@go-to-k/cdkd 0.300.1 → 0.301.0

package/dist/{provider-classes-CDzT2xg0.js → provider-classes-C1xbZd9k.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isThrottlingError, ct as canonicalizeRoute53QueryName, dr as wrapMaskedAwsError, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as markNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, o as readPrincipalLists, or as THROTTLING_ERROR_NAMES, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isRetryableTransientError, sr as isMarkedNonRetryable, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, u as clearOnUpdateRemoval, ur as markRedactedCause, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DAs3w7QW.js";
+import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DFk7zr0Q.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as withheldAccountClause, Ao as withRetry, At as withNestedStackContext, Br as markWaitAbandoned, Bt as awaitInFlightSibling, C as withApiLimit, Co as replayWarn, Ei as getAccountInfo, Eo as requireConfigString, Es as recordAttributeIdCopy, Fl as describeFileReadFailure, G as deleteBudgetKey, Go as passedNoEchoParametersOf, Gr as reDisableInstanceApiTermination, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as ec2InstanceProtectionSite, Ht as getStackRecords, Ii as parseWebACLArn, Il as displayAssemblyPath, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Ki as accountArgs, Kr as reEnableInstanceApiTermination, Ll as renderAssemblyPathEscape, Lr as deleteSkipReason, Mo as lambdaFunctionNameForMask, Mr as unchangedBehindSecretReference, No as sameLambdaFunctionAddress, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qo as hasMaskableValues, Rl as resolveAssemblyPath, Rr as withIndeterminateGuard, S as lookupEachName, So as readConfigString, St as getNestedRevertRun, Tl as derivePartitionAndUrlSuffix, To as requireConfigObject, Tr as getCurrentResourceSecrets, Ts as physicalNameCopiesOf, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ur as isTerminationProtectionPropagationError, V as DynamoDBGlobalTableProvider, Va as refuseMalformedResourcesForDestroy, W as compensateRemovedDeletionProtection, Wr as observeThenDisableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, _i as s3BucketRegionalDomainName, _o as coerceCfnBoolean, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as configIntegerRefusal, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as DBPROXY_TAGS_WHAT, di as outputReferenceProvenanceOf, dr as readTagList, ds as recordReferenceProvenanceEntry, et as hasCdkAutoDeleteTag, fo as WARM_THROUGHPUT_MEMBERS, fr as refuseMalformedDesiredTags, fs as snapshotPassProvenance, gi as s3BucketDualStackDomainName, go as toFiniteNumber, gr as stringifyIfAssigned, gs as withoutPhysicalNameCopies, hi as s3BucketDomainName, ho as toCfnInteger, hr as definedAttributes, jo as canonicalLambdaFunctionName, jr as slowCcOperationTimeoutMs, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as isSettledInstanceState, ln as redactedDeleteAddressFields, lr as DBPROXY_TAG_OPTIONS, mc as stringifyValue, mi as s3BucketArn, mo as isWarmThroughputDecrease, mr as tagPlanWarning, nt as getPriorAttempts, or as isRefusedByName, po as coerceWarmThroughput$1, pr as tagMapAsList, ps as redactSecretsForState, q as resolveDynamoDbDeleteBudgetMs, ro as withoutSilentDropProperties, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as markDeleteStarted, t as DeployEngine, to as findSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, ur as planTagDiff, us as markSameGenerationBag, vi as s3BucketWebsiteUrl, vo as coerceCfnInteger, vs as dynamicReferenceTokens, wl as canonicalizeRegion, wo as requireConfigArray, ws as recoverMaskedOutput, x as isAccessDeniedError, xa as refuseMalformedNestedChildOutputs, xl as decodeListingKey, xo as configStringRefusal, yc as rewriteTemplateAssetReferences, yo as configBooleanRefusal, zi as passedParameterClassesOf, zr as isWaitAbandonedError } from "./deploy-engine-BK4gG_5A.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-SmvPHPLC.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DVPHKsxv.js";
-import { RDSProvider } from "./rds-provider-DraxDuQq.js";
-import { NeptuneProvider } from "./neptune-provider-CqZ1FaqT.js";
-import { ASGProvider } from "./asg-provider-BS5i71bK.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Bl as renderAssemblyPathEscape, Br as deleteSkipReason, C as withApiLimit, Co as configIntegerRefusal, Dl as canonicalizeRegion, Do as requireConfigArray, Ds as recoverMaskedOutput, Eo as replayWarn, Fo as lambdaFunctionNameForMask, Fr as unchangedBehindSecretReference, G as deleteBudgetKey, Gr as ec2InstanceProtectionSite, Gt as awaitInFlightSibling, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hi as passedParameterClassesOf, Hr as isWaitAbandonedError, Ht as withNestedStackContext, Io as sameLambdaFunctionAddress, J as DELETE_INDEX_WAIT_PROCEED_NOTE, Jo as passedNoEchoParametersOf, Jr as reDisableInstanceApiTermination, K as resolveDynamoDbDeleteBudgetClock, Kr as isTerminationProtectionPropagationError, Lt as revertNestedChildFromJournal, Ms as carriesSecretMask, No as withRetry, Ol as derivePartitionAndUrlSuffix, Oo as requireConfigObject, Or as getCurrentResourceSecrets, Os as physicalNameCopiesOf, Po as canonicalLambdaFunctionName, Pr as slowCcOperationTimeoutMs, Pt as getNestedRevertRun, Q as ECR_AUTO_DELETE_IMAGES_TAG, Rl as describeFileReadFailure, S as lookupEachName, Sc as rewriteTemplateAssetReferences, So as configBooleanRefusal, To as readConfigString, U as beginDeleteWait, Ur as markWaitAbandoned, V as DynamoDBGlobalTableProvider, Vl as resolveAssemblyPath, Vr as withIndeterminateGuard, Vt as getCurrentNestedStackContext, W as compensateRemovedDeletionProtection, Wa as refuseMalformedResourcesForDestroy, X as deleteTableWithIndexBusyRetry, Xt as replacedDeleteFailureVerdict, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yi as accountArgs, Yr as reEnableInstanceApiTermination, Z as waitForIndexesSettled, _c as stringifyValue, _i as s3BucketArn, _o as isWarmThroughputDecrease, _r as tagPlanWarning, b as chunks, bi as s3BucketRegionalDomainName, bo as coerceCfnBoolean, c as isAbsoluteAssetPath, cr as acquireIdempotencyToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as DBPROXY_TAGS_WHAT, et as hasCdkAutoDeleteTag, fi as isSettledInstanceState, fn as isRedactedRecordedValue, fr as DBPROXY_TAG_OPTIONS, go as coerceWarmThroughput$1, gr as tagMapAsList, gs as redactSecretsForState, ho as WARM_THROUGHPUT_MEMBERS, hr as refuseMalformedDesiredTags, hs as snapshotPassProvenance, io as findSilentDropProperties, ir as earliestDefined, ki as getAccountInfo, ko as requireConfigString, ks as recordAttributeIdCopy, l as listNestedTemplateRows, ln as getCurrentProducerRegions, lr as isRefusedByName, mi as outputReferenceProvenanceOf, mn as redactedDeleteAddressSkip, mr as readTagList, ms as recordReferenceProvenanceEntry, no as withheldAccountClause, nt as getPriorAttempts, oo as withoutSilentDropProperties, or as reserveStackCreateToken, pn as redactedDeleteAddressFields, pr as planTagDiff, ps as markSameGenerationBag, q as resolveDynamoDbDeleteBudgetMs, qr as observeThenDisableInstanceApiTermination, qt as getStackRecords, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, t as DeployEngine, ts as hasMaskableValues, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, ur as markDeleteStarted, vi as s3BucketDomainName, vo as toCfnInteger, vr as definedAttributes, wa as refuseMalformedNestedChildOutputs, wl as decodeListingKey, wo as configStringRefusal, x as isAccessDeniedError, xi as s3BucketWebsiteUrl, xo as coerceCfnInteger, xs as dynamicReferenceTokens, yi as s3BucketDualStackDomainName, yo as toFiniteNumber, yr as stringifyIfAssigned, ys as withoutPhysicalNameCopies, zi as parseWebACLArn, zl as displayAssemblyPath } from "./deploy-engine-DEvS2r2M.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-s7oQ_V1d.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-C_kDHyxY.js";
+import { RDSProvider } from "./rds-provider-BfwQbYRR.js";
+import { NeptuneProvider } from "./neptune-provider-BWESr5fm.js";
+import { ASGProvider } from "./asg-provider-CK2nZE6B.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -3259,6 +3259,8 @@ function isPlainBucketName(value) {
 const BUCKET_LIST_IDENTITY_ATTEMPTS = 3;
 const BUCKET_LIST_IDENTITY_DELAY_MS = 1500;
 const BUCKET_LIST_IDENTITY_BUDGET_MS = 6e3;
+const OWN_WRITE_HEAD_ATTEMPTS = 5;
+const OWN_WRITE_HEAD_DELAY_MS = 500;
 function isNoSuchBucketError(error) {
 	return error?.name === "NoSuchBucket";
 }
@@ -3324,6 +3326,15 @@ function takeOwnLeftoverBucket(logicalId) {
 	ownLeftoverBuckets.delete(key);
 	return held !== void 0 && Date.now() - held.heldAtMs <= 18e5 ? held.identity : void 0;
 }
+function isCreateTagResourceDenial(error) {
+	return error instanceof Error && error.name === "AccessDenied" && describeAwsFailure(error).detail.includes("s3:TagResource");
+}
+function isCreateTagsShapeRefusal(error) {
+	if (!(error instanceof Error)) return false;
+	if (error.name === "MalformedXML" || error.name === "NotImplemented") return true;
+	return (error.name === "InvalidArgument" || error.name === "InvalidRequest") && /\btags?\b/i.test(describeAwsFailure(error).detail);
+}
+const untaggedExplicitDeny = /* @__PURE__ */ new WeakMap();
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	createClientHolder = {};
@@ -4603,6 +4614,11 @@ var S3BucketProvider = class S3BucketProvider {
 			const canonicalRegion = canonicalizeRegion(region);
 			if (canonicalRegion !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: canonicalRegion };
 			if (declaresBucketObjectLock(properties)) createParams.ObjectLockEnabledForBucket = true;
+			if (desiredTags.length > 0) createParams.CreateBucketConfiguration = {
+				...createParams.CreateBucketConfiguration,
+				Tags: desiredTags
+			};
+			let tagsAppliedOnCreate = false;
 			const preflight = canonicalizeRegion(region) === "us-east-1" ? await this.probeBucketRegion(bucketName) : { kind: "absent" };
 			let createdNewBucket = false;
 			const createClient = await this.getCreateClient();
@@ -4628,11 +4644,40 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			try {
 				const attemptStartMs = Date.now();
-				if (!adoptedOwnLeftover) try {
-					await createClient.send(new CreateBucketCommand(createParams));
-				} catch (sendError) {
-					createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
-					throw sendError;
+				if (!adoptedOwnLeftover) {
+					let tagsSent = createParams.CreateBucketConfiguration?.Tags !== void 0;
+					try {
+						try {
+							await createClient.send(new CreateBucketCommand(createParams));
+						} catch (taggedError) {
+							const tagResourceDenied = isCreateTagResourceDenial(taggedError);
+							if (!tagsSent || !(tagResourceDenied || isCreateTagsShapeRefusal(taggedError))) throw taggedError;
+							this.logger.debug(safeMsg`CreateBucket with tags was ${tagResourceDenied ? "denied s3:TagResource" : "refused for its Tags member"} for ${displaySafe(logicalId)}; ` + `retrying without tags and applying them with PutBucketTagging`);
+							const { Tags: _omitted, ...rest } = createParams.CreateBucketConfiguration ?? {};
+							const untagged = { ...createParams };
+							if (Object.keys(rest).length > 0) untagged.CreateBucketConfiguration = rest;
+							else delete untagged.CreateBucketConfiguration;
+							tagsSent = false;
+							try {
+								await createClient.send(new CreateBucketCommand(untagged));
+							} catch (untaggedError) {
+								if (tagResourceDenied && untaggedError instanceof Error && untaggedError.name === "AccessDenied") {
+									this.logger.debug(safeMsg`CreateBucket without tags was denied too for ${displaySafe(logicalId)}; ` + `reporting the s3:TagResource denial`);
+									const untaggedText = describeAwsFailure(untaggedError).detail;
+									if (isExplicitDenyError(untaggedText) && taggedError instanceof Error) {
+										untaggedExplicitDeny.set(taggedError, explicitDenyPolicyKind(untaggedText) ?? null);
+										markNonRetryable(taggedError);
+									}
+									throw taggedError;
+								}
+								throw untaggedError;
+							}
+						}
+					} catch (sendError) {
+						createBucketLatch.noteFailure(logicalId, sendError, attemptStartMs, ambiguousWindow);
+						throw sendError;
+					}
+					tagsAppliedOnCreate = tagsSent && preflight.kind === "absent";
 				}
 				createdNewBucket = adoptedOwnLeftover || preflight.kind === "absent";
 				bucketLeftBehind = createdNewBucket;
@@ -4658,7 +4703,7 @@ var S3BucketProvider = class S3BucketProvider {
 			try {
 				effectiveOverrides = await this.applyConfiguration(bucketName, properties, {
 					...context ? { context } : {},
-					desiredTags
+					...tagsAppliedOnCreate ? { skipTags: true } : { desiredTags }
 				});
 				for (const [key, value] of await this.applyAllSubConfigsForCreate(bucketName, properties, context)) effectiveOverrides.set(key, value);
 			} catch (innerError) {
@@ -4765,7 +4810,12 @@ var S3BucketProvider = class S3BucketProvider {
 	wrapOperationError(operation, logicalId, resourceType, physicalId, error) {
 		const failure = describeAwsFailure(error);
 		if (failure.redacted) this.logger.debug(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)} (${this.shown(physicalId)}): ${this.maskRaw(failure.detail)}`);
-		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${this.maskRaw(failure.summary)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		const denyKind = failure.redacted ? explicitDenyPolicyKind(failure.detail) : void 0;
+		const denyNote = failure.redacted && isExplicitDenyError(failure.detail) ? ` Refused by an explicit deny${denyKind !== void 0 ? ` (${denyKind})` : ""}, which retrying cannot clear.` : "";
+		const tagResourceNote = failure.redacted && isCreateTagResourceDenial(error) ? " Creating a bucket with tags needs s3:TagResource." : "";
+		const untaggedDenyKind = error instanceof Error ? untaggedExplicitDeny.get(error) : void 0;
+		const untaggedDenyNote = untaggedDenyKind !== void 0 ? ` The untagged retry was refused by an explicit deny${untaggedDenyKind !== null ? ` (${untaggedDenyKind})` : ""}, which retrying cannot clear.` : "";
+		const wrapped = new ProvisioningError(`Failed to ${operation} S3 bucket ${displaySafe(logicalId)}: ${this.maskRaw(failure.summary)}${denyNote}${tagResourceNote}${untaggedDenyNote}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		return failure.redacted ? markRedactedCause(wrapped) : wrapped;
 	}
 	canonicalizeDesiredProperties(resourceType, properties) {
@@ -4777,12 +4827,21 @@ var S3BucketProvider = class S3BucketProvider {
 		out = canonicalizeBlock(out, "LifecycleConfiguration", effectiveLifecycleConfiguration);
 		return out;
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		try {
+	async readCurrentState(physicalId, logicalId, _resourceType, _properties, context) {
+		const headAttempts = context?.afterOwnWrite === true ? OWN_WRITE_HEAD_ATTEMPTS : 1;
+		for (let attempt = 1;; attempt++) try {
 			await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId }));
+			break;
 		} catch (err) {
 			const e = err;
-			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) return RESOURCE_NOT_FOUND;
+			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) {
+				if (attempt < headAttempts) {
+					await new Promise((r) => setTimeout(r, OWN_WRITE_HEAD_DELAY_MS));
+					continue;
+				}
+				if (headAttempts > 1) this.logger.debug(safeMsg`HeadBucket still answered 404 after ${String(headAttempts)} attempts right after cdkd's own write; ` + safeMsg`no observed baseline is captured for ${displaySafe(logicalId)}`);
+				return RESOURCE_NOT_FOUND;
+			}
 			throw err;
 		}
 		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
@@ -14641,7 +14700,6 @@ var SSMParameterProvider = class SSMParameterProvider {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
-		const warn = (message) => this.logger.warn(mask(message));
 		const ssmTags = SSMParameterProvider.desiredSsmTags(properties["Tags"], resourceType, logicalId);
 		const debug = (message) => this.logger.debug(mask(message));
 		debug(`Creating SSM parameter ${displaySafe(logicalId)}`);
@@ -14652,7 +14710,6 @@ var SSMParameterProvider = class SSMParameterProvider {
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
-		let leftBehind = false;
 		try {
 			const putParams = {
 				Name: name,
@@ -14666,30 +14723,8 @@ var SSMParameterProvider = class SSMParameterProvider {
 			const policies = ssmPoliciesParameter(properties["Policies"]);
 			if (policies !== void 0) putParams.Policies = policies;
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
+			if (ssmTags.length > 0) putParams.Tags = ssmTags;
 			await (await this.getCreateClient()).send(new PutParameterCommand(putParams));
-			leftBehind = true;
-			try {
-				if (ssmTags.length > 0) await this.ssmClient.send(new AddTagsToResourceCommand({
-					ResourceType: "Parameter",
-					ResourceId: name,
-					Tags: ssmTags
-				}));
-			} catch (innerError) {
-				try {
-					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
-					leftBehind = false;
-					debug(`Cleaned up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}) after wiring failure`);
-				} catch (cleanupError) {
-					const deleteCommand = renderDisableCommand({
-						before: "aws ssm delete-parameter --name",
-						identifier: name,
-						maskSecrets: mask
-					});
-					const manualStep = deleteCommand ? `Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "Outside a rollback's re-create, the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
-					warn(`Failed to clean up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
-				}
-				throw markAuxiliaryFailure(innerError, logicalId);
-			}
 			debug(`Successfully created SSM parameter ${displaySafe(logicalId)}: ${displaySafe(mask(name))}`);
 			const arn = await this.buildParameterArn(name, mask);
 			return {
@@ -14702,9 +14737,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${text}`, resourceType, logicalId, void 0, cause));
-			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, name);
-			throw thrown;
+			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -15689,7 +15722,15 @@ const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
 const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
 const allocateAddressLatch = new AmbiguousCreateLatch("ec2:AllocateAddress");
 const ec2IdsCreatedByThisProcess = new RecentIdSet();
-const isUntagged = (tags) => tags === void 0 || tags.length === 0;
+const mayBeLostCreate = (tags, sent) => tags === void 0 || tags.length === 0 || sent.length > 0 && tagListsMatch(tags, sent);
+const lostCreateNoun = (what, sent, adjective) => sent.length === 0 ? `${adjective !== void 0 ? `${adjective}, ` : ""}untagged ${what}` : `${adjective !== void 0 ? `${adjective} ` : ""}${what} with no tags or exactly the template's tags`;
+function isCreateTagsDenial(error) {
+	return isNamedError(error, CREATE_TAGS_DENIAL_NAMES) && describeAwsFailure(error).detail.includes("ec2:CreateTags");
+}
+const CREATE_TAGS_DENIAL_NAMES = /* @__PURE__ */ new Set(["UnauthorizedOperation"]);
+const IDEMPOTENT_MISMATCH_NAMES = /* @__PURE__ */ new Set(["IdempotentParameterMismatch"]);
+const OWN_WRITE_READ_ATTEMPTS = 5;
+const OWN_WRITE_READ_DELAY_MS = 500;
 const ORPHAN_LIST_PAGE_SIZE$2 = 1e3;
 var EC2Provider = class {
 	ec2Client;
@@ -15844,14 +15885,14 @@ var EC2Provider = class {
 			inspect: (id) => lookup.inspect(aws, id, regionArg)
 		});
 	}
-	async reportPossibleOrphanVpcs(logicalId, cidrBlock, window, context) {
+	async reportPossibleOrphanVpcs(logicalId, cidrBlock, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateVpc",
 			listAction: "DescribeVpcs",
 			subject: `a VPC with CIDR ${log.value(cidrBlock)}`,
-			noun: "untagged VPC(s)",
+			noun: lostCreateNoun("VPC(s)", sent),
 			list: () => collectOrphanIds(async (token) => {
 				const page = await this.ec2Client.send(new DescribeVpcsCommand({
 					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
@@ -15861,18 +15902,18 @@ var EC2Provider = class {
 					items: page.Vpcs ?? [],
 					next: page.NextToken
 				};
-			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && isUntagged(vpc.Tags) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
+			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && mayBeLostCreate(vpc.Tags, sent) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-vpcs --vpc-ids ${id}${regionArg}`.render()
 		});
 	}
-	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, window, context) {
+	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateSubnet",
 			listAction: "DescribeSubnets",
 			subject: `a subnet with CIDR ${log.value(cidrBlock)} in VPC ${log.value(vpcId)}`,
-			noun: "untagged subnet(s)",
+			noun: lostCreateNoun("subnet(s)", sent),
 			afterward: "Creating it again, which fails with InvalidSubnet.Conflict while that subnet exists.",
 			list: () => collectOrphanIds(async (token) => {
 				const page = await this.ec2Client.send(new DescribeSubnetsCommand({
@@ -15887,17 +15928,17 @@ var EC2Provider = class {
 					items: page.Subnets ?? [],
 					next: page.NextToken
 				};
-			}, (subnet) => subnet.SubnetId !== void 0 && isUntagged(subnet.Tags) && subnet.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(subnet.CidrBlock) ?? subnet.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(subnet.SubnetId) ? subnet.SubnetId : void 0),
+			}, (subnet) => subnet.SubnetId !== void 0 && mayBeLostCreate(subnet.Tags, sent) && subnet.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(subnet.CidrBlock) ?? subnet.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(subnet.SubnetId) ? subnet.SubnetId : void 0),
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-subnets --subnet-ids ${id}${regionArg}`.render()
 		});
 	}
-	async reportPossibleOrphanInternetGateways(logicalId, window, context) {
+	async reportPossibleOrphanInternetGateways(logicalId, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateInternetGateway",
 			listAction: "DescribeInternetGateways",
 			subject: "an internet gateway",
-			noun: "detached, untagged internet gateway(s)",
+			noun: lostCreateNoun("internet gateway(s)", sent, "detached"),
 			list: () => collectOrphanIds(async (token) => {
 				const page = await this.ec2Client.send(new DescribeInternetGatewaysCommand({
 					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
@@ -15907,23 +15948,23 @@ var EC2Provider = class {
 					items: page.InternetGateways ?? [],
 					next: page.NextToken
 				};
-			}, (igw) => igw.InternetGatewayId !== void 0 && (igw.Attachments ?? []).length === 0 && isUntagged(igw.Tags) && !ec2IdsCreatedByThisProcess.has(igw.InternetGatewayId) ? igw.InternetGatewayId : void 0),
+			}, (igw) => igw.InternetGatewayId !== void 0 && (igw.Attachments ?? []).length === 0 && mayBeLostCreate(igw.Tags, sent) && !ec2IdsCreatedByThisProcess.has(igw.InternetGatewayId) ? igw.InternetGatewayId : void 0),
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-internet-gateways --internet-gateway-ids ${id}${regionArg}`.render()
 		});
 	}
-	async reportPossibleOrphanAddresses(logicalId, input, window, context) {
+	async reportPossibleOrphanAddresses(logicalId, input, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "AllocateAddress",
 			listAction: "DescribeAddresses",
 			subject: `an Elastic IP address (domain ${log.value(input.Domain ?? "vpc")})`,
-			noun: "unassociated, untagged Elastic IP address(es)",
+			noun: lostCreateNoun("Elastic IP address(es)", sent, "unassociated"),
 			list: async () => {
 				const response = await this.ec2Client.send(new DescribeAddressesCommand({}));
 				const ids = [];
 				for (const address of response.Addresses ?? []) {
 					const id = address.AllocationId;
-					if (id === void 0 || (address.Domain ?? "vpc") !== (input.Domain ?? "vpc") || address.AssociationId !== void 0 || !isUntagged(address.Tags) || input.NetworkBorderGroup !== void 0 && address.NetworkBorderGroup !== input.NetworkBorderGroup || input.PublicIpv4Pool !== void 0 && address.PublicIpv4Pool !== input.PublicIpv4Pool || ec2IdsCreatedByThisProcess.has(id)) continue;
+					if (id === void 0 || (address.Domain ?? "vpc") !== (input.Domain ?? "vpc") || address.AssociationId !== void 0 || !mayBeLostCreate(address.Tags, sent) || input.NetworkBorderGroup !== void 0 && address.NetworkBorderGroup !== input.NetworkBorderGroup || input.PublicIpv4Pool !== void 0 && address.PublicIpv4Pool !== input.PublicIpv4Pool || ec2IdsCreatedByThisProcess.has(id)) continue;
 					ids.push(id);
 				}
 				return {
@@ -16139,14 +16180,16 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createVpcLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new CreateVpcCommand({
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "vpc", desiredTags, (TagSpecifications) => createClient.send(new CreateVpcCommand({
 					CidrBlock: cidrBlock,
-					InstanceTenancy: properties["InstanceTenancy"] ?? void 0
-				}));
+					InstanceTenancy: properties["InstanceTenancy"] ?? void 0,
+					...TagSpecifications && { TagSpecifications }
+				}))));
 			} catch (error) {
 				createVpcLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16154,7 +16197,7 @@ var EC2Provider = class {
 			const vpcId = response.Vpc.VpcId;
 			ec2IdsCreatedByThisProcess.add(vpcId);
 			const vpcReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, vpcReplayWindow, context);
+			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, vpcReplayWindow, context);
 			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -16165,7 +16208,7 @@ var EC2Provider = class {
 					VpcId: vpcId,
 					EnableDnsSupport: { Value: false }
 				}));
-				await this.applyTags(vpcId, desiredTags, logicalId);
+				if (!tagsApplied) await this.applyTags(vpcId, desiredTags, logicalId);
 				await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [vpcId] }));
 				try {
 					defaultSgId = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [{
@@ -16309,15 +16352,17 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createSubnetLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new CreateSubnetCommand({
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "subnet", desiredTags, (TagSpecifications) => createClient.send(new CreateSubnetCommand({
 					VpcId: vpcId,
 					CidrBlock: cidrBlock,
-					AvailabilityZone: properties["AvailabilityZone"] ?? void 0
-				}));
+					AvailabilityZone: properties["AvailabilityZone"] ?? void 0,
+					...TagSpecifications && { TagSpecifications }
+				}))));
 			} catch (error) {
 				createSubnetLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16325,10 +16370,10 @@ var EC2Provider = class {
 			const subnetId = response.Subnet.SubnetId;
 			ec2IdsCreatedByThisProcess.add(subnetId);
 			const subnetReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (subnetReplayWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, subnetReplayWindow, context);
+			if (subnetReplayWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, desiredTags, subnetReplayWindow, context);
 			const availabilityZone = response.Subnet.AvailabilityZone;
 			try {
-				await this.applyTags(subnetId, desiredTags, logicalId);
+				if (!tagsApplied) await this.applyTags(subnetId, desiredTags, logicalId);
 				const mapPublicIp = properties["MapPublicIpOnLaunch"];
 				if (mapPublicIp === true || mapPublicIp === "true") {
 					await this.ec2Client.send(new ModifySubnetAttributeCommand({
@@ -16479,11 +16524,12 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createInternetGatewayLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new CreateInternetGatewayCommand({}));
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "internet-gateway", desiredTags, (TagSpecifications) => createClient.send(new CreateInternetGatewayCommand(TagSpecifications ? { TagSpecifications } : {}))));
 			} catch (error) {
 				createInternetGatewayLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16491,8 +16537,8 @@ var EC2Provider = class {
 			const igwId = response.InternetGateway.InternetGatewayId;
 			ec2IdsCreatedByThisProcess.add(igwId);
 			const igwReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (igwReplayWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, igwReplayWindow, context);
-			await this.applyTags(igwId, desiredTags, logicalId);
+			if (igwReplayWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, desiredTags, igwReplayWindow, context);
+			if (!tagsApplied) await this.applyTags(igwId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created InternetGateway ${logicalId}: ${igwId}`);
 			return {
 				physicalId: igwId,
@@ -16558,11 +16604,15 @@ var EC2Provider = class {
 			};
 			const createClient = await this.getCreateClient();
 			const orphanWindow = allocateAddressLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new AllocateAddressCommand(input));
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "elastic-ip", desiredTags, (TagSpecifications) => createClient.send(new AllocateAddressCommand(TagSpecifications ? {
+					...input,
+					TagSpecifications
+				} : input))));
 			} catch (error) {
 				allocateAddressLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16578,8 +16628,8 @@ var EC2Provider = class {
 			}
 			ec2IdsCreatedByThisProcess.add(allocationId);
 			const eipReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (eipReplayWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, eipReplayWindow, context);
-			await this.applyTags(allocationId, desiredTags, logicalId);
+			if (eipReplayWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, desiredTags, eipReplayWindow, context);
+			if (!tagsApplied) await this.applyTags(allocationId, desiredTags, logicalId);
 			const instanceId = properties["InstanceId"];
 			if (instanceId) {
 				if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${displayIdent(instanceId)}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`.render()}`);
@@ -16767,7 +16817,8 @@ var EC2Provider = class {
 		});
 		let createdId;
 		try {
-			const natGatewayId = (await this.ec2Client.send(new CreateNatGatewayCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "natgateway", desiredTags, (TagSpecifications) => this.ec2Client.send(new CreateNatGatewayCommand({
+				...TagSpecifications && { TagSpecifications },
 				ClientToken: natGatewayToken.value,
 				SubnetId: subnetId,
 				AllocationId: properties["AllocationId"],
@@ -16776,9 +16827,10 @@ var EC2Provider = class {
 				SecondaryAllocationIds: properties["SecondaryAllocationIds"],
 				SecondaryPrivateIpAddresses: properties["SecondaryPrivateIpAddresses"],
 				SecondaryPrivateIpAddressCount: properties["SecondaryPrivateIpAddressCount"]
-			}))).NatGateway.NatGatewayId;
+			})));
+			const natGatewayId = response.NatGateway.NatGatewayId;
 			createdId = natGatewayId;
-			await this.applyTags(natGatewayId, desiredTags, logicalId);
+			if (!tagsApplied) await this.applyTags(natGatewayId, desiredTags, logicalId);
 			if (process.env["CDKD_NO_WAIT"] !== "true") {
 				this.logger.debug(`Waiting for NatGateway ${natGatewayId} to reach available state...`);
 				await waitUntilNatGatewayAvailable({
@@ -16843,11 +16895,13 @@ var EC2Provider = class {
 			logicalId
 		});
 		try {
-			const routeTableId = (await this.ec2Client.send(new CreateRouteTableCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "route-table", desiredTags, (TagSpecifications) => this.ec2Client.send(new CreateRouteTableCommand({
 				VpcId: vpcId,
-				ClientToken: routeTableToken.value
-			}))).RouteTable.RouteTableId;
-			await this.applyTags(routeTableId, desiredTags, logicalId);
+				ClientToken: routeTableToken.value,
+				...TagSpecifications && { TagSpecifications }
+			})));
+			const routeTableId = response.RouteTable.RouteTableId;
+			if (!tagsApplied) await this.applyTags(routeTableId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created RouteTable ${logicalId}: ${routeTableId}`);
 			routeTableToken.release();
 			return {
@@ -17028,11 +17082,14 @@ var EC2Provider = class {
 		if (!groupDescription) throw new ProvisioningError(`GroupDescription is required for SecurityGroup ${logicalId}`, resourceType, logicalId);
 		let leftBehindId;
 		try {
-			const groupId = (await (await this.getCreateClient()).send(new CreateSecurityGroupCommand({
+			const createClient = await this.getCreateClient();
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "security-group", desiredTags, (TagSpecifications) => createClient.send(new CreateSecurityGroupCommand({
 				GroupName: properties["GroupName"] ?? logicalId,
 				Description: groupDescription,
-				VpcId: properties["VpcId"] ?? void 0
-			}))).GroupId;
+				VpcId: properties["VpcId"] ?? void 0,
+				...TagSpecifications && { TagSpecifications }
+			})));
+			const groupId = response.GroupId;
 			try {
 				const ingressRules = properties["SecurityGroupIngress"];
 				const egressRules = properties["SecurityGroupEgress"];
@@ -17041,7 +17098,7 @@ var EC2Provider = class {
 					firstRejection ??= { error };
 				});
 				await Promise.all([
-					recordRejection(this.applyTags(groupId, desiredTags, logicalId)),
+					recordRejection(this.applyTags(groupId, tagsApplied ? [] : desiredTags, logicalId)),
 					recordRejection(this.authorizeInlineIngress(groupId, ingressRules)),
 					recordRejection(this.applyInlineEgress(groupId, egressRules))
 				]);
@@ -17563,7 +17620,8 @@ var EC2Provider = class {
 				scope: "RunInstances",
 				logicalId
 			});
-			const instance = (await this.ec2Client.send(new RunInstancesCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "instance", desiredTags, (TagSpecifications) => this.ec2Client.send(new RunInstancesCommand({
+				...TagSpecifications && { TagSpecifications },
 				ClientToken: runInstancesToken.value,
 				ImageId: imageId,
 				InstanceType: instanceType,
@@ -17586,11 +17644,12 @@ var EC2Provider = class {
 				MetadataOptions: this.buildMetadataOptions(properties),
 				CreditSpecification: this.buildCreditSpecification(properties),
 				Placement: this.buildPlacement(properties)
-			}))).Instances?.[0];
+			})));
+			const instance = response.Instances?.[0];
 			if (!instance?.InstanceId) throw new Error("No instance ID returned from RunInstances");
 			const instanceId = instance.InstanceId;
 			try {
-				await this.applyTags(instanceId, desiredTags, logicalId);
+				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId);
 				if (process.env["CDKD_NO_WAIT"] !== "true") {
 					this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
 					await waitUntilInstanceRunning({
@@ -18021,11 +18080,13 @@ var EC2Provider = class {
 			logicalId
 		});
 		try {
-			const networkAclId = (await this.ec2Client.send(new CreateNetworkAclCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "network-acl", desiredTags, (TagSpecifications) => this.ec2Client.send(new CreateNetworkAclCommand({
 				VpcId: vpcId,
-				ClientToken: networkAclToken.value
-			}))).NetworkAcl.NetworkAclId;
-			await this.applyTags(networkAclId, desiredTags, logicalId);
+				ClientToken: networkAclToken.value,
+				...TagSpecifications && { TagSpecifications }
+			})));
+			const networkAclId = response.NetworkAcl.NetworkAclId;
+			if (!tagsApplied) await this.applyTags(networkAclId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created NetworkAcl ${logicalId}: ${networkAclId}`);
 			networkAclToken.release();
 			return {
@@ -18175,6 +18236,45 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create SubnetNetworkAclAssociation ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	async sendTaggedCreate(logicalId, tagResourceType, tags, send) {
+		if (tags.length === 0) return {
+			response: await send(void 0),
+			tagsApplied: false
+		};
+		const tagSpecifications = [{
+			ResourceType: tagResourceType,
+			Tags: tags.map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			}))
+		}];
+		try {
+			return {
+				response: await send(tagSpecifications),
+				tagsApplied: true
+			};
+		} catch (taggedError) {
+			const tagsDenied = isCreateTagsDenial(taggedError);
+			if (!tagsDenied && !isNamedError(taggedError, IDEMPOTENT_MISMATCH_NAMES)) throw taggedError;
+			this.logger.debug(safeMsg`Create of ${logicalId} with tags was ${tagsDenied ? "denied ec2:CreateTags" : "refused for a client token an untagged create already used"}; ` + `retrying without tags and applying them with CreateTags`);
+			try {
+				return {
+					response: await send(void 0),
+					tagsApplied: false
+				};
+			} catch (untaggedError) {
+				if (!tagsDenied || !(taggedError instanceof Error) || !isNamedError(untaggedError, CREATE_TAGS_DENIAL_NAMES)) throw untaggedError;
+				this.logger.debug(safeMsg`Create of ${logicalId} without tags was denied too; reporting the ec2:CreateTags denial`);
+				const untaggedDetail = describeAwsFailure(untaggedError).detail;
+				this.logger.debug(safeMsg`Create of ${logicalId} without tags was refused: ${untaggedDetail}`);
+				const explicit = isExplicitDenyError(untaggedDetail);
+				const kind = explicit ? explicitDenyPolicyKind(untaggedDetail) : void 0;
+				taggedError.message = `${taggedError.message} The create without tags was refused too (UnauthorizedOperation)${explicit ? `; explicit deny${kind !== void 0 ? ` (${kind})` : ""}` : ""}.`;
+				if (explicit) markNonRetryable(taggedError);
+				throw taggedError;
+			}
+		}
+	}
 	async applyTags(resourceId, tags, logicalId) {
 		if (tags.length > 0) try {
 			await this.ec2Client.send(new CreateTagsCommand({
@@ -18267,6 +18367,14 @@ var EC2Provider = class {
 		return null;
 	}
 	async readCurrentState(physicalId, logicalId, resourceType, properties, context) {
+		const attempts = context?.afterOwnWrite === true ? OWN_WRITE_READ_ATTEMPTS : 1;
+		for (let attempt = 1;; attempt++) {
+			const read = await this.readCurrentStateOnce(physicalId, logicalId, resourceType, properties, context);
+			if (read !== RESOURCE_NOT_FOUND || attempt >= attempts) return read;
+			await new Promise((r) => setTimeout(r, OWN_WRITE_READ_DELAY_MS));
+		}
+	}
+	async readCurrentStateOnce(physicalId, logicalId, resourceType, properties, context) {
 		try {
 			switch (resourceType) {
 				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId);
@@ -29821,6 +29929,8 @@ function customAcrLevels(acr) {
 	}));
 	return Object.keys(custom).length > 0 ? custom : void 0;
 }
+const EMAIL_RESET_CLAUSE = "reset to Cognito's default sender (EmailSendingAccount COGNITO_DEFAULT), dropping its SES SourceArn, and a redeploy will not restore it. Put the SES settings back with an UpdateUserPool that also carries the pool's other settings, since that call resets what it omits.";
+const EMAIL_RESET_BEFORE_DELETE_CLAUSE = "reset to Cognito's default sender (EmailSendingAccount COGNITO_DEFAULT), dropping its SES SourceArn, which stays that way if the delete fails.";
 const sentWithoutEmail = /* @__PURE__ */ new WeakSet();
 const createUserPoolLatch = new AmbiguousCreateLatch("CreateUserPool");
 const userPoolsCreatedByThisProcess = new RecentIdSet();
@@ -30031,6 +30141,7 @@ var CognitoUserPoolProvider = class {
 	logger = getLogger().child("CognitoUserPoolProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	preFlipPools = /* @__PURE__ */ new WeakMap();
+	emailOmittedFlips = /* @__PURE__ */ new WeakMap();
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Set([
 		"UserPoolName",
 		"AutoVerifiedAttributes",
@@ -30487,10 +30598,12 @@ var CognitoUserPoolProvider = class {
 					if (bareFlip && pool.DeletionProtection !== "ACTIVE") bareFlip.ambiguous = false;
 					const resetConfirmed = bareFlip !== void 0 && !bareFlip.ambiguous;
 					if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+					if (flipRecord && this.emailOmittedFlips.has(flipRecord) && !echoesDeveloperEmail(pool) && !(bareFlip && echoesDeveloperEmail(bareFlip.pool))) this.logger.error(safeMsg`Cognito User Pool ${physicalId} is LIVE with its SES email configuration reset: ` + safeMsg`--remove-protection turned DeletionProtection off with an UpdateUserPool that left ` + safeMsg`out its DEVELOPER EmailConfiguration (sending it was refused), and the delete then ` + safeMsg`failed. The pool's email configuration was ${EMAIL_RESET_CLAUSE}`);
 					const bareLicensed = resetConfirmed && bareFlip.echoedSince !== true;
 					const readOn = pool.DeletionProtection === "ACTIVE";
 					try {
-						await this.sendEchoedDeletionProtection(physicalId, pool, "ACTIVE");
+						const emailAlreadyReset = flipRecord !== void 0 && this.emailOmittedFlips.get(flipRecord) === "definite";
+						await this.sendEchoedDeletionProtection(physicalId, pool, "ACTIVE", { emailFallback: !readOn || emailAlreadyReset });
 					} catch (echoError) {
 						let failure = echoError;
 						if (bareLicensed && isRefusedEcho(echoError)) try {
@@ -30526,8 +30639,10 @@ var CognitoUserPoolProvider = class {
 		}
 		const mode = before.UserPoolAddOns?.AdvancedSecurityMode;
 		if (mode) held.push(`AdvancedSecurityMode=${mode}`);
+		if (echoesDeveloperEmail(before)) held.push("EmailConfiguration.EmailSendingAccount=DEVELOPER (SES)");
 		const heldText = held.length > 0 ? held.join(", ") : "none of these settings";
-		const state = kind === "unclear" ? safeMsg`is LIVE and its self sign-up, Lambda triggers and advanced security MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its self sign-up, Lambda triggers and advanced security were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its self sign-up, Lambda triggers and advanced security reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
+		const what = echoesDeveloperEmail(before) ? "self sign-up, Lambda triggers, advanced security and SES email configuration" : "self sign-up, Lambda triggers and advanced security";
+		const state = kind === "unclear" ? safeMsg`is LIVE and its ${what} MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its ${what} were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its ${what} reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
 		this.logger.error(safeMsg`Cognito User Pool ${physicalId} ` + state + safeMsg` Before that write the pool held: ${heldText}. Put them back with ` + safeMsg`aws cognito-idp update-user-pool, sending the pool's complete configuration -- a ` + safeMsg`cdkd deploy will NOT restore them, because its recorded properties still match the template.`);
 	}
 	async deleteOnce(logicalId, physicalId, resourceType, context, flip) {
@@ -30592,31 +30707,38 @@ var CognitoUserPoolProvider = class {
 			throw new ProvisioningError(`Failed to delete Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async sendEchoedDeletionProtection(physicalId, pool, value) {
+	async sendEchoedDeletionProtection(physicalId, pool, value, opts = {}) {
 		try {
 			await this.getClient().send(new UpdateUserPoolCommand(userPoolDeletionProtectionUpdate(physicalId, pool, value)));
+			return "echoed";
 		} catch (echoError) {
 			if (!echoesDeveloperEmail(pool) || !isRefusedEcho(echoError)) throw echoError;
+			if (opts.emailFallback === false) throw echoError;
+			const resetClause = value === "ACTIVE" ? EMAIL_RESET_CLAUSE : EMAIL_RESET_BEFORE_DELETE_CLAUSE;
 			this.logger.debug(safeMsg`UpdateUserPool refused the SES EmailConfiguration of ${physicalId}: ${describeAwsFailure(echoError).summary}`);
 			try {
 				await this.getClient().send(new UpdateUserPoolCommand(userPoolDeletionProtectionUpdate(physicalId, pool, value, { withoutDeveloperEmail: true })));
 			} catch (resendError) {
 				if (typeof resendError === "object" && resendError !== null) sentWithoutEmail.add(resendError);
+				if (isAmbiguousWriteFailure(resendError) && (value === "ACTIVE" || isTransientCognitoFailure(resendError))) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write carrying the ` + safeMsg`pool's SES EmailConfiguration (${describeAwsFailure(echoError).summary}), and the ` + safeMsg`write re-sent without it answered ${describeAwsFailure(resendError).summary}. If ` + safeMsg`that write landed, the pool's email configuration was ${resetClause}`);
 				throw resendError;
 			}
-			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write (possibly the ` + safeMsg`pool's SES EmailConfiguration, ${describeAwsFailure(echoError).summary}), so ` + safeMsg`DeletionProtection was set to ${value} with the pool's other settings but without ` + safeMsg`that EmailConfiguration. Whether that resets the email configuration is not ` + safeMsg`measured; check it with aws cognito-idp describe-user-pool.`);
+			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the write (possibly the ` + safeMsg`pool's SES EmailConfiguration, ${describeAwsFailure(echoError).summary}), so ` + safeMsg`DeletionProtection was set to ${value} with the pool's other settings but without ` + safeMsg`that EmailConfiguration. The pool's email configuration was ${resetClause}`);
+			return "without-email";
 		}
 	}
 	async disableUserPoolDeletionProtection(physicalId, pool, flip) {
 		if (this.preFlipPools.get(flip)?.ambiguous) this.preFlipPools.delete(flip);
 		const observedOn = pool.DeletionProtection === "ACTIVE";
 		try {
-			await this.sendEchoedDeletionProtection(physicalId, pool, "INACTIVE");
+			if (await this.sendEchoedDeletionProtection(physicalId, pool, "INACTIVE") === "without-email") this.emailOmittedFlips.set(flip, "definite");
+			else if (echoesDeveloperEmail(pool)) this.emailOmittedFlips.delete(flip);
 			const earlier = this.preFlipPools.get(flip);
 			if (earlier) earlier.echoedSince = true;
 			return;
 		} catch (echoError) {
 			if (echoError instanceof ResourceNotFoundException$11) throw echoError;
+			if (typeof echoError === "object" && echoError !== null && sentWithoutEmail.has(echoError) && isAmbiguousWriteFailure(echoError) && !this.emailOmittedFlips.has(flip)) this.emailOmittedFlips.set(flip, "ambiguous");
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
@@ -30663,7 +30785,7 @@ var CognitoUserPoolProvider = class {
 		const echoClause = echoError === void 0 ? "" : safeMsg`; the pool's own settings sent back were refused first (${describeAwsFailure(echoError).summary})`;
 		this.logger.debug(safeMsg`UpdateUserPool did not turn DeletionProtection off on ${physicalId}: ${describeAwsFailure(error).detail}`);
 		const refused = error instanceof Error && isAwsAuthoredFailure(error);
-		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${describeAwsFailure(error).summary})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${describeAwsFailure(error).summary})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except possibly the SES EmailConfiguration, which that write omitted.` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
+		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${describeAwsFailure(error).summary})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${describeAwsFailure(error).summary})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::Cognito::UserPool") return void 0;
@@ -37089,21 +37211,18 @@ var KinesisStreamProvider = class {
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const shardCount = streamMode === "PROVISIONED" ? Number(properties["ShardCount"] ?? 1) : void 0;
 			const maxRecordSizeInKiB = maxRecordRead.kind === "usable" ? maxRecordRead.size : void 0;
+			const tags = {};
+			for (const tag of desiredTags) tags[tag.Key] = tag.Value;
 			await this.getCreateClient().send(new CreateStreamCommand({
 				StreamName: streamName,
 				...shardCount !== void 0 && { ShardCount: shardCount },
 				StreamModeDetails: { StreamMode: streamMode },
-				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB }
+				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB },
+				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			streamCreated = true;
 			this.logger.debug(`CreateStream initiated for ${streamName}, waiting for ACTIVE status`);
 			const streamInfo = await this.waitForStreamActive(streamName);
-			const tags = {};
-			for (const tag of desiredTags) tags[tag.Key] = tag.Value;
-			if (Object.keys(tags).length > 0) await this.getClient().send(new AddTagsToStreamCommand({
-				StreamName: streamName,
-				Tags: tags
-			}));
 			const retentionPeriodHours = retentionRead.kind === "usable" ? retentionRead.hours : void 0;
 			if (retentionPeriodHours !== void 0 && retentionPeriodHours !== 24) {
 				this.logger.debug(`Setting retention period to ${retentionPeriodHours} hours for ${streamName}`);
@@ -46592,4 +46711,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CDzT2xg0.js.map
+//# sourceMappingURL=provider-classes-C1xbZd9k.js.map