@go-to-k/cdkd 0.301.2 → 0.301.4

package/dist/{provider-classes-CDxfoC_T.js → provider-classes-BSUoljqw.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DFk7zr0Q.js";
+import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-BkeM7IXi.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Bl as renderAssemblyPathEscape, Br as deleteSkipReason, C as withApiLimit, Co as configIntegerRefusal, Dl as canonicalizeRegion, Do as requireConfigArray, Ds as recoverMaskedOutput, Eo as replayWarn, Fo as lambdaFunctionNameForMask, Fr as unchangedBehindSecretReference, G as deleteBudgetKey, Gr as ec2InstanceProtectionSite, Gt as awaitInFlightSibling, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hi as passedParameterClassesOf, Hr as isWaitAbandonedError, Ht as withNestedStackContext, Io as sameLambdaFunctionAddress, J as DELETE_INDEX_WAIT_PROCEED_NOTE, Jo as passedNoEchoParametersOf, Jr as reDisableInstanceApiTermination, K as resolveDynamoDbDeleteBudgetClock, Kr as isTerminationProtectionPropagationError, Lt as revertNestedChildFromJournal, Ms as carriesSecretMask, No as withRetry, Ol as derivePartitionAndUrlSuffix, Oo as requireConfigObject, Or as getCurrentResourceSecrets, Os as physicalNameCopiesOf, Po as canonicalLambdaFunctionName, Pr as slowCcOperationTimeoutMs, Pt as getNestedRevertRun, Q as ECR_AUTO_DELETE_IMAGES_TAG, Rl as describeFileReadFailure, S as lookupEachName, Sc as rewriteTemplateAssetReferences, So as configBooleanRefusal, To as readConfigString, U as beginDeleteWait, Ur as markWaitAbandoned, V as DynamoDBGlobalTableProvider, Vl as resolveAssemblyPath, Vr as withIndeterminateGuard, Vt as getCurrentNestedStackContext, W as compensateRemovedDeletionProtection, Wa as refuseMalformedResourcesForDestroy, X as deleteTableWithIndexBusyRetry, Xt as replacedDeleteFailureVerdict, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yi as accountArgs, Yr as reEnableInstanceApiTermination, Z as waitForIndexesSettled, _c as stringifyValue, _i as s3BucketArn, _o as isWarmThroughputDecrease, _r as tagPlanWarning, b as chunks, bi as s3BucketRegionalDomainName, bo as coerceCfnBoolean, c as isAbsoluteAssetPath, cr as acquireIdempotencyToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as DBPROXY_TAGS_WHAT, et as hasCdkAutoDeleteTag, fi as isSettledInstanceState, fn as isRedactedRecordedValue, fr as DBPROXY_TAG_OPTIONS, go as coerceWarmThroughput$1, gr as tagMapAsList, gs as redactSecretsForState, ho as WARM_THROUGHPUT_MEMBERS, hr as refuseMalformedDesiredTags, hs as snapshotPassProvenance, io as findSilentDropProperties, ir as earliestDefined, ki as getAccountInfo, ko as requireConfigString, ks as recordAttributeIdCopy, l as listNestedTemplateRows, ln as getCurrentProducerRegions, lr as isRefusedByName, mi as outputReferenceProvenanceOf, mn as redactedDeleteAddressSkip, mr as readTagList, ms as recordReferenceProvenanceEntry, no as withheldAccountClause, nt as getPriorAttempts, oo as withoutSilentDropProperties, or as reserveStackCreateToken, pn as redactedDeleteAddressFields, pr as planTagDiff, ps as markSameGenerationBag, q as resolveDynamoDbDeleteBudgetMs, qr as observeThenDisableInstanceApiTermination, qt as getStackRecords, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, t as DeployEngine, ts as hasMaskableValues, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, ur as markDeleteStarted, vi as s3BucketDomainName, vo as toCfnInteger, vr as definedAttributes, wa as refuseMalformedNestedChildOutputs, wl as decodeListingKey, wo as configStringRefusal, x as isAccessDeniedError, xi as s3BucketWebsiteUrl, xo as coerceCfnInteger, xs as dynamicReferenceTokens, yi as s3BucketDualStackDomainName, yo as toFiniteNumber, yr as stringifyIfAssigned, ys as withoutPhysicalNameCopies, zi as parseWebACLArn, zl as displayAssemblyPath } from "./deploy-engine--5XWdjW3.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-Bwgqyn6-.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DEPit8lD.js";
-import { RDSProvider } from "./rds-provider-BvZhdkOC.js";
-import { NeptuneProvider } from "./neptune-provider-DjEVKBcV.js";
-import { ASGProvider } from "./asg-provider--t5d-gjf.js";
+import { $ as markRefusedBeforeApplying, Ao as requireConfigArray, B as compensateRemovedDeletionProtection, Ci as s3BucketRegionalDomainName, Co as coerceCfnBoolean, Cs as withoutPhysicalNameCopies, Da as refuseMalformedNestedChildOutputs, Do as configStringRefusal, Dr as waitForLambdaFunctionActive, Ec as rewriteTemplateAssetReferences, Eo as configIntegerRefusal, G as INDEX_SETTLE_POLL_INTERVAL_MS, Gi as passedParameterClassesOf, Gl as resolveAssemblyPath, Gr as isWaitAbandonedError, Gt as awaitInFlightSibling, H as resolveDynamoDbDeleteBudgetClock, Hi as parseWebACLArn, Hl as describeFileReadFailure, Hn as secretNamedAttributeNamesOf, Ht as withNestedStackContext, Io as withRetry, Is as carriesSecretMask, J as ECR_AUTO_DELETE_IMAGES_TAG, Jr as ec2InstanceProtectionSite, K as deleteTableWithIndexBusyRetry, Kr as markWaitAbandoned, L as DynamoDBGlobalTableProvider, Lo as canonicalLambdaFunctionName, Lr as slowCcOperationTimeoutMs, Lt as revertNestedChildFromJournal, Mi as getAccountInfo, Ml as derivePartitionAndUrlSuffix, Mo as requireConfigString, Ms as physicalNameCopiesOf, Ns as recordAttributeIdCopy, Ol as decodeListingKey, Oo as readConfigString, Pt as getNestedRevertRun, Q as getPriorAttempts, Qi as accountArgs, Qr as reEnableInstanceApiTermination, R as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ro as lambdaFunctionNameForMask, Rr as unchangedBehindSecretReference, Si as s3BucketDualStackDomainName, So as toFiniteNumber, To as configBooleanRefusal, Ts as dynamicReferenceTokens, U as resolveDynamoDbDeleteBudgetMs, Ul as displayAssemblyPath, Ur as deleteSkipReason, V as deleteBudgetKey, Vt as getCurrentNestedStackContext, W as DELETE_INDEX_WAIT_PROCEED_NOTE, Wl as renderAssemblyPathEscape, Wr as withIndeterminateGuard, X as hasCdkAutoDeleteTag, Xr as observeThenDisableInstanceApiTermination, Xt as replacedDeleteFailureVerdict, Y as S3_AUTO_DELETE_OBJECTS_TAG, Yr as isTerminationProtectionPropagationError, Z as isTruthyCfnBoolean, Zo as passedNoEchoParametersOf, Zr as reDisableInstanceApiTermination, _i as outputReferenceProvenanceOf, _r as refuseMalformedDesiredTags, _s as markSameGenerationBag, a as findNestedTemplateTreeDefect, ao as withheldAccountClause, as as hasMaskableValues, b as lookupEachName, bi as s3BucketArn, bo as isWarmThroughputDecrease, br as definedAttributes, bs as redactSecretsForState, c as renderNestedTemplateTreeDefect, cr as reserveStackCreateToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as isRefusedByName, fn as isRedactedRecordedValue, fr as markDeleteStarted, gr as readTagList, hi as isSettledInstanceState, hr as planTagDiff, jl as canonicalizeRegion, jo as requireConfigObject, jr as getCurrentResourceSecrets, js as recoverMaskedOutput, ko as replayWarn, ln as getCurrentProducerRegions, lo as withoutSilentDropProperties, mn as redactedDeleteAddressSkip, mr as DBPROXY_TAG_OPTIONS, o as isAbsoluteAssetPath, or as earliestDefined, pn as redactedDeleteAddressFields, pr as DBPROXY_TAGS_WHAT, q as waitForIndexesSettled, qa as refuseMalformedResourcesForDestroy, qt as getStackRecords, s as listNestedTemplateRows, so as findSilentDropProperties, t as DeployEngine, ur as acquireIdempotencyToken, v as chunks, vo as WARM_THROUGHPUT_MEMBERS, vr as tagMapAsList, vs as recordReferenceProvenanceEntry, wi as s3BucketWebsiteUrl, wo as coerceCfnInteger, x as withApiLimit, xc as stringifyValue, xi as s3BucketDomainName, xo as toCfnInteger, xr as stringifyIfAssigned, y as isAccessDeniedError, yo as coerceWarmThroughput$1, yr as tagPlanWarning, ys as snapshotPassProvenance, z as beginDeleteWait, zo as sameLambdaFunctionAddress } from "./deploy-engine-BIPU9Xdh.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C58oW5zG.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DYfZCsxM.js";
+import { RDSProvider } from "./rds-provider-DI_O0_iG.js";
+import { NeptuneProvider } from "./neptune-provider-DoKgbZCz.js";
+import { ASGProvider } from "./asg-provider--GY-B-zI.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -507,7 +507,7 @@ var IAMPolicyProvider = class {
 			this.logger.debug(`Successfully deleted IAM policy ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete IAM policy ${logicalId}: ${mask(describeAwsFailure(error).detail)}`, resourceType, logicalId, physicalId, cause);
 			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
@@ -1359,7 +1359,7 @@ var IAMInstanceProfileProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete IAM instance profile ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -1610,7 +1610,7 @@ var IAMAccessKeyProvider = class {
 		try {
 			status = properties["Status"] === void 0 ? "Active" : requireConfigString(properties["Status"], previousStatus, "AWS::IAM::AccessKey Status", stateBorneDesired ? { onUnusable: (message) => log.warn(message) } : {});
 		} catch (error) {
-			throw new ProvisioningError(`${v(error instanceof Error ? error.message : String(error))}. Nothing was applied to access key ${logicalId}; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(`${v(describeAwsFailure(error).detail)}. Nothing was applied to access key ${logicalId}; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		}
 		try {
 			await this.iamClient.send(new UpdateAccessKeyCommand({
@@ -1648,7 +1648,7 @@ var IAMAccessKeyProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete IAM access key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete IAM access key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -2049,7 +2049,7 @@ var IAMUserGroupProvider = class {
 			log.debug(`Successfully deleted IAM user ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM user ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -2330,7 +2330,7 @@ var IAMUserGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(log.mask(`Failed to delete IAM group ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -2614,7 +2614,7 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM UserToGroupAddition ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(error instanceof Error ? error.message : String(error))}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete IAM UserToGroupAddition ${logicalId}: ${mask(describeAwsFailure(error).detail)}`, resourceType, logicalId, physicalId, cause);
 			throw maskError(removedAny ? markDeleteStarted(failure) : failure);
 		}
 	}
@@ -5707,10 +5707,7 @@ const SQS_ATTRIBUTE_REMOVAL_RESET = {
 	DelaySeconds: "0",
 	ReceiveMessageWaitTimeSeconds: "0",
 	KmsDataKeyReusePeriodSeconds: "300",
-	ContentBasedDeduplication: "false",
-	SqsManagedSseEnabled: "true",
-	DeduplicationScope: "queue",
-	FifoThroughputLimit: "perQueue"
+	ContentBasedDeduplication: "false"
 };
 const CDK_TO_SQS_ATTRIBUTES = {
 	VisibilityTimeout: "VisibilityTimeout",
@@ -5808,7 +5805,7 @@ var SQSQueueProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SQS queue ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, queueName, cause);
+			throw new ProvisioningError(`Failed to create SQS queue ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, queueName, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -5824,13 +5821,7 @@ var SQSQueueProvider = class {
 					if (cdkKey === "RedrivePolicy" && typeof value === "object") attributes[sqsKey] = serializeRedrivePolicy(value);
 					else if (cdkKey === "RedriveAllowPolicy") attributes[sqsKey] = serializeRedriveAllowPolicy(value);
 					else attributes[sqsKey] = stringifyValue(value);
-				} else if (previousProperties[cdkKey] !== void 0 && cdkKey in SQS_ATTRIBUTE_REMOVAL_RESET) {
-					if (cdkKey === "SqsManagedSseEnabled") {
-						const desiredKmsKey = properties["KmsMasterKeyId"];
-						if (desiredKmsKey !== void 0 && desiredKmsKey !== "") continue;
-					}
-					attributes[sqsKey] = SQS_ATTRIBUTE_REMOVAL_RESET[cdkKey];
-				}
+				} else if (previousProperties[cdkKey] !== void 0 && cdkKey in SQS_ATTRIBUTE_REMOVAL_RESET) attributes[sqsKey] = SQS_ATTRIBUTE_REMOVAL_RESET[cdkKey];
 			}
 			if (Object.keys(attributes).length > 0) {
 				await this.sqsClient.send(new SetQueueAttributesCommand({
@@ -5856,7 +5847,7 @@ var SQSQueueProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SQS queue ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SQS queue ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -5872,7 +5863,7 @@ var SQSQueueProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SQS queue ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete SQS queue ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyTagDiff(queueUrl, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
@@ -6597,7 +6588,7 @@ var SNSTopicProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create SNS topic ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, topicName, cause);
+			const thrown = new ProvisioningError(`Failed to create SNS topic ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, topicName, cause);
 			if (leftBehindArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
 			throw thrown;
 		}
@@ -6609,7 +6600,7 @@ var SNSTopicProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SNS topic ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SNS topic ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
@@ -6775,7 +6766,7 @@ var SNSTopicProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SNS topic ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete SNS topic ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -7217,7 +7208,7 @@ var SNSSubscriptionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(mask(`Failed to delete SNS subscription ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(mask(`Failed to delete SNS subscription ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	logPendingConfirmationSkip(logicalId, physicalId) {
@@ -7948,7 +7939,7 @@ var LambdaFunctionProvider = class {
 		} catch (error) {
 			if (functionCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda function ${logicalId}: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(String(error))));
+			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda function ${logicalId}: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(safeStringify(error))));
 			if (createdFunctionName !== void 0 && !postCreateCleanup.deleted) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFunctionName, createdFunctionIdentity);
 			throw thrown;
 		}
@@ -8126,7 +8117,7 @@ var LambdaFunctionProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update Lambda function ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause ?? new Error(String(error))));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update Lambda function ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause ?? new Error(safeStringify(error))));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -8167,7 +8158,7 @@ var LambdaFunctionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Lambda function ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 		if (hasVpcConfig) await this.cleanupLambdaEnis(physicalId);
@@ -8232,7 +8223,7 @@ var LambdaFunctionProvider = class {
 			}, { FunctionName: functionName });
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Lambda function ${logicalId} update did not complete: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(String(error))));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Lambda function ${logicalId} update did not complete: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(safeStringify(error))));
 		}
 	}
 	async waitForLambdaUpdateCompleted(functionName) {
@@ -8724,7 +8715,7 @@ var LambdaPermissionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda permission ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Lambda permission ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -8861,7 +8852,7 @@ var LambdaUrlProvider = class {
 				log.warn(`${message} The function URL's existing auth type is kept for this update rather than reset to the default (NONE), which would make the URL public.`);
 			} } : {});
 		} catch (error) {
-			throw new ProvisioningError(`${log.mask(error instanceof Error ? error.message : String(error))}. Nothing was applied to Lambda URL ${logicalId}; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(`${log.mask(describeAwsFailure(error).detail)}. Nothing was applied to Lambda URL ${logicalId}; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		}
 		const previousAuthType = previousProperties["AuthType"];
 		const authType = authTypeUnusable ? typeof previousAuthType === "string" && previousAuthType.trim() !== "" ? previousAuthType : void 0 : requestedAuthType;
@@ -8875,7 +8866,7 @@ var LambdaUrlProvider = class {
 			FunctionName: physicalId,
 			...authType !== void 0 && { AuthType: authType }
 		};
-		const invokeMode = clearOnUpdateRemoval(properties["InvokeMode"], previousProperties["InvokeMode"], "BUFFERED");
+		const invokeMode = properties["InvokeMode"];
 		if (invokeMode !== void 0) updateParams.InvokeMode = invokeMode;
 		const newCorsRaw = properties["Cors"];
 		const prevCorsRaw = previousProperties["Cors"];
@@ -8912,7 +8903,7 @@ var LambdaUrlProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda URL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Lambda URL ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -9411,7 +9402,7 @@ var LambdaEventSourceMappingProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete event source mapping ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete event source mapping ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -9639,7 +9630,7 @@ var LambdaLayerVersionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda layer version ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Lambda layer version ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
@@ -9853,7 +9844,7 @@ var LambdaEventInvokeConfigProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Lambda EventInvokeConfig ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Lambda EventInvokeConfig ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(_physicalId, _resourceType, _attributeName) {}
@@ -12055,7 +12046,7 @@ var DynamoDBTableProvider = class {
 				}
 				markAuxiliaryFailure(error, logicalId);
 			}
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DynamoDB table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, tableName, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DynamoDB table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, tableName, error instanceof Error ? error : void 0);
 			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName, createdTableId);
 			throw thrown;
 		}
@@ -12078,7 +12069,7 @@ var DynamoDBTableProvider = class {
 			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && JSON.stringify(properties["BillingMode"]) !== JSON.stringify(previousProperties["BillingMode"])) try {
 				requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode");
 			} catch (error) {
-				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: ${describeAwsFailure(error).detail}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 			}
 			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) {
 				const pitrRefusal = pointInTimeRecoveryRefusal(properties["PointInTimeRecoverySpecification"]);
@@ -12310,7 +12301,7 @@ var DynamoDBTableProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update DynamoDB table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update DynamoDB table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -12411,7 +12402,7 @@ var DynamoDBTableProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DynamoDB table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DynamoDB table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
@@ -13685,7 +13676,7 @@ var LogsLogGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete log group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete log group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	logGoneOnDelete(logicalId, physicalId, context) {
@@ -13867,7 +13858,7 @@ var CloudWatchAlarmProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CloudWatch alarm ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create CloudWatch alarm ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -13886,7 +13877,7 @@ var CloudWatchAlarmProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudWatch alarm ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CloudWatch alarm ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	throttleDelaysMs = [
@@ -13926,7 +13917,7 @@ var CloudWatchAlarmProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudWatch alarm ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CloudWatch alarm ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAlarmArn(alarmName) {
@@ -14147,7 +14138,7 @@ var CloudWatchAnomalyDetectorProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create CloudWatch anomaly detector ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
@@ -14165,7 +14156,7 @@ var CloudWatchAnomalyDetectorProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CloudWatch anomaly detector ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -14191,7 +14182,7 @@ var CloudWatchAnomalyDetectorProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CloudWatch anomaly detector ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -14377,7 +14368,6 @@ var SecretsManagerSecretProvider = class {
 		"ReplicaRegions",
 		"Type"
 	])]]);
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::SecretsManager::Secret", /* @__PURE__ */ new Map([["Description", ""]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.smClient = awsClients.secretsManager;
@@ -14422,7 +14412,6 @@ var SecretsManagerSecretProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const log = this.operationSinks(context?.maskSecrets, [
 			[properties["Name"], properties["Name"]],
 			[properties["Name"], physicalId],
@@ -14436,7 +14425,7 @@ var SecretsManagerSecretProvider = class {
 		try {
 			changedValue = this.changedSecretValue(properties, previousProperties, stateBorneDesired, log.warn);
 		} catch (error) {
-			const message = v(error instanceof Error ? error.message : String(error));
+			const message = v(describeAwsFailure(error).detail);
 			throw new ProvisioningError(stateBorneDesired ? `Failed to update secret ${logicalId}: ${message}` : `${message}. Nothing was applied to secret ${logicalId}; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		}
 		try {
@@ -14447,7 +14436,7 @@ var SecretsManagerSecretProvider = class {
 			if (description !== void 0) updateParams.Description = description;
 			const newKmsKeyId = properties["KmsKeyId"];
 			const prevKmsKeyId = previousProperties["KmsKeyId"];
-			const kmsKeyId = clearOnUpdateRemoval(newKmsKeyId === "" ? void 0 : newKmsKeyId, prevKmsKeyId === "" ? void 0 : prevKmsKeyId, "");
+			const kmsKeyId = newKmsKeyId === void 0 ? void 0 : newKmsKeyId === "" ? prevKmsKeyId !== void 0 && prevKmsKeyId !== "" ? "" : void 0 : newKmsKeyId;
 			if (kmsKeyId !== void 0) updateParams.KmsKeyId = kmsKeyId;
 			if (properties["Type"]) updateParams.Type = properties["Type"];
 			await this.smClient.send(new UpdateSecretCommand(updateParams));
@@ -14547,7 +14536,7 @@ var SecretsManagerSecretProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete secret ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete secret ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	retainPreviousGenerateBlock(logicalId, properties, previousProperties) {
@@ -14847,7 +14836,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SSM parameter ${displaySafe(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete SSM parameter ${displaySafe(logicalId)}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
@@ -15121,7 +15110,7 @@ var EventBridgeRuleProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, ruleName, cause);
+			const thrown = new ProvisioningError(`Failed to create EventBridge rule ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, ruleName, cause);
 			if (leftLiveArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftLiveArn);
 			throw thrown;
 		}
@@ -15191,7 +15180,7 @@ var EventBridgeRuleProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update EventBridge rule ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -15237,7 +15226,7 @@ var EventBridgeRuleProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete EventBridge rule ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -15442,7 +15431,7 @@ var EventBridgeBusProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create EventBus ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create EventBus ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -15453,7 +15442,7 @@ var EventBridgeBusProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EventBus ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update EventBus ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -16037,7 +16026,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EC2 resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update EC2 resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -16278,7 +16267,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create VPC ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create VPC ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (leftBehindId !== void 0) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 				markNonRetryable(thrown);
@@ -16318,7 +16307,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update VPC ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update VPC ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteVpc(logicalId, physicalId, resourceType, context) {
@@ -16438,7 +16427,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create Subnet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create Subnet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 			throw thrown;
 		}
@@ -16474,7 +16463,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Subnet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Subnet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async waitForSubnetMapPublicIp(subnetId, expected) {
@@ -16582,7 +16571,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create InternetGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create InternetGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	updateInternetGateway(logicalId, physicalId) {
@@ -16601,7 +16590,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete InternetGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete InternetGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	eipPhysicalId(logicalId, publicIp, allocationId, options) {
@@ -16700,7 +16689,7 @@ var EC2Provider = class {
 				this.logger.warn(safeMsg`Failed to release partially-created EIP ${logicalId} (${allocatedId}): ${describeAwsFailure(cleanupError).detail}. Manual release may be required: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 release-address --allocation-id ${allocatedId}`.render()}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create EIP ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (createdId !== void 0) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
 				markNonRetryable(thrown);
@@ -16771,7 +16760,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete EIP ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getEipAttribute(physicalId, attributeName) {
@@ -16814,7 +16803,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create VPCGatewayAttachment ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create VPCGatewayAttachment ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	updateVpcGatewayAttachment(logicalId, physicalId) {
@@ -16839,7 +16828,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete VPCGatewayAttachment ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete VPCGatewayAttachment ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createNatGateway(logicalId, resourceType, properties) {
@@ -16885,7 +16874,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create NatGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create NatGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (createdId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
 			throw thrown;
 		}
@@ -16906,7 +16895,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete NatGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete NatGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		this.logger.debug(`Waiting for NatGateway ${physicalId} to reach deleted state...`);
 		try {
@@ -16946,7 +16935,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create RouteTable ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create RouteTable ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	updateRouteTable(logicalId, physicalId) {
@@ -16965,7 +16954,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete RouteTable ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete RouteTable ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createRoute(logicalId, resourceType, properties, onMultipleDestinations, maskSecrets) {
@@ -17020,7 +17009,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create Route ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -17046,7 +17035,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Route ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteRoute(logicalId, physicalId, resourceType, context) {
@@ -17069,7 +17058,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Route ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createSubnetRouteTableAssociation(logicalId, resourceType, properties) {
@@ -17089,7 +17078,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SubnetRouteTableAssociation ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create SubnetRouteTableAssociation ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	updateSubnetRouteTableAssociation(logicalId, physicalId) {
@@ -17108,7 +17097,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SubnetRouteTableAssociation ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete SubnetRouteTableAssociation ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createSecurityGroup(logicalId, resourceType, properties) {
@@ -17159,7 +17148,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create SecurityGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create SecurityGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 			throw thrown;
 		}
@@ -17212,7 +17201,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SecurityGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SecurityGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteSecurityGroup(logicalId, physicalId, resourceType, context) {
@@ -17367,7 +17356,7 @@ var EC2Provider = class {
 				};
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to create SecurityGroupIngress ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const failure = new ProvisioningError(`Failed to create SecurityGroupIngress ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			const lookup = getPriorAttempts(logicalId);
 			if (authorizeDefinitelyNotApplied(error) && !earlierSendAmbiguous && lookup?.possiblyLanded() !== true) markRefusedBeforeApplying(failure);
 			else lookup?.notePossiblyLanded();
@@ -17561,7 +17550,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SecurityGroupIngress ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update SecurityGroupIngress ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	withoutDescription(value) {
@@ -17637,7 +17626,7 @@ var EC2Provider = class {
 				return notMatched();
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SecurityGroupIngress ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete SecurityGroupIngress ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createInstance(logicalId, resourceType, properties, context) {
@@ -17722,7 +17711,7 @@ var EC2Provider = class {
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create EC2 Instance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create EC2 Instance ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 			throw thrown;
 		}
@@ -17820,7 +17809,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async updateInstanceSecurityProps(physicalId, properties, previousProperties) {
@@ -18131,7 +18120,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create NetworkAcl ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create NetworkAcl ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async deleteNetworkAcl(logicalId, physicalId, resourceType, context) {
@@ -18147,7 +18136,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete NetworkAcl ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete NetworkAcl ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createNetworkAclEntry(logicalId, resourceType, properties, context) {
@@ -18204,7 +18193,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create NetworkAclEntry ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create NetworkAclEntry ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async deleteNetworkAclEntry(logicalId, physicalId, resourceType, context) {
@@ -18235,7 +18224,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete NetworkAclEntry ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete NetworkAclEntry ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createSubnetNetworkAclAssociation(logicalId, resourceType, properties) {
@@ -18269,7 +18258,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SubnetNetworkAclAssociation ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create SubnetNetworkAclAssociation ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async sendTaggedCreate(logicalId, tagResourceType, tags, send) {
@@ -19463,7 +19452,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Account ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway Account ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway Account ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async updateAccountWithRetry(cloudWatchRoleArn, logicalId, _resourceType, log) {
@@ -19641,7 +19630,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway Authorizer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway Authorizer ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getAuthorizerAttribute(physicalId, attributeName) {
@@ -19726,7 +19715,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway Resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway Resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getResourceAttribute(physicalId, _resourceType, attributeName) {
@@ -19811,7 +19800,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway Deployment ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway Deployment ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getDeploymentAttribute(physicalId, attributeName) {
@@ -20055,7 +20044,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway Stage ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway Stage ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getStageAttribute(physicalId, attributeName) {
@@ -20279,7 +20268,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway Method ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway Method ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getMethodAttribute(physicalId, attributeName) {
@@ -20758,9 +20747,9 @@ var ApiGatewayV2Provider = class {
 		const log = resourceType === "AWS::ApiGatewayV2::Stage" ? stageSinks(this.logger, context, [[properties["StageName"], physicalId], [previousProperties["StageName"], physicalId]]) : createMaskedLogSinks(this.logger, context?.maskSecrets);
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.updateApi(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
 			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			default: throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "Unsupported API Gateway V2 resource type for in-place update in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
 		}
@@ -20873,7 +20862,7 @@ var ApiGatewayV2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway V2 Api ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway V2 Api ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async buildExecuteApiArn(apiId, log = createMaskedLogSinks(this.logger, void 0)) {
@@ -20944,7 +20933,7 @@ var ApiGatewayV2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway V2 Stage ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway V2 Stage ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getStageAttribute(physicalId, attributeName) {
@@ -21041,7 +21030,7 @@ var ApiGatewayV2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway V2 Integration ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway V2 Integration ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getIntegrationAttribute(physicalId, attributeName) {
@@ -21095,7 +21084,7 @@ var ApiGatewayV2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway V2 Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway V2 Route ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getRouteAttribute(physicalId, attributeName) {
@@ -21184,7 +21173,7 @@ var ApiGatewayV2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete API Gateway V2 Authorizer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete API Gateway V2 Authorizer ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getDriftUnknownPaths(resourceType, properties) {
@@ -21366,49 +21355,34 @@ var ApiGatewayV2Provider = class {
 			input.Name = properties["Name"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Description"], previousProperties["Description"], "");
-			if (r.changed) {
-				input.Description = r.value;
-				changed = true;
-			}
+		if (properties["Description"] !== void 0 && properties["Description"] !== previousProperties["Description"]) {
+			input.Description = properties["Description"];
+			changed = true;
 		}
 		if (properties["CorsConfiguration"] !== void 0 && !this.deepEqual(properties["CorsConfiguration"], previousProperties["CorsConfiguration"])) {
 			input.CorsConfiguration = properties["CorsConfiguration"];
 			changed = true;
 		}
 		const corsRemoved = properties["CorsConfiguration"] === void 0 && previousProperties["CorsConfiguration"] !== void 0;
-		{
-			const r = this.clearableUpdate(properties["DisableExecuteApiEndpoint"], previousProperties["DisableExecuteApiEndpoint"], false);
-			if (r.changed) {
-				input.DisableExecuteApiEndpoint = r.value;
-				changed = true;
-			}
+		if (properties["DisableExecuteApiEndpoint"] !== void 0 && properties["DisableExecuteApiEndpoint"] !== previousProperties["DisableExecuteApiEndpoint"]) {
+			input.DisableExecuteApiEndpoint = properties["DisableExecuteApiEndpoint"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Version"], previousProperties["Version"], "");
-			if (r.changed) {
-				input.Version = r.value;
-				changed = true;
-			}
+		if (properties["Version"] !== void 0 && properties["Version"] !== previousProperties["Version"]) {
+			input.Version = properties["Version"];
+			changed = true;
 		}
 		if (properties["RouteSelectionExpression"] !== void 0 && properties["RouteSelectionExpression"] !== previousProperties["RouteSelectionExpression"]) {
 			input.RouteSelectionExpression = properties["RouteSelectionExpression"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["ApiKeySelectionExpression"], previousProperties["ApiKeySelectionExpression"], "$request.header.x-api-key");
-			if (r.changed) {
-				input.ApiKeySelectionExpression = r.value;
-				changed = true;
-			}
+		if (properties["ApiKeySelectionExpression"] !== void 0 && properties["ApiKeySelectionExpression"] !== previousProperties["ApiKeySelectionExpression"]) {
+			input.ApiKeySelectionExpression = properties["ApiKeySelectionExpression"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["IpAddressType"], previousProperties["IpAddressType"], "ipv4");
-			if (r.changed) {
-				input.IpAddressType = r.value;
-				changed = true;
-			}
+		if (properties["IpAddressType"] !== void 0 && properties["IpAddressType"] !== previousProperties["IpAddressType"]) {
+			input.IpAddressType = properties["IpAddressType"];
+			changed = true;
 		}
 		if (!changed && !corsRemoved) {
 			log.debug(`No mutable Api fields changed for ${logicalId}; skipping UpdateApi`);
@@ -21447,7 +21421,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Api ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Stage ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Stage; re-deploy with cdkd deploy --replace");
@@ -21474,12 +21448,15 @@ var ApiGatewayV2Provider = class {
 			input.Description = properties["Description"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["StageVariables"], previousProperties["StageVariables"]);
 			if (merged !== void 0) {
 				input.StageVariables = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["StageVariables"], previousProperties["StageVariables"])) {
+			input.StageVariables = properties["StageVariables"];
+			changed = true;
 		}
 		if (properties["DefaultRouteSettings"] !== void 0 && !this.deepEqual(properties["DefaultRouteSettings"], previousProperties["DefaultRouteSettings"])) {
 			input.DefaultRouteSettings = properties["DefaultRouteSettings"];
@@ -21495,12 +21472,9 @@ var ApiGatewayV2Provider = class {
 			changed = true;
 		}
 		const droppedRouteSettingKeys = this.droppedKeys(properties["RouteSettings"], previousProperties["RouteSettings"]);
-		{
-			const r = this.clearableUpdate(properties["ClientCertificateId"], previousProperties["ClientCertificateId"], "");
-			if (r.changed) {
-				input.ClientCertificateId = r.value;
-				changed = true;
-			}
+		if (properties["ClientCertificateId"] !== void 0 && properties["ClientCertificateId"] !== previousProperties["ClientCertificateId"]) {
+			input.ClientCertificateId = properties["ClientCertificateId"];
+			changed = true;
 		}
 		if (properties["DeploymentId"] !== void 0 && properties["DeploymentId"] !== previousProperties["DeploymentId"]) {
 			input.DeploymentId = properties["DeploymentId"];
@@ -21538,7 +21512,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Stage ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Integration; re-deploy with cdkd deploy --replace");
@@ -21567,19 +21541,19 @@ var ApiGatewayV2Provider = class {
 			input.TimeoutInMillis = properties["TimeoutInMillis"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestParameters"], previousProperties["RequestParameters"]);
 			if (merged !== void 0) {
 				input.RequestParameters = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["RequestParameters"], previousProperties["RequestParameters"])) {
+			input.RequestParameters = properties["RequestParameters"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Description"], previousProperties["Description"], "");
-			if (r.changed) {
-				input.Description = r.value;
-				changed = true;
-			}
+		if (properties["Description"] !== void 0 && properties["Description"] !== previousProperties["Description"]) {
+			input.Description = properties["Description"];
+			changed = true;
 		}
 		if (properties["ConnectionId"] != null && properties["ConnectionId"] !== previousProperties["ConnectionId"]) {
 			input.ConnectionId = properties["ConnectionId"];
@@ -21645,7 +21619,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Integration ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Route ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Route; re-deploy with cdkd deploy --replace");
@@ -21662,19 +21636,13 @@ var ApiGatewayV2Provider = class {
 			input.Target = properties["Target"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizationType"], previousProperties["AuthorizationType"], "NONE");
-			if (r.changed) {
-				input.AuthorizationType = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizationType"] !== void 0 && properties["AuthorizationType"] !== previousProperties["AuthorizationType"]) {
+			input.AuthorizationType = properties["AuthorizationType"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerId"], previousProperties["AuthorizerId"], "");
-			if (r.changed) {
-				input.AuthorizerId = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerId"] !== void 0 && properties["AuthorizerId"] !== previousProperties["AuthorizerId"]) {
+			input.AuthorizerId = properties["AuthorizerId"];
+			changed = true;
 		}
 		{
 			const r = this.clearableUpdate(properties["AuthorizationScopes"], previousProperties["AuthorizationScopes"], []);
@@ -21683,12 +21651,9 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
-		{
-			const r = this.clearableUpdate(properties["OperationName"], previousProperties["OperationName"], "");
-			if (r.changed) {
-				input.OperationName = r.value;
-				changed = true;
-			}
+		if (properties["OperationName"] !== void 0 && properties["OperationName"] !== previousProperties["OperationName"]) {
+			input.OperationName = properties["OperationName"];
+			changed = true;
 		}
 		{
 			const r = this.clearableUpdate(properties["ApiKeyRequired"], previousProperties["ApiKeyRequired"], false);
@@ -21697,18 +21662,21 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestModels"], previousProperties["RequestModels"]);
 			if (merged !== void 0) {
 				input.RequestModels = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["RequestModels"], previousProperties["RequestModels"])) {
+			input.RequestModels = properties["RequestModels"];
+			changed = true;
 		}
-		if (properties["RequestParameters"] !== void 0 && !this.deepEqual(properties["RequestParameters"], previousProperties["RequestParameters"])) {
+		if (restoreFromAws ? properties["RequestParameters"] !== void 0 && !this.deepEqual(properties["RequestParameters"], previousProperties["RequestParameters"]) : this.mapEntryAddedOrChanged(properties["RequestParameters"], previousProperties["RequestParameters"])) {
 			input.RequestParameters = properties["RequestParameters"];
 			changed = true;
 		}
-		const droppedRequestParameterKeys = this.droppedKeys(properties["RequestParameters"], previousProperties["RequestParameters"]);
+		const droppedRequestParameterKeys = restoreFromAws ? this.droppedKeys(properties["RequestParameters"], previousProperties["RequestParameters"]) : [];
 		if (properties["ModelSelectionExpression"] !== void 0 && properties["ModelSelectionExpression"] !== previousProperties["ModelSelectionExpression"]) {
 			input.ModelSelectionExpression = properties["ModelSelectionExpression"];
 			changed = true;
@@ -21782,37 +21750,25 @@ var ApiGatewayV2Provider = class {
 			input.AuthorizerUri = properties["AuthorizerUri"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerCredentialsArn"], previousProperties["AuthorizerCredentialsArn"], "");
-			if (r.changed) {
-				input.AuthorizerCredentialsArn = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerCredentialsArn"] !== void 0 && properties["AuthorizerCredentialsArn"] !== previousProperties["AuthorizerCredentialsArn"]) {
+			input.AuthorizerCredentialsArn = properties["AuthorizerCredentialsArn"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerPayloadFormatVersion"], previousProperties["AuthorizerPayloadFormatVersion"], "");
-			if (r.changed) {
-				input.AuthorizerPayloadFormatVersion = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerPayloadFormatVersion"] !== void 0 && properties["AuthorizerPayloadFormatVersion"] !== previousProperties["AuthorizerPayloadFormatVersion"]) {
+			input.AuthorizerPayloadFormatVersion = properties["AuthorizerPayloadFormatVersion"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerResultTtlInSeconds"], previousProperties["AuthorizerResultTtlInSeconds"], 0);
-			if (r.changed) {
-				input.AuthorizerResultTtlInSeconds = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerResultTtlInSeconds"] !== void 0 && properties["AuthorizerResultTtlInSeconds"] !== previousProperties["AuthorizerResultTtlInSeconds"]) {
+			input.AuthorizerResultTtlInSeconds = properties["AuthorizerResultTtlInSeconds"];
+			changed = true;
 		}
 		if (properties["EnableSimpleResponses"] !== void 0 && properties["EnableSimpleResponses"] !== previousProperties["EnableSimpleResponses"]) {
 			input.EnableSimpleResponses = properties["EnableSimpleResponses"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["IdentityValidationExpression"], previousProperties["IdentityValidationExpression"], "");
-			if (r.changed) {
-				input.IdentityValidationExpression = r.value;
-				changed = true;
-			}
+		if (properties["IdentityValidationExpression"] !== void 0 && properties["IdentityValidationExpression"] !== previousProperties["IdentityValidationExpression"]) {
+			input.IdentityValidationExpression = properties["IdentityValidationExpression"];
+			changed = true;
 		}
 		if (!changed) {
 			log.debug(`No mutable Authorizer fields changed for ${logicalId}; skipping UpdateAuthorizer`);
@@ -21880,6 +21836,11 @@ var ApiGatewayV2Provider = class {
 		for (const key of Object.keys(prevMap)) if (!Object.hasOwn(nextMap, key)) merged[key] = "";
 		return merged;
 	}
+	mapEntryAddedOrChanged(next, previous) {
+		if (next == null || typeof next !== "object" || Array.isArray(next)) return false;
+		const prevMap = previous != null && typeof previous === "object" && !Array.isArray(previous) ? previous : {};
+		return Object.entries(next).some(([key, value]) => !Object.prototype.hasOwnProperty.call(prevMap, key) || !this.deepEqual(value, prevMap[key]));
+	}
 	warnTlsConfigIgnoredIfPublic(logicalId, properties, log) {
 		if (properties["TlsConfig"] != null && properties["ConnectionType"] !== "VPC_LINK") log.warn(`AWS::ApiGatewayV2::Integration ${logicalId}: TlsConfig is only honored on a VPC_LINK (private) integration — AWS silently ignores it on a public one, and the value will never be readable back from AWS.`);
 	}
@@ -22006,7 +21967,7 @@ var CloudFrontOAIProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CloudFront OAI ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create CloudFront OAI ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
@@ -22040,7 +22001,7 @@ var CloudFrontOAIProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudFront OAI ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CloudFront OAI ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -22071,7 +22032,7 @@ var CloudFrontOAIProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudFront OAI ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CloudFront OAI ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -22151,7 +22112,7 @@ var CloudFrontOACProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create CloudFront Origin Access Control ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
@@ -22174,7 +22135,7 @@ var CloudFrontOACProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CloudFront Origin Access Control ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -22205,7 +22166,7 @@ var CloudFrontOACProvider = class {
 			}
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CloudFront Origin Access Control ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -22381,7 +22342,7 @@ var CloudFrontDistributionProvider = class {
 				throw markNonRetryable(new ProvisioningError(maskSecrets(`Failed to create CloudFront Distribution ${logicalId}: CloudFront refused the create because this deploy's CallerReference had been used before, which means an EARLIER attempt of this same create succeeded and cdkd never received its response. That distribution is LIVE, is not in cdkd state, and 'cdkd destroy' will not remove it — it bills until you delete it by hand. CloudFront does not return CallerReference from ListDistributions, so find it with 'aws cloudfront list-distributions' and match on ${this.orphanSearchHint(properties, maskSecrets)}; then disable and delete it (or import it with 'cdkd import') before re-running. The AWS error is on this error's cause.`), resourceType, logicalId, void 0, cause));
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create CloudFront Distribution ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	orphanSearchHint(properties, maskSecrets) {
@@ -22428,7 +22389,7 @@ var CloudFrontDistributionProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CloudFront Distribution ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -22479,7 +22440,7 @@ var CloudFrontDistributionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -22897,7 +22858,7 @@ var CloudFrontDistributionProvider = class {
 			}
 		} catch (err) {
 			const cause = err instanceof Error ? err : void 0;
-			throw new ProvisioningError(`CloudFront Distribution ${physicalId}: tag diff failed (removed=${removed.length}, upserts=${upserts.length}): ${err instanceof Error ? err.message : String(err)}. UpdateDistribution succeeded but TagResource/UntagResource did not — state has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`CloudFront Distribution ${physicalId}: tag diff failed (removed=${removed.length}, upserts=${upserts.length}): ${describeAwsFailure(err).detail}. UpdateDistribution succeeded but TagResource/UntagResource did not — state has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async import(input) {
@@ -22998,7 +22959,7 @@ var AgentCoreRuntimeProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create BedrockAgentCore Runtime ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create BedrockAgentCore Runtime ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties, context) {
@@ -23033,7 +22994,7 @@ var AgentCoreRuntimeProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update BedrockAgentCore Runtime ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update BedrockAgentCore Runtime ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -23049,7 +23010,7 @@ var AgentCoreRuntimeProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete BedrockAgentCore Runtime ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete BedrockAgentCore Runtime ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	buildAttributes(response, agentRuntimeName) {
@@ -23151,7 +23112,7 @@ var AgentCoreBrowserProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to adopt the AWS-managed default browser for ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to adopt the AWS-managed default browser for ${logicalId}: ${describeAwsFailure(error).detail}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties, _context) {
@@ -23218,7 +23179,7 @@ var AgentCoreCodeInterpreterProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to adopt the AWS-managed default code interpreter for ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to adopt the AWS-managed default code interpreter for ${logicalId}: ${describeAwsFailure(error).detail}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties, _context) {
@@ -23314,7 +23275,7 @@ var AgentCoreEvaluatorProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create BedrockAgentCore Evaluator ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create BedrockAgentCore Evaluator ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -23343,7 +23304,7 @@ var AgentCoreEvaluatorProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update BedrockAgentCore Evaluator ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update BedrockAgentCore Evaluator ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async syncTags(evaluatorArn, resourceType, logicalId, previousTagsRaw, nextTagsRaw) {
@@ -23374,7 +23335,7 @@ var AgentCoreEvaluatorProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete BedrockAgentCore Evaluator ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete BedrockAgentCore Evaluator ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -23516,7 +23477,7 @@ var StepFunctionsProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Step Functions state machine ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, stateMachineName, cause);
+			throw new ProvisioningError(`Failed to create Step Functions state machine ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, stateMachineName, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -23550,7 +23511,7 @@ var StepFunctionsProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Step Functions state machine ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Step Functions state machine ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -23566,7 +23527,7 @@ var StepFunctionsProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Step Functions state machine ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Step Functions state machine ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
@@ -23840,15 +23801,7 @@ var ECSProvider = class {
 	taskDefinitionCreateClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ECSProvider");
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::ECS::Service", /* @__PURE__ */ new Map([
-		["CapacityProviderStrategy", []],
-		["PlacementConstraints", []],
-		["PlatformVersion", "LATEST"],
-		["HealthCheckGracePeriodSeconds", 0],
-		["EnableECSManagedTags", false],
-		["PropagateTags", "NONE"],
-		["EnableExecuteCommand", false]
-	])]]);
+	removalDefaults = /* @__PURE__ */ new Map();
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::ECS::Cluster", /* @__PURE__ */ new Set([
 			"ClusterName",
@@ -24112,7 +24065,7 @@ var ECSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ECS cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete ECS cluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getClusterAttribute(physicalId, attributeName) {
@@ -24188,7 +24141,7 @@ var ECSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ECS task definition ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete ECS task definition ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getTaskDefinitionAttribute(physicalId, attributeName) {
@@ -24257,7 +24210,7 @@ var ECSProvider = class {
 					survivorArn = service.serviceArn;
 					log.warn(`Failed to clean up partially-created ECS service ${logicalIdShown(logicalId)} ${isPlainImportValue(service.serviceArn) ? `(${service.serviceArn})` : VALUE_NOT_SHOWN}: ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${deleteCommand.render()}`);
 				}
-				throw new Error(`ECS service ${logicalIdShown(logicalId)} did not reach steady state under --full-wait: ${waitError instanceof Error ? waitError.message : String(waitError)}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): ${listStopped.render()}, then ${aws`aws ecs describe-tasks${clusterArg} --tasks '<task-arn>' --query 'tasks[].[stoppedReason,containers[].reason]'`.render()}`, { cause: waitError });
+				throw new Error(`ECS service ${logicalIdShown(logicalId)} did not reach steady state under --full-wait: ${describeAwsFailure(waitError).detail}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): ${listStopped.render()}, then ${aws`aws ecs describe-tasks${clusterArg} --tasks '<task-arn>' --query 'tasks[].[stoppedReason,containers[].reason]'`.render()}`, { cause: waitError });
 			}
 			return {
 				physicalId: service.serviceArn,
@@ -24348,7 +24301,7 @@ var ECSProvider = class {
 		const serviceRegistriesInput = isEcsController && serviceRegistriesChanged ? this.convertServiceRegistries(properties["ServiceRegistries"]) ?? [] : void 0;
 		const capacityProviderStrategyInput = this.convertCapacityProviderStrategy(properties["CapacityProviderStrategy"]);
 		const placementConstraintsInput = this.convertPlacementConstraints(properties["PlacementConstraints"]);
-		const placementStrategyInput = clearOnUpdateRemoval(this.convertPlacementStrategies(properties["PlacementStrategies"] ?? properties["PlacementStrategy"]), previousProperties["PlacementStrategies"] ?? previousProperties["PlacementStrategy"], []);
+		const placementStrategyInput = this.convertPlacementStrategies(properties["PlacementStrategies"] ?? properties["PlacementStrategy"]);
 		const platformVersionInput = properties["PlatformVersion"];
 		const healthCheckGracePeriodSecondsInput = properties["HealthCheckGracePeriodSeconds"];
 		const enableECSManagedTagsInput = properties["EnableECSManagedTags"];
@@ -24449,7 +24402,7 @@ var ECSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete ECS service ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -25467,6 +25420,7 @@ var ELBv2Provider = class {
 		"Tags",
 		...LISTENER_LEFT_IN_PLACE_ON_REMOVAL
 	])]]);
+	lambdaClients = /* @__PURE__ */ new Map();
 	getClient() {
 		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client({
 			...ambientClientDefaults(),
@@ -25474,6 +25428,41 @@ var ELBv2Provider = class {
 		});
 		return this.elbv2Client;
 	}
+	async waitForLambdaTargetsActive(logicalId, targetType, targets) {
+		if (targetType !== "lambda") return;
+		for (const target of targets) {
+			const parts = typeof target.Id === "string" ? target.Id.split(":") : [];
+			if (parts[0] !== "arn" || parts[2] !== "lambda" || !parts[3]) {
+				this.logger.debug(`Skipping the Active wait for target ${String(target.Id)} of ${logicalId}: not a Lambda function ARN`);
+				continue;
+			}
+			const region = parts[3];
+			let client = this.lambdaClients.get(region);
+			if (!client) {
+				client = new LambdaClient({
+					...ambientClientDefaults(),
+					region
+				});
+				this.lambdaClients.set(region, client);
+			}
+			const watch = startInterruptWatch(`ELBv2 TargetGroup ${logicalId} Lambda target wait`);
+			const abort = new AbortController();
+			const poll = setInterval(() => {
+				if (watch.isInterrupted()) abort.abort();
+			}, 1e3);
+			try {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				await waitForLambdaFunctionActive(client, target.Id, abort.signal);
+			} catch (error) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				throw error;
+			} finally {
+				clearInterval(poll);
+				watch.dispose();
+			}
+			this.logger.debug(`Lambda target ${target.Id} of ${logicalId} is Active`);
+		}
+	}
 	maskedRetryLogger(maskSecrets) {
 		return createMaskedRetryLogger(this.logger, maskSecrets);
 	}
@@ -25845,7 +25834,7 @@ var ELBv2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete LoadBalancer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete LoadBalancer ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createTargetGroup(logicalId, resourceType, properties, maskSecrets) {
@@ -25892,6 +25881,7 @@ var ELBv2Provider = class {
 					this.logger.debug(`Applied ${tgAttributes.length} TargetGroup attribute(s) for ${logicalId}`);
 				}
 				if (targets.length > 0) {
+					await this.waitForLambdaTargetsActive(logicalId, properties["TargetType"], targets);
 					await this.getClient().send(new RegisterTargetsCommand({
 						TargetGroupArn: tgArn,
 						Targets: targets
@@ -25900,12 +25890,15 @@ var ELBv2Provider = class {
 				}
 			} catch (innerError) {
 				if (heldBefore !== "free") this.logger.warn(maskerOrIdentity(maskSecrets)(skippedCleanupText(heldBefore, `TargetGroup ${logicalId} (${tgArn})`, pasteableAwsCommand(maskSecrets)`aws elbv2 delete-target-group --target-group-arn ${tgArn}`.render())));
-				else try {
-					await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
-					this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
-				} catch (cleanupError) {
-					leftBehindArn = tgArn;
-					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-target-group --target-group-arn ${tgArn}`.render()}`);
+				else {
+					if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating TargetGroup ${logicalId} (${tgArn}) but before its targets were registered. Nothing in cdkd state refers to it, so cdkd is deleting it now. If that delete fails, remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-target-group --target-group-arn ${tgArn}`.render()}`));
+					try {
+						await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
+						this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
+					} catch (cleanupError) {
+						leftBehindArn = tgArn;
+						this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-target-group --target-group-arn ${tgArn}`.render()}`);
+					}
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -25973,6 +25966,7 @@ var ELBv2Provider = class {
 			const targetsToRegister = newTargets.filter((t) => !oldTargetKeys.has(targetKey(t)));
 			const targetsToDeregister = oldTargets.filter((t) => !newTargetKeys.has(targetKey(t)));
 			if (targetsToRegister.length > 0) {
+				await this.waitForLambdaTargetsActive(logicalId, properties["TargetType"], targetsToRegister);
 				await this.getClient().send(new RegisterTargetsCommand({
 					TargetGroupArn: physicalId,
 					Targets: targetsToRegister
@@ -26012,7 +26006,7 @@ var ELBv2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete TargetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async listenerPortHeld(loadBalancerArn, port) {
@@ -26164,7 +26158,7 @@ var ELBv2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Listener ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Listener ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	normalizeAttributes(raw) {
@@ -27786,7 +27780,6 @@ var DocDBProvider = class {
 	logger = getLogger().child("DocDBProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Map([["DeletionProtection", false]])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
 		"DBClusterIdentifier",
 		"EngineVersion",
@@ -27836,8 +27829,7 @@ var DocDBProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
 		switch (resourceType) {
 			case "AWS::DocDB::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -27889,7 +27881,7 @@ var DocDBProvider = class {
 				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbClusterIdentifier, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, dbClusterIdentifier, error instanceof Error ? error : void 0);
 			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbClusterIdentifier, createdResourceId);
 			throw thrown;
 		}
@@ -27904,7 +27896,7 @@ var DocDBProvider = class {
 				DBClusterIdentifier: physicalId,
 				EngineVersion: properties["EngineVersion"],
 				DeletionProtection: properties["DeletionProtection"],
-				BackupRetentionPeriod: clearOnUpdateRemoval(properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0, previousProperties["BackupRetentionPeriod"] != null ? Number(previousProperties["BackupRetentionPeriod"]) : void 0, 1),
+				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
 				PreferredBackupWindow: properties["PreferredBackupWindow"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
@@ -27923,7 +27915,7 @@ var DocDBProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteDBCluster(logicalId, physicalId, resourceType, context) {
@@ -27997,7 +27989,7 @@ var DocDBProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createDBInstance(logicalId, resourceType, properties) {
@@ -28030,7 +28022,7 @@ var DocDBProvider = class {
 				attributes: instanceAttributes(await this.describeDBInstance(dbInstanceIdentifier))
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbInstanceIdentifier, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBInstance ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, dbInstanceIdentifier, error instanceof Error ? error : void 0);
 			if (instanceCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
 			throw thrown;
 		}
@@ -28056,7 +28048,7 @@ var DocDBProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update DocDB DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update DocDB DBInstance ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteDBInstance(logicalId, physicalId, resourceType, context) {
@@ -28074,7 +28066,7 @@ var DocDBProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DocDB DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DocDB DBInstance ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async describeDBCluster(dbClusterIdentifier) {
@@ -28340,7 +28332,7 @@ var DocDBSubnetGroupProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DocDB DBSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbSubnetGroupName, cause);
+			throw new ProvisioningError(`Failed to create DocDB DBSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, dbSubnetGroupName, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -28367,7 +28359,7 @@ var DocDBSubnetGroupProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update DocDB DBSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update DocDB DBSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -28384,7 +28376,7 @@ var DocDBSubnetGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DocDB DBSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DocDB DBSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async import(input) {
@@ -28624,7 +28616,7 @@ var Route53Provider = class {
 					this.logger.warn(`Best-effort rollback DeleteHostedZone for ${zoneId} also failed: ${describeAwsFailure(deleteError).detail} — operator may need to clean up the orphan zone`);
 				}
 				const cause = uhfError instanceof Error ? uhfError : void 0;
-				throw new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${uhfError instanceof Error ? uhfError.message : String(uhfError)}`, resourceType, logicalId, zoneId, cause);
+				throw new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${describeAwsFailure(uhfError).detail}`, resourceType, logicalId, zoneId, cause);
 			}
 			const nameServers = response.DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully created hosted zone ${logicalId}: ${zoneId}`);
@@ -28638,7 +28630,7 @@ var Route53Provider = class {
 			};
 		} catch (error) {
 			if (zoneCreated) markAuxiliaryFailure(error, logicalId);
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			if (createdZoneId !== void 0 && !zoneRolledBack) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdZoneId);
 			throw thrown;
 		}
@@ -28652,7 +28644,7 @@ var Route53Provider = class {
 			try {
 				adopted = await this.findHostedZoneByCallerReference(input.Name, input.CallerReference);
 			} catch (lookupError) {
-				this.logger.warn(`CreateHostedZone for ${input.Name} was refused as already-existing, and the lookup that would have adopted the existing zone failed: ${lookupError instanceof Error ? lookupError.message : String(lookupError)}. Reporting the original error.`);
+				this.logger.warn(`CreateHostedZone for ${input.Name} was refused as already-existing, and the lookup that would have adopted the existing zone failed: ${describeAwsFailure(lookupError).detail}. Reporting the original error.`);
 				throw error;
 			}
 			if (!adopted?.Id) throw error;
@@ -28664,7 +28656,7 @@ var Route53Provider = class {
 					...described.DelegationSet ? { DelegationSet: described.DelegationSet } : {}
 				};
 			} catch (describeError) {
-				this.logger.warn(`Adopted hosted zone ${adopted.Id} but could not read it back: ${describeError instanceof Error ? describeError.message : String(describeError)}. Reporting the original error rather than returning a zone with no NameServers.`);
+				this.logger.warn(`Adopted hosted zone ${adopted.Id} but could not read it back: ${describeAwsFailure(describeError).detail}. Reporting the original error rather than returning a zone with no NameServers.`);
 				throw error;
 			}
 		}
@@ -28718,7 +28710,7 @@ var Route53Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteHostedZone(logicalId, physicalId, resourceType, context) {
@@ -28737,7 +28729,7 @@ var Route53Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to delete hosted zone ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw progress.stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -28824,7 +28816,7 @@ var Route53Provider = class {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			const cnameConflict = isCnameConflictRefusal(error);
-			const wrapped = new ProvisioningError(`Failed to create record set ${logicalId}: ${error instanceof Error ? error.message : String(error)}` + (cnameConflict ? CNAME_CONFLICT_COLLISION_NOTE : ""), resourceType, logicalId, void 0, cause);
+			const wrapped = new ProvisioningError(`Failed to create record set ${logicalId}: ${describeAwsFailure(error).detail}` + (cnameConflict ? CNAME_CONFLICT_COLLISION_NOTE : ""), resourceType, logicalId, void 0, cause);
 			throw cnameConflict ? markNameCollision(wrapped) : wrapped;
 		}
 	}
@@ -28865,7 +28857,7 @@ var Route53Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update record set ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update record set ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async findLiveRecordSet(hostedZoneId, properties) {
@@ -28955,7 +28947,7 @@ var Route53Provider = class {
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete record set ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete record set ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType) {
@@ -29752,7 +29744,7 @@ var WAFv2WebACLProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -29798,7 +29790,7 @@ var WAFv2WebACLProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update WAFv2 WebACL ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -29827,7 +29819,7 @@ var WAFv2WebACLProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete WAFv2 WebACL ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	warnOnSdkUnsupportedRuleKeys(logicalId, rules) {
@@ -30252,7 +30244,7 @@ var CognitoUserPoolProvider = class {
 			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], replayWarn(this.logger, context));
 			this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
 		} catch (error) {
-			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, poolName, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(describeAwsFailure(error).detail, resourceType, logicalId, poolName, error instanceof Error ? error : void 0);
 		}
 		this.assertMfaCombinationApplicable(logicalId, resourceType, poolName, properties, mfaConfiguration);
 		let createdUserPoolId;
@@ -30332,7 +30324,7 @@ var CognitoUserPoolProvider = class {
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
+			const thrown = new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, poolName, cause);
 			if (poolLeftBehind && createdUserPoolId) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
 				markNonRetryable(thrown);
@@ -30484,7 +30476,7 @@ var CognitoUserPoolProvider = class {
 		try {
 			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], stateBorneDesired ? { onUnusable: (message) => this.logger.warn(message) } : {});
 		} catch (error) {
-			throw new ProvisioningError(`${error instanceof Error ? error.message : String(error)}. Nothing was applied to user pool ${physicalId}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(`${describeAwsFailure(error).detail}. Nothing was applied to user pool ${physicalId}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		}
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
 		const liveFirstAuthFactors = mfaPreflightNeedsLiveSignInPolicy(properties, mfaConfiguration) ? await this.readLiveAllowedFirstAuthFactors(physicalId) : void 0;
@@ -30554,7 +30546,7 @@ var CognitoUserPoolProvider = class {
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError || error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Cognito User Pool ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema, deletionProtected = false) {
@@ -30740,7 +30732,7 @@ var CognitoUserPoolProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Cognito User Pool ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async sendEchoedDeletionProtection(physicalId, pool, value, opts = {}) {
@@ -30936,7 +30928,6 @@ var ElastiCacheProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ElastiCacheProvider");
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["AutoMinorVersionUpgrade", true]])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
 		"CacheSubnetGroupName",
 		"CacheSubnetGroupDescription",
@@ -30993,8 +30984,7 @@ var ElastiCacheProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
 		switch (resourceType) {
 			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -31029,7 +31019,7 @@ var ElastiCacheProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CacheSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, cacheSubnetGroupName, cause);
+			throw new ProvisioningError(`Failed to create CacheSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, cacheSubnetGroupName, cause);
 		}
 	}
 	async updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -31056,7 +31046,7 @@ var ElastiCacheProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CacheSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CacheSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteSubnetGroup(logicalId, physicalId, resourceType, context) {
@@ -31072,7 +31062,7 @@ var ElastiCacheProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CacheSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CacheSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createCacheCluster(logicalId, resourceType, properties) {
@@ -31129,7 +31119,7 @@ var ElastiCacheProvider = class {
 				attributes
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create CacheCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, cacheClusterId, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create CacheCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, cacheClusterId, error instanceof Error ? error : void 0);
 			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, cacheClusterId);
 			throw thrown;
 		}
@@ -31141,7 +31131,6 @@ var ElastiCacheProvider = class {
 			const rawSgIds = properties["VpcSecurityGroupIds"];
 			const sgIds = rawSgIds && rawSgIds.length > 0 ? rawSgIds : void 0;
 			const notificationTopicArn = properties["NotificationTopicArn"];
-			const notificationRemoved = notificationTopicArn === void 0 && previousProperties["NotificationTopicArn"] != null;
 			await this.getClient().send(new ModifyCacheClusterCommand({
 				CacheClusterId: physicalId,
 				NumCacheNodes: properties["NumCacheNodes"] != null ? Number(properties["NumCacheNodes"]) : void 0,
@@ -31149,11 +31138,10 @@ var ElastiCacheProvider = class {
 				CacheParameterGroupName: properties["CacheParameterGroupName"],
 				EngineVersion: properties["EngineVersion"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
-				SnapshotRetentionLimit: clearOnUpdateRemoval(properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0, previousProperties["SnapshotRetentionLimit"] != null ? Number(previousProperties["SnapshotRetentionLimit"]) : void 0, 0),
+				SnapshotRetentionLimit: properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0,
 				SnapshotWindow: properties["SnapshotWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 				NotificationTopicArn: notificationTopicArn,
-				...notificationRemoved && { NotificationTopicStatus: "inactive" },
 				...notificationTopicArn !== void 0 && { NotificationTopicStatus: "active" },
 				LogDeliveryConfigurations: this.buildLogDeliveryConfigurationsForUpdate(properties["LogDeliveryConfigurations"], previousProperties["LogDeliveryConfigurations"]),
 				IpDiscovery: properties["IpDiscovery"],
@@ -31182,7 +31170,7 @@ var ElastiCacheProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CacheCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CacheCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteCacheCluster(logicalId, physicalId, resourceType, context) {
@@ -31209,7 +31197,7 @@ var ElastiCacheProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CacheCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CacheCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	buildLogDeliveryConfigurationsForUpdate(newConfigs, previousConfigs) {
@@ -31631,7 +31619,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			}
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Cloud Map namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Cloud Map namespace ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createHttpNamespace(logicalId, resourceType, properties, maskSecrets) {
@@ -31944,7 +31932,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete service discovery service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete service discovery service ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	extractSoaTtlProperties(properties) {
@@ -33026,7 +33014,7 @@ var AppSyncProvider = class {
 			body = await resp.Body.transformToString();
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			throw new ProvisioningError(`Failed to fetch ${propertyPath} s3://${bucket}/${key} for ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(`Failed to fetch ${propertyPath} s3://${bucket}/${key} for ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
 		if (body.length === 0) throw new ProvisioningError(`${propertyPath} object s3://${bucket}/${key} returned an empty body`, resourceType, logicalId);
 		return body;
@@ -33201,7 +33189,7 @@ var AppSyncProvider = class {
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (apiLeftBehind && createdApiId) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
 				markNonRetryable(thrown);
@@ -33270,7 +33258,7 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete GraphQL API ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createGraphQLSchema(logicalId, resourceType, properties) {
@@ -33300,7 +33288,7 @@ var AppSyncProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create GraphQL Schema ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create GraphQL Schema ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async createDataSource(logicalId, resourceType, properties, context) {
@@ -33331,7 +33319,7 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DataSource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create DataSource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 		const dataSourceArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/datasources/${name}`, logicalId, physicalId);
 		return {
@@ -33363,7 +33351,7 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DataSource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DataSource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createResolver(logicalId, resourceType, properties, context) {
@@ -33401,7 +33389,7 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully created Resolver ${logicalId}: ${physicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Resolver ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create Resolver ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 		const resolverArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`, logicalId, physicalId);
 		return {
@@ -33432,7 +33420,7 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Resolver ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Resolver ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createApiKey(logicalId, resourceType, properties, context) {
@@ -33461,7 +33449,7 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully created ApiKey ${logicalId}: ${apiKeyId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create ApiKey ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create ApiKey ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 		const physicalId = packCompositeId(resourceType, logicalId, [{
 			name: "apiId",
@@ -33528,7 +33516,7 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ApiKey ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete ApiKey ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	isNotFoundError(error) {
@@ -34189,7 +34177,7 @@ var GlueProvider = class {
 				previousDatabaseInput
 			});
 		} catch (error) {
-			throw new ProvisioningError(`${v(error instanceof Error ? error.message : String(error))}. Nothing was applied to Glue Database ${logicalId}; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(`${v(describeAwsFailure(error).detail)}. Nothing was applied to Glue Database ${logicalId}; fix the template value`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 		}
 		const liveParameters = await this.readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId, log.mask);
 		try {
@@ -34230,7 +34218,7 @@ var GlueProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Database ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createTable(logicalId, resourceType, properties, context) {
@@ -34373,7 +34361,7 @@ var GlueProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Table ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	preserveAwsManagedParameters(built, desiredParameters, previousParameters, liveParameters) {
@@ -34832,7 +34820,7 @@ var GlueWorkflowProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Workflow ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Glue Workflow ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -34960,7 +34948,7 @@ var GlueSecurityConfigurationProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue SecurityConfiguration ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Glue SecurityConfiguration ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35211,7 +35199,7 @@ var GlueJobProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Job ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Glue Job ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35509,7 +35497,7 @@ var GlueCrawlerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Crawler ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Crawler ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async stopCrawlerAndWait(physicalId, log = {
@@ -35758,7 +35746,7 @@ var GlueConnectionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Connection ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(log.mask(`Failed to delete Glue Connection ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35983,7 +35971,7 @@ var GlueTriggerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -36197,7 +36185,7 @@ var KMSProvider = class {
 				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. If the deploy then FAILS (outside a rollback's re-create), its rollback journal records the key for \`cdkd rollback --revert-failed\` to schedule its deletion; otherwise schedule it yourself with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (createdKeyId !== void 0) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
 				if (supersededPending) markSupersedesEarlierCreate(thrown);
@@ -36370,7 +36358,7 @@ var KMSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteKey(logicalId, physicalId, resourceType, properties, context) {
@@ -36390,7 +36378,7 @@ var KMSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to schedule deletion for KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to schedule deletion for KMS Key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyTagDiff(keyId, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
@@ -36435,7 +36423,7 @@ var KMSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create KMS Alias ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create KMS Alias ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async updateAlias(logicalId, physicalId, resourceType, properties) {
@@ -36454,7 +36442,7 @@ var KMSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update KMS Alias ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update KMS Alias ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteAlias(logicalId, physicalId, resourceType, context) {
@@ -36470,7 +36458,7 @@ var KMSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete KMS Alias ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete KMS Alias ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
@@ -36820,7 +36808,7 @@ var BudgetsBudgetProvider = class {
 				try {
 					await this.addNotificationsOnly(accountId, physicalId, newNotifications);
 				} catch (error) {
-					throw new ProvisioningError(`Failed to update budget ${logicalId}: adding ${newNotifications.length} desired notification(s) beside every notification the budget already holds (the recorded NotificationsWithSubscribers is not a list cdkd can read, so none was deleted; a budget allows at most 5 notifications and 10 email subscribers each): ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+					throw new ProvisioningError(`Failed to update budget ${logicalId}: adding ${newNotifications.length} desired notification(s) beside every notification the budget already holds (the recorded NotificationsWithSubscribers is not a list cdkd can read, so none was deleted; a budget allows at most 5 notifications and 10 email subscribers each): ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 				}
 				this.logger.warn(safeMsg`The recorded NotificationsWithSubscribers of budget ${logicalId} is not a list cdkd can read, so cdkd deleted no notification or subscriber and only added the desired ones. Delete any the template no longer names yourself.`);
 			}
@@ -36998,7 +36986,7 @@ var BudgetsBudgetProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete budget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete budget ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -37012,7 +37000,7 @@ var BudgetsBudgetProvider = class {
 			return await this.budgetArn(accountId, physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async import(input) {
@@ -37301,7 +37289,7 @@ var KinesisStreamProvider = class {
 			};
 		} catch (error) {
 			if (streamCreated) markAuxiliaryFailure(error, logicalId);
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create Kinesis stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, streamName, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create Kinesis stream ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, streamName, error instanceof Error ? error : void 0);
 			if (streamCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, streamName);
 			throw thrown;
 		}
@@ -37427,7 +37415,7 @@ var KinesisStreamProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Kinesis stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Kinesis stream ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -37446,7 +37434,7 @@ var KinesisStreamProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Kinesis stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Kinesis stream ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		await waitForGoneAfterDelete({
 			what: `Kinesis stream ${physicalId}`,
@@ -37693,7 +37681,7 @@ var KinesisStreamConsumerProvider = class {
 				}
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to register Kinesis stream consumer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, consumerName, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to register Kinesis stream consumer ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, consumerName, error instanceof Error ? error : void 0);
 			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
 			throw thrown;
 		}
@@ -37761,7 +37749,7 @@ var KinesisStreamConsumerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to deregister Kinesis stream consumer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to deregister Kinesis stream consumer ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -37988,7 +37976,7 @@ var SchedulerScheduleProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Schedule ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create Schedule ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async readIdentity(name, groupName) {
@@ -38089,7 +38077,7 @@ var SchedulerScheduleProvider = class {
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Schedule ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Schedule ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteByRecordedIdentity(logicalId, physicalId, resourceType, recorded, context) {
@@ -38200,7 +38188,7 @@ var SchedulerScheduleProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Schedule ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Schedule ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -38210,7 +38198,7 @@ var SchedulerScheduleProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const customGroupHint = error instanceof ResourceNotFoundException$13 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
-			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? String(error)}.${customGroupHint}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? safeStringify(error)}.${customGroupHint}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -38529,7 +38517,7 @@ var PipesPipeProvider = class {
 			createdIdentity = pipeIdentityToken(name, created?.Arn, created?.CreationTime);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Pipe ${logicalId}: ${mask(cause?.message ?? String(error))}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create Pipe ${logicalId}: ${mask(cause?.message ?? safeStringify(error))}`, resourceType, logicalId, void 0, cause);
 		}
 		let settled;
 		try {
@@ -38601,7 +38589,7 @@ var PipesPipeProvider = class {
 			if (error instanceof ProvisioningError) throw error;
 			if (error instanceof NotFoundException$6) assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Pipe ${logicalId}: ${mask(cause?.message ?? String(error))}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Pipe ${logicalId}: ${mask(cause?.message ?? safeStringify(error))}`, resourceType, logicalId, physicalId, cause);
 		}
 		return {
 			physicalId,
@@ -38622,7 +38610,7 @@ var PipesPipeProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Pipe ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Pipe ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 		await waitForGoneAfterDelete({
 			what: `Pipe ${physicalId}`,
@@ -39255,7 +39243,7 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete EFS FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType, log) {
@@ -39325,7 +39313,7 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS MountTarget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete EFS MountTarget ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async waitForMountTargetDeleted(mountTargetId, logicalId) {
@@ -39454,7 +39442,7 @@ var EFSProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EFS AccessPoint ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete EFS AccessPoint ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
@@ -39852,7 +39840,7 @@ var FSxFileSystemProvider = class {
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const message = `Failed to create FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
+			const message = `Failed to create FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`;
 			if (survivorId !== void 0) {
 				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
@@ -40088,7 +40076,7 @@ var FSxFileSystemProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	detectVariantConfigKey(properties, previousProperties) {
@@ -40281,7 +40269,7 @@ var FSxFileSystemProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete FSx FileSystem ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType);
 		this.logger.debug(`Successfully deleted FSx FileSystem ${logicalId}`);
@@ -40375,7 +40363,7 @@ var FSxFileSystemProvider = class {
 			} catch (error) {
 				if (error instanceof FileSystemNotFound$1) return;
 				const cause = error instanceof Error ? error : void 0;
-				throw new ProvisioningError(`Failed to poll FSx FileSystem ${fileSystemId} deletion: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, fileSystemId, cause);
+				throw new ProvisioningError(`Failed to poll FSx FileSystem ${fileSystemId} deletion: ${describeAwsFailure(error).detail}`, resourceType, logicalId, fileSystemId, cause);
 			}
 			if (!fs && sawResponse) return;
 			if (!fs) {
@@ -40885,7 +40873,7 @@ var EMRClusterProvider = class {
 				throw error;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const message = `Failed to create EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
+			const message = `Failed to create EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`;
 			if (survivorId !== void 0) {
 				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
@@ -41083,7 +41071,7 @@ var EMRClusterProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyTagDiff(physicalId, resourceType, logicalId, prevTagsRaw, nextTagsRaw) {
@@ -41137,7 +41125,7 @@ var EMRClusterProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to describe EMR Cluster ${logicalId} before deletion: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to describe EMR Cluster ${logicalId} before deletion: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		const currentState = current?.Status?.State;
 		if (currentState && TERMINAL_STATES.has(currentState)) {
@@ -41166,7 +41154,7 @@ var EMRClusterProvider = class {
 			flip.deleteAccepted = true;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to terminate EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to terminate EMR Cluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		await this.waitForClusterTerminated(physicalId, logicalId, resourceType);
 		this.logger.debug(`Successfully deleted EMR Cluster ${logicalId}`);
@@ -41213,7 +41201,7 @@ var EMRClusterProvider = class {
 			} catch (error) {
 				if (error instanceof InvalidRequestException) return;
 				const cause = error instanceof Error ? error : void 0;
-				throw new ProvisioningError(`Failed to poll EMR Cluster ${clusterId} termination: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, clusterId, cause);
+				throw new ProvisioningError(`Failed to poll EMR Cluster ${clusterId} termination: ${describeAwsFailure(error).detail}`, resourceType, logicalId, clusterId, cause);
 			}
 			const state = cluster?.Status?.State;
 			if (state && TERMINAL_STATES.has(state)) {
@@ -41557,7 +41545,7 @@ var EMRInstanceGroupConfigProvider = class {
 				}
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			let leftBehindGroupId = createdGroupId;
 			if (leftBehindGroupId && properties["InstanceRole"] === "TASK") {
 				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
@@ -41663,7 +41651,7 @@ var EMRInstanceGroupConfigProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -41883,7 +41871,7 @@ var EMRInstanceFleetConfigProvider = class {
 				}
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			if (createdFleetId) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
 				markNonRetryable(thrown);
@@ -41971,7 +41959,7 @@ var EMRInstanceFleetConfigProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -42267,7 +42255,7 @@ var FirehoseProvider = class {
 				attributes: { Arn: arn }
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create Firehose delivery stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create Firehose delivery stream ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			if (createdStreamName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdStreamName);
 			throw thrown;
 		}
@@ -42279,7 +42267,7 @@ var FirehoseProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Firehose delivery stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update Firehose delivery stream ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -42418,7 +42406,7 @@ var FirehoseProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Firehose delivery stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete Firehose delivery stream ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		await waitForGoneAfterDelete({
 			what: `Firehose delivery stream ${physicalId}`,
@@ -43073,7 +43061,7 @@ var CloudTrailProvider = class {
 		} catch (error) {
 			if (trailCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create CloudTrail Trail ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (createdTrailArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdTrailArn);
 			throw thrown;
 		}
@@ -43161,7 +43149,7 @@ var CloudTrailProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -43186,7 +43174,7 @@ var CloudTrailProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			const failure = new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -43514,7 +43502,7 @@ var CodeBuildProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create CodeBuild Project ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -43532,7 +43520,7 @@ var CodeBuildProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CodeBuild Project ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -43548,7 +43536,7 @@ var CodeBuildProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CodeBuild Project ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CodeBuild Project ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	getAttribute(_physicalId, _resourceType, attributeName) {
@@ -43917,7 +43905,7 @@ var CodeCommitRepositoryProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+			const thrown = new ProvisioningError(`Failed to create CodeCommit Repository ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, repositoryName, cause);
 			if (leftLiveName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftLiveName);
 			throw thrown;
 		}
@@ -44022,7 +44010,7 @@ var CodeCommitRepositoryProvider = class {
 					}));
 				} catch (error) {
 					if (retainedCount === 0) throw error;
-					throw new Error(`PutRepositoryTriggers failed with ${retainedCount} live trigger(s) the desired Triggers does not name kept beside the desired ones (the recorded Triggers is not a list cdkd can read; CodeCommit allows at most 10 triggers per repository): ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+					throw new Error(`PutRepositoryTriggers failed with ${retainedCount} live trigger(s) the desired Triggers does not name kept beside the desired ones (the recorded Triggers is not a list cdkd can read; CodeCommit allows at most 10 triggers per repository): ${describeAwsFailure(error).detail}`, { cause: error });
 				}
 				this.logger.debug(`Updated triggers for ${currentName} (${newSdkTriggers.length} trigger(s))`);
 			}
@@ -44036,7 +44024,7 @@ var CodeCommitRepositoryProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update CodeCommit Repository ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	readDesiredLists(logicalId, resourceType, values, physicalId) {
@@ -44121,7 +44109,7 @@ var CodeCommitRepositoryProvider = class {
 				return withIndeterminateGuard(void 0, guard);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete CodeCommit Repository ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		if (!deletedRepositoryId) {
 			const clientRegion = await this.getClient().config.region();
@@ -44349,30 +44337,6 @@ var DLMLifecyclePolicyProvider = class {
 			...properties["Exclusions"] != null && { Exclusions: properties["Exclusions"] }
 		};
 	}
-	buildRemovalResets(properties, previousProperties) {
-		const resets = {};
-		const createInterval = clearOnUpdateRemoval(properties["CreateInterval"] != null ? Number(properties["CreateInterval"]) : void 0, previousProperties["CreateInterval"] != null ? Number(previousProperties["CreateInterval"]) : void 0, 1);
-		if (createInterval !== void 0) resets.CreateInterval = createInterval;
-		const retainInterval = clearOnUpdateRemoval(properties["RetainInterval"] != null ? Number(properties["RetainInterval"]) : void 0, previousProperties["RetainInterval"] != null ? Number(previousProperties["RetainInterval"]) : void 0, 7);
-		if (retainInterval !== void 0) resets.RetainInterval = retainInterval;
-		const copyTags = clearOnUpdateRemoval(properties["CopyTags"] ?? void 0, previousProperties["CopyTags"] ?? void 0, false);
-		if (copyTags !== void 0) resets.CopyTags = copyTags;
-		const extendDeletion = clearOnUpdateRemoval(properties["ExtendDeletion"] ?? void 0, previousProperties["ExtendDeletion"] ?? void 0, false);
-		if (extendDeletion !== void 0) resets.ExtendDeletion = extendDeletion;
-		const crossRegionCopyTargets = clearOnUpdateRemoval(properties["CrossRegionCopyTargets"] ?? void 0, previousProperties["CrossRegionCopyTargets"] ?? void 0, []);
-		if (crossRegionCopyTargets !== void 0) resets.CrossRegionCopyTargets = crossRegionCopyTargets;
-		const defaultPolicy = properties["DefaultPolicy"] ?? previousProperties["DefaultPolicy"];
-		const exclusionsClear = defaultPolicy === "VOLUME" ? {
-			ExcludeBootVolumes: false,
-			ExcludeVolumeTypes: [],
-			ExcludeTags: []
-		} : defaultPolicy === "INSTANCE" ? { ExcludeTags: [] } : void 0;
-		if (exclusionsClear !== void 0) {
-			const exclusions = clearOnUpdateRemoval(properties["Exclusions"] ?? void 0, previousProperties["Exclusions"] ?? void 0, exclusionsClear);
-			if (exclusions !== void 0) resets.Exclusions = exclusions;
-		}
-		return resets;
-	}
 	async fetchPolicyArn(policyId) {
 		return (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: policyId }))).Policy?.PolicyArn ?? "";
 	}
@@ -44414,7 +44378,7 @@ var DLMLifecyclePolicyProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -44426,7 +44390,8 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new UpdateLifecyclePolicyCommand({
 				PolicyId: physicalId,
 				...this.toSdkFields(properties),
-				...this.buildRemovalResets(properties, previousProperties)
+				...properties["CreateInterval"] != null && { CreateInterval: Number(properties["CreateInterval"]) },
+				...properties["RetainInterval"] != null && { RetainInterval: Number(properties["RetainInterval"]) }
 			}));
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 			const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
@@ -44460,7 +44425,7 @@ var DLMLifecyclePolicyProvider = class {
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -44476,7 +44441,7 @@ var DLMLifecyclePolicyProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -44486,7 +44451,7 @@ var DLMLifecyclePolicyProvider = class {
 			return await this.fetchPolicyArn(physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to resolve Arn for DLM Lifecycle Policy ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to resolve Arn for DLM Lifecycle Policy ${physicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
@@ -44652,7 +44617,7 @@ var S3VectorsProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 VectorBucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create S3 VectorBucket ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async deleteVectorBucket(logicalId, physicalId, resourceType, context) {
@@ -44669,7 +44634,7 @@ var S3VectorsProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 VectorBucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete S3 VectorBucket ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async emptyVectorBucket(logicalId, vectorBucketName) {
@@ -44869,7 +44834,7 @@ var S3DirectoryBucketProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, bucketName, cause);
+			throw new ProvisioningError(`Failed to create S3 Express Directory Bucket ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, bucketName, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -44905,7 +44870,7 @@ var S3DirectoryBucketProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update S3 Express Directory Bucket ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -44923,7 +44888,7 @@ var S3DirectoryBucketProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(mask(`Failed to delete S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`), resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(mask(`Failed to delete S3 Express Directory Bucket ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteBucketWithEmptyRetry(logicalId, bucketName, allowAutoEmpty, maskSecrets) {
@@ -45111,7 +45076,7 @@ var S3TablesProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update S3 Tables resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update S3 Tables resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -45150,7 +45115,7 @@ var S3TablesProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 Table Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create S3 Table Bucket ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async deleteTableBucket(logicalId, physicalId, resourceType, context) {
@@ -45167,7 +45132,7 @@ var S3TablesProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 Table Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete S3 Table Bucket ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async emptyTableBucket(tableBucketARN) {
@@ -45247,7 +45212,7 @@ var S3TablesProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 Tables Namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create S3 Tables Namespace ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async deleteNamespace(logicalId, physicalId, resourceType, context) {
@@ -45268,7 +45233,7 @@ var S3TablesProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 Tables Namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete S3 Tables Namespace ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createTable(logicalId, resourceType, properties, context) {
@@ -45319,7 +45284,7 @@ var S3TablesProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create S3 Tables Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create S3 Tables Table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 			if (tableCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, physicalId);
 			throw thrown;
 		}
@@ -45582,7 +45547,7 @@ var S3TablesProvider = class {
 			resolved = await this.resolveTableParts(physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to resolve S3 Tables Table ${logicalId} (${physicalId}): ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to resolve S3 Tables Table ${logicalId} (${physicalId}): ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 		if (resolved === "not-found") {
 			const clientRegion = await this.getClient().config.region();
@@ -45607,7 +45572,7 @@ var S3TablesProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete S3 Tables Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete S3 Tables Table ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	tagListToSdkMap(tags) {
@@ -45662,7 +45627,7 @@ var S3TablesProvider = class {
 			}));
 		} catch (err) {
 			const cause = err instanceof Error ? err : void 0;
-			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${describeAwsFailure(err).detail}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
 			await this.getClient().send(new TagResourceCommand$27({
@@ -45671,7 +45636,7 @@ var S3TablesProvider = class {
 			}));
 		} catch (err) {
 			const cause = err instanceof Error ? err : void 0;
-			throw new ProvisioningError(`applyTableTagsDiff: TagResource failed for ${resourceArn} (keys: ${Object.keys(upserts).join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`applyTableTagsDiff: TagResource failed for ${resourceArn} (keys: ${Object.keys(upserts).join(", ")}): ${describeAwsFailure(err).detail}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async applyTableBucketTagsDiff(logicalId, physicalId, resourceType, previousTags, newTags) {
@@ -45689,7 +45654,7 @@ var S3TablesProvider = class {
 			}));
 		} catch (err) {
 			const cause = err instanceof Error ? err : void 0;
-			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${describeAwsFailure(err).detail}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
 			await this.getClient().send(new TagResourceCommand$27({
@@ -45698,7 +45663,7 @@ var S3TablesProvider = class {
 			}));
 		} catch (err) {
 			const cause = err instanceof Error ? err : void 0;
-			throw new ProvisioningError(`applyTableBucketTagsDiff: TagResource failed for ${resourceArn} (keys: ${Object.keys(upserts).join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`applyTableBucketTagsDiff: TagResource failed for ${resourceArn} (keys: ${Object.keys(upserts).join(", ")}): ${describeAwsFailure(err).detail}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 };
@@ -45813,7 +45778,7 @@ var ECRProvider = class {
 		} catch (error) {
 			if (repositoryCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create ECR Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+			const thrown = new ProvisioningError(`Failed to create ECR Repository ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, repositoryName, cause);
 			if (repositoryCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, repositoryName);
 			throw thrown;
 		}
@@ -45909,7 +45874,7 @@ var ECRProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update ECR Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update ECR Repository ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -45931,7 +45896,7 @@ var ECRProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ECR Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete ECR Repository ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
@@ -46057,6 +46022,7 @@ var NestedStackProvider = class {
 				physicalId,
 				attributes: childOutputs.attributes,
 				...childOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: childOutputs.noEchoAttributeNames },
+				secretNamedAttributeNames: childOutputs.secretNamedAttributeNames,
 				...pendingRecord && { effectiveProperties: pendingRecord }
 			};
 		} catch (error) {
@@ -46084,6 +46050,7 @@ var NestedStackProvider = class {
 			wasReplaced: false,
 			attributes: updatedOutputs.attributes,
 			...updatedOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: updatedOutputs.noEchoAttributeNames },
+			secretNamedAttributeNames: updatedOutputs.secretNamedAttributeNames,
 			...pendingRecord && { effectiveProperties: pendingRecord }
 		};
 	}
@@ -46267,9 +46234,11 @@ var NestedStackProvider = class {
 			attributes[attributeName] = recovered;
 			noEchoAttributeNames.push(attributeName);
 		}
+		const childResources = childStateData.state.resources;
 		return {
 			attributes,
-			noEchoAttributeNames
+			noEchoAttributeNames,
+			secretNamedAttributeNames: childResources !== null && typeof childResources === "object" ? secretNamedAttributeNamesOf(attributes, childResources, rowSecrets) : []
 		};
 	}
 	requireContext() {
@@ -46497,7 +46466,7 @@ var ACMCertificateProvider = class {
 				throw thrown;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const detail = error instanceof Error ? error.message : String(error);
+			const detail = describeAwsFailure(error).detail;
 			const message = `Failed to create ACM certificate ${logicalIdShown(logicalId)}: ${detail}`;
 			if (requestedArn && survivorNote !== void 0) {
 				const thrown = new ProvisioningError(`${message} ${survivorNote}`, resourceType, logicalId, requestedArn, cause);
@@ -46605,7 +46574,7 @@ var ACMCertificateProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update ACM certificate ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -46625,7 +46594,7 @@ var ACMCertificateProvider = class {
 			this.logger.debug(`Successfully deleted ACM certificate ${logicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete ACM certificate ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -46747,4 +46716,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CDxfoC_T.js.map
+//# sourceMappingURL=provider-classes-BSUoljqw.js.map