@go-to-k/cdkd 0.299.1 → 0.299.3

package/dist/{provider-classes-Xrt4DIC7.js → provider-classes-BFHOZwKd.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Pn2m0R67.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as isTruthyCfnBoolean, Al as displayAssemblyPath, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Bo as passedNoEchoParametersOf, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cs as carriesSecretMask, Ct as revertNestedChildFromJournal, Do as lambdaFunctionNameForMask, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Eo as canonicalLambdaFunctionName, Er as slowCcOperationTimeoutMs, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, H as compensateRemovedDeletionProtection, Ia as refuseMalformedResourcesForDestroy, J as deleteTableWithIndexBusyRetry, Ja as withheldAccountClause, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Ml as resolveAssemblyPath, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Oo as sameLambdaFunctionAddress, Ot as withNestedStackContext, Pi as passedParameterClassesOf, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qa as withoutSilentDropProperties, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, To as withRetry, U as deleteBudgetKey, V as beginDeleteWait, Vi as accountArgs, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Xa as findSilentDropProperties, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, _o as readConfigString, a as findNestedTemplateTreeDefect, an as isRedactedRecordedValue, ar as planTagDiff, as as recordReferenceProvenanceEntry, b as lookupEachName, bo as requireConfigObject, br as getCurrentResourceSecrets, bs as recordAttributeIdCopy, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, cc as stringifyValue, co as coerceWarmThroughput$1, cr as tagMapAsList, di as s3BucketDualStackDomainName, do as toFiniteNumber, dr as stringifyIfAssigned, er as reserveStackCreateToken, et as getPriorAttempts, fi as s3BucketRegionalDomainName, fo as coerceCfnBoolean, fs as dynamicReferenceTokens, ga as refuseMalformedNestedChildOutputs, go as configStringRefusal, hl as decodeListingKey, ho as configIntegerRefusal, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ir as DBPROXY_TAG_OPTIONS, is as markSameGenerationBag, ji as parseWebACLArn, jl as renderAssemblyPathEscape, kl as describeFileReadFailure, li as s3BucketArn, lo as isWarmThroughputDecrease, lr as tagPlanWarning, mo as configBooleanRefusal, nn as getCurrentProducerRegions, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as outputReferenceProvenanceOf, on as redactedDeleteAddressFields, or as readTagList, os as snapshotPassProvenance, pc as rewriteTemplateAssetReferences, pi as s3BucketWebsiteUrl, po as coerceCfnInteger, q as INDEX_SETTLE_POLL_INTERVAL_MS, qo as hasMaskableValues, rr as DBPROXY_TAGS_WHAT, s as listNestedTemplateRows, sn as redactedDeleteAddressSkip, so as WARM_THROUGHPUT_MEMBERS, sr as refuseMalformedDesiredTags, ss as redactSecretsForState, t as DeployEngine, tt as markRefusedBeforeApplying, ui as s3BucketDomainName, uo as toCfnInteger, ur as definedAttributes, us as withoutPhysicalNameCopies, v as chunks, vl as canonicalizeRegion, vo as replayWarn, vs as recoverMaskedOutput, x as withApiLimit, xi as getAccountInfo, xo as requireConfigString, y as isAccessDeniedError, yl as derivePartitionAndUrlSuffix, yo as requireConfigArray, ys as physicalNameCopiesOf, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-CZUhJ1IZ.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C24I_FvR.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-w-kAH85e.js";
-import { RDSProvider } from "./rds-provider-Bz8JUYBp.js";
-import { NeptuneProvider } from "./neptune-provider-D7sAjt4U.js";
-import { ASGProvider } from "./asg-provider-BxW2FkQz.js";
+import { $ as isTruthyCfnBoolean, Al as displayAssemblyPath, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Bo as passedNoEchoParametersOf, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cs as carriesSecretMask, Ct as revertNestedChildFromJournal, Do as lambdaFunctionNameForMask, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Eo as canonicalLambdaFunctionName, Er as slowCcOperationTimeoutMs, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, H as compensateRemovedDeletionProtection, Ia as refuseMalformedResourcesForDestroy, J as deleteTableWithIndexBusyRetry, Ja as withheldAccountClause, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Ml as resolveAssemblyPath, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Oo as sameLambdaFunctionAddress, Ot as withNestedStackContext, Pi as passedParameterClassesOf, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qa as withoutSilentDropProperties, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, To as withRetry, U as deleteBudgetKey, V as beginDeleteWait, Vi as accountArgs, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Xa as findSilentDropProperties, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, _o as readConfigString, a as findNestedTemplateTreeDefect, an as isRedactedRecordedValue, ar as planTagDiff, as as recordReferenceProvenanceEntry, b as lookupEachName, bo as requireConfigObject, br as getCurrentResourceSecrets, bs as recordAttributeIdCopy, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, cc as stringifyValue, co as coerceWarmThroughput$1, cr as tagMapAsList, di as s3BucketDualStackDomainName, do as toFiniteNumber, dr as stringifyIfAssigned, er as reserveStackCreateToken, et as getPriorAttempts, fi as s3BucketRegionalDomainName, fo as coerceCfnBoolean, fs as dynamicReferenceTokens, ga as refuseMalformedNestedChildOutputs, go as configStringRefusal, hl as decodeListingKey, ho as configIntegerRefusal, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ir as DBPROXY_TAG_OPTIONS, is as markSameGenerationBag, ji as parseWebACLArn, jl as renderAssemblyPathEscape, kl as describeFileReadFailure, li as s3BucketArn, lo as isWarmThroughputDecrease, lr as tagPlanWarning, mo as configBooleanRefusal, nn as getCurrentProducerRegions, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as outputReferenceProvenanceOf, on as redactedDeleteAddressFields, or as readTagList, os as snapshotPassProvenance, pc as rewriteTemplateAssetReferences, pi as s3BucketWebsiteUrl, po as coerceCfnInteger, q as INDEX_SETTLE_POLL_INTERVAL_MS, qo as hasMaskableValues, rr as DBPROXY_TAGS_WHAT, s as listNestedTemplateRows, sn as redactedDeleteAddressSkip, so as WARM_THROUGHPUT_MEMBERS, sr as refuseMalformedDesiredTags, ss as redactSecretsForState, t as DeployEngine, tt as markRefusedBeforeApplying, ui as s3BucketDomainName, uo as toCfnInteger, ur as definedAttributes, us as withoutPhysicalNameCopies, v as chunks, vl as canonicalizeRegion, vo as replayWarn, vs as recoverMaskedOutput, x as withApiLimit, xi as getAccountInfo, xo as requireConfigString, y as isAccessDeniedError, yl as derivePartitionAndUrlSuffix, yo as requireConfigArray, ys as physicalNameCopiesOf, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-DEBgHf6Z.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CXfEJz94.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B4pWdUfl.js";
+import { RDSProvider } from "./rds-provider-d15q7Rp5.js";
+import { NeptuneProvider } from "./neptune-provider-C81KkPPG.js";
+import { ASGProvider } from "./asg-provider-CsBxbRlH.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -379,7 +379,7 @@ var IAMPolicyProvider = class {
 			const values = Object.fromEntries(malformedKinds.map((k) => [k, recordedLists[k]]));
 			const memo = optIn.retryMemo;
 			const reused = memo?.resolved;
-			const resolved = reused ?? await resolveSecretDerivedPrincipals(values, context?.expectedRegion, optIn.importedProducerRegions);
+			const resolved = reused ?? await resolveSecretDerivedPrincipals(values, context?.expectedRegion, optIn.importedProducerRegions, optIn.recordedRegions);
 			if (resolved && memo) memo.resolved = resolved;
 			if (resolved) {
 				roles = resolved.lists["Roles"] ?? targets.wellFormed.roles;
@@ -571,6 +571,11 @@ const principalsOf = (bag) => readPrincipalLists({
 });
 const PRINCIPAL_NAMES = "group / role / user names";
 const AWS_MANAGED_POLICY_ARN_RE = /^arn:aws[a-z0-9-]*:iam::aws:/;
+const MANAGED_POLICY_TYPE = "AWS::IAM::ManagedPolicy";
+const CUSTOMER_POLICY_ARN_RE = /^(arn:aws[a-z0-9-]*:iam::\d{12}):policy\/(?:[!-~]{0,510}\/)?([\w+=,.@-]{1,128})$/;
+function policyIdentityToken(id) {
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
 var IAMManagedPolicyProvider = class {
 	iamClient;
 	createClient = new IamCreateClientCache(() => this.iamClient);
@@ -604,6 +609,7 @@ var IAMManagedPolicyProvider = class {
 		if ("malformed" in principals) throw new ProvisioningError(`${principals.malformed.join(" / ")} of IAM managed policy ${logicalId} is not a list of IAM names — no managed policy was created or attached`, resourceType, logicalId);
 		const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
 		let leftBehindArn;
+		let createdPolicyIdentity;
 		try {
 			const createParams = {
 				PolicyName: policyName,
@@ -612,9 +618,11 @@ var IAMManagedPolicyProvider = class {
 			if (properties["Description"]) createParams.Description = properties["Description"];
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (tags.length > 0) createParams.Tags = tags;
-			const policyArn = (await (await this.createClient.get()).send(new CreatePolicyCommand(createParams))).Policy?.Arn;
+			const response = await (await this.createClient.get()).send(new CreatePolicyCommand(createParams));
+			const policyArn = response.Policy?.Arn;
 			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
 			leftBehindArn = policyArn;
+			createdPolicyIdentity = policyIdentityToken(response.Policy?.PolicyId);
 			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
 			try {
 				await this.attachToPrincipals(policyArn, principals.lists.Groups, principals.lists.Roles, principals.lists.Users, log);
@@ -636,7 +644,7 @@ var IAMManagedPolicyProvider = class {
 				attributes: { PolicyArn: policyArn }
 			};
 		} catch (error) {
-			const markLeftBehind = (e) => leftBehindArn !== void 0 ? markCreatedBeforeFailure(e, logicalId, resourceType, leftBehindArn) : e;
+			const markLeftBehind = (e) => leftBehindArn !== void 0 ? markCreatedBeforeFailure(e, logicalId, resourceType, leftBehindArn, createdPolicyIdentity) : e;
 			if (error instanceof CdkdError) {
 				markLeftBehind(error);
 				throw error;
@@ -764,9 +772,7 @@ var IAMManagedPolicyProvider = class {
 				await this.iamClient.send(new GetPolicyCommand({ PolicyArn: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					const clientRegion = await this.iamClient.config.region();
-					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					this.logger.debug(mask(`Managed policy ${physicalId} does not exist, skipping deletion`));
+					await this.goneOnDelete(logicalId, physicalId, resourceType, context, mask);
 					return;
 				}
 				throw error;
@@ -776,10 +782,20 @@ var IAMManagedPolicyProvider = class {
 			await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: physicalId }));
 			this.logger.debug(`Successfully deleted IAM managed policy ${logicalId}`);
 		} catch (error) {
+			if (error instanceof NoSuchEntityException) {
+				await this.goneOnDelete(logicalId, physicalId, resourceType, context, mask);
+				return;
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async goneOnDelete(logicalId, physicalId, resourceType, context, mask) {
+		const clientRegion = await this.iamClient.config.region();
+		assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+		if (context?.failedCreateOrphan === true) this.logger.info(mask(safeMsg`  IAM managed policy ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`));
+		else this.logger.debug(mask(`Managed policy ${physicalId} does not exist, skipping deletion`));
+	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
 		if (attributeName === "PolicyArn") return physicalId;
 	}
@@ -877,6 +893,43 @@ var IAMManagedPolicyProvider = class {
 		}
 		return null;
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== MANAGED_POLICY_TYPE) return "unknown";
+		const journaled = CUSTOMER_POLICY_ARN_RE.exec(journaledPhysicalId);
+		const recorded = CUSTOMER_POLICY_ARN_RE.exec(record.physicalId);
+		if (journaled === null || recorded === null) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaled[1] !== recorded[1]) return "unknown";
+		if (journaled[2].toLowerCase() === recorded[2].toLowerCase()) return "unknown";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordId = await this.readPolicyIdIfExists(record.physicalId);
+		if (recordId === void 0) return "unknown";
+		const journaledId = await this.readPolicyIdIfExists(journaledPhysicalId);
+		if (journaledId === void 0) return "different";
+		return journaledId === recordId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== MANAGED_POLICY_TYPE || !CUSTOMER_POLICY_ARN_RE.test(physicalId)) return;
+		if (await this.iamClient.config.region() !== context.expectedRegion) return void 0;
+		const id = await this.readPolicyIdIfExists(physicalId);
+		return id === void 0 ? RESOURCE_NOT_FOUND : id;
+	}
+	async readPolicyIdIfExists(policyArn) {
+		let answeredArn;
+		let id;
+		try {
+			const response = await this.iamClient.send(new GetPolicyCommand({ PolicyArn: policyArn }));
+			answeredArn = response.Policy?.Arn;
+			id = response.Policy?.PolicyId;
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) return void 0;
+			throw error;
+		}
+		if (answeredArn !== policyArn) throw new Error("IAM answered for another managed policy than the one asked for");
+		const token = policyIdentityToken(id);
+		if (token === void 0) throw new Error("IAM returned no PolicyId");
+		return token;
+	}
 	async attachToPrincipals(policyArn, groups, roles, users, log) {
 		const { value: v } = log;
 		if (groups && Array.isArray(groups)) for (const groupName of groups) {
@@ -1113,6 +1166,13 @@ function recordedNonRootPath(arn) {
 
 //#endregion
 //#region src/provisioning/providers/iam-instance-profile-provider.ts
+const INSTANCE_PROFILE_TYPE = "AWS::IAM::InstanceProfile";
+function isInstanceProfileName(id) {
+	return /^[\w+=,.@-]{1,128}$/.test(id);
+}
+function instanceProfileIdentityToken(id) {
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
 var IAMInstanceProfileProvider = class {
 	iamClient;
 	createClient = new IamCreateClientCache(() => this.iamClient);
@@ -1139,12 +1199,14 @@ var IAMInstanceProfileProvider = class {
 		if ("malformed" in principals) throw new ProvisioningError(`Roles of IAM instance profile ${logicalId} is not a list of IAM role names — no instance profile was created`, resourceType, logicalId);
 		const roles = principals.lists.Roles;
 		let leftBehind = false;
+		let createdProfileIdentity;
 		try {
 			const response = await (await this.createClient.get()).send(new CreateInstanceProfileCommand({
 				InstanceProfileName: instanceProfileName,
 				Path: path
 			}));
 			leftBehind = true;
+			createdProfileIdentity = instanceProfileIdentityToken(response.InstanceProfile?.InstanceProfileId);
 			log.debug(`Created IAM instance profile: ${v(instanceProfileName)}`);
 			const attachedRoles = [];
 			try {
@@ -1183,7 +1245,7 @@ var IAMInstanceProfileProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM instance profile ${logicalId}: ${text}`, resourceType, logicalId, instanceProfileName, cause));
-			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, instanceProfileName);
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, instanceProfileName, createdProfileIdentity);
 			throw thrown;
 		}
 	}
@@ -1258,7 +1320,7 @@ var IAMInstanceProfileProvider = class {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+					this.logGoneOnDelete(logicalId, physicalId, context);
 					return;
 				}
 				throw error;
@@ -1278,13 +1340,51 @@ var IAMInstanceProfileProvider = class {
 			if (error instanceof NoSuchEntityException) {
 				const clientRegion = await this.iamClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+				this.logGoneOnDelete(logicalId, physicalId, context);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	logGoneOnDelete(logicalId, physicalId, context) {
+		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  IAM instance profile ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+		else this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== INSTANCE_PROFILE_TYPE) return "unknown";
+		if (!isInstanceProfileName(journaledPhysicalId) || !isInstanceProfileName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordId = await this.readIdIfExists(record.physicalId);
+		if (recordId === void 0) return "unknown";
+		const journaledId = await this.readIdIfExists(journaledPhysicalId);
+		if (journaledId === void 0) return "different";
+		return journaledId === recordId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== INSTANCE_PROFILE_TYPE || !isInstanceProfileName(physicalId)) return;
+		if (await this.iamClient.config.region() !== context.expectedRegion) return void 0;
+		const id = await this.readIdIfExists(physicalId);
+		return id === void 0 ? RESOURCE_NOT_FOUND : id;
+	}
+	async readIdIfExists(name) {
+		let answeredName;
+		let id;
+		try {
+			const response = await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: name }));
+			answeredName = response.InstanceProfile?.InstanceProfileName;
+			id = response.InstanceProfile?.InstanceProfileId;
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) return void 0;
+			throw error;
+		}
+		if (answeredName !== name) throw new Error("IAM answered for another instance profile than the one asked for");
+		const token = instanceProfileIdentityToken(id);
+		if (token === void 0) throw new Error("IAM returned no InstanceProfileId");
+		return token;
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		let profile;
 		try {
@@ -2403,7 +2503,7 @@ var IAMUserGroupProvider = class {
 		const resolutionAttempted = "malformed" in read && optIn !== void 0 && isResolvableSecretPrincipalList(properties["Users"]);
 		if (resolutionAttempted) {
 			const reused = memo?.resolved;
-			const resolved = reused ?? await resolveSecretDerivedPrincipals({ Users: properties["Users"] }, context?.expectedRegion, optIn.importedProducerRegions);
+			const resolved = reused ?? await resolveSecretDerivedPrincipals({ Users: properties["Users"] }, context?.expectedRegion, optIn.importedProducerRegions, optIn.recordedRegions);
 			if (resolved && memo) memo.resolved = resolved;
 			if (resolved?.lists["Users"] !== void 0) {
 				users = resolved.lists["Users"];
@@ -5335,8 +5435,9 @@ var S3BucketPolicyProvider = class {
 			throw new ProvisioningError(`Failed to create S3 bucket policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		this.logger.debug(`Updating S3 bucket policy ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.s3Client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		const bucketName = properties["Bucket"];
 		const policyDocument = properties["PolicyDocument"];
 		if (!bucketName) throw new ProvisioningError(`Bucket is required for S3 bucket policy ${logicalId}`, resourceType, logicalId, physicalId);
@@ -5591,8 +5692,9 @@ var SQSQueueProvider = class {
 			throw new ProvisioningError(`Failed to create SQS queue ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, queueName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating SQS queue ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.sqsClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const attributes = {};
@@ -13547,6 +13649,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 			if (properties["Tier"] !== void 0) putParams.Tier = properties["Tier"];
 			const policies = ssmPoliciesParameter(properties["Policies"]);
 			if (policies !== void 0) putParams.Policies = policies;
+			else if (context?.desiredFromAwsReadback === true && !["[]", void 0].includes(ssmPoliciesParameter(previousProperties["Policies"])) && context.declaredEmptyProperties?.has("Policies") === true) putParams.Policies = SSM_CLEAR_POLICIES;
 			if (properties["DataType"] !== void 0) putParams.DataType = properties["DataType"];
 			await this.ssmClient.send(new PutParameterCommand(putParams));
 			const plan = planTagDiff(tagMapAsList(previousProperties["Tags"]), tagMapAsList(properties["Tags"]));
@@ -13692,6 +13795,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 		return null;
 	}
 };
+const SSM_CLEAR_POLICIES = "[{}]";
 function ssmPoliciesParameter(policies) {
 	if (policies === void 0 || policies === null || policies === "") return void 0;
 	if (typeof policies === "string") return policies;
@@ -13875,8 +13979,9 @@ var EventBridgeRuleProvider = class {
 			throw thrown;
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating EventBridge rule ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
 		const newTargets = properties["Targets"];
@@ -14190,7 +14295,8 @@ var EventBridgeBusProvider = class {
 			throw new ProvisioningError(`Failed to create EventBus ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -22143,8 +22249,9 @@ var StepFunctionsProvider = class {
 			throw new ProvisioningError(`Failed to create Step Functions state machine ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, stateMachineName, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
+		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
 			const definitionString = await this.buildDefinitionString(properties);
@@ -45116,4 +45223,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Xrt4DIC7.js.map
+//# sourceMappingURL=provider-classes-BFHOZwKd.js.map