@go-to-k/cdkd 0.299.2 → 0.299.4

package/dist/{provider-classes-WJRB6zvO.js → provider-classes-SNKb1al7.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
 import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Pn2m0R67.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as isTruthyCfnBoolean, Al as displayAssemblyPath, B as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Bo as passedNoEchoParametersOf, Br as reDisableInstanceApiTermination, Bt as getStackRecords, Cs as carriesSecretMask, Ct as revertNestedChildFromJournal, Do as lambdaFunctionNameForMask, Dr as unchangedBehindSecretReference, Dt as getCurrentNestedStackContext, Eo as canonicalLambdaFunctionName, Er as slowCcOperationTimeoutMs, Fr as markWaitAbandoned, G as resolveDynamoDbDeleteBudgetMs, H as compensateRemovedDeletionProtection, Ia as refuseMalformedResourcesForDestroy, J as deleteTableWithIndexBusyRetry, Ja as withheldAccountClause, K as DELETE_INDEX_WAIT_PROCEED_NOTE, Lr as ec2InstanceProtectionSite, Ml as resolveAssemblyPath, Mr as deleteSkipReason, Nr as withIndeterminateGuard, Oo as sameLambdaFunctionAddress, Ot as withNestedStackContext, Pi as passedParameterClassesOf, Pr as isWaitAbandonedError, Q as hasCdkAutoDeleteTag, Qa as withoutSilentDropProperties, Qn as earliestDefined, Rr as isTerminationProtectionPropagationError, Rt as awaitInFlightSibling, To as withRetry, U as deleteBudgetKey, V as beginDeleteWait, Vi as accountArgs, Vr as reEnableInstanceApiTermination, W as resolveDynamoDbDeleteBudgetClock, X as ECR_AUTO_DELETE_IMAGES_TAG, Xa as findSilentDropProperties, Y as waitForIndexesSettled, Z as S3_AUTO_DELETE_OBJECTS_TAG, _o as readConfigString, a as findNestedTemplateTreeDefect, an as isRedactedRecordedValue, ar as planTagDiff, as as recordReferenceProvenanceEntry, b as lookupEachName, bo as requireConfigObject, br as getCurrentResourceSecrets, bs as recordAttributeIdCopy, bt as getNestedRevertRun, c as renderNestedTemplateTreeDefect, cc as stringifyValue, co as coerceWarmThroughput$1, cr as tagMapAsList, di as s3BucketDualStackDomainName, do as toFiniteNumber, dr as stringifyIfAssigned, er as reserveStackCreateToken, et as getPriorAttempts, fi as s3BucketRegionalDomainName, fo as coerceCfnBoolean, fs as dynamicReferenceTokens, ga as refuseMalformedNestedChildOutputs, go as configStringRefusal, hl as decodeListingKey, ho as configIntegerRefusal, ii as isSettledInstanceState, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ir as DBPROXY_TAG_OPTIONS, is as markSameGenerationBag, ji as parseWebACLArn, jl as renderAssemblyPathEscape, kl as describeFileReadFailure, li as s3BucketArn, lo as isWarmThroughputDecrease, lr as tagPlanWarning, mo as configBooleanRefusal, nn as getCurrentProducerRegions, nr as acquireIdempotencyToken, o as isAbsoluteAssetPath, oi as outputReferenceProvenanceOf, on as redactedDeleteAddressFields, or as readTagList, os as snapshotPassProvenance, pc as rewriteTemplateAssetReferences, pi as s3BucketWebsiteUrl, po as coerceCfnInteger, q as INDEX_SETTLE_POLL_INTERVAL_MS, qo as hasMaskableValues, rr as DBPROXY_TAGS_WHAT, s as listNestedTemplateRows, sn as redactedDeleteAddressSkip, so as WARM_THROUGHPUT_MEMBERS, sr as refuseMalformedDesiredTags, ss as redactSecretsForState, t as DeployEngine, tt as markRefusedBeforeApplying, ui as s3BucketDomainName, uo as toCfnInteger, ur as definedAttributes, us as withoutPhysicalNameCopies, v as chunks, vl as canonicalizeRegion, vo as replayWarn, vs as recoverMaskedOutput, x as withApiLimit, xi as getAccountInfo, xo as requireConfigString, y as isAccessDeniedError, yl as derivePartitionAndUrlSuffix, yo as requireConfigArray, ys as physicalNameCopiesOf, z as DynamoDBGlobalTableProvider, zr as observeThenDisableInstanceApiTermination } from "./deploy-engine-DlLwYRJk.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-D5B5lEmu.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-TA6lNkLr.js";
-import { RDSProvider } from "./rds-provider-DcUEh3d2.js";
-import { NeptuneProvider } from "./neptune-provider-Ba5va85p.js";
-import { ASGProvider } from "./asg-provider-C6USPLiS.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ao as sameLambdaFunctionAddress, At as withNestedStackContext, Br as isTerminationProtectionPropagationError, Bt as awaitInFlightSibling, C as withApiLimit, Ci as getAccountInfo, Co as requireConfigString, Do as withRetry, Fr as withIndeterminateGuard, G as deleteBudgetKey, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ho as passedNoEchoParametersOf, Hr as reDisableInstanceApiTermination, Ht as getStackRecords, Ii as passedParameterClassesOf, Ir as isWaitAbandonedError, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Lr as markWaitAbandoned, Ml as displayAssemblyPath, Ni as parseWebACLArn, Nl as renderAssemblyPathEscape, Oo as canonicalLambdaFunctionName, Or as slowCcOperationTimeoutMs, Pl as resolveAssemblyPath, Pr as deleteSkipReason, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qa as findSilentDropProperties, Ra as refuseMalformedResourcesForDestroy, S as lookupEachName, So as requireConfigObject, Sr as getCurrentResourceSecrets, Ss as recordAttributeIdCopy, St as getNestedRevertRun, Ts as carriesSecretMask, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ui as accountArgs, Ur as reEnableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as observeThenDisableInstanceApiTermination, W as compensateRemovedDeletionProtection, X as deleteTableWithIndexBusyRetry, Xa as withheldAccountClause, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as hasMaskableValues, Z as waitForIndexesSettled, _l as decodeListingKey, _o as configIntegerRefusal, ar as DBPROXY_TAGS_WHAT, b as chunks, bl as canonicalizeRegion, bo as replayWarn, bs as recoverMaskedOutput, c as isAbsoluteAssetPath, ci as outputReferenceProvenanceOf, cn as redactedDeleteAddressFields, cr as readTagList, cs as snapshotPassProvenance, di as s3BucketArn, do as isWarmThroughputDecrease, dr as tagPlanWarning, eo as withoutSilentDropProperties, er as earliestDefined, et as hasCdkAutoDeleteTag, fi as s3BucketDomainName, fo as toCfnInteger, fr as definedAttributes, fs as withoutPhysicalNameCopies, go as configBooleanRefusal, hc as rewriteTemplateAssetReferences, hi as s3BucketWebsiteUrl, ho as coerceCfnInteger, in as getCurrentProducerRegions, ir as acquireIdempotencyToken, jl as describeFileReadFailure, ko as lambdaFunctionNameForMask, kr as unchangedBehindSecretReference, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, ln as redactedDeleteAddressSkip, lo as WARM_THROUGHPUT_MEMBERS, lr as refuseMalformedDesiredTags, ls as redactSecretsForState, mi as s3BucketRegionalDomainName, mo as coerceCfnBoolean, ms as dynamicReferenceTokens, nr as reserveStackCreateToken, nt as getPriorAttempts, oi as isSettledInstanceState, on as REDACTED_DELETE_ADDRESS_SKIP_REASON, or as DBPROXY_TAG_OPTIONS, os as markSameGenerationBag, pi as s3BucketDualStackDomainName, po as toFiniteNumber, pr as stringifyIfAssigned, q as resolveDynamoDbDeleteBudgetMs, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as isRedactedRecordedValue, sr as planTagDiff, ss as recordReferenceProvenanceEntry, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, uc as stringifyValue, uo as coerceWarmThroughput$1, ur as tagMapAsList, va as refuseMalformedNestedChildOutputs, vo as configStringRefusal, x as isAccessDeniedError, xl as derivePartitionAndUrlSuffix, xo as requireConfigArray, xs as physicalNameCopiesOf, yo as readConfigString, zr as ec2InstanceProtectionSite } from "./deploy-engine-DWIbDQdg.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DTQlG8qe.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B4_qJpAO.js";
+import { RDSProvider } from "./rds-provider-B9gz-giS.js";
+import { NeptuneProvider } from "./neptune-provider-Bkrw65eO.js";
+import { ASGProvider } from "./asg-provider-BtUUjRnI.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -571,6 +571,11 @@ const principalsOf = (bag) => readPrincipalLists({
 });
 const PRINCIPAL_NAMES = "group / role / user names";
 const AWS_MANAGED_POLICY_ARN_RE = /^arn:aws[a-z0-9-]*:iam::aws:/;
+const MANAGED_POLICY_TYPE = "AWS::IAM::ManagedPolicy";
+const CUSTOMER_POLICY_ARN_RE = /^(arn:aws[a-z0-9-]*:iam::\d{12}):policy\/(?:[!-~]{0,510}\/)?([\w+=,.@-]{1,128})$/;
+function policyIdentityToken(id) {
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
 var IAMManagedPolicyProvider = class {
 	iamClient;
 	createClient = new IamCreateClientCache(() => this.iamClient);
@@ -604,6 +609,7 @@ var IAMManagedPolicyProvider = class {
 		if ("malformed" in principals) throw new ProvisioningError(`${principals.malformed.join(" / ")} of IAM managed policy ${logicalId} is not a list of IAM names — no managed policy was created or attached`, resourceType, logicalId);
 		const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
 		let leftBehindArn;
+		let createdPolicyIdentity;
 		try {
 			const createParams = {
 				PolicyName: policyName,
@@ -612,9 +618,11 @@ var IAMManagedPolicyProvider = class {
 			if (properties["Description"]) createParams.Description = properties["Description"];
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (tags.length > 0) createParams.Tags = tags;
-			const policyArn = (await (await this.createClient.get()).send(new CreatePolicyCommand(createParams))).Policy?.Arn;
+			const response = await (await this.createClient.get()).send(new CreatePolicyCommand(createParams));
+			const policyArn = response.Policy?.Arn;
 			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
 			leftBehindArn = policyArn;
+			createdPolicyIdentity = policyIdentityToken(response.Policy?.PolicyId);
 			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
 			try {
 				await this.attachToPrincipals(policyArn, principals.lists.Groups, principals.lists.Roles, principals.lists.Users, log);
@@ -636,7 +644,7 @@ var IAMManagedPolicyProvider = class {
 				attributes: { PolicyArn: policyArn }
 			};
 		} catch (error) {
-			const markLeftBehind = (e) => leftBehindArn !== void 0 ? markCreatedBeforeFailure(e, logicalId, resourceType, leftBehindArn) : e;
+			const markLeftBehind = (e) => leftBehindArn !== void 0 ? markCreatedBeforeFailure(e, logicalId, resourceType, leftBehindArn, createdPolicyIdentity) : e;
 			if (error instanceof CdkdError) {
 				markLeftBehind(error);
 				throw error;
@@ -764,9 +772,7 @@ var IAMManagedPolicyProvider = class {
 				await this.iamClient.send(new GetPolicyCommand({ PolicyArn: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					const clientRegion = await this.iamClient.config.region();
-					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					this.logger.debug(mask(`Managed policy ${physicalId} does not exist, skipping deletion`));
+					await this.goneOnDelete(logicalId, physicalId, resourceType, context, mask);
 					return;
 				}
 				throw error;
@@ -776,10 +782,20 @@ var IAMManagedPolicyProvider = class {
 			await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: physicalId }));
 			this.logger.debug(`Successfully deleted IAM managed policy ${logicalId}`);
 		} catch (error) {
+			if (error instanceof NoSuchEntityException) {
+				await this.goneOnDelete(logicalId, physicalId, resourceType, context, mask);
+				return;
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to delete IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async goneOnDelete(logicalId, physicalId, resourceType, context, mask) {
+		const clientRegion = await this.iamClient.config.region();
+		assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
+		if (context?.failedCreateOrphan === true) this.logger.info(mask(safeMsg`  IAM managed policy ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`));
+		else this.logger.debug(mask(`Managed policy ${physicalId} does not exist, skipping deletion`));
+	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
 		if (attributeName === "PolicyArn") return physicalId;
 	}
@@ -877,6 +893,43 @@ var IAMManagedPolicyProvider = class {
 		}
 		return null;
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== MANAGED_POLICY_TYPE) return "unknown";
+		const journaled = CUSTOMER_POLICY_ARN_RE.exec(journaledPhysicalId);
+		const recorded = CUSTOMER_POLICY_ARN_RE.exec(record.physicalId);
+		if (journaled === null || recorded === null) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaled[1] !== recorded[1]) return "unknown";
+		if (journaled[2].toLowerCase() === recorded[2].toLowerCase()) return "unknown";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordId = await this.readPolicyIdIfExists(record.physicalId);
+		if (recordId === void 0) return "unknown";
+		const journaledId = await this.readPolicyIdIfExists(journaledPhysicalId);
+		if (journaledId === void 0) return "different";
+		return journaledId === recordId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== MANAGED_POLICY_TYPE || !CUSTOMER_POLICY_ARN_RE.test(physicalId)) return;
+		if (await this.iamClient.config.region() !== context.expectedRegion) return void 0;
+		const id = await this.readPolicyIdIfExists(physicalId);
+		return id === void 0 ? RESOURCE_NOT_FOUND : id;
+	}
+	async readPolicyIdIfExists(policyArn) {
+		let answeredArn;
+		let id;
+		try {
+			const response = await this.iamClient.send(new GetPolicyCommand({ PolicyArn: policyArn }));
+			answeredArn = response.Policy?.Arn;
+			id = response.Policy?.PolicyId;
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) return void 0;
+			throw error;
+		}
+		if (answeredArn !== policyArn) throw new Error("IAM answered for another managed policy than the one asked for");
+		const token = policyIdentityToken(id);
+		if (token === void 0) throw new Error("IAM returned no PolicyId");
+		return token;
+	}
 	async attachToPrincipals(policyArn, groups, roles, users, log) {
 		const { value: v } = log;
 		if (groups && Array.isArray(groups)) for (const groupName of groups) {
@@ -1113,6 +1166,13 @@ function recordedNonRootPath(arn) {
 
 //#endregion
 //#region src/provisioning/providers/iam-instance-profile-provider.ts
+const INSTANCE_PROFILE_TYPE = "AWS::IAM::InstanceProfile";
+function isInstanceProfileName(id) {
+	return /^[\w+=,.@-]{1,128}$/.test(id);
+}
+function instanceProfileIdentityToken(id) {
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
 var IAMInstanceProfileProvider = class {
 	iamClient;
 	createClient = new IamCreateClientCache(() => this.iamClient);
@@ -1139,12 +1199,14 @@ var IAMInstanceProfileProvider = class {
 		if ("malformed" in principals) throw new ProvisioningError(`Roles of IAM instance profile ${logicalId} is not a list of IAM role names — no instance profile was created`, resourceType, logicalId);
 		const roles = principals.lists.Roles;
 		let leftBehind = false;
+		let createdProfileIdentity;
 		try {
 			const response = await (await this.createClient.get()).send(new CreateInstanceProfileCommand({
 				InstanceProfileName: instanceProfileName,
 				Path: path
 			}));
 			leftBehind = true;
+			createdProfileIdentity = instanceProfileIdentityToken(response.InstanceProfile?.InstanceProfileId);
 			log.debug(`Created IAM instance profile: ${v(instanceProfileName)}`);
 			const attachedRoles = [];
 			try {
@@ -1183,7 +1245,7 @@ var IAMInstanceProfileProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM instance profile ${logicalId}: ${text}`, resourceType, logicalId, instanceProfileName, cause));
-			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, instanceProfileName);
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, instanceProfileName, createdProfileIdentity);
 			throw thrown;
 		}
 	}
@@ -1258,7 +1320,7 @@ var IAMInstanceProfileProvider = class {
 				if (error instanceof NoSuchEntityException) {
 					const clientRegion = await this.iamClient.config.region();
 					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-					this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+					this.logGoneOnDelete(logicalId, physicalId, context);
 					return;
 				}
 				throw error;
@@ -1278,13 +1340,51 @@ var IAMInstanceProfileProvider = class {
 			if (error instanceof NoSuchEntityException) {
 				const clientRegion = await this.iamClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+				this.logGoneOnDelete(logicalId, physicalId, context);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	logGoneOnDelete(logicalId, physicalId, context) {
+		if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  IAM instance profile ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+		else this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
+	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== INSTANCE_PROFILE_TYPE) return "unknown";
+		if (!isInstanceProfileName(journaledPhysicalId) || !isInstanceProfileName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "unknown";
+		if (await this.iamClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordId = await this.readIdIfExists(record.physicalId);
+		if (recordId === void 0) return "unknown";
+		const journaledId = await this.readIdIfExists(journaledPhysicalId);
+		if (journaledId === void 0) return "different";
+		return journaledId === recordId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== INSTANCE_PROFILE_TYPE || !isInstanceProfileName(physicalId)) return;
+		if (await this.iamClient.config.region() !== context.expectedRegion) return void 0;
+		const id = await this.readIdIfExists(physicalId);
+		return id === void 0 ? RESOURCE_NOT_FOUND : id;
+	}
+	async readIdIfExists(name) {
+		let answeredName;
+		let id;
+		try {
+			const response = await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: name }));
+			answeredName = response.InstanceProfile?.InstanceProfileName;
+			id = response.InstanceProfile?.InstanceProfileId;
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) return void 0;
+			throw error;
+		}
+		if (answeredName !== name) throw new Error("IAM answered for another instance profile than the one asked for");
+		const token = instanceProfileIdentityToken(id);
+		if (token === void 0) throw new Error("IAM returned no InstanceProfileId");
+		return token;
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		let profile;
 		try {
@@ -44544,6 +44644,7 @@ var NestedStackProvider = class {
 			...deleteContext?.removeProtection === true && { removeProtection: true },
 			...deleteContext?.resolveSecretDerivedPrincipals !== void 0 && { resolveSecretDerivedPrincipals: { inheritedProducerRegions: deleteContext.resolveSecretDerivedPrincipals.importedProducerRegions } },
 			...deleteContext?.stackDestroy === true && { stackDestroy: true },
+			...ctx.destroyOptions?.purgeStateHistory === true && { purgeStateHistory: true },
 			...childNoEchoReresolver !== void 0 && { noEchoReresolver: childNoEchoReresolver },
 			...(ctx.destroyOptions?.skipFinalSnapshot === true || ctx.options?.skipFinalSnapshot === true) && { skipFinalSnapshot: true },
 			...ctx.destroyOptions?.resourceWarnAfterMs !== void 0 && { resourceWarnAfterMs: ctx.destroyOptions.resourceWarnAfterMs },
@@ -45123,4 +45224,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-WJRB6zvO.js.map
+//# sourceMappingURL=provider-classes-SNKb1al7.js.map