@go-to-k/cdkd 0.299.0 → 0.299.2

package/dist/{provider-classes-DxHQcC1K.js → provider-classes-WJRB6zvO.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Pn2m0R67.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as isTruthyCfnBoolean, $n as earliestDefined, Ai as passedParameterClassesOf, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Br as observeThenDisableInstanceApiTermination, Bt as getStackRecords, Co as lambdaFunctionNameForMask, Ct as revertNestedChildFromJournal, Di as parseWebACLArn, Dl as renderAssemblyPathEscape, Dr as slowCcOperationTimeoutMs, Dt as getCurrentNestedStackContext, El as displayAssemblyPath, Fr as isWaitAbandonedError, G as resolveDynamoDbDeleteBudgetMs, H as compensateRemovedDeletionProtection, Hr as reEnableInstanceApiTermination, Io as passedNoEchoParametersOf, Ir as markWaitAbandoned, J as deleteTableWithIndexBusyRetry, Ja as withoutSilentDropProperties, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Ka as findSilentDropProperties, Li as accountArgs, Ma as refuseMalformedResourcesForDestroy, Nr as deleteSkipReason, Ol as resolveAssemblyPath, Or as unchangedBehindSecretReference, Ot as withNestedStackContext, Pr as withIndeterminateGuard, Q as hasCdkAutoDeleteTag, Qn as outputReferenceProvenanceOf, Rr as ec2InstanceProtectionSite, Rt as awaitInFlightSibling, So as canonicalLambdaFunctionName, Tl as describeFileReadFailure, U as deleteBudgetKey, Uo as hasMaskableValues, V as beginDeleteWait, Vr as reDisableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, Wa as withheldAccountClause, X as ECR_AUTO_DELETE_IMAGES_TAG, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, _i as getAccountInfo, _o as requireConfigString, a as findNestedTemplateTreeDefect, ai as isSettledInstanceState, an as isRedactedRecordedValue, ao as isWarmThroughputDecrease, ar as DBPROXY_TAG_OPTIONS, b as lookupEachName, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, ci as s3BucketDualStackDomainName, co as coerceCfnBoolean, cr as refuseMalformedDesiredTags, cs as dynamicReferenceTokens, dl as decodeListingKey, do as configIntegerRefusal, dr as definedAttributes, es as markSameGenerationBag, et as getPriorAttempts, fa as refuseMalformedNestedChildOutputs, fo as configStringRefusal, fr as stringifyIfAssigned, go as requireConfigObject, gs as recordAttributeIdCopy, hl as derivePartitionAndUrlSuffix, ho as requireConfigArray, hs as physicalNameCopiesOf, ic as stringifyValue, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, io as coerceWarmThroughput$1, ir as DBPROXY_TAGS_WHAT, lc as rewriteTemplateAssetReferences, li as s3BucketRegionalDomainName, lo as coerceCfnInteger, lr as tagMapAsList, ml as canonicalizeRegion, mo as replayWarn, ms as recoverMaskedOutput, nn as getCurrentProducerRegions, ns as snapshotPassProvenance, o as isAbsoluteAssetPath, oi as s3BucketArn, on as redactedDeleteAddressFields, oo as toCfnInteger, or as planTagDiff, os as withoutPhysicalNameCopies, po as readConfigString, q as INDEX_SETTLE_POLL_INTERVAL_MS, ro as WARM_THROUGHPUT_MEMBERS, rr as acquireIdempotencyToken, rs as redactSecretsForState, s as listNestedTemplateRows, si as s3BucketDomainName, sn as redactedDeleteAddressSkip, so as toFiniteNumber, sr as readTagList, t as DeployEngine, tr as reserveStackCreateToken, ts as recordReferenceProvenanceEntry, tt as markRefusedBeforeApplying, ui as s3BucketWebsiteUrl, uo as configBooleanRefusal, ur as tagPlanWarning, v as chunks, wo as sameLambdaFunctionAddress, x as withApiLimit, xo as withRetry, xr as getCurrentResourceSecrets, y as isAccessDeniedError, ys as carriesSecretMask, z as DynamoDBGlobalTableProvider, zr as isTerminationProtectionPropagationError } from "./deploy-engine-4K_B3N08.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BKnf387o.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-BgsCaZFy.js";
-import { RDSProvider } from "./rds-provider-BO3U39K0.js";
-import { NeptuneProvider } from "./neptune-provider-CR19ID_J.js";
-import { ASGProvider } from "./asg-provider-CGN1a3d3.js";
+import { $ as isTruthyCfnBoolean, Al as displayAssemblyPath, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Bo as passedNoEchoParametersOf, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cs as carriesSecretMask, Ct as revertNestedChildFromJournal, Do as lambdaFunctionNameForMask, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Eo as canonicalLambdaFunctionName, Er as slowCcOperationTimeoutMs, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, H as compensateRemovedDeletionProtection, Ia as refuseMalformedResourcesForDestroy, J as deleteTableWithIndexBusyRetry, Ja as withheldAccountClause, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Ml as resolveAssemblyPath, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Oo as sameLambdaFunctionAddress, Ot as withNestedStackContext, Pi as passedParameterClassesOf, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qa as withoutSilentDropProperties, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, To as withRetry, U as deleteBudgetKey, V as beginDeleteWait, Vi as accountArgs, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Xa as findSilentDropProperties, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, _o as readConfigString, a as findNestedTemplateTreeDefect, an as isRedactedRecordedValue, ar as planTagDiff, as as recordReferenceProvenanceEntry, b as lookupEachName, bo as requireConfigObject, br as getCurrentResourceSecrets, bs as recordAttributeIdCopy, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, cc as stringifyValue, co as coerceWarmThroughput$1, cr as tagMapAsList, di as s3BucketDualStackDomainName, do as toFiniteNumber, dr as stringifyIfAssigned, er as reserveStackCreateToken, et as getPriorAttempts, fi as s3BucketRegionalDomainName, fo as coerceCfnBoolean, fs as dynamicReferenceTokens, ga as refuseMalformedNestedChildOutputs, go as configStringRefusal, hl as decodeListingKey, ho as configIntegerRefusal, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ir as DBPROXY_TAG_OPTIONS, is as markSameGenerationBag, ji as parseWebACLArn, jl as renderAssemblyPathEscape, kl as describeFileReadFailure, li as s3BucketArn, lo as isWarmThroughputDecrease, lr as tagPlanWarning, mo as configBooleanRefusal, nn as getCurrentProducerRegions, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as outputReferenceProvenanceOf, on as redactedDeleteAddressFields, or as readTagList, os as snapshotPassProvenance, pc as rewriteTemplateAssetReferences, pi as s3BucketWebsiteUrl, po as coerceCfnInteger, q as INDEX_SETTLE_POLL_INTERVAL_MS, qo as hasMaskableValues, rr as DBPROXY_TAGS_WHAT, s as listNestedTemplateRows, sn as redactedDeleteAddressSkip, so as WARM_THROUGHPUT_MEMBERS, sr as refuseMalformedDesiredTags, ss as redactSecretsForState, t as DeployEngine, tt as markRefusedBeforeApplying, ui as s3BucketDomainName, uo as toCfnInteger, ur as definedAttributes, us as withoutPhysicalNameCopies, v as chunks, vl as canonicalizeRegion, vo as replayWarn, vs as recoverMaskedOutput, x as withApiLimit, xi as getAccountInfo, xo as requireConfigString, y as isAccessDeniedError, yl as derivePartitionAndUrlSuffix, yo as requireConfigArray, ys as physicalNameCopiesOf, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-DlLwYRJk.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-D5B5lEmu.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-TA6lNkLr.js";
+import { RDSProvider } from "./rds-provider-DcUEh3d2.js";
+import { NeptuneProvider } from "./neptune-provider-Ba5va85p.js";
+import { ASGProvider } from "./asg-provider-C6USPLiS.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -379,7 +379,7 @@ var IAMPolicyProvider = class {
 			const values = Object.fromEntries(malformedKinds.map((k) => [k, recordedLists[k]]));
 			const memo = optIn.retryMemo;
 			const reused = memo?.resolved;
-			const resolved = reused ?? await resolveSecretDerivedPrincipals(values, context?.expectedRegion, optIn.importedProducerRegions);
+			const resolved = reused ?? await resolveSecretDerivedPrincipals(values, context?.expectedRegion, optIn.importedProducerRegions, optIn.recordedRegions);
 			if (resolved && memo) memo.resolved = resolved;
 			if (resolved) {
 				roles = resolved.lists["Roles"] ?? targets.wellFormed.roles;
@@ -2403,7 +2403,7 @@ var IAMUserGroupProvider = class {
 		const resolutionAttempted = "malformed" in read && optIn !== void 0 && isResolvableSecretPrincipalList(properties["Users"]);
 		if (resolutionAttempted) {
 			const reused = memo?.resolved;
-			const resolved = reused ?? await resolveSecretDerivedPrincipals({ Users: properties["Users"] }, context?.expectedRegion, optIn.importedProducerRegions);
+			const resolved = reused ?? await resolveSecretDerivedPrincipals({ Users: properties["Users"] }, context?.expectedRegion, optIn.importedProducerRegions, optIn.recordedRegions);
 			if (resolved && memo) memo.resolved = resolved;
 			if (resolved?.lists["Users"] !== void 0) {
 				users = resolved.lists["Users"];
@@ -5335,8 +5335,9 @@ var S3BucketPolicyProvider = class {
 			throw new ProvisioningError(`Failed to create S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating S3 bucket policy ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.s3Client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		const bucketName = properties["Bucket"];
 		const policyDocument = properties["PolicyDocument"];
 		if (!bucketName) throw new ProvisioningError(`Bucket is required for S3 bucket policy ${logicalId}`, resourceType, logicalId, physicalId);
@@ -5591,8 +5592,9 @@ var SQSQueueProvider = class {
 			throw new ProvisioningError(`Failed to create SQS queue ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, queueName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating SQS queue ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.sqsClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const attributes = {};
@@ -13483,7 +13485,8 @@ var SSMParameterProvider = class SSMParameterProvider {
 			};
 			if (properties["AllowedPattern"]) putParams.AllowedPattern = properties["AllowedPattern"];
 			if (properties["Tier"]) putParams.Tier = properties["Tier"];
-			if (properties["Policies"]) putParams.Policies = properties["Policies"];
+			const policies = ssmPoliciesParameter(properties["Policies"]);
+			if (policies !== void 0) putParams.Policies = policies;
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
 			await (await this.getCreateClient()).send(new PutParameterCommand(putParams));
 			leftBehind = true;
@@ -13544,7 +13547,9 @@ var SSMParameterProvider = class SSMParameterProvider {
 			if (properties["Description"] !== void 0) putParams.Description = properties["Description"];
 			if (properties["AllowedPattern"] !== void 0) putParams.AllowedPattern = properties["AllowedPattern"];
 			if (properties["Tier"] !== void 0) putParams.Tier = properties["Tier"];
-			if (properties["Policies"] !== void 0) putParams.Policies = properties["Policies"];
+			const policies = ssmPoliciesParameter(properties["Policies"]);
+			if (policies !== void 0) putParams.Policies = policies;
+			else if (context?.desiredFromAwsReadback === true && !["[]", void 0].includes(ssmPoliciesParameter(previousProperties["Policies"])) && context.declaredEmptyProperties?.has("Policies") === true) putParams.Policies = SSM_CLEAR_POLICIES;
 			if (properties["DataType"] !== void 0) putParams.DataType = properties["DataType"];
 			await this.ssmClient.send(new PutParameterCommand(putParams));
 			const plan = planTagDiff(tagMapAsList(previousProperties["Tags"]), tagMapAsList(properties["Tags"]));
@@ -13690,6 +13695,13 @@ var SSMParameterProvider = class SSMParameterProvider {
 		return null;
 	}
 };
+const SSM_CLEAR_POLICIES = "[{}]";
+function ssmPoliciesParameter(policies) {
+	if (policies === void 0 || policies === null || policies === "") return void 0;
+	if (typeof policies === "string") return policies;
+	if (Array.isArray(policies)) return policies.length === 0 ? void 0 : JSON.stringify(policies);
+	return JSON.stringify(policies);
+}
 
 //#endregion
 //#region src/provisioning/providers/eventbridge-rule-provider.ts
@@ -13867,8 +13879,9 @@ var EventBridgeRuleProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating EventBridge rule ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
 		const newTargets = properties["Targets"];
@@ -14182,7 +14195,8 @@ var EventBridgeBusProvider = class {
 			throw new ProvisioningError(`Failed to create EventBus ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -22135,8 +22149,9 @@ var StepFunctionsProvider = class {
 			throw new ProvisioningError(`Failed to create Step Functions state machine ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, stateMachineName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const definitionString = await this.buildDefinitionString(properties);
@@ -45108,4 +45123,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DxHQcC1K.js.map
+//# sourceMappingURL=provider-classes-WJRB6zvO.js.map