const id = await this.readIdIfExists(resourceType, physicalId);
+		return id === void 0 ? RESOURCE_NOT_FOUND : id;
+	}
+	async readIdIfExists(resourceType, name) {
+		let answeredName;
+		let id;
+		try {
+			if (resourceType === "AWS::IAM::User") {
+				const response = await this.iamClient.send(new GetUserCommand({ UserName: name }));
+				answeredName = response.User?.UserName;
+				id = response.User?.UserId;
+			} else {
+				const response = await this.iamClient.send(new GetGroupCommand({
+					GroupName: name,
+					MaxItems: 1
+				}));
+				answeredName = response.Group?.GroupName;
+				id = response.Group?.GroupId;
+			}
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) return void 0;
+			throw error;
+		}
+		const noun = resourceType === "AWS::IAM::User" ? "user" : "group";
+		if (answeredName !== name) throw new Error(`IAM answered for another ${noun} than the one asked for`);
+		const token = userOrGroupIdentityToken(id);
+		if (token === void 0) throw new Error(`IAM returned no ${noun === "user" ? "UserId" : "GroupId"}`);
+		return token;
+	}
 	async readCurrentState(physicalId, logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::IAM::User": return this.readUserCurrentState(physicalId, properties, context);
@@ -13424,7 +13483,8 @@ var SSMParameterProvider = class SSMParameterProvider {
 			};
 			if (properties["AllowedPattern"]) putParams.AllowedPattern = properties["AllowedPattern"];
 			if (properties["Tier"]) putParams.Tier = properties["Tier"];
-			if (properties["Policies"]) putParams.Policies = properties["Policies"];
+			const policies = ssmPoliciesParameter(properties["Policies"]);
+			if (policies !== void 0) putParams.Policies = policies;
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
 			await (await this.getCreateClient()).send(new PutParameterCommand(putParams));
 			leftBehind = true;
@@ -13485,7 +13545,8 @@ var SSMParameterProvider = class SSMParameterProvider {
 			if (properties["Description"] !== void 0) putParams.Description = properties["Description"];
 			if (properties["AllowedPattern"] !== void 0) putParams.AllowedPattern = properties["AllowedPattern"];
 			if (properties["Tier"] !== void 0) putParams.Tier = properties["Tier"];
-			if (properties["Policies"] !== void 0) putParams.Policies = properties["Policies"];
+			const policies = ssmPoliciesParameter(properties["Policies"]);
+			if (policies !== void 0) putParams.Policies = policies;
 			if (properties["DataType"] !== void 0) putParams.DataType = properties["DataType"];
 			await this.ssmClient.send(new PutParameterCommand(putParams));
 			const plan = planTagDiff(tagMapAsList(previousProperties["Tags"]), tagMapAsList(properties["Tags"]));
@@ -13631,6 +13692,12 @@ var SSMParameterProvider = class SSMParameterProvider {
 		return null;
 	}
 };
+function ssmPoliciesParameter(policies) {
+	if (policies === void 0 || policies === null || policies === "") return void 0;
+	if (typeof policies === "string") return policies;
+	if (Array.isArray(policies)) return policies.length === 0 ? void 0 : JSON.stringify(policies);
+	return JSON.stringify(policies);
+}
 
 //#endregion
 //#region src/provisioning/providers/eventbridge-rule-provider.ts
@@ -44522,6 +44589,7 @@ var NestedStackProvider = class {
 			onDestructivePlan: void 0,
 			...inheritedSecrets && hasMaskableValues(inheritedSecrets) && { inheritedSecrets },
 			inheritedPhysicalNameCopies: inheritedPhysicalNameCopiesOf(inheritedSecrets),
+			inheritedReferenceProvenance: snapshotPassProvenance(inheritedSecrets),
 			...passedClasses && { passedParameterClasses: passedClasses },
 			passedNoEchoParameters: passedNoEchoParametersOf(inheritedSecrets),
 			inheritedProducerRegions: getCurrentProducerRegions(),
@@ -44552,6 +44620,11 @@ var NestedStackProvider = class {
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion, runAccountOf(ctx));
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const rowSecrets = getCurrentResourceSecrets();
+		if (rowSecrets !== void 0) for (const outputKey of Object.keys(childStateData.state.outputs ?? {})) {
+			const entries = outputReferenceProvenanceOf(childStateData.state, outputKey);
+			if (entries === void 0) continue;
+			for (const [token, entry] of Object.entries(entries)) recordReferenceProvenanceEntry(rowSecrets, token, entry, "read");
+		}
 		if (rowSecrets !== void 0) {
 			const childResources = childStateData.state.resources;
 			const ids = childResources !== null && typeof childResources === "object" ? Object.values(childResources).map((record) => record?.physicalId).filter((id) => typeof id === "string" && id !== "") : [];
@@ -45043,4 +45116,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes--iMwAb7q.js.map
+//# sourceMappingURL=provider-classes-Xrt4DIC7.js.map