@go-to-k/cdkd 0.301.12 → 0.301.14

package/dist/{provider-classes-D1zpvb93.js → provider-classes-Dmz-lVVh.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
-import { B as plainIdentOr, F as displayIdent, I as displaySafe, L as displayStackName, R as isPasteableIdent, V as safeMsg, b as generateResourceName, i as safeStringify, k as SECRET_REF_MAX_CODE_POINTS, n as describeAwsFailure, o as getLogger, r as isAwsAuthoredFailure, x as generateResourceNameWithFallback } from "./aws-failure-text-YMKku1DS.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Df2XcLrn.js";
+import { A as SECRET_REF_MAX_CODE_POINTS, H as safeMsg, I as displayIdent, L as displaySafe, R as displayStackName, S as generateResourceNameWithFallback, V as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, r as describeAwsStatusReason, s as getLogger, x as generateResourceName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as markRedactedCause, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isExplicitDenyError, ct as canonicalizeRoute53QueryName, dr as isTransientServerError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as markNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as explicitDenyPolicyKind, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as isMarkedNonRetryable, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as THROTTLING_ERROR_NAMES, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isAmbiguousOutcomeError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-Dap4bLyq.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-C_9bc6wV.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-4NDbgxK0.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-SAXkerq9.js";
-import { RDSProvider } from "./rds-provider-DUk3Oqhy.js";
-import { NeptuneProvider } from "./neptune-provider-BM-ndw-1.js";
-import { ASGProvider } from "./asg-provider-CUvV78Th.js";
+import { $r as reDisableInstanceApiTermination, Aa as refuseMalformedNestedChildOutputs, Ao as configStringRefusal, Bl as renderAssemblyPathEscape, Bo as canonicalLambdaFunctionName, Br as unchangedBehindSecretReference, C as hasCdkAutoDeleteTag, Co as isWarmThroughputDecrease, Cr as stringifyIfAssigned, Dl as canonicalizeRegion, Dn as getStackRecords, Do as coerceCfnInteger, Dt as isAccessDeniedError, E as markRefusedBeforeApplying, Eo as coerceCfnBoolean, Es as withoutPhysicalNameCopies, Et as chunks, F as findNestedTemplateTreeDefect, Fi as getAccountInfo, Fo as requireConfigString, Fs as physicalNameCopiesOf, Gi as parseWebACLArn, Gr as deleteSkipReason, Ho as sameLambdaFunctionAddress, I as isAbsoluteAssetPath, Is as recordAttributeIdCopy, Ji as passedParameterClassesOf, Jn as secretNamedAttributeNamesOf, Jr as markWaitAbandoned, Jt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Kr as withIndeterminateGuard, Kt as getCurrentProducerRegions, L as listNestedTemplateRows, Mo as replayWarn, No as requireConfigArray, Nr as getCurrentResourceSecrets, Ol as derivePartitionAndUrlSuffix, Oo as configBooleanRefusal, Os as dynamicReferenceTokens, Ot as lookupEachName, Po as requireConfigObject, Ps as recoverMaskedOutput, Qr as observeThenDisableInstanceApiTermination, R as renderNestedTemplateTreeDefect, Rl as describeFileReadFailure, S as S3_AUTO_DELETE_OBJECTS_TAG, So as coerceWarmThroughput$1, Sr as definedAttributes, T as getPriorAttempts, Tc as rewriteTemplateAssetReferences, Tn as awaitInFlightSibling, To as toFiniteNumber, Vl as resolveAssemblyPath, Vo as lambdaFunctionNameForMask, Xa as refuseMalformedResourcesForDestroy, Xr as ec2InstanceProtectionSite, Xt as redactedDeleteAddressFields, Yt as isRedactedRecordedValue, Zr as isTerminationProtectionPropagationError, Zt as redactedDeleteAddressSkip, _ as deleteTableWithIndexBusyRetry, _r as planTagDiff, ai as isSettledInstanceState, b as waitForIndexesSettled, bc as stringifyValue, br as tagMapAsList, c as DynamoDBGlobalTableProvider, ci as s3BucketDualStackDomainName, co as withheldAccountClause, cr as earliestDefined, cs as recordReferenceProvenanceEntry, ct as getNestedRevertRun, d as compensateRemovedDeletionProtection, dt as revertNestedChildFromJournal, ei as reEnableInstanceApiTermination, es as passedNoEchoParametersOf, f as deleteBudgetKey, fo as withoutSilentDropProperties, fr as acquireIdempotencyToken, fs as hasMaskableValues, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as DBPROXY_TAG_OPTIONS, gt as withNestedStackContext, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as outputReferenceProvenanceOf, hr as DBPROXY_TAGS_WHAT, ht as getCurrentNestedStackContext, jo as readConfigString, kn as replacedDeleteFailureVerdict, ko as configIntegerRefusal, kr as waitForLambdaFunctionActive, kt as withApiLimit, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as s3BucketRegionalDomainName, ls as snapshotPassProvenance, m as resolveDynamoDbDeleteBudgetMs, mr as markDeleteStarted, oi as s3BucketArn, os as markSameGenerationBag, p as resolveDynamoDbDeleteBudgetClock, pr as isRefusedByName, qr as isWaitAbandonedError, si as s3BucketDomainName, ss as redactForState, t as DeployEngine, ta as accountArgs, u as beginDeleteWait, ui as s3BucketWebsiteUrl, uo as findSilentDropProperties, ur as reserveStackCreateToken, v as maskedLogger, vr as readTagList, w as isTruthyCfnBoolean, wl as decodeListingKey, wo as toCfnInteger, x as ECR_AUTO_DELETE_IMAGES_TAG, xo as WARM_THROUGHPUT_MEMBERS, xr as tagPlanWarning, y as relayedIndexBusyDelete, yr as refuseMalformedDesiredTags, zl as displayAssemblyPath, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask } from "./deploy-engine-B0ObJCy0.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CukWclVP.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-9BJEui0z.js";
+import { RDSProvider } from "./rds-provider-D0srL6Rb.js";
+import { NeptuneProvider } from "./neptune-provider-BTkMpImX.js";
+import { ASGProvider } from "./asg-provider-ak7zMqaQ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -8789,8 +8789,12 @@ var LambdaUrlProvider = class {
 	operationSinks(maskSecrets, pairs) {
 		return withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, maskSecrets), pairs);
 	}
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapMaskedError(log, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(log.mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
+		log.debug(build(log.mask(failure.detail)).message);
+		return markRedactedCause(build(`${log.mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const targetFunctionArn = properties["TargetFunctionArn"];
@@ -8821,7 +8825,7 @@ var LambdaUrlProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, targetFunctionArn, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, targetFunctionArn, cause));
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -8887,23 +8891,24 @@ var LambdaUrlProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting Lambda URL ${logicalId}: ${physicalId}`);
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const log = this.operationSinks(context?.maskSecrets, [[properties?.["TargetFunctionArn"], physicalId], [properties?.["TargetFunctionArn"], lambdaFunctionNameForMask(physicalId)]]);
+		log.debug(`Deleting Lambda URL ${logicalId}: ${physicalId}`);
 		try {
 			await this.lambdaClient.send(new DeleteFunctionUrlConfigCommand({ FunctionName: physicalId }));
-			this.logger.debug(`Successfully deleted Lambda URL ${logicalId}`);
+			log.debug(`Successfully deleted Lambda URL ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
 				const clientRegion = await this.lambdaClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Lambda URL ${physicalId} does not exist, skipping deletion`);
+				log.debug(`Lambda URL ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda URL ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete Lambda URL ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -9185,8 +9190,12 @@ var LambdaEventSourceMappingProvider = class {
 		}
 		return withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, maskSecrets), pairs);
 	}
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapMaskedError(log, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(log.mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
+		log.debug(build(log.mask(failure.detail)).message);
+		return markRedactedCause(build(`${log.mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const log = this.operationSinks(context?.maskSecrets, properties);
@@ -9257,7 +9266,7 @@ var LambdaEventSourceMappingProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create event source mapping ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create event source mapping ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async reportPossibleMappingOrphans(logicalId, window, log, functionName, sourceArn) {
@@ -9297,7 +9306,7 @@ var LambdaEventSourceMappingProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update event source mapping ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update event source mapping ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, context) {
@@ -9378,7 +9387,7 @@ var LambdaEventSourceMappingProvider = class {
 			log.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on EventSourceMapping ${arn}`);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting event source mapping ${logicalId}: ${physicalId}`);
 		try {
 			try {
@@ -9402,7 +9411,7 @@ var LambdaEventSourceMappingProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete event source mapping ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(this.operationSinks(context?.maskSecrets, properties ?? {}), error, (text) => new ProvisioningError(`Failed to delete event source mapping ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -9939,7 +9948,7 @@ var LambdaMicrovmImageProvider = class {
 	getMinResourceTimeoutMs() {
 		return this.maxPollAttempts * this.pollIntervalMs;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		this.logger.debug(`Creating MicroVM image ${logicalId}`);
 		const name = properties["Name"];
@@ -9988,7 +9997,7 @@ var LambdaMicrovmImageProvider = class {
 				})
 			};
 		} catch (error) {
-			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error, context?.maskSecrets);
 			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
 			throw thrown;
 		}
@@ -10046,7 +10055,7 @@ var LambdaMicrovmImageProvider = class {
 				})
 			};
 		} catch (error) {
-			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -10066,7 +10075,7 @@ var LambdaMicrovmImageProvider = class {
 			await this.waitForDeleted(physicalId, logicalId);
 			this.logger.debug(`Successfully deleted MicroVM image ${logicalId}`);
 		} catch (error) {
-			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -10173,10 +10182,15 @@ var LambdaMicrovmImageProvider = class {
 			Tags: tagsToAdd
 		}));
 	}
-	wrapError(operation, logicalId, resourceType, physicalId, error) {
+	wrapError(operation, logicalId, resourceType, physicalId, error, mask) {
 		if (error instanceof ProvisioningError) return error;
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`Failed to ${operation} MicroVM image ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`Failed to ${operation} MicroVM image ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 };
 const BUILD_AFFECTING_CFN_KEYS = [
@@ -10352,16 +10366,16 @@ var LambdaWebFunctionRevisionProvider = class {
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await this.reportPossibleRevisionOrphans(logicalId, replayWindow, log, input.functionName);
 			if (!createdArn || !response.revisionId) throw new ProvisioningError(`CreateWebFunctionRevision succeeded but returned no revision ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
-			const active = await this.waitForActive(input.functionName, createdArn, logicalId);
+			const active = await this.waitForActive(input.functionName, createdArn, logicalId, resourceType, log.mask);
 			return {
 				physicalId: createdArn,
 				attributes: buildAttributes$2(active)
 			};
 		} catch (error) {
-			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error, log.mask);
 			let leftBehindArn = createdArn;
 			if (leftBehindArn) try {
-				await this.delete(logicalId, leftBehindArn, resourceType);
+				await this.delete(logicalId, leftBehindArn, resourceType, void 0, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
 				leftBehindArn = void 0;
 			} catch (cleanupError) {
 				log.warn(safeMsg`Failed to delete partially-created Lambda web function revision ${logicalId}: ${describeAwsFailure(cleanupError).detail}. The failed deploy records it for \`cdkd rollback --revert-failed\`, or delete it by hand`);
@@ -10430,7 +10444,7 @@ var LambdaWebFunctionRevisionProvider = class {
 			}
 			await this.waitForGone(parts.functionArn, physicalId, logicalId);
 		} catch (error) {
-			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -10563,7 +10577,7 @@ var LambdaWebFunctionRevisionProvider = class {
 		}
 		return out;
 	}
-	async waitForActive(functionName, revisionArn, logicalId) {
+	async waitForActive(functionName, revisionArn, logicalId, resourceType, mask) {
 		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
 			const resp = await this.client.send(new GetWebFunctionRevisionCommand({
 				functionName,
@@ -10571,8 +10585,12 @@ var LambdaWebFunctionRevisionProvider = class {
 			}));
 			if (resp.state === "Active") return resp;
 			if (resp.state === "Failed") {
-				const errors = (resp.errors ?? []).map((e) => `${e.errorCode ?? ""} ${e.errorMessage ?? ""}`.trim());
-				throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}` + (errors.length > 0 ? ` (${errors.join("; ")})` : ""));
+				const errors = (resp.errors ?? []).map((e) => `${e.errorCode ?? ""} ${e.errorMessage ?? ""}`.trim()).filter((e) => e !== "");
+				const reasonText = resp.stateReason || errors.length > 0 ? `${resp.stateReason || "no reason given"}` + (errors.length > 0 ? ` (${errors.join("; ")})` : "") : void 0;
+				throw this.wrapStatusReasonError(mask, {
+					code: resp.errors?.find((e) => e.errorCode)?.errorCode,
+					message: reasonText
+				}, (text, cause) => new ProvisioningError(`Lambda web function revision ${logicalIdShown(logicalId)} entered Failed: ${text}`, resourceType, logicalId, revisionArn, cause));
 			}
 			await sleep$1(500);
 		}
@@ -10593,10 +10611,23 @@ var LambdaWebFunctionRevisionProvider = class {
 		}
 		throw new Error(`Lambda web function revision ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
 	}
-	wrapError(operation, logicalId, resourceType, physicalId, error) {
+	wrapStatusReasonError(mask, reason, build) {
+		const text = describeAwsStatusReason(reason, "no reason given");
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = mask ?? ((value) => value);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error, mask) {
 		if (error instanceof ProvisioningError) return error;
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`Failed to ${operation} Lambda web function revision ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`Failed to ${operation} Lambda web function revision ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 };
 function buildAttributes$2(resp) {
@@ -10713,13 +10744,13 @@ var LambdaWebFunctionEndpointProvider = class {
 		try {
 			createdArn = (await this.client.send(new CreateWebFunctionEndpointCommand(input))).endpointArn;
 			if (!createdArn) throw new ProvisioningError(`CreateWebFunctionEndpoint succeeded but returned no endpoint ARN for ${logicalIdShown(logicalId)}`, resourceType, logicalId);
-			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, "create");
+			const settled = await this.waitForSettled(input.functionName, input.endpointName, logicalId, resourceType, "create", void 0, context?.maskSecrets);
 			return {
 				physicalId: createdArn,
 				attributes: buildAttributes$1(settled)
 			};
 		} catch (error) {
-			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error, context?.maskSecrets);
 			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
 			throw thrown;
 		}
@@ -10753,10 +10784,10 @@ var LambdaWebFunctionEndpointProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: buildAttributes$1(await this.waitForSettled(parts.functionArn, parts.childId, logicalId, "update", input.revisionWeights))
+				attributes: buildAttributes$1(await this.waitForSettled(parts.functionArn, parts.childId, logicalId, resourceType, "update", input.revisionWeights, context?.maskSecrets, physicalId))
 			};
 		} catch (error) {
-			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -10779,7 +10810,7 @@ var LambdaWebFunctionEndpointProvider = class {
 			}
 			await this.waitForGone(parts.functionArn, parts.childId, logicalId);
 		} catch (error) {
-			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error, context?.maskSecrets);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -10876,7 +10907,7 @@ var LambdaWebFunctionEndpointProvider = class {
 			n
 		};
 	}
-	async waitForSettled(functionName, endpointName, logicalId, operation, sentWeights) {
+	async waitForSettled(functionName, endpointName, logicalId, resourceType, operation, sentWeights, mask, physicalId) {
 		for (let attempt = 1; attempt <= LAMBDA_WEB_MAX_POLL_ATTEMPTS; attempt++) {
 			let resp;
 			try {
@@ -10891,8 +10922,8 @@ var LambdaWebFunctionEndpointProvider = class {
 				}
 				throw error;
 			}
-			if (resp.state === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} entered Failed: ${resp.stateReason ?? "no reason given"}`);
-			if (resp.updateStatus === "Failed") throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} ${operation} failed: ${resp.updateStatusReason ?? "no reason given"}`);
+			if (resp.state === "Failed") throw this.wrapStatusReasonError(mask, { message: resp.stateReason }, (text, cause) => new ProvisioningError(`Lambda web function endpoint ${logicalIdShown(logicalId)} entered Failed: ${text}`, resourceType, logicalId, physicalId, cause));
+			if (resp.updateStatus === "Failed") throw this.wrapStatusReasonError(mask, { message: resp.updateStatusReason }, (text, cause) => new ProvisioningError(`Lambda web function endpoint ${logicalIdShown(logicalId)} ${operation} failed: ${text}`, resourceType, logicalId, physicalId, cause));
 			if (resp.state === "Active" && resp.updateStatus !== "InProgress" && (sentWeights === void 0 || sameWeights(sentWeights, resp.revisionWeights))) return resp;
 			await sleep$1(500);
 		}
@@ -10913,10 +10944,23 @@ var LambdaWebFunctionEndpointProvider = class {
 		}
 		throw new Error(`Lambda web function endpoint ${logicalIdShown(logicalId)} was not fully deleted within ${LAMBDA_WEB_MAX_POLL_ATTEMPTS * 500 / 1e3}s.`);
 	}
-	wrapError(operation, logicalId, resourceType, physicalId, error) {
+	wrapStatusReasonError(mask, reason, build) {
+		const text = describeAwsStatusReason(reason, "no reason given");
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = mask ?? ((value) => value);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error, mask) {
 		if (error instanceof ProvisioningError) return error;
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`Failed to ${operation} Lambda web function endpoint ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`Failed to ${operation} Lambda web function endpoint ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 };
 function readRevisionWeights(value, fail) {
@@ -15969,7 +16013,7 @@ var EC2Provider = class {
 		])],
 		["AWS::EC2::SubnetNetworkAclAssociation", /* @__PURE__ */ new Set(["SubnetId", "NetworkAclId"])]
 	]);
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::EC2::VPC", /* @__PURE__ */ new Map([["EnableDnsHostnames", false], ["EnableDnsSupport", true]])], ["AWS::EC2::Instance", /* @__PURE__ */ new Map([["Monitoring", false]])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([
 		["AWS::EC2::Instance", /* @__PURE__ */ new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
 		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
@@ -16145,7 +16189,7 @@ var EC2Provider = class {
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
 			case "AWS::EC2::SecurityGroup": return this.updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.replayingState === true, context?.recordedAttributes);
-			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NetworkAclEntry": return this.updateNetworkAclEntry(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NetworkAcl":
 			case "AWS::EC2::SubnetNetworkAclAssociation": throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS provides no in-place Update API for this EC2 sub-resource type; every property change requires Delete + Create. Re-deploy with cdkd deploy --replace, or destroy + redeploy.");
@@ -17914,9 +17958,10 @@ var EC2Provider = class {
 	isInstanceProfilePropagationError(msg) {
 		return msg.includes("Invalid IAM Instance Profile") || msg.includes("NoSuchEntity") || msg.includes("not authorized") || msg.includes("InvalidParameterValue") && msg.includes("instance profile");
 	}
-	async updateInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateInstance(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating EC2 Instance ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		this.guardTerminationProtectionRemoval(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		try {
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			await this.updateInstanceSecurityProps(physicalId, properties, previousProperties);
@@ -17931,6 +17976,14 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	guardTerminationProtectionRemoval(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		if (!(context?.removedProperties !== void 0 ? context.removedProperties.has("DisableApiTermination") : previousProperties["DisableApiTermination"] !== void 0 && properties["DisableApiTermination"] === void 0)) return;
+		if (context?.replayingState === true) {
+			if (this.coerceBool(previousProperties["DisableApiTermination"]) === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare DisableApiTermination; the rollback leaves termination protection at its current AWS value. Set DisableApiTermination to false to turn termination protection off.`);
+			return;
+		}
+		throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): DisableApiTermination was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared, and set it to false to turn termination protection off. The instance was not updated.`, resourceType, logicalId, physicalId));
+	}
 	async updateInstanceSecurityProps(physicalId, properties, previousProperties) {
 		const newDisableApiTermination = this.coerceBool(properties["DisableApiTermination"]);
 		const oldDisableApiTermination = this.coerceBool(previousProperties["DisableApiTermination"]);
@@ -19480,6 +19533,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		])]
 	]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Map([["StageName", "CFn-only convenience for inline-creating a Stage from a Deployment; declare AWS::ApiGateway::Stage explicitly to attach to this Deployment"], ["StageDescription", "CFn-only convenience for inline-creating a Stage; declare AWS::ApiGateway::Stage with the Description property instead"]])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::ApiGateway::Account", /* @__PURE__ */ new Map([["CloudWatchRoleArn", ""]])]]);
 	static MAX_IAM_RETRIES = 3;
 	static IAM_RETRY_DELAY_MS = 1e4;
 	constructor() {
@@ -19528,7 +19582,9 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 		switch (resourceType) {
-			case "AWS::ApiGateway::Account": return this.updateAccount(logicalId, physicalId, resourceType, properties, log);
+			case "AWS::ApiGateway::Account":
+				properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+				return this.updateAccount(logicalId, physicalId, resourceType, properties, log);
 			case "AWS::ApiGateway::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::ApiGateway::Resource": return this.updateResource(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::ApiGateway::Deployment": return this.updateDeployment(logicalId, physicalId, resourceType);
@@ -23397,6 +23453,14 @@ var AgentCoreEvaluatorProvider = class {
 		"KmsKeyArn",
 		"Tags"
 	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::Evaluator", /* @__PURE__ */ new Set([
+		"EvaluatorName",
+		"EvaluatorConfig",
+		"Level",
+		"Description",
+		"KmsKeyArn",
+		"Tags"
+	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.client = awsClients.bedrockAgentCoreControl;
@@ -31608,6 +31672,10 @@ var ElastiCacheProvider = class {
 //#region src/provisioning/providers/servicediscovery-provider.ts
 const PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL = 60;
 const PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL = 15;
+const CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES = 9;
+const CREATE_SERVICE_NAMESPACE_LAG_INITIAL_DELAY_MS = 500;
+const CREATE_SERVICE_NAMESPACE_LAG_MAX_DELAY_MS = 4e3;
+const CREATE_SERVICE_NAMESPACE_LAG_BACKOFF_SECONDS = Array.from({ length: CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES }, (_, i) => Math.min(CREATE_SERVICE_NAMESPACE_LAG_INITIAL_DELAY_MS * 2 ** i, CREATE_SERVICE_NAMESPACE_LAG_MAX_DELAY_MS)).reduce((a, b) => a + b, 0) / 1e3;
 const NAMESPACE_TYPES = [
 	"AWS::ServiceDiscovery::PrivateDnsNamespace",
 	"AWS::ServiceDiscovery::HttpNamespace",
@@ -31618,6 +31686,19 @@ const NAMESPACE_KIND_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::ServiceDiscovery::PublicDnsNamespace", "DNS_PUBLIC"],
 	["AWS::ServiceDiscovery::HttpNamespace", "HTTP"]
 ]);
+function sameAsRecorded(desired, recorded) {
+	if (typeof recorded === "string" && isRecordedStandIn(recorded)) return false;
+	if (Array.isArray(desired) && Array.isArray(recorded)) return desired.length === recorded.length && desired.every((item, i) => sameAsRecorded(item, recorded[i]));
+	if (desired !== null && recorded !== null && typeof desired === "object" && typeof recorded === "object" && !Array.isArray(desired) && !Array.isArray(recorded)) {
+		const d = desired;
+		const r = recorded;
+		return [.../* @__PURE__ */ new Set([...Object.keys(d), ...Object.keys(r)])].every((key) => Object.hasOwn(d, key) === Object.hasOwn(r, key) && sameAsRecorded(d[key], r[key]));
+	}
+	return isDeepStrictEqual(desired, recorded);
+}
+function isRecordedStandIn(value) {
+	return dynamicReferenceTokens(value).length > 0 || value.includes("***");
+}
 const NAMESPACE_ID_PATTERN = /^ns-[a-z0-9]{16}$/;
 const SERVICE_ID_PATTERN = /^srv-[a-z0-9]{16}$/;
 var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
@@ -31669,6 +31750,17 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			"Name",
 			"Tags",
 			"Properties"
+		])],
+		["AWS::ServiceDiscovery::Service", /* @__PURE__ */ new Set([
+			"Name",
+			"NamespaceId",
+			"Type",
+			"HealthCheckCustomConfig",
+			"Tags",
+			"ServiceAttributes",
+			"Description",
+			"DnsConfig",
+			"HealthCheckConfig"
 		])]
 	]);
 	getClient() {
@@ -31970,16 +32062,31 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		if (!name) throw new ProvisioningError(`Name is required for ServiceDiscovery Service ${logicalId}`, resourceType, logicalId);
 		let leftBehindServiceId;
 		try {
-			const service = (await client.send(new CreateServiceCommand$1({
-				Name: name,
-				...namespaceId && { NamespaceId: namespaceId },
-				...description && { Description: description },
-				...dnsConfig && { DnsConfig: dnsConfig },
-				...healthCheckCustomConfig && { HealthCheckCustomConfig: healthCheckCustomConfig },
-				...healthCheckConfig && { HealthCheckConfig: healthCheckConfig },
-				...tags.length > 0 && { Tags: tags },
-				...type && { Type: type }
-			}))).Service;
+			const watch = startInterruptWatch(`Cloud Map service ${logicalId}`);
+			let response;
+			try {
+				response = await withRetry(() => client.send(new CreateServiceCommand$1({
+					Name: name,
+					...namespaceId && { NamespaceId: namespaceId },
+					...description && { Description: description },
+					...dnsConfig && { DnsConfig: dnsConfig },
+					...healthCheckCustomConfig && { HealthCheckCustomConfig: healthCheckCustomConfig },
+					...healthCheckConfig && { HealthCheckConfig: healthCheckConfig },
+					...tags.length > 0 && { Tags: tags },
+					...type && { Type: type }
+				})), logicalId, {
+					maxRetries: CREATE_SERVICE_NAMESPACE_LAG_MAX_RETRIES,
+					initialDelayMs: CREATE_SERVICE_NAMESPACE_LAG_INITIAL_DELAY_MS,
+					maxDelayMs: CREATE_SERVICE_NAMESPACE_LAG_MAX_DELAY_MS,
+					isRetryable: (_text, error) => error instanceof NamespaceNotFound,
+					logger: this.maskedRetryLogger(maskSecrets),
+					isInterrupted: watch.isInterrupted,
+					onInterrupted: watch.onInterrupted
+				});
+			} finally {
+				watch.dispose();
+			}
+			const service = response.Service;
 			if (!service || !service.Id) throw new Error("CreateService did not return Service ID");
 			const serviceId = service.Id;
 			leftBehindServiceId = serviceId;
@@ -32023,7 +32130,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const retriedNote = error instanceof NamespaceNotFound ? ` (Cloud Map still rejected the namespace after ${CREATE_SERVICE_NAMESPACE_LAG_BACKOFF_SECONDS}s of retries)` : "";
+			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${text}${retriedNote}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindServiceId) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindServiceId);
 			throw thrown;
 		}
@@ -32032,17 +32140,14 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		const client = this.getClient();
-		const serviceChange = {};
-		if (properties["Description"] !== void 0) serviceChange.Description = properties["Description"];
-		const dnsConfig = properties["DnsConfig"];
-		if (dnsConfig?.DnsRecords !== void 0) serviceChange.DnsConfig = { DnsRecords: dnsConfig.DnsRecords };
-		if (properties["HealthCheckConfig"] !== void 0) serviceChange.HealthCheckConfig = properties["HealthCheckConfig"];
+		const servicePlan = this.planServiceChange(properties, previousProperties);
+		const serviceChange = servicePlan?.change ?? {};
 		const newAttrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
 		const oldAttrs = this.normalizeServiceAttributes(previousProperties["ServiceAttributes"]);
 		const upsertAttrs = {};
 		for (const [k, v] of Object.entries(newAttrs)) if (oldAttrs[k] !== v) upsertAttrs[k] = v;
 		const removedAttrKeys = Object.keys(oldAttrs).filter((k) => !Object.hasOwn(newAttrs, k));
-		const hasServiceChange = Object.keys(serviceChange).length > 0;
+		const hasServiceChange = servicePlan !== void 0;
 		const hasAttrUpsert = Object.keys(upsertAttrs).length > 0;
 		const hasAttrRemove = removedAttrKeys.length > 0;
 		const tagPlan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
@@ -32056,8 +32161,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				wasReplaced: false
 			};
 		}
+		let knownArn;
 		try {
 			if (hasServiceChange) {
+				if (servicePlan.keepRemovedFromLive) knownArn = await this.keepUndeclaredServiceFields(physicalId, serviceChange);
 				const operationId = (await client.send(new UpdateServiceCommand$1({
 					Id: physicalId,
 					Service: serviceChange
@@ -32094,7 +32201,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}
 			}
 			if (hasTagChange) {
-				const arn = (await client.send(new GetServiceCommand({ Id: physicalId }))).Service?.Arn;
+				const arn = knownArn ?? (await client.send(new GetServiceCommand({ Id: physicalId }))).Service?.Arn;
 				if (!arn) throw new ProvisioningError(safeMsg`Could not resolve the ARN of service discovery service ${logicalId}; its Tags were not updated`, resourceType, logicalId, physicalId);
 				if (tagPlan.remove.length > 0) await client.send(new UntagResourceCommand$16({
 					ResourceARN: arn,
@@ -32119,6 +32226,30 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to update service discovery service ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	planServiceChange(properties, previousProperties) {
+		const declaredDiffers = (key) => properties[key] !== void 0 && !sameAsRecorded(properties[key], previousProperties[key]);
+		const change = {};
+		if (properties["Description"] !== void 0) change.Description = properties["Description"];
+		const desiredRecords = properties["DnsConfig"]?.DnsRecords;
+		const previousRecords = previousProperties["DnsConfig"]?.DnsRecords;
+		if (desiredRecords !== void 0) change.DnsConfig = { DnsRecords: desiredRecords };
+		if (properties["HealthCheckConfig"] !== void 0) change.HealthCheckConfig = properties["HealthCheckConfig"];
+		if (declaredDiffers("Description") || declaredDiffers("HealthCheckConfig")) return {
+			change,
+			keepRemovedFromLive: false
+		};
+		if (desiredRecords !== void 0 && !sameAsRecorded(desiredRecords, previousRecords)) return {
+			change,
+			keepRemovedFromLive: true
+		};
+	}
+	async keepUndeclaredServiceFields(physicalId, serviceChange) {
+		if (serviceChange.Description !== void 0 && serviceChange.HealthCheckConfig !== void 0) return;
+		const live = (await this.getClient().send(new GetServiceCommand({ Id: physicalId }))).Service;
+		if (serviceChange.Description === void 0 && live?.Description !== void 0) serviceChange.Description = live.Description;
+		if (serviceChange.HealthCheckConfig === void 0 && live?.HealthCheckConfig !== void 0) serviceChange.HealthCheckConfig = live.HealthCheckConfig;
+		return live?.Arn;
+	}
 	async deleteService(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting service discovery service ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
@@ -39205,8 +39336,12 @@ var EFSProvider = class {
 		this.getClient();
 		return this.mountTargetCreateClient;
 	}
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapMaskedError(log, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(log.mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
+		log.debug(build(log.mask(failure.detail)).message);
+		return markRedactedCause(build(`${log.mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	async create(logicalId, resourceType, properties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
@@ -39278,7 +39413,7 @@ var EFSProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async updateMountTarget(logicalId, physicalId, resourceType, properties, log) {
@@ -39303,7 +39438,7 @@ var EFSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -39385,7 +39520,7 @@ var EFSProvider = class {
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (fileSystemLeftBehind && fileSystemId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, fileSystemId);
 			throw thrown;
 		}
@@ -39510,7 +39645,8 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, log) {
@@ -39549,7 +39685,7 @@ var EFSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (createdMountTargetId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdMountTargetId);
 			throw thrown;
 		}
@@ -39580,7 +39716,8 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS MountTarget ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async waitForMountTargetDeleted(mountTargetId, logicalId) {
@@ -39648,7 +39785,7 @@ var EFSProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async createOrAdoptAccessPoint(logicalId, resourceType, log, input) {
@@ -39709,7 +39846,8 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS AccessPoint ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to delete EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
@@ -39986,6 +40124,21 @@ var FSxFileSystemProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$3;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$3;
 	}
+	wrapStatusReasonError(mask, message, build) {
+		const text = describeAwsStatusReason({ message }, "no failure details reported");
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::FSx::FileSystem", /* @__PURE__ */ new Set([
 		"BackupId",
 		"FileSystemType",
@@ -40019,7 +40172,7 @@ var FSxFileSystemProvider = class {
 	getMinResourceTimeoutMs() {
 		return this.maxWaitMs;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		if (resourceType !== "AWS::FSx::FileSystem") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		const backupId = properties["BackupId"];
@@ -40085,7 +40238,7 @@ var FSxFileSystemProvider = class {
 				throw markNonRetryable(new ProvisioningError(safeMsg`FSx answered the create of ${logicalId} with file system ${returnedId}, which ${createdAt === void 0 ? "carries no creation time" : "predates this create"}: the create token cdkd derives for this stack's file system is held by it, and it is NOT recorded in cdkd state. It is not one this deploy, or an interrupted earlier deploy of this stack, made: it was created under this token by an earlier cdkd version, or a completed deploy recorded it and cdkd later let go of it, and it may hold data, so cdkd neither records nor deletes it. Inspect it with: ${inspect} --file-system-ids ${returnedId} -- then import it into this stack, or delete it once you are sure its data is not needed, and deploy again.`, resourceType, logicalId));
 			}
 			fileSystemId = returnedId;
-			const fs = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType);
+			const fs = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, context?.maskSecrets);
 			this.logger.debug(`Successfully created FSx FileSystem ${logicalId}: ${fileSystemId}`);
 			this.createTokenFirstSentAt.delete(clientRequestToken);
 			return {
@@ -40107,13 +40260,9 @@ var FSxFileSystemProvider = class {
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const message = `Failed to create FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`;
-			if (survivorId !== void 0) {
-				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
-				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
-				throw thrown;
-			}
-			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create FSx FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (survivorId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
+			throw thrown;
 		}
 	}
 	toCreateLustreConfiguration(config) {
@@ -40325,7 +40474,7 @@ var FSxFileSystemProvider = class {
 				}))).FileSystem?.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.Status === "PENDING" || a.Status === "IN_PROGRESS"));
 				const requestTimes = respPendingActions.map((a) => a.RequestTime?.getTime()).filter((t) => t !== void 0);
 				const actionThresholdMs = requestTimes.length > 0 ? Math.min(...requestTimes) : callTimeMs - 6e4;
-				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0);
+				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0, context?.maskSecrets);
 			}
 			if (tagsChanged) await this.applyTagDiff(physicalId, resourceType, logicalId, properties["Tags"], previousProperties["Tags"]);
 			if (!updatedFs) try {
@@ -40343,7 +40492,7 @@ var FSxFileSystemProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update FSx FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	detectVariantConfigKey(properties, previousProperties) {
@@ -40536,9 +40685,9 @@ var FSxFileSystemProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete FSx FileSystem ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
-		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType);
+		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType, context?.maskSecrets);
 		this.logger.debug(`Successfully deleted FSx FileSystem ${logicalId}`);
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -40581,23 +40730,20 @@ var FSxFileSystemProvider = class {
 			throw error;
 		}
 	}
-	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType) {
+	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
 			const fs = await this.describeForPoll(fileSystemId, transientState);
 			const lifecycle = fs?.Lifecycle;
 			if (fs && lifecycle === "AVAILABLE") return fs;
-			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") {
-				const detail = fs?.FailureDetails?.Message ?? "no failure details reported";
-				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${detail}`, resourceType, logicalId, fileSystemId);
-			}
+			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") throw this.wrapStatusReasonError(mask, fs?.FailureDetails?.Message, (text, cause) => new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${text}`, resourceType, logicalId, fileSystemId, cause));
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${lifecycle ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
 		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} to become AVAILABLE (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
 	}
-	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation) {
+	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		let seenTrackedAction = false;
@@ -40607,10 +40753,7 @@ var FSxFileSystemProvider = class {
 				const updateActions = (fs.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.RequestTime === void 0 || a.RequestTime.getTime() >= actionThresholdMs));
 				if (updateActions.length > 0) seenTrackedAction = true;
 				const failed = updateActions.find((a) => a.Status === "FAILED");
-				if (failed) {
-					const detail = failed.FailureDetails?.Message ?? "no failure details reported";
-					throw new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${detail}`, resourceType, logicalId, fileSystemId);
-				}
+				if (failed) throw this.wrapStatusReasonError(mask, failed.FailureDetails?.Message, (text, cause) => new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${text}`, resourceType, logicalId, fileSystemId, cause));
 				if (!updateActions.some((a) => a.Status === "PENDING" || a.Status === "IN_PROGRESS") && (!requireActionObservation || seenTrackedAction) && fs.Lifecycle === "AVAILABLE") return fs;
 				this.logger.debug(`FSx FileSystem ${fileSystemId} update in progress (lifecycle: ${fs.Lifecycle ?? "unknown"}), waiting...`);
 			}
@@ -40618,7 +40761,7 @@ var FSxFileSystemProvider = class {
 		}
 		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} update to complete (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
 	}
-	async waitForFileSystemDeleted(fileSystemId, logicalId, resourceType) {
+	async waitForFileSystemDeleted(fileSystemId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
@@ -40630,17 +40773,14 @@ var FSxFileSystemProvider = class {
 			} catch (error) {
 				if (error instanceof FileSystemNotFound$1) return;
 				const cause = error instanceof Error ? error : void 0;
-				throw new ProvisioningError(`Failed to poll FSx FileSystem ${fileSystemId} deletion: ${describeAwsFailure(error).detail}`, resourceType, logicalId, fileSystemId, cause);
+				throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to poll FSx FileSystem ${fileSystemId} deletion: ${text}`, resourceType, logicalId, fileSystemId, cause));
 			}
 			if (!fs && sawResponse) return;
 			if (!fs) {
 				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 				continue;
 			}
-			if (fs.Lifecycle === "FAILED") {
-				const detail = fs.FailureDetails?.Message ?? "no failure details reported";
-				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${detail}`, resourceType, logicalId, fileSystemId);
-			}
+			if (fs.Lifecycle === "FAILED") throw this.wrapStatusReasonError(mask, fs.FailureDetails?.Message, (text, cause) => new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${text}`, resourceType, logicalId, fileSystemId, cause));
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${fs.Lifecycle ?? "unknown"}, waiting for deletion...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -40976,6 +41116,21 @@ var EMRClusterProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$2;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$2;
 	}
+	wrapStatusReasonError(mask, reason, fallback, build) {
+		const text = describeAwsStatusReason(reason, fallback);
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::Cluster", /* @__PURE__ */ new Set([
 		"AdditionalInfo",
 		"Applications",
@@ -41113,7 +41268,7 @@ var EMRClusterProvider = class {
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			if (!clusterId) throw new ProvisioningError(`EMR RunJobFlow for ${logicalId} returned no JobFlowId`, resourceType, logicalId);
-			const cluster = await this.waitForClusterReady(clusterId, logicalId, resourceType);
+			const cluster = await this.waitForClusterReady(clusterId, logicalId, resourceType, context?.maskSecrets);
 			this.logger.debug(`Successfully created EMR Cluster ${logicalId}: ${clusterId}`);
 			return {
 				physicalId: clusterId,
@@ -41140,14 +41295,12 @@ var EMRClusterProvider = class {
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const message = `Failed to create EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`;
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create EMR Cluster ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (survivorId !== void 0) {
-				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
 				markNonRetryable(thrown);
-				throw thrown;
 			}
-			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
+			throw thrown;
 		}
 	}
 	toJobFlowInstancesConfig(config) {
@@ -41338,7 +41491,7 @@ var EMRClusterProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update EMR Cluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyTagDiff(physicalId, resourceType, logicalId, prevTagsRaw, nextTagsRaw) {
@@ -41392,7 +41545,7 @@ var EMRClusterProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to describe EMR Cluster ${logicalId} before deletion: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to describe EMR Cluster ${logicalId} before deletion: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 		const currentState = current?.Status?.State;
 		if (currentState && TERMINAL_STATES.has(currentState)) {
@@ -41421,9 +41574,9 @@ var EMRClusterProvider = class {
 			flip.deleteAccepted = true;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to terminate EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to terminate EMR Cluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
-		await this.waitForClusterTerminated(physicalId, logicalId, resourceType);
+		await this.waitForClusterTerminated(physicalId, logicalId, resourceType, context?.maskSecrets);
 		this.logger.debug(`Successfully deleted EMR Cluster ${logicalId}`);
 	}
 	async describeForPoll(clusterId, transientState, maxConsecutiveTransient = 5) {
@@ -41442,7 +41595,7 @@ var EMRClusterProvider = class {
 			throw error;
 		}
 	}
-	async waitForClusterReady(clusterId, logicalId, resourceType) {
+	async waitForClusterReady(clusterId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
@@ -41450,15 +41603,18 @@ var EMRClusterProvider = class {
 			const state = cluster?.Status?.State;
 			if (cluster && state && CREATE_READY_STATES.has(state)) return cluster;
 			if (state && TERMINAL_STATES.has(state)) {
-				const reason = cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
-				throw new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${reason}`, resourceType, logicalId, clusterId);
+				const reason = cluster?.Status?.StateChangeReason;
+				throw this.wrapStatusReasonError(mask, {
+					code: reason?.Code,
+					message: reason?.Message
+				}, "no state-change reason reported", (text, cause) => new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${text}`, resourceType, logicalId, clusterId, cause));
 			}
 			this.logger.debug(`EMR Cluster ${clusterId} state: ${state ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
 		throw new ProvisioningError(`Timed out waiting for EMR Cluster ${clusterId} to reach WAITING/RUNNING (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, clusterId);
 	}
-	async waitForClusterTerminated(clusterId, logicalId, resourceType) {
+	async waitForClusterTerminated(clusterId, logicalId, resourceType, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		while (Date.now() - startTime < this.maxWaitMs) {
@@ -41468,7 +41624,7 @@ var EMRClusterProvider = class {
 			} catch (error) {
 				if (error instanceof InvalidRequestException) return;
 				const cause = error instanceof Error ? error : void 0;
-				throw new ProvisioningError(`Failed to poll EMR Cluster ${clusterId} termination: ${describeAwsFailure(error).detail}`, resourceType, logicalId, clusterId, cause);
+				throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to poll EMR Cluster ${clusterId} termination: ${text}`, resourceType, logicalId, clusterId, cause));
 			}
 			const state = cluster?.Status?.State;
 			if (state && TERMINAL_STATES.has(state)) {
@@ -41719,6 +41875,21 @@ var EMRInstanceGroupConfigProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$1;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$1;
 	}
+	wrapStatusReasonError(mask, reason, fallback, build) {
+		const text = describeAwsStatusReason(reason, fallback);
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceGroupConfig", /* @__PURE__ */ new Set([
 		"AutoScalingPolicy",
 		"BidPrice",
@@ -41802,7 +41973,7 @@ var EMRInstanceGroupConfigProvider = class {
 			const replayWindow = replayedSendWindow(response, attemptStartMs);
 			if (replayWindow !== void 0 && group.InstanceRole === "TASK") await reportOrphans(replayWindow);
 			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
-			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, false, context?.maskSecrets);
 			this.logger.debug(`Successfully added EMR instance group ${logicalId}: ${groupId}`);
 			return {
 				physicalId: groupId,
@@ -41812,7 +41983,7 @@ var EMRInstanceGroupConfigProvider = class {
 				}
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${text}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
 			let leftBehindGroupId = createdGroupId;
 			if (leftBehindGroupId && properties["InstanceRole"] === "TASK") {
 				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
@@ -41891,7 +42062,7 @@ var EMRInstanceGroupConfigProvider = class {
 						InstanceCount: toNumber$1(properties["InstanceCount"]) ?? 0
 					}]
 				}));
-				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, true);
+				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, true, context?.maskSecrets);
 			}
 			if (autoScalingChanged) {
 				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
@@ -41918,7 +42089,7 @@ var EMRInstanceGroupConfigProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -41949,7 +42120,7 @@ var EMRInstanceGroupConfigProvider = class {
 	async getAttribute(physicalId, _resourceType, attributeName) {
 		if (attributeName === "Id" || attributeName === "InstanceGroupId") return physicalId;
 	}
-	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount, toleratesStaleFailedState = false) {
+	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount, toleratesStaleFailedState = false, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		let initialState;
@@ -41964,8 +42135,11 @@ var EMRInstanceGroupConfigProvider = class {
 			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
 			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) {
-				const reason = group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
-				throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${reason}`, resourceType, logicalId, groupId);
+				const reason = group?.Status?.StateChangeReason;
+				throw this.wrapStatusReasonError(mask, {
+					code: reason?.Code,
+					message: reason?.Message
+				}, "no state-change reason reported", (text, cause) => new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${text}`, resourceType, logicalId, groupId, cause));
 			}
 			if (state && !enforceFailedStates && FAILED_STATES$1.has(state)) this.logger.debug(`EMR instance group ${groupId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
@@ -42036,6 +42210,21 @@ var EMRInstanceFleetConfigProvider = class {
 		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
 		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
 	}
+	wrapStatusReasonError(mask, reason, fallback, build) {
+		const text = describeAwsStatusReason(reason, fallback);
+		if (!text.redacted) return build(text.detail, void 0);
+		const m = maskerOrIdentity(mask);
+		const cause = new Error(text.detail);
+		this.logger.debug(m(build(m(text.detail), cause).message));
+		return markRedactedCause(build(m(text.summary), cause));
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = maskerOrIdentity(mask);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceFleetConfig", /* @__PURE__ */ new Set([
 		"ClusterId",
 		"InstanceFleetType",
@@ -42128,7 +42317,7 @@ var EMRInstanceFleetConfigProvider = class {
 			await this.waitForFleetReady(clusterId, fleetId, logicalId, resourceType, this.targetCapacities(properties), {
 				onDemand: 0,
 				spot: 0
-			});
+			}, false, context?.maskSecrets);
 			this.logger.debug(`Successfully added EMR instance fleet ${logicalId}: ${fleetId}`);
 			return {
 				physicalId: fleetId,
@@ -42138,7 +42327,7 @@ var EMRInstanceFleetConfigProvider = class {
 				}
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${text}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
 			if (createdFleetId) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
 				markNonRetryable(thrown);
@@ -42212,7 +42401,7 @@ var EMRInstanceFleetConfigProvider = class {
 				ClusterId: clusterId,
 				InstanceFleet: modify
 			}));
-			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, this.targetCapacities(properties), this.targetCapacities(previousProperties), true);
+			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, this.targetCapacities(properties), this.targetCapacities(previousProperties), true, context?.maskSecrets);
 			this.logger.debug(`Successfully updated EMR instance fleet ${logicalId}`);
 			warnLeftInPlace();
 			return {
@@ -42226,7 +42415,7 @@ var EMRInstanceFleetConfigProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -42264,7 +42453,7 @@ var EMRInstanceFleetConfigProvider = class {
 			spot: toNumber(properties["TargetSpotCapacity"]) ?? 0
 		};
 	}
-	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, target, previous, toleratesStaleFailedState = false) {
+	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, target, previous, toleratesStaleFailedState = false, mask) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
 		let initialState;
@@ -42284,8 +42473,11 @@ var EMRInstanceFleetConfigProvider = class {
 			if (state && READY_STATES.has(state) && capacityReady) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
 			if (state && enforceFailedStates && FAILED_STATES.has(state)) {
-				const reason = fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
-				throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${reason}`, resourceType, logicalId, fleetId);
+				const reason = fleet?.Status?.StateChangeReason;
+				throw this.wrapStatusReasonError(mask, {
+					code: reason?.Code,
+					message: reason?.Message
+				}, "no state-change reason reported", (text, cause) => new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${text}`, resourceType, logicalId, fleetId, cause));
 			}
 			if (state && !enforceFailedStates && FAILED_STATES.has(state)) this.logger.debug(`EMR instance fleet ${fleetId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${onDemand}/${target.onDemand} on-demand + ${spot}/${target.spot} spot (${provisioned} total), waiting...`);
@@ -46666,6 +46858,13 @@ var ACMCertificateProvider = class {
 	logger = getLogger().child("ACMCertificateProvider");
 	maxPollAttempts = Number(process.env["CDKD_ACM_POLL_ATTEMPTS"] ?? 60);
 	pollIntervalMs = Number(process.env["CDKD_ACM_POLL_INTERVAL_MS"] ?? 1e4);
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		const m = mask ?? ((text) => text);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		return markRedactedCause(build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`));
+	}
 	constructor() {
 		this.acmClient = getAwsClients().acm;
 	}
@@ -46691,7 +46890,7 @@ var ACMCertificateProvider = class {
 		"KeyAlgorithm",
 		"Tags"
 	])]]);
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Requesting ACM certificate ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const domainName = properties["DomainName"];
@@ -46743,14 +46942,11 @@ var ACMCertificateProvider = class {
 				throw thrown;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const detail = describeAwsFailure(error).detail;
-			const message = `Failed to create ACM certificate ${logicalIdShown(logicalId)}: ${detail}`;
-			if (requestedArn && survivorNote !== void 0) {
-				const thrown = new ProvisioningError(`${message} ${survivorNote}`, resourceType, logicalId, requestedArn, cause);
-				markCreatedBeforeFailure(thrown, logicalId, resourceType, requestedArn);
-				throw thrown;
-			}
-			throw new ProvisioningError(message, resourceType, logicalId, requestedArn, cause);
+			const build = (text) => new ProvisioningError(`Failed to create ACM certificate ${logicalIdShown(logicalId)}: ` + (survivorNote !== void 0 ? `${text} ${survivorNote}` : text), resourceType, logicalId, requestedArn, cause);
+			if (!requestedArn || survivorNote === void 0) throw this.wrapCaughtError(context?.maskSecrets, error, build);
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, build);
+			markCreatedBeforeFailure(thrown, logicalId, resourceType, requestedArn);
+			throw thrown;
 		}
 	}
 	regionOfArn(arn) {
@@ -46802,7 +46998,7 @@ var ACMCertificateProvider = class {
 		}
 		if (changedImmutable) {
 			this.logger.debug(`${changedImmutable} changed, replacing ACM certificate: ${physicalId}`);
-			const createResult = await this.create(logicalId, resourceType, properties);
+			const createResult = await this.create(logicalId, resourceType, properties, context?.maskSecrets ? { maskSecrets: context.maskSecrets } : void 0);
 			let orphanReason;
 			let oldResourceSurvivor = "unconfirmed";
 			try {
@@ -46851,7 +47047,7 @@ var ACMCertificateProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update ACM certificate ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update ACM certificate ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -46871,7 +47067,7 @@ var ACMCertificateProvider = class {
 			this.logger.debug(`Successfully deleted ACM certificate ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ACM certificate ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete ACM certificate ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -46993,4 +47189,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-D1zpvb93.js.map
+//# sourceMappingURL=provider-classes-Dmz-lVVh.js.map