@go-to-k/cdkd 0.301.10 → 0.301.12

package/dist/{provider-classes-B9XBsEl1.js → provider-classes-D1zpvb93.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
-import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isExplicitDenyError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isTransientServerError, ct as canonicalizeRoute53QueryName, dr as isMarkedNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, fr as isThrottlingError, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as wrapMaskedAwsError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isAmbiguousOutcomeError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as markRedactedCause, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as markNonRetryable, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isRetryableTransientError, tn as credentialFingerprint, tr as explicitDenyPolicyKind, u as clearOnUpdateRemoval, ur as THROTTLING_ERROR_NAMES, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DJmfxbko.js";
+import { B as plainIdentOr, F as displayIdent, I as displaySafe, L as displayStackName, R as isPasteableIdent, V as safeMsg, b as generateResourceName, i as safeStringify, k as SECRET_REF_MAX_CODE_POINTS, n as describeAwsFailure, o as getLogger, r as isAwsAuthoredFailure, x as generateResourceNameWithFallback } from "./aws-failure-text-YMKku1DS.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Df2XcLrn.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $i as accountArgs, Ao as replayWarn, Bl as displayAssemblyPath, Bo as sameLambdaFunctionAddress, C as getPriorAttempts, Cc as rewriteTemplateAssetReferences, Cn as awaitInFlightSibling, Co as toFiniteNumber, Dn as replacedDeleteFailureVerdict, Do as configIntegerRefusal, Dr as waitForLambdaFunctionActive, Dt as withApiLimit, Eo as configBooleanRefusal, Es as dynamicReferenceTokens, Et as lookupEachName, F as listNestedTemplateRows, Gr as isWaitAbandonedError, Hl as resolveAssemblyPath, I as renderNestedTemplateTreeDefect, Ja as refuseMalformedResourcesForDestroy, Jr as ec2InstanceProtectionSite, Jt as redactedDeleteAddressFields, Ki as passedParameterClassesOf, Kn as secretNamedAttributeNamesOf, Kr as markWaitAbandoned, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Mo as requireConfigObject, Ms as recoverMaskedOutput, N as findNestedTemplateTreeDefect, Ni as getAccountInfo, No as requireConfigString, Ns as physicalNameCopiesOf, Oa as refuseMalformedNestedChildOutputs, Ol as canonicalizeRegion, Oo as configStringRefusal, P as isAbsoluteAssetPath, Ps as recordAttributeIdCopy, Qo as passedNoEchoParametersOf, Qr as reEnableInstanceApiTermination, Ro as canonicalLambdaFunctionName, Rr as unchangedBehindSecretReference, S as isTruthyCfnBoolean, So as toCfnInteger, Tl as decodeListingKey, Tn as getStackRecords, To as coerceCfnInteger, Tt as isAccessDeniedError, Ui as parseWebACLArn, Ur as deleteSkipReason, Vl as renderAssemblyPathEscape, Wr as withIndeterminateGuard, Wt as getCurrentProducerRegions, Xr as observeThenDisableInstanceApiTermination, Yr as isTerminationProtectionPropagationError, Yt as redactedDeleteAddressSkip, Zr as reDisableInstanceApiTermination, _ as deleteTableWithIndexBusyRetry, _r as refuseMalformedDesiredTags, ai as s3BucketDomainName, as as redactForState, b as S3_AUTO_DELETE_OBJECTS_TAG, bo as coerceWarmThroughput$1, br as definedAttributes, c as DynamoDBGlobalTableProvider, ci as s3BucketWebsiteUrl, co as findSilentDropProperties, cr as reserveStackCreateToken, d as compensateRemovedDeletionProtection, dr as isRefusedByName, f as deleteBudgetKey, fr as markDeleteStarted, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as readTagList, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hr as planTagDiff, ii as s3BucketArn, is as markSameGenerationBag, jo as requireConfigArray, jr as getCurrentResourceSecrets, kl as derivePartitionAndUrlSuffix, ko as readConfigString, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mr as DBPROXY_TAG_OPTIONS, mt as withNestedStackContext, oi as s3BucketDualStackDomainName, oo as withheldAccountClause, or as earliestDefined, os as recordReferenceProvenanceEntry, ot as getNestedRevertRun, p as resolveDynamoDbDeleteBudgetClock, pi as outputReferenceProvenanceOf, pr as DBPROXY_TAGS_WHAT, pt as getCurrentNestedStackContext, qt as isRedactedRecordedValue, ri as isSettledInstanceState, si as s3BucketRegionalDomainName, ss as snapshotPassProvenance, t as DeployEngine, u as beginDeleteWait, uo as withoutSilentDropProperties, ur as acquireIdempotencyToken, us as hasMaskableValues, v as waitForIndexesSettled, vc as stringifyValue, vr as tagMapAsList, w as markRefusedBeforeApplying, wo as coerceCfnBoolean, ws as withoutPhysicalNameCopies, wt as chunks, x as hasCdkAutoDeleteTag, xo as isWarmThroughputDecrease, xr as stringifyIfAssigned, y as ECR_AUTO_DELETE_IMAGES_TAG, yo as WARM_THROUGHPUT_MEMBERS, yr as tagPlanWarning, zl as describeFileReadFailure, zo as lambdaFunctionNameForMask } from "./deploy-engine-BOHXbSq5.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-3CUpHJfg.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BGo747Co.js";
-import { RDSProvider } from "./rds-provider-CaPSidBQ.js";
-import { NeptuneProvider } from "./neptune-provider-U_LOS8jM.js";
-import { ASGProvider } from "./asg-provider-BEProOyz.js";
+import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-C_9bc6wV.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-4NDbgxK0.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-SAXkerq9.js";
+import { RDSProvider } from "./rds-provider-DUk3Oqhy.js";
+import { NeptuneProvider } from "./neptune-provider-BM-ndw-1.js";
+import { ASGProvider } from "./asg-provider-CUvV78Th.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -11909,6 +11909,13 @@ var DynamoDBTableProvider = class {
 	createClient;
 	credentialConfig;
 	logger = getLogger().child("DynamoDBTableProvider");
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}${relayedIndexBusyDelete(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Set([
 		"TableName",
 		"KeySchema",
@@ -12046,7 +12053,8 @@ var DynamoDBTableProvider = class {
 				}
 				markAuxiliaryFailure(error, logicalId);
 			}
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DynamoDB table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, tableName, error instanceof Error ? error : void 0);
+			const cause = error instanceof Error ? error : void 0;
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(maskSecrets, error, (text) => new ProvisioningError(`Failed to create DynamoDB table ${logicalId}: ${text}`, resourceType, logicalId, tableName, cause));
 			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName, createdTableId);
 			throw thrown;
 		}
@@ -12301,7 +12309,7 @@ var DynamoDBTableProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update DynamoDB table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(maskSecrets, error, (text) => new ProvisioningError(`Failed to update DynamoDB table ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -12333,6 +12341,7 @@ var DynamoDBTableProvider = class {
 	}
 	async deleteTableResource(logicalId, physicalId, resourceType, context, flip) {
 		this.logger.debug(`Deleting DynamoDB table ${logicalId}: ${physicalId}`);
+		const loopLogger = maskedLogger(this.logger, context?.maskSecrets, physicalId);
 		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
 			let observedProtectionOn = false;
@@ -12368,7 +12377,7 @@ var DynamoDBTableProvider = class {
 				physicalId,
 				typeLabel: "table",
 				maxRetries: 14,
-				logger: this.logger,
+				logger: loopLogger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
 					flip.deleteAccepted = true;
@@ -12376,14 +12385,14 @@ var DynamoDBTableProvider = class {
 				reArm: () => waitForIndexesSettled({
 					tableName: physicalId,
 					logicalId,
-					logger: this.logger,
+					logger: loopLogger,
 					describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId })),
 					...reArmPolls(),
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
 				}),
 				shouldKeepRetrying: () => {
 					if (!budget.isExhausted()) return true;
-					this.logger.warn(`DynamoDB table ${logicalId}: giving up the index-busy DeleteTable retry on ${physicalId} — the delete path has spent its whole ${Math.round(budget.totalMs / 6e4)}-minute budget. AWS's own message follows; re-running the destroy succeeds once the index is ACTIVE.`);
+					loopLogger.warn(`DynamoDB table ${logicalId}: giving up the index-busy DeleteTable retry on ${physicalId} — the delete path has spent its whole ${Math.round(budget.totalMs / 6e4)}-minute budget, so the destroy fails on AWS's refusal; re-running it succeeds once the index is ACTIVE.`);
 					return false;
 				},
 				sleepSeam: deleteTableRetryDelays
@@ -12402,7 +12411,7 @@ var DynamoDBTableProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DynamoDB table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DynamoDB table ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
@@ -28636,6 +28645,9 @@ function templateZoneVisibility(properties) {
 	if (!Array.isArray(vpcs)) return void 0;
 	return vpcs.some((v) => typeof v === "object" && v !== null && !Array.isArray(v) && !isIntrinsicOnly(v)) ? true : void 0;
 }
+function sentence$1(text) {
+	return text.endsWith(".") ? text : `${text}.`;
+}
 function isCnameConflictRefusal(error) {
 	return error instanceof Error && error.name === "InvalidChangeBatch" && isAwsAuthoredFailure(error) && /^\[?RRSet of type CNAME with DNS name \S+ is not permitted as it conflicts with other records with the same DNS name in zone \S+\]?$/.test(error.message);
 }
@@ -28664,6 +28676,13 @@ var Route53Provider = class {
 	route53Client;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("Route53Provider");
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Route53::HostedZone", /* @__PURE__ */ new Set([
 		"Name",
 		"HostedZoneConfig",
@@ -28697,16 +28716,16 @@ var Route53Provider = class {
 		});
 		return this.route53Client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::Route53::HostedZone": return this.createHostedZone(logicalId, resourceType, properties);
-			case "AWS::Route53::RecordSet": return this.createRecordSet(logicalId, resourceType, properties);
+			case "AWS::Route53::HostedZone": return this.createHostedZone(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::Route53::RecordSet": return this.createRecordSet(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
 			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -28724,7 +28743,7 @@ var Route53Provider = class {
 			default: return;
 		}
 	}
-	async createHostedZone(logicalId, resourceType, properties) {
+	async createHostedZone(logicalId, resourceType, properties, mask) {
 		this.logger.debug(`Creating Route 53 hosted zone ${logicalId}`);
 		const name = properties["Name"];
 		if (!name) throw new ProvisioningError(`Name is required for hosted zone ${logicalId}`, resourceType, logicalId);
@@ -28769,7 +28788,7 @@ var Route53Provider = class {
 					}
 				}));
 			}
-			await this.applyHostedZoneTags(zoneId, properties, logicalId);
+			await this.applyHostedZoneTags(zoneId, properties, logicalId, void 0, mask);
 			await this.applyQueryLoggingConfig(zoneId, properties, logicalId);
 			if (properties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED") try {
 				await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
@@ -28787,7 +28806,7 @@ var Route53Provider = class {
 					this.logger.warn(`Best-effort rollback DeleteHostedZone for ${zoneId} also failed: ${describeAwsFailure(deleteError).detail} — operator may need to clean up the orphan zone`);
 				}
 				const cause = uhfError instanceof Error ? uhfError : void 0;
-				throw new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${describeAwsFailure(uhfError).detail}`, resourceType, logicalId, zoneId, cause);
+				throw this.wrapCaughtError(mask, uhfError, (text) => new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${text}`, resourceType, logicalId, zoneId, cause));
 			}
 			const nameServers = response.DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully created hosted zone ${logicalId}: ${zoneId}`);
@@ -28801,7 +28820,8 @@ var Route53Provider = class {
 			};
 		} catch (error) {
 			if (zoneCreated) markAuxiliaryFailure(error, logicalId);
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const cause = error instanceof Error ? error : void 0;
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (createdZoneId !== void 0 && !zoneRolledBack) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdZoneId);
 			throw thrown;
 		}
@@ -28850,7 +28870,7 @@ var Route53Provider = class {
 			} : void 0;
 		}
 	}
-	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
 		this.logger.debug(`Updating Route 53 hosted zone ${logicalId}: ${physicalId}`);
 		try {
 			const hostedZoneConfig = properties["HostedZoneConfig"];
@@ -28859,7 +28879,7 @@ var Route53Provider = class {
 				Id: physicalId,
 				Comment: comment
 			}));
-			await this.applyHostedZoneTags(physicalId, properties, logicalId, previousProperties);
+			await this.applyHostedZoneTags(physicalId, properties, logicalId, previousProperties, mask);
 			await this.applyQueryLoggingConfig(physicalId, properties, logicalId, previousProperties);
 			await this.syncVPCAssociations(physicalId, properties, logicalId);
 			const prevEnabled = previousProperties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED";
@@ -28881,7 +28901,7 @@ var Route53Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update hosted zone ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteHostedZone(logicalId, physicalId, resourceType, context) {
@@ -28900,7 +28920,7 @@ var Route53Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const failure = error instanceof ProvisioningError ? error : this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -28959,7 +28979,7 @@ var Route53Provider = class {
 			default: return;
 		}
 	}
-	async createRecordSet(logicalId, resourceType, properties) {
+	async createRecordSet(logicalId, resourceType, properties, mask) {
 		this.logger.debug(`Creating Route 53 record set ${logicalId}`);
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType);
 		const recordName = properties["Name"];
@@ -28987,7 +29007,7 @@ var Route53Provider = class {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			const cnameConflict = isCnameConflictRefusal(error);
-			const wrapped = new ProvisioningError(`Failed to create record set ${logicalId}: ${describeAwsFailure(error).detail}` + (cnameConflict ? CNAME_CONFLICT_COLLISION_NOTE : ""), resourceType, logicalId, void 0, cause);
+			const wrapped = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create record set ${logicalId}${cnameConflict ? CNAME_CONFLICT_COLLISION_NOTE : ""}: ${text}`, resourceType, logicalId, void 0, cause));
 			throw cnameConflict ? markNameCollision(wrapped) : wrapped;
 		}
 	}
@@ -29028,7 +29048,7 @@ var Route53Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update record set ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update record set ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async findLiveRecordSet(hostedZoneId, properties) {
@@ -29118,7 +29138,7 @@ var Route53Provider = class {
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete record set ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete record set ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType) {
@@ -29212,7 +29232,7 @@ var Route53Provider = class {
 		}
 		return recordSet;
 	}
-	async applyHostedZoneTags(zoneId, properties, logicalId, previousProperties) {
+	async applyHostedZoneTags(zoneId, properties, logicalId, previousProperties, mask) {
 		const desiredRaw = properties["HostedZoneTags"];
 		if (desiredRaw != null && !Array.isArray(desiredRaw)) {
 			this.logger.warn(`AWS::Route53::HostedZone HostedZoneTags must be an array on ${logicalId}; ignoring it and leaving the live tags untouched (no tag is added or removed)`);
@@ -29240,8 +29260,12 @@ var Route53Provider = class {
 			this.logger.debug(`Applied ${tags.length} tag(s) and removed ${removeTagKeys.length} tag(s) on hosted zone ${logicalId}`);
 		} catch (error) {
 			const detail = describeAwsFailure(error).detail;
-			if (removeTagKeys.length > 0) throw new ProvisioningError(`Failed to remove tag(s) ${removeTagKeys.join(", ")} from hosted zone ${logicalId}: ${detail}. The removal will NOT be retried on the next deploy (state no longer records the tag), so it is reported instead of ignored.`, "AWS::Route53::HostedZone", logicalId, zoneId, error instanceof Error ? error : void 0);
-			this.logger.warn(`Failed to apply tags to hosted zone ${logicalId}: ${detail}`);
+			if (removeTagKeys.length > 0) {
+				const cause = error instanceof Error ? error : void 0;
+				throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to remove tag(s) ${removeTagKeys.join(", ")} from hosted zone ${logicalId}: ${sentence$1(text)} The removal will NOT be retried on the next deploy (state no longer records the tag), so it is reported instead of ignored.`, "AWS::Route53::HostedZone", logicalId, zoneId, cause));
+			}
+			const m = mask ?? ((text) => text);
+			this.logger.warn(m(`Failed to apply tags to hosted zone ${logicalId}: ${m(detail)}`));
 		}
 	}
 	readHostedZoneTags(properties) {
@@ -29366,6 +29390,8 @@ var Route53Provider = class {
 		if (typeof hostedZoneId === "string" && hostedZoneId) return hostedZoneId;
 		let lookupErrorMessage;
 		let lookupErrorCause;
+		let lookupErrorShown;
+		let lookupErrorRedacted = false;
 		const narrowing = options?.requirePrivateZone !== void 0;
 		const hostedZoneName = properties["HostedZoneName"];
 		if (typeof hostedZoneName === "string" && hostedZoneName) {
@@ -29383,8 +29409,11 @@ var Route53Provider = class {
 				const sawLaterName = zones.some((z) => normalizeRecordName(z.Name ?? "") !== normalizedName);
 				absenceIsSound = !hostedZoneName.includes("\\") && (narrowing ? sawLaterName || response.IsTruncated !== true : zones.length > 0 || response.IsTruncated !== true);
 			} catch (error) {
-				lookupErrorMessage = describeAwsFailure(error).detail;
+				const failure = describeAwsFailure(error);
+				lookupErrorMessage = failure.detail;
 				lookupErrorCause = error instanceof Error ? error : void 0;
+				lookupErrorRedacted = error instanceof Error && failure.redacted;
+				lookupErrorShown = lookupErrorRedacted ? failure.summary : failure.detail;
 				this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${lookupErrorMessage}`);
 			}
 			if (matched.length > 1 && options?.requireUnambiguousZoneName) {
@@ -29398,7 +29427,8 @@ var Route53Provider = class {
 				throw new HostedZoneNameNotFoundError(`HostedZoneName "${hostedZoneName}" matches no ${visibility}hosted zone in this account/region for ${logicalId}`, resourceType, logicalId, physicalId);
 			}
 		}
-		throw new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for ${subject.noun} ${logicalId}: ${lookupErrorMessage}` : typeof hostedZoneName === "string" && hostedZoneName ? `Could not determine whether HostedZoneName ${zoneNameShown(hostedZoneName)} exists for ${subject.noun} ${logicalIdShown(logicalId)} — the hosted-zone listing ended before the name could be resolved either way, so cdkd will not assume it is absent. ${subject.remedy}.` : `Either HostedZoneId or HostedZoneName is required for ${subject.noun} ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
+		const unresolved = new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for ${subject.noun} ${logicalId}: ${lookupErrorShown}` : typeof hostedZoneName === "string" && hostedZoneName ? `Could not determine whether HostedZoneName ${zoneNameShown(hostedZoneName)} exists for ${subject.noun} ${logicalIdShown(logicalId)} — the hosted-zone listing ended before the name could be resolved either way, so cdkd will not assume it is absent. ${subject.remedy}.` : `Either HostedZoneId or HostedZoneName is required for ${subject.noun} ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
+		throw lookupErrorMessage && lookupErrorRedacted ? markRedactedCause(unresolved) : unresolved;
 	}
 	async resolveRecordSetIdentity(physicalId, properties, options) {
 		const composite = parseRecordSetCompositeId(physicalId);
@@ -36268,6 +36298,13 @@ var KMSProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("KMSProvider");
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::KMS::Key", /* @__PURE__ */ new Set([
 		"Description",
 		"KeyPolicy",
@@ -36296,18 +36333,18 @@ var KMSProvider = class {
 		}));
 		return this.createClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::KMS::Key": return this.createKey(logicalId, resourceType, properties);
-			case "AWS::KMS::Alias": return this.createAlias(logicalId, resourceType, properties);
+			case "AWS::KMS::Key": return this.createKey(logicalId, resourceType, properties, context?.maskSecrets);
+			case "AWS::KMS::Alias": return this.createAlias(logicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.getClient().config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		switch (resourceType) {
-			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties);
-			case "AWS::KMS::Alias": return this.updateAlias(logicalId, physicalId, resourceType, properties);
+			case "AWS::KMS::Key": return this.updateKey(logicalId, physicalId, resourceType, properties, _previousProperties, context?.maskSecrets);
+			case "AWS::KMS::Alias": return this.updateAlias(logicalId, physicalId, resourceType, properties, context?.maskSecrets);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -36318,7 +36355,7 @@ var KMSProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createKey(logicalId, resourceType, properties) {
+	async createKey(logicalId, resourceType, properties, mask) {
 		this.logger.debug(`Creating KMS Key ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const description = properties["Description"];
@@ -36412,7 +36449,7 @@ var KMSProvider = class {
 				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. If the deploy then FAILS (outside a rollback's re-create), its rollback journal records the key for \`cdkd rollback --revert-failed\` to schedule its deletion; otherwise schedule it yourself with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (createdKeyId !== void 0) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
 				if (supersededPending) markSupersedesEarlierCreate(thrown);
@@ -36530,7 +36567,7 @@ var KMSProvider = class {
 		const deletion = shown.map((keyId) => aws`aws kms schedule-key-deletion --key-id ${keyId}${region} --pending-window-in-days 7`.render()).join(" ; ");
 		this.logger.warn(safeMsg`${lead}, and KMS may have created a key then that no cdkd state records. ${candidates.length} customer managed key(s) created between ${since} and ${until} match this key's settings: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them, because a key has no name or token that ties it to ${logicalId} -- another key with the same settings is indistinguishable. ${window.replayedInSend === true ? "cdkd recorded the key the create returned, so the orphan (if any) and that key both exist." : "Creating a new key now, so the orphan (if any) and the new key will both exist."} First inspect each candidate: ${inspect}. Only after confirming a key is this deploy's orphan and no other deploy uses it, schedule its deletion: ${deletion}.${incomplete}`);
 	}
-	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
 		this.logger.debug(`Updating KMS Key ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
@@ -36585,7 +36622,7 @@ var KMSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteKey(logicalId, physicalId, resourceType, properties, context) {
@@ -36605,7 +36642,7 @@ var KMSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to schedule deletion for KMS Key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to schedule deletion for KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyTagDiff(keyId, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
@@ -36632,7 +36669,7 @@ var KMSProvider = class {
 			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on KMS Key ${keyId}`);
 		}
 	}
-	async createAlias(logicalId, resourceType, properties) {
+	async createAlias(logicalId, resourceType, properties, mask) {
 		this.logger.debug(`Creating KMS Alias ${logicalId}`);
 		const aliasName = properties["AliasName"];
 		if (!aliasName) throw new ProvisioningError(`AliasName is required for KMS Alias ${logicalId}`, resourceType, logicalId);
@@ -36650,10 +36687,10 @@ var KMSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create KMS Alias ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create KMS Alias ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	async updateAlias(logicalId, physicalId, resourceType, properties) {
+	async updateAlias(logicalId, physicalId, resourceType, properties, mask) {
 		this.logger.debug(`Updating KMS Alias ${logicalId}: ${physicalId}`);
 		const targetKeyId = properties["TargetKeyId"];
 		if (!targetKeyId) throw new ProvisioningError(`TargetKeyId is required for KMS Alias update ${logicalId}`, resourceType, logicalId, physicalId);
@@ -36669,7 +36706,7 @@ var KMSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update KMS Alias ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Alias ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteAlias(logicalId, physicalId, resourceType, context) {
@@ -36685,7 +36722,7 @@ var KMSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete KMS Alias ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete KMS Alias ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
@@ -46956,4 +46993,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-B9XBsEl1.js.map
+//# sourceMappingURL=provider-classes-D1zpvb93.js.map