@go-to-k/cdkd 0.301.3 → 0.301.5

package/dist/{provider-classes-59TTNMFB.js → provider-classes-DPwEHVDJ.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-BkeM7IXi.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ai as getAccountInfo, Ao as requireConfigString, As as recordAttributeIdCopy, Bi as parseWebACLArn, Bl as displayAssemblyPath, C as withApiLimit, Cc as rewriteTemplateAssetReferences, Co as configBooleanRefusal, Do as replayWarn, Eo as readConfigString, Fo as canonicalLambdaFunctionName, Fr as slowCcOperationTimeoutMs, G as deleteBudgetKey, Ga as refuseMalformedResourcesForDestroy, Gt as awaitInFlightSibling, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Hl as resolveAssemblyPath, Hr as withIndeterminateGuard, Ht as withNestedStackContext, Io as lambdaFunctionNameForMask, Ir as unchangedBehindSecretReference, J as DELETE_INDEX_WAIT_PROCEED_NOTE, Jr as observeThenDisableInstanceApiTermination, K as resolveDynamoDbDeleteBudgetClock, Kr as ec2InstanceProtectionSite, Lo as sameLambdaFunctionAddress, Lt as revertNestedChildFromJournal, Ns as carriesSecretMask, Ol as canonicalizeRegion, Oo as requireConfigArray, Os as recoverMaskedOutput, Po as withRetry, Pt as getNestedRevertRun, Q as ECR_AUTO_DELETE_IMAGES_TAG, S as lookupEachName, Si as s3BucketWebsiteUrl, So as coerceCfnInteger, Ss as dynamicReferenceTokens, Ta as refuseMalformedNestedChildOutputs, Tl as decodeListingKey, To as configStringRefusal, Tr as waitForLambdaFunctionActive, U as beginDeleteWait, Ui as passedParameterClassesOf, Ur as isWaitAbandonedError, V as DynamoDBGlobalTableProvider, Vl as renderAssemblyPathEscape, Vr as deleteSkipReason, Vt as getCurrentNestedStackContext, W as compensateRemovedDeletionProtection, Wr as markWaitAbandoned, X as deleteTableWithIndexBusyRetry, Xi as accountArgs, Xr as reEnableInstanceApiTermination, Xt as replacedDeleteFailureVerdict, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as passedNoEchoParametersOf, Yr as reDisableInstanceApiTermination, Z as waitForIndexesSettled, _o as coerceWarmThroughput$1, _r as tagPlanWarning, _s as redactSecretsForState, ao as findSilentDropProperties, b as chunks, bi as s3BucketDualStackDomainName, bo as toFiniteNumber, bs as withoutPhysicalNameCopies, c as isAbsoluteAssetPath, cr as acquireIdempotencyToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as DBPROXY_TAGS_WHAT, et as hasCdkAutoDeleteTag, fn as isRedactedRecordedValue, fr as DBPROXY_TAG_OPTIONS, go as WARM_THROUGHPUT_MEMBERS, gr as tagMapAsList, gs as snapshotPassProvenance, hi as outputReferenceProvenanceOf, hr as refuseMalformedDesiredTags, hs as recordReferenceProvenanceEntry, ir as earliestDefined, kl as derivePartitionAndUrlSuffix, ko as requireConfigObject, kr as getCurrentResourceSecrets, ks as physicalNameCopiesOf, l as listNestedTemplateRows, ln as getCurrentProducerRegions, lr as isRefusedByName, mn as redactedDeleteAddressSkip, mr as readTagList, ms as markSameGenerationBag, ns as hasMaskableValues, nt as getPriorAttempts, or as reserveStackCreateToken, pi as isSettledInstanceState, pn as redactedDeleteAddressFields, pr as planTagDiff, q as resolveDynamoDbDeleteBudgetMs, qr as isTerminationProtectionPropagationError, qt as getStackRecords, ro as withheldAccountClause, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, so as withoutSilentDropProperties, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, ur as markDeleteStarted, vc as stringifyValue, vi as s3BucketArn, vo as isWarmThroughputDecrease, vr as definedAttributes, wo as configIntegerRefusal, x as isAccessDeniedError, xi as s3BucketRegionalDomainName, xo as coerceCfnBoolean, yi as s3BucketDomainName, yo as toCfnInteger, yr as stringifyIfAssigned, zl as describeFileReadFailure } from "./deploy-engine-CZaafy9R.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-De0ZPOAF.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CYtSW-WU.js";
-import { RDSProvider } from "./rds-provider-Dadp11aB.js";
-import { NeptuneProvider } from "./neptune-provider-DTUriVz3.js";
-import { ASGProvider } from "./asg-provider-Di3xOH3L.js";
+import { $i as accountArgs, Ao as replayWarn, Bo as sameLambdaFunctionAddress, C as getPriorAttempts, Cn as awaitInFlightSibling, Co as toFiniteNumber, Dc as rewriteTemplateAssetReferences, Dn as replacedDeleteFailureVerdict, Do as configIntegerRefusal, Dr as waitForLambdaFunctionActive, Dt as withApiLimit, Eo as configBooleanRefusal, Es as dynamicReferenceTokens, Et as lookupEachName, F as listNestedTemplateRows, Gl as renderAssemblyPathEscape, Gr as isWaitAbandonedError, I as renderNestedTemplateTreeDefect, Ja as refuseMalformedResourcesForDestroy, Jr as ec2InstanceProtectionSite, Jt as redactedDeleteAddressFields, Ki as passedParameterClassesOf, Kl as resolveAssemblyPath, Kn as secretNamedAttributeNamesOf, Kr as markWaitAbandoned, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Ml as canonicalizeRegion, Mo as requireConfigObject, Ms as recoverMaskedOutput, N as findNestedTemplateTreeDefect, Ni as getAccountInfo, Nl as derivePartitionAndUrlSuffix, No as requireConfigString, Ns as physicalNameCopiesOf, Oa as refuseMalformedNestedChildOutputs, Oo as configStringRefusal, P as isAbsoluteAssetPath, Ps as recordAttributeIdCopy, Qo as passedNoEchoParametersOf, Qr as reEnableInstanceApiTermination, Ro as canonicalLambdaFunctionName, Rr as unchangedBehindSecretReference, S as isTruthyCfnBoolean, Sc as stringifyValue, So as toCfnInteger, Tn as getStackRecords, To as coerceCfnInteger, Tt as isAccessDeniedError, Ui as parseWebACLArn, Ul as describeFileReadFailure, Ur as deleteSkipReason, Wl as displayAssemblyPath, Wr as withIndeterminateGuard, Wt as getCurrentProducerRegions, Xr as observeThenDisableInstanceApiTermination, Yr as isTerminationProtectionPropagationError, Yt as redactedDeleteAddressSkip, Zr as reDisableInstanceApiTermination, _ as deleteTableWithIndexBusyRetry, _r as refuseMalformedDesiredTags, ai as s3BucketDomainName, b as S3_AUTO_DELETE_OBJECTS_TAG, bo as coerceWarmThroughput$1, br as definedAttributes, bs as snapshotPassProvenance, c as DynamoDBGlobalTableProvider, ci as s3BucketWebsiteUrl, co as findSilentDropProperties, cr as reserveStackCreateToken, d as compensateRemovedDeletionProtection, dr as isRefusedByName, f as deleteBudgetKey, fr as markDeleteStarted, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as readTagList, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hr as planTagDiff, ii as s3BucketArn, jo as requireConfigArray, jr as getCurrentResourceSecrets, kl as decodeListingKey, ko as readConfigString, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mr as DBPROXY_TAG_OPTIONS, mt as withNestedStackContext, oi as s3BucketDualStackDomainName, oo as withheldAccountClause, or as earliestDefined, os as hasMaskableValues, ot as getNestedRevertRun, p as resolveDynamoDbDeleteBudgetClock, pi as outputReferenceProvenanceOf, pr as DBPROXY_TAGS_WHAT, pt as getCurrentNestedStackContext, qt as isRedactedRecordedValue, ri as isSettledInstanceState, si as s3BucketRegionalDomainName, t as DeployEngine, u as beginDeleteWait, uo as withoutSilentDropProperties, ur as acquireIdempotencyToken, v as waitForIndexesSettled, vr as tagMapAsList, vs as markSameGenerationBag, w as markRefusedBeforeApplying, wo as coerceCfnBoolean, ws as withoutPhysicalNameCopies, wt as chunks, x as hasCdkAutoDeleteTag, xo as isWarmThroughputDecrease, xr as stringifyIfAssigned, xs as redactSecretsForState, y as ECR_AUTO_DELETE_IMAGES_TAG, yo as WARM_THROUGHPUT_MEMBERS, yr as tagPlanWarning, ys as recordReferenceProvenanceEntry, zo as lambdaFunctionNameForMask } from "./deploy-engine-HAvm8vSI.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CTpDWSUG.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DmPDfDhE.js";
+import { RDSProvider } from "./rds-provider-CxB94DZy.js";
+import { NeptuneProvider } from "./neptune-provider-CXhoiT-P.js";
+import { ASGProvider } from "./asg-provider-DHB498Xq.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -5707,10 +5707,7 @@ const SQS_ATTRIBUTE_REMOVAL_RESET = {
 	DelaySeconds: "0",
 	ReceiveMessageWaitTimeSeconds: "0",
 	KmsDataKeyReusePeriodSeconds: "300",
-	ContentBasedDeduplication: "false",
-	SqsManagedSseEnabled: "true",
-	DeduplicationScope: "queue",
-	FifoThroughputLimit: "perQueue"
+	ContentBasedDeduplication: "false"
 };
 const CDK_TO_SQS_ATTRIBUTES = {
 	VisibilityTimeout: "VisibilityTimeout",
@@ -5824,13 +5821,7 @@ var SQSQueueProvider = class {
 					if (cdkKey === "RedrivePolicy" && typeof value === "object") attributes[sqsKey] = serializeRedrivePolicy(value);
 					else if (cdkKey === "RedriveAllowPolicy") attributes[sqsKey] = serializeRedriveAllowPolicy(value);
 					else attributes[sqsKey] = stringifyValue(value);
-				} else if (previousProperties[cdkKey] !== void 0 && cdkKey in SQS_ATTRIBUTE_REMOVAL_RESET) {
-					if (cdkKey === "SqsManagedSseEnabled") {
-						const desiredKmsKey = properties["KmsMasterKeyId"];
-						if (desiredKmsKey !== void 0 && desiredKmsKey !== "") continue;
-					}
-					attributes[sqsKey] = SQS_ATTRIBUTE_REMOVAL_RESET[cdkKey];
-				}
+				} else if (previousProperties[cdkKey] !== void 0 && cdkKey in SQS_ATTRIBUTE_REMOVAL_RESET) attributes[sqsKey] = SQS_ATTRIBUTE_REMOVAL_RESET[cdkKey];
 			}
 			if (Object.keys(attributes).length > 0) {
 				await this.sqsClient.send(new SetQueueAttributesCommand({
@@ -8875,7 +8866,7 @@ var LambdaUrlProvider = class {
 			FunctionName: physicalId,
 			...authType !== void 0 && { AuthType: authType }
 		};
-		const invokeMode = clearOnUpdateRemoval(properties["InvokeMode"], previousProperties["InvokeMode"], "BUFFERED");
+		const invokeMode = properties["InvokeMode"];
 		if (invokeMode !== void 0) updateParams.InvokeMode = invokeMode;
 		const newCorsRaw = properties["Cors"];
 		const prevCorsRaw = previousProperties["Cors"];
@@ -14377,7 +14368,6 @@ var SecretsManagerSecretProvider = class {
 		"ReplicaRegions",
 		"Type"
 	])]]);
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::SecretsManager::Secret", /* @__PURE__ */ new Map([["Description", ""]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.smClient = awsClients.secretsManager;
@@ -14422,7 +14412,6 @@ var SecretsManagerSecretProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const log = this.operationSinks(context?.maskSecrets, [
 			[properties["Name"], properties["Name"]],
 			[properties["Name"], physicalId],
@@ -14447,7 +14436,7 @@ var SecretsManagerSecretProvider = class {
 			if (description !== void 0) updateParams.Description = description;
 			const newKmsKeyId = properties["KmsKeyId"];
 			const prevKmsKeyId = previousProperties["KmsKeyId"];
-			const kmsKeyId = clearOnUpdateRemoval(newKmsKeyId === "" ? void 0 : newKmsKeyId, prevKmsKeyId === "" ? void 0 : prevKmsKeyId, "");
+			const kmsKeyId = newKmsKeyId === void 0 ? void 0 : newKmsKeyId === "" ? prevKmsKeyId !== void 0 && prevKmsKeyId !== "" ? "" : void 0 : newKmsKeyId;
 			if (kmsKeyId !== void 0) updateParams.KmsKeyId = kmsKeyId;
 			if (properties["Type"]) updateParams.Type = properties["Type"];
 			await this.smClient.send(new UpdateSecretCommand(updateParams));
@@ -20758,9 +20747,9 @@ var ApiGatewayV2Provider = class {
 		const log = resourceType === "AWS::ApiGatewayV2::Stage" ? stageSinks(this.logger, context, [[properties["StageName"], physicalId], [previousProperties["StageName"], physicalId]]) : createMaskedLogSinks(this.logger, context?.maskSecrets);
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.updateApi(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log);
-			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log);
+			case "AWS::ApiGatewayV2::Stage": return this.updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Integration": return this.updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
+			case "AWS::ApiGatewayV2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, context?.desiredFromAwsReadback === true);
 			case "AWS::ApiGatewayV2::Authorizer": return this.updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			default: throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "Unsupported API Gateway V2 resource type for in-place update in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
 		}
@@ -21366,49 +21355,34 @@ var ApiGatewayV2Provider = class {
 			input.Name = properties["Name"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Description"], previousProperties["Description"], "");
-			if (r.changed) {
-				input.Description = r.value;
-				changed = true;
-			}
+		if (properties["Description"] !== void 0 && properties["Description"] !== previousProperties["Description"]) {
+			input.Description = properties["Description"];
+			changed = true;
 		}
 		if (properties["CorsConfiguration"] !== void 0 && !this.deepEqual(properties["CorsConfiguration"], previousProperties["CorsConfiguration"])) {
 			input.CorsConfiguration = properties["CorsConfiguration"];
 			changed = true;
 		}
 		const corsRemoved = properties["CorsConfiguration"] === void 0 && previousProperties["CorsConfiguration"] !== void 0;
-		{
-			const r = this.clearableUpdate(properties["DisableExecuteApiEndpoint"], previousProperties["DisableExecuteApiEndpoint"], false);
-			if (r.changed) {
-				input.DisableExecuteApiEndpoint = r.value;
-				changed = true;
-			}
+		if (properties["DisableExecuteApiEndpoint"] !== void 0 && properties["DisableExecuteApiEndpoint"] !== previousProperties["DisableExecuteApiEndpoint"]) {
+			input.DisableExecuteApiEndpoint = properties["DisableExecuteApiEndpoint"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Version"], previousProperties["Version"], "");
-			if (r.changed) {
-				input.Version = r.value;
-				changed = true;
-			}
+		if (properties["Version"] !== void 0 && properties["Version"] !== previousProperties["Version"]) {
+			input.Version = properties["Version"];
+			changed = true;
 		}
 		if (properties["RouteSelectionExpression"] !== void 0 && properties["RouteSelectionExpression"] !== previousProperties["RouteSelectionExpression"]) {
 			input.RouteSelectionExpression = properties["RouteSelectionExpression"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["ApiKeySelectionExpression"], previousProperties["ApiKeySelectionExpression"], "$request.header.x-api-key");
-			if (r.changed) {
-				input.ApiKeySelectionExpression = r.value;
-				changed = true;
-			}
+		if (properties["ApiKeySelectionExpression"] !== void 0 && properties["ApiKeySelectionExpression"] !== previousProperties["ApiKeySelectionExpression"]) {
+			input.ApiKeySelectionExpression = properties["ApiKeySelectionExpression"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["IpAddressType"], previousProperties["IpAddressType"], "ipv4");
-			if (r.changed) {
-				input.IpAddressType = r.value;
-				changed = true;
-			}
+		if (properties["IpAddressType"] !== void 0 && properties["IpAddressType"] !== previousProperties["IpAddressType"]) {
+			input.IpAddressType = properties["IpAddressType"];
+			changed = true;
 		}
 		if (!changed && !corsRemoved) {
 			log.debug(`No mutable Api fields changed for ${logicalId}; skipping UpdateApi`);
@@ -21447,7 +21421,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Api ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Stage ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Stage; re-deploy with cdkd deploy --replace");
@@ -21474,12 +21448,15 @@ var ApiGatewayV2Provider = class {
 			input.Description = properties["Description"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["StageVariables"], previousProperties["StageVariables"]);
 			if (merged !== void 0) {
 				input.StageVariables = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["StageVariables"], previousProperties["StageVariables"])) {
+			input.StageVariables = properties["StageVariables"];
+			changed = true;
 		}
 		if (properties["DefaultRouteSettings"] !== void 0 && !this.deepEqual(properties["DefaultRouteSettings"], previousProperties["DefaultRouteSettings"])) {
 			input.DefaultRouteSettings = properties["DefaultRouteSettings"];
@@ -21495,12 +21472,9 @@ var ApiGatewayV2Provider = class {
 			changed = true;
 		}
 		const droppedRouteSettingKeys = this.droppedKeys(properties["RouteSettings"], previousProperties["RouteSettings"]);
-		{
-			const r = this.clearableUpdate(properties["ClientCertificateId"], previousProperties["ClientCertificateId"], "");
-			if (r.changed) {
-				input.ClientCertificateId = r.value;
-				changed = true;
-			}
+		if (properties["ClientCertificateId"] !== void 0 && properties["ClientCertificateId"] !== previousProperties["ClientCertificateId"]) {
+			input.ClientCertificateId = properties["ClientCertificateId"];
+			changed = true;
 		}
 		if (properties["DeploymentId"] !== void 0 && properties["DeploymentId"] !== previousProperties["DeploymentId"]) {
 			input.DeploymentId = properties["DeploymentId"];
@@ -21538,7 +21512,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Stage ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Integration ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Integration; re-deploy with cdkd deploy --replace");
@@ -21567,19 +21541,19 @@ var ApiGatewayV2Provider = class {
 			input.TimeoutInMillis = properties["TimeoutInMillis"];
 			changed = true;
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestParameters"], previousProperties["RequestParameters"]);
 			if (merged !== void 0) {
 				input.RequestParameters = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["RequestParameters"], previousProperties["RequestParameters"])) {
+			input.RequestParameters = properties["RequestParameters"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["Description"], previousProperties["Description"], "");
-			if (r.changed) {
-				input.Description = r.value;
-				changed = true;
-			}
+		if (properties["Description"] !== void 0 && properties["Description"] !== previousProperties["Description"]) {
+			input.Description = properties["Description"];
+			changed = true;
 		}
 		if (properties["ConnectionId"] != null && properties["ConnectionId"] !== previousProperties["ConnectionId"]) {
 			input.ConnectionId = properties["ConnectionId"];
@@ -21645,7 +21619,7 @@ var ApiGatewayV2Provider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update API Gateway V2 Integration ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, log, restoreFromAws = false) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required to update Route ${logicalId}`, resourceType, logicalId, physicalId);
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "ApiId is immutable on AWS::ApiGatewayV2::Route; re-deploy with cdkd deploy --replace");
@@ -21662,19 +21636,13 @@ var ApiGatewayV2Provider = class {
 			input.Target = properties["Target"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizationType"], previousProperties["AuthorizationType"], "NONE");
-			if (r.changed) {
-				input.AuthorizationType = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizationType"] !== void 0 && properties["AuthorizationType"] !== previousProperties["AuthorizationType"]) {
+			input.AuthorizationType = properties["AuthorizationType"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerId"], previousProperties["AuthorizerId"], "");
-			if (r.changed) {
-				input.AuthorizerId = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerId"] !== void 0 && properties["AuthorizerId"] !== previousProperties["AuthorizerId"]) {
+			input.AuthorizerId = properties["AuthorizerId"];
+			changed = true;
 		}
 		{
 			const r = this.clearableUpdate(properties["AuthorizationScopes"], previousProperties["AuthorizationScopes"], []);
@@ -21683,12 +21651,9 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
-		{
-			const r = this.clearableUpdate(properties["OperationName"], previousProperties["OperationName"], "");
-			if (r.changed) {
-				input.OperationName = r.value;
-				changed = true;
-			}
+		if (properties["OperationName"] !== void 0 && properties["OperationName"] !== previousProperties["OperationName"]) {
+			input.OperationName = properties["OperationName"];
+			changed = true;
 		}
 		{
 			const r = this.clearableUpdate(properties["ApiKeyRequired"], previousProperties["ApiKeyRequired"], false);
@@ -21697,18 +21662,21 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
-		{
+		if (restoreFromAws) {
 			const merged = this.mapWithRemovals(properties["RequestModels"], previousProperties["RequestModels"]);
 			if (merged !== void 0) {
 				input.RequestModels = merged;
 				changed = true;
 			}
+		} else if (this.mapEntryAddedOrChanged(properties["RequestModels"], previousProperties["RequestModels"])) {
+			input.RequestModels = properties["RequestModels"];
+			changed = true;
 		}
-		if (properties["RequestParameters"] !== void 0 && !this.deepEqual(properties["RequestParameters"], previousProperties["RequestParameters"])) {
+		if (restoreFromAws ? properties["RequestParameters"] !== void 0 && !this.deepEqual(properties["RequestParameters"], previousProperties["RequestParameters"]) : this.mapEntryAddedOrChanged(properties["RequestParameters"], previousProperties["RequestParameters"])) {
 			input.RequestParameters = properties["RequestParameters"];
 			changed = true;
 		}
-		const droppedRequestParameterKeys = this.droppedKeys(properties["RequestParameters"], previousProperties["RequestParameters"]);
+		const droppedRequestParameterKeys = restoreFromAws ? this.droppedKeys(properties["RequestParameters"], previousProperties["RequestParameters"]) : [];
 		if (properties["ModelSelectionExpression"] !== void 0 && properties["ModelSelectionExpression"] !== previousProperties["ModelSelectionExpression"]) {
 			input.ModelSelectionExpression = properties["ModelSelectionExpression"];
 			changed = true;
@@ -21782,37 +21750,25 @@ var ApiGatewayV2Provider = class {
 			input.AuthorizerUri = properties["AuthorizerUri"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerCredentialsArn"], previousProperties["AuthorizerCredentialsArn"], "");
-			if (r.changed) {
-				input.AuthorizerCredentialsArn = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerCredentialsArn"] !== void 0 && properties["AuthorizerCredentialsArn"] !== previousProperties["AuthorizerCredentialsArn"]) {
+			input.AuthorizerCredentialsArn = properties["AuthorizerCredentialsArn"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerPayloadFormatVersion"], previousProperties["AuthorizerPayloadFormatVersion"], "");
-			if (r.changed) {
-				input.AuthorizerPayloadFormatVersion = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerPayloadFormatVersion"] !== void 0 && properties["AuthorizerPayloadFormatVersion"] !== previousProperties["AuthorizerPayloadFormatVersion"]) {
+			input.AuthorizerPayloadFormatVersion = properties["AuthorizerPayloadFormatVersion"];
+			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["AuthorizerResultTtlInSeconds"], previousProperties["AuthorizerResultTtlInSeconds"], 0);
-			if (r.changed) {
-				input.AuthorizerResultTtlInSeconds = r.value;
-				changed = true;
-			}
+		if (properties["AuthorizerResultTtlInSeconds"] !== void 0 && properties["AuthorizerResultTtlInSeconds"] !== previousProperties["AuthorizerResultTtlInSeconds"]) {
+			input.AuthorizerResultTtlInSeconds = properties["AuthorizerResultTtlInSeconds"];
+			changed = true;
 		}
 		if (properties["EnableSimpleResponses"] !== void 0 && properties["EnableSimpleResponses"] !== previousProperties["EnableSimpleResponses"]) {
 			input.EnableSimpleResponses = properties["EnableSimpleResponses"];
 			changed = true;
 		}
-		{
-			const r = this.clearableUpdate(properties["IdentityValidationExpression"], previousProperties["IdentityValidationExpression"], "");
-			if (r.changed) {
-				input.IdentityValidationExpression = r.value;
-				changed = true;
-			}
+		if (properties["IdentityValidationExpression"] !== void 0 && properties["IdentityValidationExpression"] !== previousProperties["IdentityValidationExpression"]) {
+			input.IdentityValidationExpression = properties["IdentityValidationExpression"];
+			changed = true;
 		}
 		if (!changed) {
 			log.debug(`No mutable Authorizer fields changed for ${logicalId}; skipping UpdateAuthorizer`);
@@ -21880,6 +21836,11 @@ var ApiGatewayV2Provider = class {
 		for (const key of Object.keys(prevMap)) if (!Object.hasOwn(nextMap, key)) merged[key] = "";
 		return merged;
 	}
+	mapEntryAddedOrChanged(next, previous) {
+		if (next == null || typeof next !== "object" || Array.isArray(next)) return false;
+		const prevMap = previous != null && typeof previous === "object" && !Array.isArray(previous) ? previous : {};
+		return Object.entries(next).some(([key, value]) => !Object.prototype.hasOwnProperty.call(prevMap, key) || !this.deepEqual(value, prevMap[key]));
+	}
 	warnTlsConfigIgnoredIfPublic(logicalId, properties, log) {
 		if (properties["TlsConfig"] != null && properties["ConnectionType"] !== "VPC_LINK") log.warn(`AWS::ApiGatewayV2::Integration ${logicalId}: TlsConfig is only honored on a VPC_LINK (private) integration — AWS silently ignores it on a public one, and the value will never be readable back from AWS.`);
 	}
@@ -25293,35 +25254,9 @@ function targetsSecretCause(read) {
 	return read.kind === "malformed" && read.onlySecret ? " (an Id holds a dynamic reference or its mask, which names no target Elastic Load Balancing accepts)" : "";
 }
 const TARGETS_WHAT = "targets, each with a string Id and, where given, an integer Port and a string AvailabilityZone";
-const TARGET_GROUP_ATTRIBUTE_DEFAULTS = {
-	"deregistration_delay.timeout_seconds": "300",
-	"deregistration_delay.connection_termination.enabled": "false",
-	"stickiness.enabled": "false",
-	"stickiness.lb_cookie.duration_seconds": "86400",
-	"stickiness.app_cookie.duration_seconds": "86400",
-	"load_balancing.algorithm.type": "round_robin",
-	"load_balancing.algorithm.anomaly_mitigation": "off",
-	"load_balancing.cross_zone.enabled": "use_load_balancer_configuration",
-	"slow_start.duration_seconds": "0",
-	"lambda.multi_value_headers.enabled": "false",
-	"proxy_protocol_v2.enabled": "false"
-};
-const LOAD_BALANCER_ATTRIBUTE_DEFAULTS = {
-	"deletion_protection.enabled": "false",
-	"access_logs.s3.enabled": "false",
-	"connection_logs.s3.enabled": "false",
-	"health_check_logs.s3.enabled": "false",
-	"routing.http.desync_mitigation_mode": "defensive",
-	"routing.http.drop_invalid_header_fields.enabled": "false",
-	"routing.http.preserve_host_header.enabled": "false",
-	"routing.http.x_amzn_tls_version_and_cipher_suite.enabled": "false",
-	"routing.http.xff_client_port.enabled": "false",
-	"routing.http.xff_header_processing.mode": "append",
-	"routing.http2.enabled": "true",
-	"waf.fail_open.enabled": "false",
-	"zonal_shift.config.enabled": "false"
-};
-const LISTENER_ATTRIBUTE_DEFAULTS = { "routing.http.response.server.enabled": "true" };
+const RETAIN_REMOVED_ATTRIBUTE = () => void 0;
+const LOG_DELIVERY_ATTRIBUTE = /^[a-z_]+_logs\.s3\./;
+const MISLEADING_IF_KEPT_ATTRIBUTE = /^routing\.http\.(response\.access_control_|request\.[a-z0-9_]+\.header_name$)/;
 function loadBalancerAttributes(lb, lbArn) {
 	return definedAttributes({
 		DNSName: lb.DNSName,
@@ -25452,13 +25387,53 @@ var ELBv2Provider = class {
 			"Tags"
 		])]
 	]);
-	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
-		"LoadBalancerArn",
-		"DefaultActions",
-		"ListenerAttributes",
-		"Tags",
-		...LISTENER_LEFT_IN_PLACE_ON_REMOVAL
-	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([
+		["AWS::ElasticLoadBalancingV2::LoadBalancer", /* @__PURE__ */ new Set([
+			"Name",
+			"Scheme",
+			"Type",
+			"Subnets",
+			"SubnetMappings",
+			"SecurityGroups",
+			"Tags",
+			"IpAddressType",
+			"Ipv4IpamPoolId",
+			"MinimumLoadBalancerCapacity",
+			"EnableCapacityReservationProvisionStabilize",
+			"LoadBalancerAttributes",
+			"EnablePrefixForIpv6SourceNat",
+			"EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"
+		])],
+		["AWS::ElasticLoadBalancingV2::TargetGroup", /* @__PURE__ */ new Set([
+			"Protocol",
+			"Port",
+			"VpcId",
+			"TargetType",
+			"ProtocolVersion",
+			"Name",
+			"IpAddressType",
+			"TargetControlPort",
+			"HealthCheckPort",
+			"Targets",
+			"Tags",
+			"HealthCheckProtocol",
+			"HealthCheckPath",
+			"HealthCheckEnabled",
+			"HealthCheckIntervalSeconds",
+			"HealthCheckTimeoutSeconds",
+			"HealthyThresholdCount",
+			"UnhealthyThresholdCount",
+			"Matcher",
+			"TargetGroupAttributes"
+		])],
+		["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
+			"LoadBalancerArn",
+			"DefaultActions",
+			"ListenerAttributes",
+			"Tags",
+			...LISTENER_LEFT_IN_PLACE_ON_REMOVAL
+		])]
+	]);
 	lambdaClients = /* @__PURE__ */ new Map();
 	getClient() {
 		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client({
@@ -25720,7 +25695,11 @@ var ELBv2Provider = class {
 			}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.";
 			throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + remedy);
 		}
-		const submittedAttrs = this.diffAttributeBag("LoadBalancerAttributes", logicalId, properties["LoadBalancerAttributes"], previousProperties["LoadBalancerAttributes"], this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS), fromReadback, maskSecrets);
+		const removedLogKeys = [];
+		const submittedAttrs = this.diffAttributeBag("LoadBalancerAttributes", logicalId, properties["LoadBalancerAttributes"], previousProperties["LoadBalancerAttributes"], (key) => {
+			if (LOG_DELIVERY_ATTRIBUTE.test(key)) removedLogKeys.push(key);
+			return RETAIN_REMOVED_ATTRIBUTE();
+		}, fromReadback, maskSecrets);
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 				LoadBalancerArn: physicalId,
@@ -25728,6 +25707,14 @@ var ELBv2Provider = class {
 			}));
 			this.logger.debug(`Applied ${submittedAttrs.length} LoadBalancerAttributes change(s) for ${logicalId}`);
 		}
+		const desiredAttrs = new Map(this.normalizeAttributes(properties["LoadBalancerAttributes"]).map((a) => [a.Key, a.Value]));
+		const exposedLogKeys = removedLogKeys.filter((key) => desiredAttrs.get(`${key.split(".")[0]}.s3.enabled`) !== "false");
+		if (exposedLogKeys.length > 0) {
+			const mask = maskerOrIdentity(maskSecrets);
+			const keys = exposedLogKeys.map((key) => mask(key)).join(", ");
+			const one = exposedLogKeys.length === 1;
+			this.logger.warn(safeMsg`${logicalId}: LoadBalancerAttributes ${one ? "key" : "keys"} ${keys} ${one ? "is" : "are"} no longer declared and ${one ? "keeps its live value" : "keep their live values"}, as CloudFormation leaves ${one ? "it" : "them"}, so the load balancer may keep delivering logs to the bucket it names. To stop it, declare the matching '<kind>_logs.s3.enabled' key as 'false' and deploy.`);
+		}
 		const newSubnets = properties["Subnets"];
 		const oldSubnets = previousProperties["Subnets"];
 		const newMappings = properties["SubnetMappings"];
@@ -25757,7 +25744,7 @@ var ELBv2Provider = class {
 			}));
 			this.logger.debug(`Updated SecurityGroups for ${logicalId}`);
 		}
-		const newIpType = properties["IpAddressType"];
+		const newIpType = fromReadback ? properties["IpAddressType"] : clearOnUpdateRemoval(properties["IpAddressType"], previousProperties["IpAddressType"], "ipv4");
 		const oldIpType = previousProperties["IpAddressType"];
 		if (newIpType !== void 0 && newIpType !== oldIpType) {
 			await this.getClient().send(new SetIpAddressTypeCommand({
@@ -25967,7 +25954,7 @@ var ELBv2Provider = class {
 		try {
 			const rawMatcher = properties["Matcher"];
 			const matcher = rawMatcher && (rawMatcher.HttpCode !== void 0 || rawMatcher.GrpcCode !== void 0) ? rawMatcher : void 0;
-			const healthCheckPort = String(properties["Protocol"] ?? previousProperties["Protocol"] ?? "").toUpperCase() === "GENEVE" ? properties["HealthCheckPort"] : clearOnUpdateRemoval(properties["HealthCheckPort"], previousProperties["HealthCheckPort"], "traffic-port");
+			const healthCheckPort = clearOnUpdateRemoval(properties["HealthCheckPort"], previousProperties["HealthCheckPort"], "traffic-port");
 			await this.getClient().send(new ModifyTargetGroupCommand({
 				TargetGroupArn: physicalId,
 				HealthCheckProtocol: properties["HealthCheckProtocol"],
@@ -25980,14 +25967,7 @@ var ELBv2Provider = class {
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
 				...matcher && { Matcher: matcher }
 			}));
-			const tgAttrDiff = this.diffAttributeBag("TargetGroupAttributes", logicalId, properties["TargetGroupAttributes"], previousProperties["TargetGroupAttributes"], (key, currentValue) => {
-				const fallback = Object.hasOwn(TARGET_GROUP_ATTRIBUTE_DEFAULTS, key) ? TARGET_GROUP_ATTRIBUTE_DEFAULTS[key] : void 0;
-				if (fallback === void 0) {
-					this.logger.warn(`TargetGroup attribute ${maskerOrIdentity(maskSecrets)(key)} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
-					return;
-				}
-				return currentValue === fallback ? void 0 : fallback;
-			}, fromReadback, maskSecrets);
+			const tgAttrDiff = this.diffAttributeBag("TargetGroupAttributes", logicalId, properties["TargetGroupAttributes"], previousProperties["TargetGroupAttributes"], RETAIN_REMOVED_ATTRIBUTE, fromReadback, maskSecrets);
 			if (tgAttrDiff.length > 0) {
 				await this.getClient().send(new ModifyTargetGroupAttributesCommand({
 					TargetGroupArn: physicalId,
@@ -26154,7 +26134,11 @@ var ELBv2Provider = class {
 				...alpnPolicy && alpnPolicy.length > 0 && { AlpnPolicy: alpnPolicy },
 				...mutualAuth !== void 0 && { MutualAuthentication: mutualAuth }
 			}));
-			const submittedAttrs = this.diffAttributeBag("ListenerAttributes", logicalId, properties["ListenerAttributes"], previousProperties["ListenerAttributes"], this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS), fromReadback, maskSecrets);
+			const removedMisleadingKeys = [];
+			const submittedAttrs = this.diffAttributeBag("ListenerAttributes", logicalId, properties["ListenerAttributes"], previousProperties["ListenerAttributes"], (key) => {
+				if (MISLEADING_IF_KEPT_ATTRIBUTE.test(key)) removedMisleadingKeys.push(key);
+				return RETAIN_REMOVED_ATTRIBUTE();
+			}, fromReadback, maskSecrets);
 			if (submittedAttrs.length > 0) {
 				const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
 				try {
@@ -26173,6 +26157,12 @@ var ELBv2Provider = class {
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskSecrets);
 			this.logger.debug(`Successfully updated Listener ${logicalId}`);
+			if (removedMisleadingKeys.length > 0) {
+				const mask = maskerOrIdentity(maskSecrets);
+				const keys = removedMisleadingKeys.map((key) => mask(key)).join(", ");
+				const one = removedMisleadingKeys.length === 1;
+				this.logger.warn(safeMsg`${logicalId}: ListenerAttributes ${one ? "key" : "keys"} ${keys} ${one ? "is" : "are"} no longer declared and ${one ? "keeps its live value" : "keep their live values"}, as CloudFormation leaves ${one ? "it" : "them"}, so the listener may keep sending a CORS response header, or keep writing a request header under its renamed name. To change ${one ? "it" : "them"}, declare the value you want and deploy, or set ${one ? "it" : "them"} with 'aws elbv2 modify-listener-attributes'.`);
+			}
 			if (leftInPlaceNames.length > 0 && !fromReadback) this.logger.warn(listenerLeftInPlaceWarning(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 			return {
 				physicalId,
@@ -26253,12 +26243,6 @@ var ELBv2Provider = class {
 		}
 		return submitted;
 	}
-	attributeRemovalResolver(defaults) {
-		return (key, currentValue) => {
-			const fallback = Object.hasOwn(defaults, key) ? defaults[key] : "";
-			return currentValue === fallback ? void 0 : fallback;
-		};
-	}
 	async readUpdateTargets(logicalId, physicalId, resourceType, desiredRaw, recordedRaw, groupPort) {
 		const desired = readTargets(desiredRaw, "desired");
 		if (desired.kind === "malformed") throw markNonRetryable(new ProvisioningError(`desired Targets of TargetGroup ${logicalId} is not a list of ${TARGETS_WHAT}${targetsSecretCause(desired)} — the target group was not updated`, resourceType, logicalId, physicalId));
@@ -27819,7 +27803,6 @@ var DocDBProvider = class {
 	logger = getLogger().child("DocDBProvider");
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Map([["DeletionProtection", false]])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
 		"DBClusterIdentifier",
 		"EngineVersion",
@@ -27869,8 +27852,7 @@ var DocDBProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
 		switch (resourceType) {
 			case "AWS::DocDB::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -27937,7 +27919,7 @@ var DocDBProvider = class {
 				DBClusterIdentifier: physicalId,
 				EngineVersion: properties["EngineVersion"],
 				DeletionProtection: properties["DeletionProtection"],
-				BackupRetentionPeriod: clearOnUpdateRemoval(properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0, previousProperties["BackupRetentionPeriod"] != null ? Number(previousProperties["BackupRetentionPeriod"]) : void 0, 1),
+				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
 				PreferredBackupWindow: properties["PreferredBackupWindow"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
@@ -30969,7 +30951,6 @@ var ElastiCacheProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ElastiCacheProvider");
-	removalDefaults = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["AutoMinorVersionUpgrade", true]])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
 		"CacheSubnetGroupName",
 		"CacheSubnetGroupDescription",
@@ -31026,8 +31007,7 @@ var ElastiCacheProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
 		switch (resourceType) {
 			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties);
@@ -31174,7 +31154,6 @@ var ElastiCacheProvider = class {
 			const rawSgIds = properties["VpcSecurityGroupIds"];
 			const sgIds = rawSgIds && rawSgIds.length > 0 ? rawSgIds : void 0;
 			const notificationTopicArn = properties["NotificationTopicArn"];
-			const notificationRemoved = notificationTopicArn === void 0 && previousProperties["NotificationTopicArn"] != null;
 			await this.getClient().send(new ModifyCacheClusterCommand({
 				CacheClusterId: physicalId,
 				NumCacheNodes: properties["NumCacheNodes"] != null ? Number(properties["NumCacheNodes"]) : void 0,
@@ -31182,11 +31161,10 @@ var ElastiCacheProvider = class {
 				CacheParameterGroupName: properties["CacheParameterGroupName"],
 				EngineVersion: properties["EngineVersion"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
-				SnapshotRetentionLimit: clearOnUpdateRemoval(properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0, previousProperties["SnapshotRetentionLimit"] != null ? Number(previousProperties["SnapshotRetentionLimit"]) : void 0, 0),
+				SnapshotRetentionLimit: properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0,
 				SnapshotWindow: properties["SnapshotWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 				NotificationTopicArn: notificationTopicArn,
-				...notificationRemoved && { NotificationTopicStatus: "inactive" },
 				...notificationTopicArn !== void 0 && { NotificationTopicStatus: "active" },
 				LogDeliveryConfigurations: this.buildLogDeliveryConfigurationsForUpdate(properties["LogDeliveryConfigurations"], previousProperties["LogDeliveryConfigurations"]),
 				IpDiscovery: properties["IpDiscovery"],
@@ -34072,7 +34050,7 @@ async function refuseCatalogMove(args) {
 		try {
 			callerAccount = await args.callerAccountId();
 		} catch (error) {
-			throw wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`Could not resolve the caller's account id (sts:GetCallerIdentity) to tell whether CatalogId ${mask(literal)} is this account's default Data Catalog, so cdkd did not update Glue ${args.noun} ${args.logicalId}: ${text}`, args.resourceType, args.logicalId, void 0, error instanceof Error ? error : void 0));
+			throw wrapGlueError(mask, args.debug, error, (text) => new ProvisioningError(`Could not resolve the caller's account id (sts:GetCallerIdentity) to tell whether CatalogId ${mask(literal)} is this account's default Data Catalog, so cdkd did not update Glue ${args.noun} ${args.logicalId}: ${text}`, args.resourceType, args.logicalId, void 0, error instanceof Error ? error : void 0));
 		}
 		if (literal === callerAccount) return;
 	}
@@ -34104,6 +34082,13 @@ function newGlueClients(region) {
 		}))
 	};
 }
+function wrapGlueError(mask, debug, error, build) {
+	const failure = describeAwsFailure(error);
+	if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+	debug(mask(build(failure.detail).message));
+	const wrapped = build(mask(failure.summary));
+	return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+}
 var GlueProvider = class {
 	client;
 	createClient;
@@ -34111,7 +34096,7 @@ var GlueProvider = class {
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Database", /* @__PURE__ */ new Set([
 		"DatabaseInput",
@@ -34210,6 +34195,7 @@ var GlueProvider = class {
 			stateful: true,
 			callerAccountId: this.callerAccountId,
 			warn: log.warn,
+			debug: log.debug,
 			mask: log.mask
 		});
 		const catalogId = updateCatalogId(properties["CatalogId"]);
@@ -34263,7 +34249,7 @@ var GlueProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Database ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to delete Glue Database ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createTable(logicalId, resourceType, properties, context) {
@@ -34342,6 +34328,7 @@ var GlueProvider = class {
 			stateful: true,
 			callerAccountId: this.callerAccountId,
 			warn: log.warn,
+			debug: log.debug,
 			mask: log.mask
 		});
 		const catalogId = updateCatalogId(properties["CatalogId"]);
@@ -34371,7 +34358,7 @@ var GlueProvider = class {
 				hint += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters and StorageDescriptor members read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
 				hint += ` Re-run the deploy to pick up the current values.`;
 			}
-			throw this.wrapMaskedError(log.mask, error, (detail) => new ProvisioningError(`Failed to update Glue Table ${logicalId}: ${detail}${hint}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log.mask, error, (detail) => new ProvisioningError(`Failed to update Glue Table ${logicalId}: ${hint ? withoutFinalPeriod(detail) : detail}${hint}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteTable(logicalId, physicalId, resourceType, properties, context) {
@@ -34406,7 +34393,7 @@ var GlueProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Table ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to delete Glue Table ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	preserveAwsManagedParameters(built, desiredParameters, previousParameters, liveParameters) {
@@ -34786,7 +34773,7 @@ var GlueWorkflowProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueWorkflowProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Workflow", /* @__PURE__ */ new Set([
 		"Name",
@@ -34865,7 +34852,7 @@ var GlueWorkflowProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Workflow ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue Workflow ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -34941,7 +34928,7 @@ var GlueSecurityConfigurationProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueSecurityConfigurationProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
@@ -34993,7 +34980,7 @@ var GlueSecurityConfigurationProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue SecurityConfiguration ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue SecurityConfiguration ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35134,7 +35121,7 @@ var GlueJobProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueJobProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Job", /* @__PURE__ */ new Set([
 		"Name",
@@ -35244,7 +35231,7 @@ var GlueJobProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Job ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue Job ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35380,8 +35367,11 @@ function asRecord$1(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
 	return value;
 }
+function withoutFinalPeriod(text) {
+	return text.endsWith(".") ? text.slice(0, -1) : text;
+}
 function preUpdateReadFailureMessage(kind, iamAction, logicalId, detail) {
-	return `Failed to read the current Glue ${kind} ${logicalId} before update: ${detail}. cdkd reads the live ${kind.toLowerCase()} so AWS-managed Parameters (Apache Iceberg's table_type / metadata_location, a crawler's classification, Lake Formation markers) survive an update that Glue applies as a full replace. Grant ${iamAction} to the deploy identity — proceeding without the read would silently erase them.`;
+	return `Failed to read the current Glue ${kind} ${logicalId} before update: ${withoutFinalPeriod(detail)}. cdkd reads the live ${kind.toLowerCase()} so AWS-managed Parameters (Apache Iceberg's table_type / metadata_location, a crawler's classification, Lake Formation markers) survive an update that Glue applies as a full replace. Grant ${iamAction} to the deploy identity — proceeding without the read would silently erase them.`;
 }
 function coerceNumber(value) {
 	if (typeof value === "number") return value;
@@ -35428,7 +35418,7 @@ var GlueCrawlerProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueCrawlerProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Crawler", /* @__PURE__ */ new Set([
 		"Name",
@@ -35535,14 +35525,23 @@ var GlueCrawlerProvider = class {
 				log.debug(`Glue Crawler ${v(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
+			let failure = error;
 			if (error instanceof CrawlerRunningException) {
 				log.debug(`Glue Crawler ${v(physicalId)} is running; stopping before delete and retrying`);
-				await this.stopCrawlerAndWait(physicalId, log);
-				await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
-				return;
+				try {
+					await this.stopCrawlerAndWait(physicalId, log);
+					await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
+					return;
+				} catch (retryError) {
+					if (retryError instanceof EntityNotFoundException) {
+						log.debug(`Glue Crawler ${v(physicalId)} does not exist, skipping deletion`);
+						return;
+					}
+					failure = retryError;
+				}
 			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Crawler ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			const cause = failure instanceof Error ? failure : void 0;
+			throw this.wrapMaskedError(log.mask, failure, (text) => new ProvisioningError(`Failed to delete Glue Crawler ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async stopCrawlerAndWait(physicalId, log = {
@@ -35690,7 +35689,7 @@ var GlueConnectionProvider = class {
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueConnectionProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
@@ -35752,6 +35751,7 @@ var GlueConnectionProvider = class {
 			stateful: false,
 			callerAccountId: this.callerAccountId,
 			warn: log.warn,
+			debug: log.debug,
 			mask: log.mask
 		});
 		const catalogId = updateCatalogId(properties["CatalogId"]);
@@ -35791,7 +35791,7 @@ var GlueConnectionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Connection ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to delete Glue Connection ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35866,7 +35866,7 @@ var GlueTriggerProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueTriggerProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Trigger", /* @__PURE__ */ new Set([
 		"Name",
@@ -35964,7 +35964,9 @@ var GlueTriggerProvider = class {
 				await this.getClient().send(new StartTriggerCommand({ Name: physicalId }));
 			} catch (restartError) {
 				if (updateError === void 0) throw restartError;
-				log.warn(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${describeAwsFailure(restartError).detail}`);
+				const restartFailure = describeAwsFailure(restartError);
+				log.warn(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${restartFailure.summary}`);
+				if (restartFailure.redacted) log.debug(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${restartFailure.detail}`);
 			}
 			if (updateError !== void 0) throw updateError;
 			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
@@ -36016,7 +36018,7 @@ var GlueTriggerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -44382,30 +44384,6 @@ var DLMLifecyclePolicyProvider = class {
 			...properties["Exclusions"] != null && { Exclusions: properties["Exclusions"] }
 		};
 	}
-	buildRemovalResets(properties, previousProperties) {
-		const resets = {};
-		const createInterval = clearOnUpdateRemoval(properties["CreateInterval"] != null ? Number(properties["CreateInterval"]) : void 0, previousProperties["CreateInterval"] != null ? Number(previousProperties["CreateInterval"]) : void 0, 1);
-		if (createInterval !== void 0) resets.CreateInterval = createInterval;
-		const retainInterval = clearOnUpdateRemoval(properties["RetainInterval"] != null ? Number(properties["RetainInterval"]) : void 0, previousProperties["RetainInterval"] != null ? Number(previousProperties["RetainInterval"]) : void 0, 7);
-		if (retainInterval !== void 0) resets.RetainInterval = retainInterval;
-		const copyTags = clearOnUpdateRemoval(properties["CopyTags"] ?? void 0, previousProperties["CopyTags"] ?? void 0, false);
-		if (copyTags !== void 0) resets.CopyTags = copyTags;
-		const extendDeletion = clearOnUpdateRemoval(properties["ExtendDeletion"] ?? void 0, previousProperties["ExtendDeletion"] ?? void 0, false);
-		if (extendDeletion !== void 0) resets.ExtendDeletion = extendDeletion;
-		const crossRegionCopyTargets = clearOnUpdateRemoval(properties["CrossRegionCopyTargets"] ?? void 0, previousProperties["CrossRegionCopyTargets"] ?? void 0, []);
-		if (crossRegionCopyTargets !== void 0) resets.CrossRegionCopyTargets = crossRegionCopyTargets;
-		const defaultPolicy = properties["DefaultPolicy"] ?? previousProperties["DefaultPolicy"];
-		const exclusionsClear = defaultPolicy === "VOLUME" ? {
-			ExcludeBootVolumes: false,
-			ExcludeVolumeTypes: [],
-			ExcludeTags: []
-		} : defaultPolicy === "INSTANCE" ? { ExcludeTags: [] } : void 0;
-		if (exclusionsClear !== void 0) {
-			const exclusions = clearOnUpdateRemoval(properties["Exclusions"] ?? void 0, previousProperties["Exclusions"] ?? void 0, exclusionsClear);
-			if (exclusions !== void 0) resets.Exclusions = exclusions;
-		}
-		return resets;
-	}
 	async fetchPolicyArn(policyId) {
 		return (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: policyId }))).Policy?.PolicyArn ?? "";
 	}
@@ -44459,7 +44437,8 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new UpdateLifecyclePolicyCommand({
 				PolicyId: physicalId,
 				...this.toSdkFields(properties),
-				...this.buildRemovalResets(properties, previousProperties)
+				...properties["CreateInterval"] != null && { CreateInterval: Number(properties["CreateInterval"]) },
+				...properties["RetainInterval"] != null && { RetainInterval: Number(properties["RetainInterval"]) }
 			}));
 			const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 			const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
@@ -46090,6 +46069,7 @@ var NestedStackProvider = class {
 				physicalId,
 				attributes: childOutputs.attributes,
 				...childOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: childOutputs.noEchoAttributeNames },
+				secretNamedAttributeNames: childOutputs.secretNamedAttributeNames,
 				...pendingRecord && { effectiveProperties: pendingRecord }
 			};
 		} catch (error) {
@@ -46117,6 +46097,7 @@ var NestedStackProvider = class {
 			wasReplaced: false,
 			attributes: updatedOutputs.attributes,
 			...updatedOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: updatedOutputs.noEchoAttributeNames },
+			secretNamedAttributeNames: updatedOutputs.secretNamedAttributeNames,
 			...pendingRecord && { effectiveProperties: pendingRecord }
 		};
 	}
@@ -46300,9 +46281,11 @@ var NestedStackProvider = class {
 			attributes[attributeName] = recovered;
 			noEchoAttributeNames.push(attributeName);
 		}
+		const childResources = childStateData.state.resources;
 		return {
 			attributes,
-			noEchoAttributeNames
+			noEchoAttributeNames,
+			secretNamedAttributeNames: childResources !== null && typeof childResources === "object" ? secretNamedAttributeNamesOf(attributes, childResources, rowSecrets) : []
 		};
 	}
 	requireContext() {
@@ -46780,4 +46763,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-59TTNMFB.js.map
+//# sourceMappingURL=provider-classes-DPwEHVDJ.js.map