@go-to-k/cdkd 0.300.2 → 0.301.0

package/dist/{provider-classes-DzoIZFZK.js → provider-classes-C1xbZd9k.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DFk7zr0Q.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, $a as withheldAccountClause, Ao as withRetry, At as withNestedStackContext, Br as markWaitAbandoned, Bt as awaitInFlightSibling, C as withApiLimit, Co as replayWarn, Ei as getAccountInfo, Eo as requireConfigString, Es as recordAttributeIdCopy, Fl as describeFileReadFailure, G as deleteBudgetKey, Go as passedNoEchoParametersOf, Gr as reDisableInstanceApiTermination, Gt as replacedDeleteFailureVerdict, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hr as ec2InstanceProtectionSite, Ht as getStackRecords, Ii as parseWebACLArn, Il as displayAssemblyPath, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Ki as accountArgs, Kr as reEnableInstanceApiTermination, Ll as renderAssemblyPathEscape, Lr as deleteSkipReason, Mo as lambdaFunctionNameForMask, Mr as unchangedBehindSecretReference, No as sameLambdaFunctionAddress, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qo as hasMaskableValues, Rl as resolveAssemblyPath, Rr as withIndeterminateGuard, S as lookupEachName, So as readConfigString, St as getNestedRevertRun, Tl as derivePartitionAndUrlSuffix, To as requireConfigObject, Tr as getCurrentResourceSecrets, Ts as physicalNameCopiesOf, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ur as isTerminationProtectionPropagationError, V as DynamoDBGlobalTableProvider, Va as refuseMalformedResourcesForDestroy, W as compensateRemovedDeletionProtection, Wr as observeThenDisableInstanceApiTermination, X as deleteTableWithIndexBusyRetry, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Z as waitForIndexesSettled, _i as s3BucketRegionalDomainName, _o as coerceCfnBoolean, an as getCurrentProducerRegions, ar as acquireIdempotencyToken, b as chunks, bo as configIntegerRefusal, c as isAbsoluteAssetPath, cn as isRedactedRecordedValue, cr as DBPROXY_TAGS_WHAT, di as outputReferenceProvenanceOf, dr as readTagList, ds as recordReferenceProvenanceEntry, et as hasCdkAutoDeleteTag, fo as WARM_THROUGHPUT_MEMBERS, fr as refuseMalformedDesiredTags, fs as snapshotPassProvenance, gi as s3BucketDualStackDomainName, go as toFiniteNumber, gr as stringifyIfAssigned, gs as withoutPhysicalNameCopies, hi as s3BucketDomainName, ho as toCfnInteger, hr as definedAttributes, jo as canonicalLambdaFunctionName, jr as slowCcOperationTimeoutMs, ks as carriesSecretMask, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, li as isSettledInstanceState, ln as redactedDeleteAddressFields, lr as DBPROXY_TAG_OPTIONS, mc as stringifyValue, mi as s3BucketArn, mo as isWarmThroughputDecrease, mr as tagPlanWarning, nt as getPriorAttempts, or as isRefusedByName, po as coerceWarmThroughput$1, pr as tagMapAsList, ps as redactSecretsForState, q as resolveDynamoDbDeleteBudgetMs, ro as withoutSilentDropProperties, rr as reserveStackCreateToken, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as REDACTED_DELETE_ADDRESS_SKIP_REASON, sr as markDeleteStarted, t as DeployEngine, to as findSilentDropProperties, tr as earliestDefined, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, un as redactedDeleteAddressSkip, ur as planTagDiff, us as markSameGenerationBag, vi as s3BucketWebsiteUrl, vo as coerceCfnInteger, vs as dynamicReferenceTokens, wl as canonicalizeRegion, wo as requireConfigArray, ws as recoverMaskedOutput, x as isAccessDeniedError, xa as refuseMalformedNestedChildOutputs, xl as decodeListingKey, xo as configStringRefusal, yc as rewriteTemplateAssetReferences, yo as configBooleanRefusal, zi as passedParameterClassesOf, zr as isWaitAbandonedError } from "./deploy-engine-DOBzE5TD.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C8gNXG1G.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BDm58Wc8.js";
-import { RDSProvider } from "./rds-provider-C-lGTdAb.js";
-import { NeptuneProvider } from "./neptune-provider-UDy6HC5O.js";
-import { ASGProvider } from "./asg-provider-DJdNNqDe.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Bl as renderAssemblyPathEscape, Br as deleteSkipReason, C as withApiLimit, Co as configIntegerRefusal, Dl as canonicalizeRegion, Do as requireConfigArray, Ds as recoverMaskedOutput, Eo as replayWarn, Fo as lambdaFunctionNameForMask, Fr as unchangedBehindSecretReference, G as deleteBudgetKey, Gr as ec2InstanceProtectionSite, Gt as awaitInFlightSibling, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hi as passedParameterClassesOf, Hr as isWaitAbandonedError, Ht as withNestedStackContext, Io as sameLambdaFunctionAddress, J as DELETE_INDEX_WAIT_PROCEED_NOTE, Jo as passedNoEchoParametersOf, Jr as reDisableInstanceApiTermination, K as resolveDynamoDbDeleteBudgetClock, Kr as isTerminationProtectionPropagationError, Lt as revertNestedChildFromJournal, Ms as carriesSecretMask, No as withRetry, Ol as derivePartitionAndUrlSuffix, Oo as requireConfigObject, Or as getCurrentResourceSecrets, Os as physicalNameCopiesOf, Po as canonicalLambdaFunctionName, Pr as slowCcOperationTimeoutMs, Pt as getNestedRevertRun, Q as ECR_AUTO_DELETE_IMAGES_TAG, Rl as describeFileReadFailure, S as lookupEachName, Sc as rewriteTemplateAssetReferences, So as configBooleanRefusal, To as readConfigString, U as beginDeleteWait, Ur as markWaitAbandoned, V as DynamoDBGlobalTableProvider, Vl as resolveAssemblyPath, Vr as withIndeterminateGuard, Vt as getCurrentNestedStackContext, W as compensateRemovedDeletionProtection, Wa as refuseMalformedResourcesForDestroy, X as deleteTableWithIndexBusyRetry, Xt as replacedDeleteFailureVerdict, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yi as accountArgs, Yr as reEnableInstanceApiTermination, Z as waitForIndexesSettled, _c as stringifyValue, _i as s3BucketArn, _o as isWarmThroughputDecrease, _r as tagPlanWarning, b as chunks, bi as s3BucketRegionalDomainName, bo as coerceCfnBoolean, c as isAbsoluteAssetPath, cr as acquireIdempotencyToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as DBPROXY_TAGS_WHAT, et as hasCdkAutoDeleteTag, fi as isSettledInstanceState, fn as isRedactedRecordedValue, fr as DBPROXY_TAG_OPTIONS, go as coerceWarmThroughput$1, gr as tagMapAsList, gs as redactSecretsForState, ho as WARM_THROUGHPUT_MEMBERS, hr as refuseMalformedDesiredTags, hs as snapshotPassProvenance, io as findSilentDropProperties, ir as earliestDefined, ki as getAccountInfo, ko as requireConfigString, ks as recordAttributeIdCopy, l as listNestedTemplateRows, ln as getCurrentProducerRegions, lr as isRefusedByName, mi as outputReferenceProvenanceOf, mn as redactedDeleteAddressSkip, mr as readTagList, ms as recordReferenceProvenanceEntry, no as withheldAccountClause, nt as getPriorAttempts, oo as withoutSilentDropProperties, or as reserveStackCreateToken, pn as redactedDeleteAddressFields, pr as planTagDiff, ps as markSameGenerationBag, q as resolveDynamoDbDeleteBudgetMs, qr as observeThenDisableInstanceApiTermination, qt as getStackRecords, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, t as DeployEngine, ts as hasMaskableValues, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, ur as markDeleteStarted, vi as s3BucketDomainName, vo as toCfnInteger, vr as definedAttributes, wa as refuseMalformedNestedChildOutputs, wl as decodeListingKey, wo as configStringRefusal, x as isAccessDeniedError, xi as s3BucketWebsiteUrl, xo as coerceCfnInteger, xs as dynamicReferenceTokens, yi as s3BucketDualStackDomainName, yo as toFiniteNumber, yr as stringifyIfAssigned, ys as withoutPhysicalNameCopies, zi as parseWebACLArn, zl as displayAssemblyPath } from "./deploy-engine-DEvS2r2M.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-s7oQ_V1d.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-C_kDHyxY.js";
+import { RDSProvider } from "./rds-provider-BfwQbYRR.js";
+import { NeptuneProvider } from "./neptune-provider-BWESr5fm.js";
+import { ASGProvider } from "./asg-provider-CK2nZE6B.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -4827,7 +4827,7 @@ var S3BucketProvider = class S3BucketProvider {
 		out = canonicalizeBlock(out, "LifecycleConfiguration", effectiveLifecycleConfiguration);
 		return out;
 	}
-	async readCurrentState(physicalId, _logicalId, _resourceType, _properties, context) {
+	async readCurrentState(physicalId, logicalId, _resourceType, _properties, context) {
 		const headAttempts = context?.afterOwnWrite === true ? OWN_WRITE_HEAD_ATTEMPTS : 1;
 		for (let attempt = 1;; attempt++) try {
 			await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId }));
@@ -4839,6 +4839,7 @@ var S3BucketProvider = class S3BucketProvider {
 					await new Promise((r) => setTimeout(r, OWN_WRITE_HEAD_DELAY_MS));
 					continue;
 				}
+				if (headAttempts > 1) this.logger.debug(safeMsg`HeadBucket still answered 404 after ${String(headAttempts)} attempts right after cdkd's own write; ` + safeMsg`no observed baseline is captured for ${displaySafe(logicalId)}`);
 				return RESOURCE_NOT_FOUND;
 			}
 			throw err;
@@ -14699,7 +14700,6 @@ var SSMParameterProvider = class SSMParameterProvider {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
-		const warn = (message) => this.logger.warn(mask(message));
 		const ssmTags = SSMParameterProvider.desiredSsmTags(properties["Tags"], resourceType, logicalId);
 		const debug = (message) => this.logger.debug(mask(message));
 		debug(`Creating SSM parameter ${displaySafe(logicalId)}`);
@@ -14710,7 +14710,6 @@ var SSMParameterProvider = class SSMParameterProvider {
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
-		let leftBehind = false;
 		try {
 			const putParams = {
 				Name: name,
@@ -14724,30 +14723,8 @@ var SSMParameterProvider = class SSMParameterProvider {
 			const policies = ssmPoliciesParameter(properties["Policies"]);
 			if (policies !== void 0) putParams.Policies = policies;
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
+			if (ssmTags.length > 0) putParams.Tags = ssmTags;
 			await (await this.getCreateClient()).send(new PutParameterCommand(putParams));
-			leftBehind = true;
-			try {
-				if (ssmTags.length > 0) await this.ssmClient.send(new AddTagsToResourceCommand({
-					ResourceType: "Parameter",
-					ResourceId: name,
-					Tags: ssmTags
-				}));
-			} catch (innerError) {
-				try {
-					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
-					leftBehind = false;
-					debug(`Cleaned up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}) after wiring failure`);
-				} catch (cleanupError) {
-					const deleteCommand = renderDisableCommand({
-						before: "aws ssm delete-parameter --name",
-						identifier: name,
-						maskSecrets: mask
-					});
-					const manualStep = deleteCommand ? `Outside a rollback's re-create, the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "Outside a rollback's re-create, the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
-					warn(`Failed to clean up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
-				}
-				throw markAuxiliaryFailure(innerError, logicalId);
-			}
 			debug(`Successfully created SSM parameter ${displaySafe(logicalId)}: ${displaySafe(mask(name))}`);
 			const arn = await this.buildParameterArn(name, mask);
 			return {
@@ -14760,9 +14737,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${text}`, resourceType, logicalId, void 0, cause));
-			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, name);
-			throw thrown;
+			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -15747,7 +15722,15 @@ const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
 const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
 const allocateAddressLatch = new AmbiguousCreateLatch("ec2:AllocateAddress");
 const ec2IdsCreatedByThisProcess = new RecentIdSet();
-const isUntagged = (tags) => tags === void 0 || tags.length === 0;
+const mayBeLostCreate = (tags, sent) => tags === void 0 || tags.length === 0 || sent.length > 0 && tagListsMatch(tags, sent);
+const lostCreateNoun = (what, sent, adjective) => sent.length === 0 ? `${adjective !== void 0 ? `${adjective}, ` : ""}untagged ${what}` : `${adjective !== void 0 ? `${adjective} ` : ""}${what} with no tags or exactly the template's tags`;
+function isCreateTagsDenial(error) {
+	return isNamedError(error, CREATE_TAGS_DENIAL_NAMES) && describeAwsFailure(error).detail.includes("ec2:CreateTags");
+}
+const CREATE_TAGS_DENIAL_NAMES = /* @__PURE__ */ new Set(["UnauthorizedOperation"]);
+const IDEMPOTENT_MISMATCH_NAMES = /* @__PURE__ */ new Set(["IdempotentParameterMismatch"]);
+const OWN_WRITE_READ_ATTEMPTS = 5;
+const OWN_WRITE_READ_DELAY_MS = 500;
 const ORPHAN_LIST_PAGE_SIZE$2 = 1e3;
 var EC2Provider = class {
 	ec2Client;
@@ -15902,14 +15885,14 @@ var EC2Provider = class {
 			inspect: (id) => lookup.inspect(aws, id, regionArg)
 		});
 	}
-	async reportPossibleOrphanVpcs(logicalId, cidrBlock, window, context) {
+	async reportPossibleOrphanVpcs(logicalId, cidrBlock, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateVpc",
 			listAction: "DescribeVpcs",
 			subject: `a VPC with CIDR ${log.value(cidrBlock)}`,
-			noun: "untagged VPC(s)",
+			noun: lostCreateNoun("VPC(s)", sent),
 			list: () => collectOrphanIds(async (token) => {
 				const page = await this.ec2Client.send(new DescribeVpcsCommand({
 					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
@@ -15919,18 +15902,18 @@ var EC2Provider = class {
 					items: page.Vpcs ?? [],
 					next: page.NextToken
 				};
-			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && isUntagged(vpc.Tags) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
+			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && mayBeLostCreate(vpc.Tags, sent) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-vpcs --vpc-ids ${id}${regionArg}`.render()
 		});
 	}
-	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, window, context) {
+	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateSubnet",
 			listAction: "DescribeSubnets",
 			subject: `a subnet with CIDR ${log.value(cidrBlock)} in VPC ${log.value(vpcId)}`,
-			noun: "untagged subnet(s)",
+			noun: lostCreateNoun("subnet(s)", sent),
 			afterward: "Creating it again, which fails with InvalidSubnet.Conflict while that subnet exists.",
 			list: () => collectOrphanIds(async (token) => {
 				const page = await this.ec2Client.send(new DescribeSubnetsCommand({
@@ -15945,17 +15928,17 @@ var EC2Provider = class {
 					items: page.Subnets ?? [],
 					next: page.NextToken
 				};
-			}, (subnet) => subnet.SubnetId !== void 0 && isUntagged(subnet.Tags) && subnet.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(subnet.CidrBlock) ?? subnet.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(subnet.SubnetId) ? subnet.SubnetId : void 0),
+			}, (subnet) => subnet.SubnetId !== void 0 && mayBeLostCreate(subnet.Tags, sent) && subnet.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(subnet.CidrBlock) ?? subnet.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(subnet.SubnetId) ? subnet.SubnetId : void 0),
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-subnets --subnet-ids ${id}${regionArg}`.render()
 		});
 	}
-	async reportPossibleOrphanInternetGateways(logicalId, window, context) {
+	async reportPossibleOrphanInternetGateways(logicalId, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "CreateInternetGateway",
 			listAction: "DescribeInternetGateways",
 			subject: "an internet gateway",
-			noun: "detached, untagged internet gateway(s)",
+			noun: lostCreateNoun("internet gateway(s)", sent, "detached"),
 			list: () => collectOrphanIds(async (token) => {
 				const page = await this.ec2Client.send(new DescribeInternetGatewaysCommand({
 					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
@@ -15965,23 +15948,23 @@ var EC2Provider = class {
 					items: page.InternetGateways ?? [],
 					next: page.NextToken
 				};
-			}, (igw) => igw.InternetGatewayId !== void 0 && (igw.Attachments ?? []).length === 0 && isUntagged(igw.Tags) && !ec2IdsCreatedByThisProcess.has(igw.InternetGatewayId) ? igw.InternetGatewayId : void 0),
+			}, (igw) => igw.InternetGatewayId !== void 0 && (igw.Attachments ?? []).length === 0 && mayBeLostCreate(igw.Tags, sent) && !ec2IdsCreatedByThisProcess.has(igw.InternetGatewayId) ? igw.InternetGatewayId : void 0),
 			inspect: (aws, id, regionArg) => aws`aws ec2 describe-internet-gateways --internet-gateway-ids ${id}${regionArg}`.render()
 		});
 	}
-	async reportPossibleOrphanAddresses(logicalId, input, window, context) {
+	async reportPossibleOrphanAddresses(logicalId, input, sent, window, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		await this.reportPossibleEc2Orphans(logicalId, window, log, {
 			action: "AllocateAddress",
 			listAction: "DescribeAddresses",
 			subject: `an Elastic IP address (domain ${log.value(input.Domain ?? "vpc")})`,
-			noun: "unassociated, untagged Elastic IP address(es)",
+			noun: lostCreateNoun("Elastic IP address(es)", sent, "unassociated"),
 			list: async () => {
 				const response = await this.ec2Client.send(new DescribeAddressesCommand({}));
 				const ids = [];
 				for (const address of response.Addresses ?? []) {
 					const id = address.AllocationId;
-					if (id === void 0 || (address.Domain ?? "vpc") !== (input.Domain ?? "vpc") || address.AssociationId !== void 0 || !isUntagged(address.Tags) || input.NetworkBorderGroup !== void 0 && address.NetworkBorderGroup !== input.NetworkBorderGroup || input.PublicIpv4Pool !== void 0 && address.PublicIpv4Pool !== input.PublicIpv4Pool || ec2IdsCreatedByThisProcess.has(id)) continue;
+					if (id === void 0 || (address.Domain ?? "vpc") !== (input.Domain ?? "vpc") || address.AssociationId !== void 0 || !mayBeLostCreate(address.Tags, sent) || input.NetworkBorderGroup !== void 0 && address.NetworkBorderGroup !== input.NetworkBorderGroup || input.PublicIpv4Pool !== void 0 && address.PublicIpv4Pool !== input.PublicIpv4Pool || ec2IdsCreatedByThisProcess.has(id)) continue;
 					ids.push(id);
 				}
 				return {
@@ -16197,14 +16180,16 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createVpcLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new CreateVpcCommand({
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "vpc", desiredTags, (TagSpecifications) => createClient.send(new CreateVpcCommand({
 					CidrBlock: cidrBlock,
-					InstanceTenancy: properties["InstanceTenancy"] ?? void 0
-				}));
+					InstanceTenancy: properties["InstanceTenancy"] ?? void 0,
+					...TagSpecifications && { TagSpecifications }
+				}))));
 			} catch (error) {
 				createVpcLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16212,7 +16197,7 @@ var EC2Provider = class {
 			const vpcId = response.Vpc.VpcId;
 			ec2IdsCreatedByThisProcess.add(vpcId);
 			const vpcReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, vpcReplayWindow, context);
+			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, desiredTags, vpcReplayWindow, context);
 			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -16223,7 +16208,7 @@ var EC2Provider = class {
 					VpcId: vpcId,
 					EnableDnsSupport: { Value: false }
 				}));
-				await this.applyTags(vpcId, desiredTags, logicalId);
+				if (!tagsApplied) await this.applyTags(vpcId, desiredTags, logicalId);
 				await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [vpcId] }));
 				try {
 					defaultSgId = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [{
@@ -16367,15 +16352,17 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createSubnetLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new CreateSubnetCommand({
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "subnet", desiredTags, (TagSpecifications) => createClient.send(new CreateSubnetCommand({
 					VpcId: vpcId,
 					CidrBlock: cidrBlock,
-					AvailabilityZone: properties["AvailabilityZone"] ?? void 0
-				}));
+					AvailabilityZone: properties["AvailabilityZone"] ?? void 0,
+					...TagSpecifications && { TagSpecifications }
+				}))));
 			} catch (error) {
 				createSubnetLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16383,10 +16370,10 @@ var EC2Provider = class {
 			const subnetId = response.Subnet.SubnetId;
 			ec2IdsCreatedByThisProcess.add(subnetId);
 			const subnetReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (subnetReplayWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, subnetReplayWindow, context);
+			if (subnetReplayWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, desiredTags, subnetReplayWindow, context);
 			const availabilityZone = response.Subnet.AvailabilityZone;
 			try {
-				await this.applyTags(subnetId, desiredTags, logicalId);
+				if (!tagsApplied) await this.applyTags(subnetId, desiredTags, logicalId);
 				const mapPublicIp = properties["MapPublicIpOnLaunch"];
 				if (mapPublicIp === true || mapPublicIp === "true") {
 					await this.ec2Client.send(new ModifySubnetAttributeCommand({
@@ -16537,11 +16524,12 @@ var EC2Provider = class {
 		try {
 			const createClient = await this.getCreateClient();
 			const orphanWindow = createInternetGatewayLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new CreateInternetGatewayCommand({}));
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "internet-gateway", desiredTags, (TagSpecifications) => createClient.send(new CreateInternetGatewayCommand(TagSpecifications ? { TagSpecifications } : {}))));
 			} catch (error) {
 				createInternetGatewayLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16549,8 +16537,8 @@ var EC2Provider = class {
 			const igwId = response.InternetGateway.InternetGatewayId;
 			ec2IdsCreatedByThisProcess.add(igwId);
 			const igwReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (igwReplayWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, igwReplayWindow, context);
-			await this.applyTags(igwId, desiredTags, logicalId);
+			if (igwReplayWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, desiredTags, igwReplayWindow, context);
+			if (!tagsApplied) await this.applyTags(igwId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created InternetGateway ${logicalId}: ${igwId}`);
 			return {
 				physicalId: igwId,
@@ -16616,11 +16604,15 @@ var EC2Provider = class {
 			};
 			const createClient = await this.getCreateClient();
 			const orphanWindow = allocateAddressLatch.take(logicalId);
-			if (orphanWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, orphanWindow, context);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, desiredTags, orphanWindow, context);
 			const attemptStartMs = Date.now();
 			let response;
+			let tagsApplied;
 			try {
-				response = await createClient.send(new AllocateAddressCommand(input));
+				({response, tagsApplied} = await this.sendTaggedCreate(logicalId, "elastic-ip", desiredTags, (TagSpecifications) => createClient.send(new AllocateAddressCommand(TagSpecifications ? {
+					...input,
+					TagSpecifications
+				} : input))));
 			} catch (error) {
 				allocateAddressLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
@@ -16636,8 +16628,8 @@ var EC2Provider = class {
 			}
 			ec2IdsCreatedByThisProcess.add(allocationId);
 			const eipReplayWindow = replayedSendWindow(response, attemptStartMs);
-			if (eipReplayWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, eipReplayWindow, context);
-			await this.applyTags(allocationId, desiredTags, logicalId);
+			if (eipReplayWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, desiredTags, eipReplayWindow, context);
+			if (!tagsApplied) await this.applyTags(allocationId, desiredTags, logicalId);
 			const instanceId = properties["InstanceId"];
 			if (instanceId) {
 				if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${displayIdent(instanceId)}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`.render()}`);
@@ -16825,7 +16817,8 @@ var EC2Provider = class {
 		});
 		let createdId;
 		try {
-			const natGatewayId = (await this.ec2Client.send(new CreateNatGatewayCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "natgateway", desiredTags, (TagSpecifications) => this.ec2Client.send(new CreateNatGatewayCommand({
+				...TagSpecifications && { TagSpecifications },
 				ClientToken: natGatewayToken.value,
 				SubnetId: subnetId,
 				AllocationId: properties["AllocationId"],
@@ -16834,9 +16827,10 @@ var EC2Provider = class {
 				SecondaryAllocationIds: properties["SecondaryAllocationIds"],
 				SecondaryPrivateIpAddresses: properties["SecondaryPrivateIpAddresses"],
 				SecondaryPrivateIpAddressCount: properties["SecondaryPrivateIpAddressCount"]
-			}))).NatGateway.NatGatewayId;
+			})));
+			const natGatewayId = response.NatGateway.NatGatewayId;
 			createdId = natGatewayId;
-			await this.applyTags(natGatewayId, desiredTags, logicalId);
+			if (!tagsApplied) await this.applyTags(natGatewayId, desiredTags, logicalId);
 			if (process.env["CDKD_NO_WAIT"] !== "true") {
 				this.logger.debug(`Waiting for NatGateway ${natGatewayId} to reach available state...`);
 				await waitUntilNatGatewayAvailable({
@@ -16901,11 +16895,13 @@ var EC2Provider = class {
 			logicalId
 		});
 		try {
-			const routeTableId = (await this.ec2Client.send(new CreateRouteTableCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "route-table", desiredTags, (TagSpecifications) => this.ec2Client.send(new CreateRouteTableCommand({
 				VpcId: vpcId,
-				ClientToken: routeTableToken.value
-			}))).RouteTable.RouteTableId;
-			await this.applyTags(routeTableId, desiredTags, logicalId);
+				ClientToken: routeTableToken.value,
+				...TagSpecifications && { TagSpecifications }
+			})));
+			const routeTableId = response.RouteTable.RouteTableId;
+			if (!tagsApplied) await this.applyTags(routeTableId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created RouteTable ${logicalId}: ${routeTableId}`);
 			routeTableToken.release();
 			return {
@@ -17086,11 +17082,14 @@ var EC2Provider = class {
 		if (!groupDescription) throw new ProvisioningError(`GroupDescription is required for SecurityGroup ${logicalId}`, resourceType, logicalId);
 		let leftBehindId;
 		try {
-			const groupId = (await (await this.getCreateClient()).send(new CreateSecurityGroupCommand({
+			const createClient = await this.getCreateClient();
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "security-group", desiredTags, (TagSpecifications) => createClient.send(new CreateSecurityGroupCommand({
 				GroupName: properties["GroupName"] ?? logicalId,
 				Description: groupDescription,
-				VpcId: properties["VpcId"] ?? void 0
-			}))).GroupId;
+				VpcId: properties["VpcId"] ?? void 0,
+				...TagSpecifications && { TagSpecifications }
+			})));
+			const groupId = response.GroupId;
 			try {
 				const ingressRules = properties["SecurityGroupIngress"];
 				const egressRules = properties["SecurityGroupEgress"];
@@ -17099,7 +17098,7 @@ var EC2Provider = class {
 					firstRejection ??= { error };
 				});
 				await Promise.all([
-					recordRejection(this.applyTags(groupId, desiredTags, logicalId)),
+					recordRejection(this.applyTags(groupId, tagsApplied ? [] : desiredTags, logicalId)),
 					recordRejection(this.authorizeInlineIngress(groupId, ingressRules)),
 					recordRejection(this.applyInlineEgress(groupId, egressRules))
 				]);
@@ -17621,7 +17620,8 @@ var EC2Provider = class {
 				scope: "RunInstances",
 				logicalId
 			});
-			const instance = (await this.ec2Client.send(new RunInstancesCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "instance", desiredTags, (TagSpecifications) => this.ec2Client.send(new RunInstancesCommand({
+				...TagSpecifications && { TagSpecifications },
 				ClientToken: runInstancesToken.value,
 				ImageId: imageId,
 				InstanceType: instanceType,
@@ -17644,11 +17644,12 @@ var EC2Provider = class {
 				MetadataOptions: this.buildMetadataOptions(properties),
 				CreditSpecification: this.buildCreditSpecification(properties),
 				Placement: this.buildPlacement(properties)
-			}))).Instances?.[0];
+			})));
+			const instance = response.Instances?.[0];
 			if (!instance?.InstanceId) throw new Error("No instance ID returned from RunInstances");
 			const instanceId = instance.InstanceId;
 			try {
-				await this.applyTags(instanceId, desiredTags, logicalId);
+				if (!tagsApplied) await this.applyTags(instanceId, desiredTags, logicalId);
 				if (process.env["CDKD_NO_WAIT"] !== "true") {
 					this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
 					await waitUntilInstanceRunning({
@@ -18079,11 +18080,13 @@ var EC2Provider = class {
 			logicalId
 		});
 		try {
-			const networkAclId = (await this.ec2Client.send(new CreateNetworkAclCommand({
+			const { response, tagsApplied } = await this.sendTaggedCreate(logicalId, "network-acl", desiredTags, (TagSpecifications) => this.ec2Client.send(new CreateNetworkAclCommand({
 				VpcId: vpcId,
-				ClientToken: networkAclToken.value
-			}))).NetworkAcl.NetworkAclId;
-			await this.applyTags(networkAclId, desiredTags, logicalId);
+				ClientToken: networkAclToken.value,
+				...TagSpecifications && { TagSpecifications }
+			})));
+			const networkAclId = response.NetworkAcl.NetworkAclId;
+			if (!tagsApplied) await this.applyTags(networkAclId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created NetworkAcl ${logicalId}: ${networkAclId}`);
 			networkAclToken.release();
 			return {
@@ -18233,6 +18236,45 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create SubnetNetworkAclAssociation ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	async sendTaggedCreate(logicalId, tagResourceType, tags, send) {
+		if (tags.length === 0) return {
+			response: await send(void 0),
+			tagsApplied: false
+		};
+		const tagSpecifications = [{
+			ResourceType: tagResourceType,
+			Tags: tags.map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			}))
+		}];
+		try {
+			return {
+				response: await send(tagSpecifications),
+				tagsApplied: true
+			};
+		} catch (taggedError) {
+			const tagsDenied = isCreateTagsDenial(taggedError);
+			if (!tagsDenied && !isNamedError(taggedError, IDEMPOTENT_MISMATCH_NAMES)) throw taggedError;
+			this.logger.debug(safeMsg`Create of ${logicalId} with tags was ${tagsDenied ? "denied ec2:CreateTags" : "refused for a client token an untagged create already used"}; ` + `retrying without tags and applying them with CreateTags`);
+			try {
+				return {
+					response: await send(void 0),
+					tagsApplied: false
+				};
+			} catch (untaggedError) {
+				if (!tagsDenied || !(taggedError instanceof Error) || !isNamedError(untaggedError, CREATE_TAGS_DENIAL_NAMES)) throw untaggedError;
+				this.logger.debug(safeMsg`Create of ${logicalId} without tags was denied too; reporting the ec2:CreateTags denial`);
+				const untaggedDetail = describeAwsFailure(untaggedError).detail;
+				this.logger.debug(safeMsg`Create of ${logicalId} without tags was refused: ${untaggedDetail}`);
+				const explicit = isExplicitDenyError(untaggedDetail);
+				const kind = explicit ? explicitDenyPolicyKind(untaggedDetail) : void 0;
+				taggedError.message = `${taggedError.message} The create without tags was refused too (UnauthorizedOperation)${explicit ? `; explicit deny${kind !== void 0 ? ` (${kind})` : ""}` : ""}.`;
+				if (explicit) markNonRetryable(taggedError);
+				throw taggedError;
+			}
+		}
+	}
 	async applyTags(resourceId, tags, logicalId) {
 		if (tags.length > 0) try {
 			await this.ec2Client.send(new CreateTagsCommand({
@@ -18325,6 +18367,14 @@ var EC2Provider = class {
 		return null;
 	}
 	async readCurrentState(physicalId, logicalId, resourceType, properties, context) {
+		const attempts = context?.afterOwnWrite === true ? OWN_WRITE_READ_ATTEMPTS : 1;
+		for (let attempt = 1;; attempt++) {
+			const read = await this.readCurrentStateOnce(physicalId, logicalId, resourceType, properties, context);
+			if (read !== RESOURCE_NOT_FOUND || attempt >= attempts) return read;
+			await new Promise((r) => setTimeout(r, OWN_WRITE_READ_DELAY_MS));
+		}
+	}
+	async readCurrentStateOnce(physicalId, logicalId, resourceType, properties, context) {
 		try {
 			switch (resourceType) {
 				case "AWS::EC2::VPC": return await this.readVpcCurrentState(physicalId);
@@ -37161,21 +37211,18 @@ var KinesisStreamProvider = class {
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const shardCount = streamMode === "PROVISIONED" ? Number(properties["ShardCount"] ?? 1) : void 0;
 			const maxRecordSizeInKiB = maxRecordRead.kind === "usable" ? maxRecordRead.size : void 0;
+			const tags = {};
+			for (const tag of desiredTags) tags[tag.Key] = tag.Value;
 			await this.getCreateClient().send(new CreateStreamCommand({
 				StreamName: streamName,
 				...shardCount !== void 0 && { ShardCount: shardCount },
 				StreamModeDetails: { StreamMode: streamMode },
-				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB }
+				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB },
+				...Object.keys(tags).length > 0 && { Tags: tags }
 			}));
 			streamCreated = true;
 			this.logger.debug(`CreateStream initiated for ${streamName}, waiting for ACTIVE status`);
 			const streamInfo = await this.waitForStreamActive(streamName);
-			const tags = {};
-			for (const tag of desiredTags) tags[tag.Key] = tag.Value;
-			if (Object.keys(tags).length > 0) await this.getClient().send(new AddTagsToStreamCommand({
-				StreamName: streamName,
-				Tags: tags
-			}));
 			const retentionPeriodHours = retentionRead.kind === "usable" ? retentionRead.hours : void 0;
 			if (retentionPeriodHours !== void 0 && retentionPeriodHours !== 24) {
 				this.logger.debug(`Setting retention period to ${retentionPeriodHours} hours for ${streamName}`);
@@ -46664,4 +46711,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DzoIZFZK.js.map
+//# sourceMappingURL=provider-classes-C1xbZd9k.js.map