@go-to-k/cdkd 0.300.1 → 0.300.2

package/dist/{provider-classes-CDzT2xg0.js → provider-classes-DzoIZFZK.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isThrottlingError, ct as canonicalizeRoute53QueryName, dr as wrapMaskedAwsError, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as markNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, o as readPrincipalLists, or as THROTTLING_ERROR_NAMES, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isRetryableTransientError, sr as isMarkedNonRetryable, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, u as clearOnUpdateRemoval, ur as markRedactedCause, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DAs3w7QW.js";
+import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DFk7zr0Q.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as withheldAccountClause, Ao as withRetry, At as withNestedStackContext, Br as markWaitAbandoned, Bt as awaitInFlightSibling, C as withApiLimit, Co as replayWarn, Ei as getAccountInfo, Eo as requireConfigString, Es as recordAttributeIdCopy, Fl as describeFileReadFailure, G as deleteBudgetKey, Go as passedNoEchoParametersOf, Gr as reDisableInstanceApiTermination, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as ec2InstanceProtectionSite, Ht as getStackRecords, Ii as parseWebACLArn, Il as displayAssemblyPath, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Ki as accountArgs, Kr as reEnableInstanceApiTermination, Ll as renderAssemblyPathEscape, Lr as deleteSkipReason, Mo as lambdaFunctionNameForMask, Mr as unchangedBehindSecretReference, No as sameLambdaFunctionAddress, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qo as hasMaskableValues, Rl as resolveAssemblyPath, Rr as withIndeterminateGuard, S as lookupEachName, So as readConfigString, St as getNestedRevertRun, Tl as derivePartitionAndUrlSuffix, To as requireConfigObject, Tr as getCurrentResourceSecrets, Ts as physicalNameCopiesOf, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ur as isTerminationProtectionPropagationError, V as DynamoDBGlobalTableProvider, Va as refuseMalformedResourcesForDestroy, W as compensateRemovedDeletionProtection, Wr as observeThenDisableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, _i as s3BucketRegionalDomainName, _o as coerceCfnBoolean, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as configIntegerRefusal, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as DBPROXY_TAGS_WHAT, di as outputReferenceProvenanceOf, dr as readTagList, ds as recordReferenceProvenanceEntry, et as hasCdkAutoDeleteTag, fo as WARM_THROUGHPUT_MEMBERS, fr as refuseMalformedDesiredTags, fs as snapshotPassProvenance, gi as s3BucketDualStackDomainName, go as toFiniteNumber, gr as stringifyIfAssigned, gs as withoutPhysicalNameCopies, hi as s3BucketDomainName, ho as toCfnInteger, hr as definedAttributes, jo as canonicalLambdaFunctionName, jr as slowCcOperationTimeoutMs, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as isSettledInstanceState, ln as redactedDeleteAddressFields, lr as DBPROXY_TAG_OPTIONS, mc as stringifyValue, mi as s3BucketArn, mo as isWarmThroughputDecrease, mr as tagPlanWarning, nt as getPriorAttempts, or as isRefusedByName, po as coerceWarmThroughput$1, pr as tagMapAsList, ps as redactSecretsForState, q as resolveDynamoDbDeleteBudgetMs, ro as withoutSilentDropProperties, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as markDeleteStarted, t as DeployEngine, to as findSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, ur as planTagDiff, us as markSameGenerationBag, vi as s3BucketWebsiteUrl, vo as coerceCfnInteger, vs as dynamicReferenceTokens, wl as canonicalizeRegion, wo as requireConfigArray, ws as recoverMaskedOutput, x as isAccessDeniedError, xa as refuseMalformedNestedChildOutputs, xl as decodeListingKey, xo as configStringRefusal, yc as rewriteTemplateAssetReferences, yo as configBooleanRefusal, zi as passedParameterClassesOf, zr as isWaitAbandonedError } from "./deploy-engine-BK4gG_5A.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-SmvPHPLC.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DVPHKsxv.js";
-import { RDSProvider } from "./rds-provider-DraxDuQq.js";
-import { NeptuneProvider } from "./neptune-provider-CqZ1FaqT.js";
-import { ASGProvider } from "./asg-provider-BS5i71bK.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as withheldAccountClause, Ao as withRetry, At as withNestedStackContext, Br as markWaitAbandoned, Bt as awaitInFlightSibling, C as withApiLimit, Co as replayWarn, Ei as getAccountInfo, Eo as requireConfigString, Es as recordAttributeIdCopy, Fl as describeFileReadFailure, G as deleteBudgetKey, Go as passedNoEchoParametersOf, Gr as reDisableInstanceApiTermination, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as ec2InstanceProtectionSite, Ht as getStackRecords, Ii as parseWebACLArn, Il as displayAssemblyPath, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Ki as accountArgs, Kr as reEnableInstanceApiTermination, Ll as renderAssemblyPathEscape, Lr as deleteSkipReason, Mo as lambdaFunctionNameForMask, Mr as unchangedBehindSecretReference, No as sameLambdaFunctionAddress, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qo as hasMaskableValues, Rl as resolveAssemblyPath, Rr as withIndeterminateGuard, S as lookupEachName, So as readConfigString, St as getNestedRevertRun, Tl as derivePartitionAndUrlSuffix, To as requireConfigObject, Tr as getCurrentResourceSecrets, Ts as physicalNameCopiesOf, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ur as isTerminationProtectionPropagationError, V as DynamoDBGlobalTableProvider, Va as refuseMalformedResourcesForDestroy, W as compensateRemovedDeletionProtection, Wr as observeThenDisableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, _i as s3BucketRegionalDomainName, _o as coerceCfnBoolean, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as configIntegerRefusal, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as DBPROXY_TAGS_WHAT, di as outputReferenceProvenanceOf, dr as readTagList, ds as recordReferenceProvenanceEntry, et as hasCdkAutoDeleteTag, fo as WARM_THROUGHPUT_MEMBERS, fr as refuseMalformedDesiredTags, fs as snapshotPassProvenance, gi as s3BucketDualStackDomainName, go as toFiniteNumber, gr as stringifyIfAssigned, gs as withoutPhysicalNameCopies, hi as s3BucketDomainName, ho as toCfnInteger, hr as definedAttributes, jo as canonicalLambdaFunctionName, jr as slowCcOperationTimeoutMs, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as isSettledInstanceState, ln as redactedDeleteAddressFields, lr as DBPROXY_TAG_OPTIONS, mc as stringifyValue, mi as s3BucketArn, mo as isWarmThroughputDecrease, mr as tagPlanWarning, nt as getPriorAttempts, or as isRefusedByName, po as coerceWarmThroughput$1, pr as tagMapAsList, ps as redactSecretsForState, q as resolveDynamoDbDeleteBudgetMs, ro as withoutSilentDropProperties, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as markDeleteStarted, t as DeployEngine, to as findSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, ur as planTagDiff, us as markSameGenerationBag, vi as s3BucketWebsiteUrl, vo as coerceCfnInteger, vs as dynamicReferenceTokens, wl as canonicalizeRegion, wo as requireConfigArray, ws as recoverMaskedOutput, x as isAccessDeniedError, xa as refuseMalformedNestedChildOutputs, xl as decodeListingKey, xo as configStringRefusal, yc as rewriteTemplateAssetReferences, yo as configBooleanRefusal, zi as passedParameterClassesOf, zr as isWaitAbandonedError } from "./deploy-engine-DOBzE5TD.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8gNXG1G.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BDm58Wc8.js";
+import { RDSProvider } from "./rds-provider-C-lGTdAb.js";
+import { NeptuneProvider } from "./neptune-provider-UDy6HC5O.js";
+import { ASGProvider } from "./asg-provider-DJdNNqDe.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -3259,6 +3259,8 @@ function isPlainBucketName(value) {
 const BUCKET_LIST_IDENTITY_ATTEMPTS = 3;
 const BUCKET_LIST_IDENTITY_DELAY_MS = 1500;
 const BUCKET_LIST_IDENTITY_BUDGET_MS = 6e3;
+const OWN_WRITE_HEAD_ATTEMPTS = 5;
+const OWN_WRITE_HEAD_DELAY_MS = 500;
 function isNoSuchBucketError(error) {
 	return error?.name === "NoSuchBucket";
 }
@@ -3324,6 +3326,15 @@ function takeOwnLeftoverBucket(logicalId) {
 	ownLeftoverBuckets.delete(key);
 	return held !== void 0 && Date.now() - held.heldAtMs <= 18e5 ? held.identity : void 0;
 }
+function isCreateTagResourceDenial(error) {
+	return error instanceof Error && error.name === "AccessDenied" && describeAwsFailure(error).detail.includes("s3:TagResource");
+}
+function isCreateTagsShapeRefusal(error) {
+	if (!(error instanceof Error)) return false;
+	if (error.name === "MalformedXML" || error.name === "NotImplemented") return true;
+	return (error.name === "InvalidArgument" || error.name === "InvalidRequest") && /\btags?\b/i.test(describeAwsFailure(error).detail);
+}
+const untaggedExplicitDeny = /* @__PURE__ */ new WeakMap();
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	createClientHolder = {};
@@ -4603,6 +4614,11 @@ var S3BucketProvider = class S3BucketProvider {
 			const canonicalRegion = canonicalizeRegion(region);
 			if (canonicalRegion !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: canonicalRegion };
 			if (declaresBucketObjectLock(properties)) createParams.ObjectLockEnabledForBucket = true;
+			if (desiredTags.length > 0) createParams.CreateBucketConfiguration = {
+				...createParams.CreateBucketConfiguration,
+				Tags: desiredTags
+			};
+			let tagsAppliedOnCreate = false;
 			const preflight = canonicalizeRegion(region) === "us-east-1" ? await this.probeBucketRegion(bucketName) : { kind: "absent" };
 			let createdNewBucket = false;
 			const createClient = await this.getCreateClient();
@@ -4628,11 +4644,40 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			try {
 				const attemptStartMs = Date.now();
-				if (!adoptedOwnLeftover) try {
-					await createClient.send(new CreateBucketCommand(createParams));
-				} catch (sendError) {
-					createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
-					throw sendError;
+				if (!adoptedOwnLeftover) {
+					let tagsSent = createParams.CreateBucketConfiguration?.Tags !== void 0;
+					try {
+						try {
+							await createClient.send(new CreateBucketCommand(createParams));
+						} catch (taggedError) {
+							const tagResourceDenied = isCreateTagResourceDenial(taggedError);
+							if (!tagsSent || !(tagResourceDenied || isCreateTagsShapeRefusal(taggedError))) throw taggedError;
+							this.logger.debug(safeMsg`CreateBucket with tags was ${tagResourceDenied ? "denied s3:TagResource" : "refused for its Tags member"} for ${displaySafe(logicalId)}; ` + `retrying without tags and applying them with PutBucketTagging`);
+							const { Tags: _omitted, ...rest } = createParams.CreateBucketConfiguration ?? {};
+							const untagged = { ...createParams };
+							if (Object.keys(rest).length > 0) untagged.CreateBucketConfiguration = rest;
+							else delete untagged.CreateBucketConfiguration;
+							tagsSent = false;
+							try {
+								await createClient.send(new CreateBucketCommand(untagged));
+							} catch (untaggedError) {
+								if (tagResourceDenied && untaggedError instanceof Error && untaggedError.name === "AccessDenied") {
+									this.logger.debug(safeMsg`CreateBucket without tags was denied too for ${displaySafe(logicalId)}; ` + `reporting the s3:TagResource denial`);
+									const untaggedText = describeAwsFailure(untaggedError).detail;
+									if (isExplicitDenyError(untaggedText) && taggedError instanceof Error) {
+										untaggedExplicitDeny.set(taggedError, explicitDenyPolicyKind(untaggedText) ?? null);
+										markNonRetryable(taggedError);
+									}
+									throw taggedError;
+								}
+								throw untaggedError;
+							}
+						}
+					} catch (sendError) {
+						createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
+						throw sendError;
+					}
+					tagsAppliedOnCreate = tagsSent && preflight.kind === "absent";
 				}
 				createdNewBucket = adoptedOwnLeftover || preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
@@ -4658,7 +4703,7 @@ var S3BucketProvider = class S3BucketProvider {
 			try {
 				effectiveOverrides = await this.applyConfiguration(bucketName, properties, {
 					...context ? { context } : {},
-					desiredTags
+					...tagsAppliedOnCreate ? { skipTags: true } : { desiredTags }
 				});
 				for (const [key, value] of await this.applyAllSubConfigsForCreate(bucketName, properties, context)) effectiveOverrides.set(key, value);
 			} catch (innerError) {
@@ -4765,7 +4810,12 @@ var S3BucketProvider = class S3BucketProvider {
 	wrapOperationError(operation, logicalId, resourceType, physicalId, error) {
 		const failure = describeAwsFailure(error);
 		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)} (${this.shown(physicalId)}): ${this.maskRaw(failure.detail)}`);
-		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${this.maskRaw(failure.summary)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		const denyKind = failure.redacted ? explicitDenyPolicyKind(failure.detail) : void 0;
+		const denyNote = failure.redacted && isExplicitDenyError(failure.detail) ? ` Refused by an explicit deny${denyKind !== void 0 ? ` (${denyKind})` : ""}, which retrying cannot clear.` : "";
+		const tagResourceNote = failure.redacted && isCreateTagResourceDenial(error) ? " Creating a bucket with tags needs s3:TagResource." : "";
+		const untaggedDenyKind = error instanceof Error ? untaggedExplicitDeny.get(error) : void 0;
+		const untaggedDenyNote = untaggedDenyKind !== void 0 ? ` The untagged retry was refused by an explicit deny${untaggedDenyKind !== null ? ` (${untaggedDenyKind})` : ""}, which retrying cannot clear.` : "";
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${this.maskRaw(failure.summary)}${denyNote}${tagResourceNote}${untaggedDenyNote}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		return failure.redacted ? markRedactedCause(wrapped) : wrapped;
 	}
 	canonicalizeDesiredProperties(resourceType, properties) {
@@ -4777,12 +4827,20 @@ var S3BucketProvider = class S3BucketProvider {
 		out = canonicalizeBlock(out, "LifecycleConfiguration", effectiveLifecycleConfiguration);
 		return out;
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		try {
+	async readCurrentState(physicalId, _logicalId, _resourceType, _properties, context) {
+		const headAttempts = context?.afterOwnWrite === true ? OWN_WRITE_HEAD_ATTEMPTS : 1;
+		for (let attempt = 1;; attempt++) try {
 			await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId }));
+			break;
 		} catch (err) {
 			const e = err;
-			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) return RESOURCE_NOT_FOUND;
+			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) {
+				if (attempt < headAttempts) {
+					await new Promise((r) => setTimeout(r, OWN_WRITE_HEAD_DELAY_MS));
+					continue;
+				}
+				return RESOURCE_NOT_FOUND;
+			}
 			throw err;
 		}
 		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
@@ -29821,6 +29879,8 @@ function customAcrLevels(acr) {
 	}));
 	return Object.keys(custom).length > 0 ? custom : void 0;
 }
+const EMAIL_RESET_CLAUSE = "reset to Cognito's default sender (EmailSendingAccount COGNITO_DEFAULT), dropping its SES SourceArn, and a redeploy will not restore it. Put the SES settings back with an UpdateUserPool that also carries the pool's other settings, since that call resets what it omits.";
+const EMAIL_RESET_BEFORE_DELETE_CLAUSE = "reset to Cognito's default sender (EmailSendingAccount COGNITO_DEFAULT), dropping its SES SourceArn, which stays that way if the delete fails.";
 const sentWithoutEmail = /* @__PURE__ */ new WeakSet();
 const createUserPoolLatch = new AmbiguousCreateLatch("CreateUserPool");
 const userPoolsCreatedByThisProcess = new RecentIdSet();
@@ -30031,6 +30091,7 @@ var CognitoUserPoolProvider = class {
 	logger = getLogger().child("CognitoUserPoolProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	preFlipPools = /* @__PURE__ */ new WeakMap();
+	emailOmittedFlips = /* @__PURE__ */ new WeakMap();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Set([
 		"UserPoolName",
 		"AutoVerifiedAttributes",
@@ -30487,10 +30548,12 @@ var CognitoUserPoolProvider = class {
 					if (bareFlip && pool.DeletionProtection !== "ACTIVE") bareFlip.ambiguous = false;
 					const resetConfirmed = bareFlip !== void 0 && !bareFlip.ambiguous;
 					if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+					if (flipRecord && this.emailOmittedFlips.has(flipRecord) && !echoesDeveloperEmail(pool) && !(bareFlip && echoesDeveloperEmail(bareFlip.pool))) this.logger.error(safeMsg`Cognito User Pool ${physicalId} is LIVE with its SES email configuration reset: ` + safeMsg`--remove-protection turned DeletionProtection off with an UpdateUserPool that left ` + safeMsg`out its DEVELOPER EmailConfiguration (sending it was refused), and the delete then ` + safeMsg`failed. The pool's email configuration was ${EMAIL_RESET_CLAUSE}`);
 					const bareLicensed = resetConfirmed && bareFlip.echoedSince !== true;
 					const readOn = pool.DeletionProtection === "ACTIVE";
 					try {
-						await this.sendEchoedDeletionProtection(physicalId, pool, "ACTIVE");
+						const emailAlreadyReset = flipRecord !== void 0 && this.emailOmittedFlips.get(flipRecord) === "definite";
+						await this.sendEchoedDeletionProtection(physicalId, pool, "ACTIVE", { emailFallback: !readOn || emailAlreadyReset });
 					} catch (echoError) {
 						let failure = echoError;
 						if (bareLicensed && isRefusedEcho(echoError)) try {
@@ -30526,8 +30589,10 @@ var CognitoUserPoolProvider = class {
 		}
 		const mode = before.UserPoolAddOns?.AdvancedSecurityMode;
 		if (mode) held.push(`AdvancedSecurityMode=${mode}`);
+		if (echoesDeveloperEmail(before)) held.push("EmailConfiguration.EmailSendingAccount=DEVELOPER (SES)");
 		const heldText = held.length > 0 ? held.join(", ") : "none of these settings";
-		const state = kind === "unclear" ? safeMsg`is LIVE and its self sign-up, Lambda triggers and advanced security MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its self sign-up, Lambda triggers and advanced security were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its self sign-up, Lambda triggers and advanced security reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
+		const what = echoesDeveloperEmail(before) ? "self sign-up, Lambda triggers, advanced security and SES email configuration" : "self sign-up, Lambda triggers and advanced security";
+		const state = kind === "unclear" ? safeMsg`is LIVE and its ${what} MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its ${what} were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its ${what} reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
 		this.logger.error(safeMsg`Cognito User Pool ${physicalId} ` + state + safeMsg` Before that write the pool held: ${heldText}. Put them back with ` + safeMsg`aws cognito-idp update-user-pool, sending the pool's complete configuration -- a ` + safeMsg`cdkd deploy will NOT restore them, because its recorded properties still match the template.`);
 	}
 	async deleteOnce(logicalId, physicalId, resourceType, context, flip) {
@@ -30592,31 +30657,38 @@ var CognitoUserPoolProvider = class {
 			throw new ProvisioningError(`Failed to delete Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async sendEchoedDeletionProtection(physicalId, pool, value) {
+	async sendEchoedDeletionProtection(physicalId, pool, value, opts = {}) {
 		try {
 			await this.getClient().send(new UpdateUserPoolCommand(userPoolDeletionProtectionUpdate(physicalId, pool, value)));
+			return "echoed";
 		} catch (echoError) {
 			if (!echoesDeveloperEmail(pool) || !isRefusedEcho(echoError)) throw echoError;
+			if (opts.emailFallback === false) throw echoError;
+			const resetClause = value === "ACTIVE" ? EMAIL_RESET_CLAUSE : EMAIL_RESET_BEFORE_DELETE_CLAUSE;
 			this.logger.debug(safeMsg`UpdateUserPool refused the SES EmailConfiguration of ${physicalId}: ${describeAwsFailure(echoError).summary}`);
 			try {
 				await this.getClient().send(new UpdateUserPoolCommand(userPoolDeletionProtectionUpdate(physicalId, pool, value, { withoutDeveloperEmail: true })));
 			} catch (resendError) {
 				if (typeof resendError === "object" && resendError !== null) sentWithoutEmail.add(resendError);
+				if (isAmbiguousWriteFailure(resendError) && (value === "ACTIVE" || isTransientCognitoFailure(resendError))) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write carrying the ` + safeMsg`pool's SES EmailConfiguration (${describeAwsFailure(echoError).summary}), and the ` + safeMsg`write re-sent without it answered ${describeAwsFailure(resendError).summary}. If ` + safeMsg`that write landed, the pool's email configuration was ${resetClause}`);
 				throw resendError;
 			}
-			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write (possibly the ` + safeMsg`pool's SES EmailConfiguration, ${describeAwsFailure(echoError).summary}), so ` + safeMsg`DeletionProtection was set to ${value} with the pool's other settings but without ` + safeMsg`that EmailConfiguration. Whether that resets the email configuration is not ` + safeMsg`measured; check it with aws cognito-idp describe-user-pool.`);
+			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write (possibly the ` + safeMsg`pool's SES EmailConfiguration, ${describeAwsFailure(echoError).summary}), so ` + safeMsg`DeletionProtection was set to ${value} with the pool's other settings but without ` + safeMsg`that EmailConfiguration. The pool's email configuration was ${resetClause}`);
+			return "without-email";
 		}
 	}
 	async disableUserPoolDeletionProtection(physicalId, pool, flip) {
 		if (this.preFlipPools.get(flip)?.ambiguous) this.preFlipPools.delete(flip);
 		const observedOn = pool.DeletionProtection === "ACTIVE";
 		try {
-			await this.sendEchoedDeletionProtection(physicalId, pool, "INACTIVE");
+			if (await this.sendEchoedDeletionProtection(physicalId, pool, "INACTIVE") === "without-email") this.emailOmittedFlips.set(flip, "definite");
+			else if (echoesDeveloperEmail(pool)) this.emailOmittedFlips.delete(flip);
 			const earlier = this.preFlipPools.get(flip);
 			if (earlier) earlier.echoedSince = true;
 			return;
 		} catch (echoError) {
 			if (echoError instanceof ResourceNotFoundException$11) throw echoError;
+			if (typeof echoError === "object" && echoError !== null && sentWithoutEmail.has(echoError) && isAmbiguousWriteFailure(echoError) && !this.emailOmittedFlips.has(flip)) this.emailOmittedFlips.set(flip, "ambiguous");
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
@@ -30663,7 +30735,7 @@ var CognitoUserPoolProvider = class {
 		const echoClause = echoError === void 0 ? "" : safeMsg`; the pool's own settings sent back were refused first (${describeAwsFailure(echoError).summary})`;
 		this.logger.debug(safeMsg`UpdateUserPool did not turn DeletionProtection off on ${physicalId}: ${describeAwsFailure(error).detail}`);
 		const refused = error instanceof Error && isAwsAuthoredFailure(error);
-		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${describeAwsFailure(error).summary})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${describeAwsFailure(error).summary})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except possibly the SES EmailConfiguration, which that write omitted.` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
+		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${describeAwsFailure(error).summary})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${describeAwsFailure(error).summary})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::Cognito::UserPool") return void 0;
@@ -46592,4 +46664,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CDzT2xg0.js.map
+//# sourceMappingURL=provider-classes-DzoIZFZK.js.map