@go-to-k/cdkd 0.301.4 → 0.301.6

package/dist/{provider-classes-BSUoljqw.js → provider-classes-CR4DtD8M.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-BkeM7IXi.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as markRefusedBeforeApplying, Ao as requireConfigArray, B as compensateRemovedDeletionProtection, Ci as s3BucketRegionalDomainName, Co as coerceCfnBoolean, Cs as withoutPhysicalNameCopies, Da as refuseMalformedNestedChildOutputs, Do as configStringRefusal, Dr as waitForLambdaFunctionActive, Ec as rewriteTemplateAssetReferences, Eo as configIntegerRefusal, G as INDEX_SETTLE_POLL_INTERVAL_MS, Gi as passedParameterClassesOf, Gl as resolveAssemblyPath, Gr as isWaitAbandonedError, Gt as awaitInFlightSibling, H as resolveDynamoDbDeleteBudgetClock, Hi as parseWebACLArn, Hl as describeFileReadFailure, Hn as secretNamedAttributeNamesOf, Ht as withNestedStackContext, Io as withRetry, Is as carriesSecretMask, J as ECR_AUTO_DELETE_IMAGES_TAG, Jr as ec2InstanceProtectionSite, K as deleteTableWithIndexBusyRetry, Kr as markWaitAbandoned, L as DynamoDBGlobalTableProvider, Lo as canonicalLambdaFunctionName, Lr as slowCcOperationTimeoutMs, Lt as revertNestedChildFromJournal, Mi as getAccountInfo, Ml as derivePartitionAndUrlSuffix, Mo as requireConfigString, Ms as physicalNameCopiesOf, Ns as recordAttributeIdCopy, Ol as decodeListingKey, Oo as readConfigString, Pt as getNestedRevertRun, Q as getPriorAttempts, Qi as accountArgs, Qr as reEnableInstanceApiTermination, R as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ro as lambdaFunctionNameForMask, Rr as unchangedBehindSecretReference, Si as s3BucketDualStackDomainName, So as toFiniteNumber, To as configBooleanRefusal, Ts as dynamicReferenceTokens, U as resolveDynamoDbDeleteBudgetMs, Ul as displayAssemblyPath, Ur as deleteSkipReason, V as deleteBudgetKey, Vt as getCurrentNestedStackContext, W as DELETE_INDEX_WAIT_PROCEED_NOTE, Wl as renderAssemblyPathEscape, Wr as withIndeterminateGuard, X as hasCdkAutoDeleteTag, Xr as observeThenDisableInstanceApiTermination, Xt as replacedDeleteFailureVerdict, Y as S3_AUTO_DELETE_OBJECTS_TAG, Yr as isTerminationProtectionPropagationError, Z as isTruthyCfnBoolean, Zo as passedNoEchoParametersOf, Zr as reDisableInstanceApiTermination, _i as outputReferenceProvenanceOf, _r as refuseMalformedDesiredTags, _s as markSameGenerationBag, a as findNestedTemplateTreeDefect, ao as withheldAccountClause, as as hasMaskableValues, b as lookupEachName, bi as s3BucketArn, bo as isWarmThroughputDecrease, br as definedAttributes, bs as redactSecretsForState, c as renderNestedTemplateTreeDefect, cr as reserveStackCreateToken, dn as REDACTED_DELETE_ADDRESS_SKIP_REASON, dr as isRefusedByName, fn as isRedactedRecordedValue, fr as markDeleteStarted, gr as readTagList, hi as isSettledInstanceState, hr as planTagDiff, jl as canonicalizeRegion, jo as requireConfigObject, jr as getCurrentResourceSecrets, js as recoverMaskedOutput, ko as replayWarn, ln as getCurrentProducerRegions, lo as withoutSilentDropProperties, mn as redactedDeleteAddressSkip, mr as DBPROXY_TAG_OPTIONS, o as isAbsoluteAssetPath, or as earliestDefined, pn as redactedDeleteAddressFields, pr as DBPROXY_TAGS_WHAT, q as waitForIndexesSettled, qa as refuseMalformedResourcesForDestroy, qt as getStackRecords, s as listNestedTemplateRows, so as findSilentDropProperties, t as DeployEngine, ur as acquireIdempotencyToken, v as chunks, vo as WARM_THROUGHPUT_MEMBERS, vr as tagMapAsList, vs as recordReferenceProvenanceEntry, wi as s3BucketWebsiteUrl, wo as coerceCfnInteger, x as withApiLimit, xc as stringifyValue, xi as s3BucketDomainName, xo as toCfnInteger, xr as stringifyIfAssigned, y as isAccessDeniedError, yo as coerceWarmThroughput$1, yr as tagPlanWarning, ys as snapshotPassProvenance, z as beginDeleteWait, zo as sameLambdaFunctionAddress } from "./deploy-engine-BIPU9Xdh.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-C58oW5zG.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DYfZCsxM.js";
-import { RDSProvider } from "./rds-provider-DI_O0_iG.js";
-import { NeptuneProvider } from "./neptune-provider-DoKgbZCz.js";
-import { ASGProvider } from "./asg-provider--GY-B-zI.js";
+import { $i as accountArgs, Al as derivePartitionAndUrlSuffix, Ao as replayWarn, Bl as describeFileReadFailure, Bo as sameLambdaFunctionAddress, C as getPriorAttempts, Cn as awaitInFlightSibling, Co as toFiniteNumber, Dn as replacedDeleteFailureVerdict, Do as configIntegerRefusal, Dr as waitForLambdaFunctionActive, Dt as withApiLimit, El as decodeListingKey, Eo as configBooleanRefusal, Es as dynamicReferenceTokens, Et as lookupEachName, F as listNestedTemplateRows, Gr as isWaitAbandonedError, Hl as renderAssemblyPathEscape, I as renderNestedTemplateTreeDefect, Ja as refuseMalformedResourcesForDestroy, Jr as ec2InstanceProtectionSite, Jt as redactedDeleteAddressFields, Ki as passedParameterClassesOf, Kn as secretNamedAttributeNamesOf, Kr as markWaitAbandoned, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Mo as requireConfigObject, Ms as recoverMaskedOutput, N as findNestedTemplateTreeDefect, Ni as getAccountInfo, No as requireConfigString, Ns as physicalNameCopiesOf, Oa as refuseMalformedNestedChildOutputs, Oo as configStringRefusal, P as isAbsoluteAssetPath, Ps as recordAttributeIdCopy, Qo as passedNoEchoParametersOf, Qr as reEnableInstanceApiTermination, Ro as canonicalLambdaFunctionName, Rr as unchangedBehindSecretReference, S as isTruthyCfnBoolean, So as toCfnInteger, Tn as getStackRecords, To as coerceCfnInteger, Tt as isAccessDeniedError, Ui as parseWebACLArn, Ul as resolveAssemblyPath, Ur as deleteSkipReason, Vl as displayAssemblyPath, Wr as withIndeterminateGuard, Wt as getCurrentProducerRegions, Xr as observeThenDisableInstanceApiTermination, Yr as isTerminationProtectionPropagationError, Yt as redactedDeleteAddressSkip, Zr as reDisableInstanceApiTermination, _ as deleteTableWithIndexBusyRetry, _r as refuseMalformedDesiredTags, ai as s3BucketDomainName, b as S3_AUTO_DELETE_OBJECTS_TAG, bo as coerceWarmThroughput$1, br as definedAttributes, bs as recordReferenceProvenanceEntry, c as DynamoDBGlobalTableProvider, ci as s3BucketWebsiteUrl, co as findSilentDropProperties, cr as reserveStackCreateToken, d as compensateRemovedDeletionProtection, dr as isRefusedByName, f as deleteBudgetKey, fr as markDeleteStarted, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as readTagList, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hr as planTagDiff, ii as s3BucketArn, jo as requireConfigArray, jr as getCurrentResourceSecrets, kl as canonicalizeRegion, ko as readConfigString, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mr as DBPROXY_TAG_OPTIONS, mt as withNestedStackContext, oi as s3BucketDualStackDomainName, oo as withheldAccountClause, or as earliestDefined, ot as getNestedRevertRun, p as resolveDynamoDbDeleteBudgetClock, pi as outputReferenceProvenanceOf, pr as DBPROXY_TAGS_WHAT, pt as getCurrentNestedStackContext, qt as isRedactedRecordedValue, ri as isSettledInstanceState, rs as redactForState, si as s3BucketRegionalDomainName, ss as hasMaskableValues, t as DeployEngine, u as beginDeleteWait, uo as withoutSilentDropProperties, ur as acquireIdempotencyToken, v as waitForIndexesSettled, vr as tagMapAsList, w as markRefusedBeforeApplying, wc as rewriteTemplateAssetReferences, wo as coerceCfnBoolean, ws as withoutPhysicalNameCopies, wt as chunks, x as hasCdkAutoDeleteTag, xo as isWarmThroughputDecrease, xr as stringifyIfAssigned, xs as snapshotPassProvenance, y as ECR_AUTO_DELETE_IMAGES_TAG, yc as stringifyValue, yo as WARM_THROUGHPUT_MEMBERS, yr as tagPlanWarning, ys as markSameGenerationBag, zo as lambdaFunctionNameForMask } from "./deploy-engine-D1z0QUsv.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-988BRmqF.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Cqk1ZTsY.js";
+import { RDSProvider } from "./rds-provider-DBW972HG.js";
+import { NeptuneProvider } from "./neptune-provider-DUaw7kpj.js";
+import { ASGProvider } from "./asg-provider-GNiE6dR1.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -14586,7 +14586,10 @@ var SecretsManagerSecretProvider = class {
 	}
 	asPersisted(bag) {
 		const secrets = getCurrentResourceSecrets();
-		return secrets !== void 0 && secrets.size > 0 ? redactSecretsForState(bag, secrets) : bag;
+		return secrets !== void 0 && secrets.size > 0 ? redactForState(bag, {
+			provenance: "value-scan",
+			secrets
+		}) : bag;
 	}
 	generateSecretString(config, options) {
 		const refusal = generateMemberRefusal(config);
@@ -15390,6 +15393,14 @@ var EventBridgeBusProvider = class {
 		"DeadLetterConfig",
 		"LogConfig"
 	])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::Events::EventBus", /* @__PURE__ */ new Map([
+		["Description", ""],
+		["KmsKeyIdentifier", ""],
+		["LogConfig", {
+			Level: "OFF",
+			IncludeDetail: "NONE"
+		}]
+	])]]);
 	constructor() {
 		this.eventBridgeClient = getAwsClients().eventBridge;
 	}
@@ -15437,15 +15448,16 @@ var EventBridgeBusProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update EventBus ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating EventBus ${logicalId}: ${physicalId}`);
 		const descChanged = properties["Description"] !== previousProperties["Description"];
 		const kmsChanged = properties["KmsKeyIdentifier"] !== previousProperties["KmsKeyIdentifier"];
@@ -15458,7 +15470,7 @@ var EventBridgeBusProvider = class {
 			if (properties["DeadLetterConfig"] !== void 0) {
 				const dlcUpdate = sanitizeDeadLetterConfig(properties["DeadLetterConfig"]);
 				if (dlcUpdate) updateParams.DeadLetterConfig = dlcUpdate;
-			}
+			} else if ((context?.removedProperties?.has("DeadLetterConfig") ?? previousProperties["DeadLetterConfig"] !== void 0) && sanitizeDeadLetterConfig(previousProperties["DeadLetterConfig"]) !== void 0) updateParams.DeadLetterConfig = { Arn: "" };
 			if (properties["LogConfig"] !== void 0) updateParams.LogConfig = properties["LogConfig"];
 			await this.eventBridgeClient.send(new UpdateEventBusCommand(updateParams));
 		}
@@ -25254,35 +25266,9 @@ function targetsSecretCause(read) {
 	return read.kind === "malformed" && read.onlySecret ? " (an Id holds a dynamic reference or its mask, which names no target Elastic Load Balancing accepts)" : "";
 }
 const TARGETS_WHAT = "targets, each with a string Id and, where given, an integer Port and a string AvailabilityZone";
-const TARGET_GROUP_ATTRIBUTE_DEFAULTS = {
-	"deregistration_delay.timeout_seconds": "300",
-	"deregistration_delay.connection_termination.enabled": "false",
-	"stickiness.enabled": "false",
-	"stickiness.lb_cookie.duration_seconds": "86400",
-	"stickiness.app_cookie.duration_seconds": "86400",
-	"load_balancing.algorithm.type": "round_robin",
-	"load_balancing.algorithm.anomaly_mitigation": "off",
-	"load_balancing.cross_zone.enabled": "use_load_balancer_configuration",
-	"slow_start.duration_seconds": "0",
-	"lambda.multi_value_headers.enabled": "false",
-	"proxy_protocol_v2.enabled": "false"
-};
-const LOAD_BALANCER_ATTRIBUTE_DEFAULTS = {
-	"deletion_protection.enabled": "false",
-	"access_logs.s3.enabled": "false",
-	"connection_logs.s3.enabled": "false",
-	"health_check_logs.s3.enabled": "false",
-	"routing.http.desync_mitigation_mode": "defensive",
-	"routing.http.drop_invalid_header_fields.enabled": "false",
-	"routing.http.preserve_host_header.enabled": "false",
-	"routing.http.x_amzn_tls_version_and_cipher_suite.enabled": "false",
-	"routing.http.xff_client_port.enabled": "false",
-	"routing.http.xff_header_processing.mode": "append",
-	"routing.http2.enabled": "true",
-	"waf.fail_open.enabled": "false",
-	"zonal_shift.config.enabled": "false"
-};
-const LISTENER_ATTRIBUTE_DEFAULTS = { "routing.http.response.server.enabled": "true" };
+const RETAIN_REMOVED_ATTRIBUTE = () => void 0;
+const LOG_DELIVERY_ATTRIBUTE = /^[a-z_]+_logs\.s3\./;
+const MISLEADING_IF_KEPT_ATTRIBUTE = /^routing\.http\.(response\.access_control_|request\.[a-z0-9_]+\.header_name$)/;
 function loadBalancerAttributes(lb, lbArn) {
 	return definedAttributes({
 		DNSName: lb.DNSName,
@@ -25413,13 +25399,53 @@ var ELBv2Provider = class {
 			"Tags"
 		])]
 	]);
-	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
-		"LoadBalancerArn",
-		"DefaultActions",
-		"ListenerAttributes",
-		"Tags",
-		...LISTENER_LEFT_IN_PLACE_ON_REMOVAL
-	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([
+		["AWS::ElasticLoadBalancingV2::LoadBalancer", /* @__PURE__ */ new Set([
+			"Name",
+			"Scheme",
+			"Type",
+			"Subnets",
+			"SubnetMappings",
+			"SecurityGroups",
+			"Tags",
+			"IpAddressType",
+			"Ipv4IpamPoolId",
+			"MinimumLoadBalancerCapacity",
+			"EnableCapacityReservationProvisionStabilize",
+			"LoadBalancerAttributes",
+			"EnablePrefixForIpv6SourceNat",
+			"EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"
+		])],
+		["AWS::ElasticLoadBalancingV2::TargetGroup", /* @__PURE__ */ new Set([
+			"Protocol",
+			"Port",
+			"VpcId",
+			"TargetType",
+			"ProtocolVersion",
+			"Name",
+			"IpAddressType",
+			"TargetControlPort",
+			"HealthCheckPort",
+			"Targets",
+			"Tags",
+			"HealthCheckProtocol",
+			"HealthCheckPath",
+			"HealthCheckEnabled",
+			"HealthCheckIntervalSeconds",
+			"HealthCheckTimeoutSeconds",
+			"HealthyThresholdCount",
+			"UnhealthyThresholdCount",
+			"Matcher",
+			"TargetGroupAttributes"
+		])],
+		["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
+			"LoadBalancerArn",
+			"DefaultActions",
+			"ListenerAttributes",
+			"Tags",
+			...LISTENER_LEFT_IN_PLACE_ON_REMOVAL
+		])]
+	]);
 	lambdaClients = /* @__PURE__ */ new Map();
 	getClient() {
 		if (!this.elbv2Client) this.elbv2Client = new ElasticLoadBalancingV2Client({
@@ -25681,7 +25707,11 @@ var ELBv2Provider = class {
 			}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.";
 			throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + remedy);
 		}
-		const submittedAttrs = this.diffAttributeBag("LoadBalancerAttributes", logicalId, properties["LoadBalancerAttributes"], previousProperties["LoadBalancerAttributes"], this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS), fromReadback, maskSecrets);
+		const removedLogKeys = [];
+		const submittedAttrs = this.diffAttributeBag("LoadBalancerAttributes", logicalId, properties["LoadBalancerAttributes"], previousProperties["LoadBalancerAttributes"], (key) => {
+			if (LOG_DELIVERY_ATTRIBUTE.test(key)) removedLogKeys.push(key);
+			return RETAIN_REMOVED_ATTRIBUTE();
+		}, fromReadback, maskSecrets);
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 				LoadBalancerArn: physicalId,
@@ -25689,6 +25719,14 @@ var ELBv2Provider = class {
 			}));
 			this.logger.debug(`Applied ${submittedAttrs.length} LoadBalancerAttributes change(s) for ${logicalId}`);
 		}
+		const desiredAttrs = new Map(this.normalizeAttributes(properties["LoadBalancerAttributes"]).map((a) => [a.Key, a.Value]));
+		const exposedLogKeys = removedLogKeys.filter((key) => desiredAttrs.get(`${key.split(".")[0]}.s3.enabled`) !== "false");
+		if (exposedLogKeys.length > 0) {
+			const mask = maskerOrIdentity(maskSecrets);
+			const keys = exposedLogKeys.map((key) => mask(key)).join(", ");
+			const one = exposedLogKeys.length === 1;
+			this.logger.warn(safeMsg`${logicalId}: LoadBalancerAttributes ${one ? "key" : "keys"} ${keys} ${one ? "is" : "are"} no longer declared and ${one ? "keeps its live value" : "keep their live values"}, as CloudFormation leaves ${one ? "it" : "them"}, so the load balancer may keep delivering logs to the bucket it names. To stop it, declare the matching '<kind>_logs.s3.enabled' key as 'false' and deploy.`);
+		}
 		const newSubnets = properties["Subnets"];
 		const oldSubnets = previousProperties["Subnets"];
 		const newMappings = properties["SubnetMappings"];
@@ -25718,7 +25756,7 @@ var ELBv2Provider = class {
 			}));
 			this.logger.debug(`Updated SecurityGroups for ${logicalId}`);
 		}
-		const newIpType = properties["IpAddressType"];
+		const newIpType = fromReadback ? properties["IpAddressType"] : clearOnUpdateRemoval(properties["IpAddressType"], previousProperties["IpAddressType"], "ipv4");
 		const oldIpType = previousProperties["IpAddressType"];
 		if (newIpType !== void 0 && newIpType !== oldIpType) {
 			await this.getClient().send(new SetIpAddressTypeCommand({
@@ -25928,7 +25966,7 @@ var ELBv2Provider = class {
 		try {
 			const rawMatcher = properties["Matcher"];
 			const matcher = rawMatcher && (rawMatcher.HttpCode !== void 0 || rawMatcher.GrpcCode !== void 0) ? rawMatcher : void 0;
-			const healthCheckPort = String(properties["Protocol"] ?? previousProperties["Protocol"] ?? "").toUpperCase() === "GENEVE" ? properties["HealthCheckPort"] : clearOnUpdateRemoval(properties["HealthCheckPort"], previousProperties["HealthCheckPort"], "traffic-port");
+			const healthCheckPort = clearOnUpdateRemoval(properties["HealthCheckPort"], previousProperties["HealthCheckPort"], "traffic-port");
 			await this.getClient().send(new ModifyTargetGroupCommand({
 				TargetGroupArn: physicalId,
 				HealthCheckProtocol: properties["HealthCheckProtocol"],
@@ -25941,14 +25979,7 @@ var ELBv2Provider = class {
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
 				...matcher && { Matcher: matcher }
 			}));
-			const tgAttrDiff = this.diffAttributeBag("TargetGroupAttributes", logicalId, properties["TargetGroupAttributes"], previousProperties["TargetGroupAttributes"], (key, currentValue) => {
-				const fallback = Object.hasOwn(TARGET_GROUP_ATTRIBUTE_DEFAULTS, key) ? TARGET_GROUP_ATTRIBUTE_DEFAULTS[key] : void 0;
-				if (fallback === void 0) {
-					this.logger.warn(`TargetGroup attribute ${maskerOrIdentity(maskSecrets)(key)} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
-					return;
-				}
-				return currentValue === fallback ? void 0 : fallback;
-			}, fromReadback, maskSecrets);
+			const tgAttrDiff = this.diffAttributeBag("TargetGroupAttributes", logicalId, properties["TargetGroupAttributes"], previousProperties["TargetGroupAttributes"], RETAIN_REMOVED_ATTRIBUTE, fromReadback, maskSecrets);
 			if (tgAttrDiff.length > 0) {
 				await this.getClient().send(new ModifyTargetGroupAttributesCommand({
 					TargetGroupArn: physicalId,
@@ -26115,7 +26146,11 @@ var ELBv2Provider = class {
 				...alpnPolicy && alpnPolicy.length > 0 && { AlpnPolicy: alpnPolicy },
 				...mutualAuth !== void 0 && { MutualAuthentication: mutualAuth }
 			}));
-			const submittedAttrs = this.diffAttributeBag("ListenerAttributes", logicalId, properties["ListenerAttributes"], previousProperties["ListenerAttributes"], this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS), fromReadback, maskSecrets);
+			const removedMisleadingKeys = [];
+			const submittedAttrs = this.diffAttributeBag("ListenerAttributes", logicalId, properties["ListenerAttributes"], previousProperties["ListenerAttributes"], (key) => {
+				if (MISLEADING_IF_KEPT_ATTRIBUTE.test(key)) removedMisleadingKeys.push(key);
+				return RETAIN_REMOVED_ATTRIBUTE();
+			}, fromReadback, maskSecrets);
 			if (submittedAttrs.length > 0) {
 				const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
 				try {
@@ -26134,6 +26169,12 @@ var ELBv2Provider = class {
 			}
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskSecrets);
 			this.logger.debug(`Successfully updated Listener ${logicalId}`);
+			if (removedMisleadingKeys.length > 0) {
+				const mask = maskerOrIdentity(maskSecrets);
+				const keys = removedMisleadingKeys.map((key) => mask(key)).join(", ");
+				const one = removedMisleadingKeys.length === 1;
+				this.logger.warn(safeMsg`${logicalId}: ListenerAttributes ${one ? "key" : "keys"} ${keys} ${one ? "is" : "are"} no longer declared and ${one ? "keeps its live value" : "keep their live values"}, as CloudFormation leaves ${one ? "it" : "them"}, so the listener may keep sending a CORS response header, or keep writing a request header under its renamed name. To change ${one ? "it" : "them"}, declare the value you want and deploy, or set ${one ? "it" : "them"} with 'aws elbv2 modify-listener-attributes'.`);
+			}
 			if (leftInPlaceNames.length > 0 && !fromReadback) this.logger.warn(listenerLeftInPlaceWarning(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 			return {
 				physicalId,
@@ -26214,12 +26255,6 @@ var ELBv2Provider = class {
 		}
 		return submitted;
 	}
-	attributeRemovalResolver(defaults) {
-		return (key, currentValue) => {
-			const fallback = Object.hasOwn(defaults, key) ? defaults[key] : "";
-			return currentValue === fallback ? void 0 : fallback;
-		};
-	}
 	async readUpdateTargets(logicalId, physicalId, resourceType, desiredRaw, recordedRaw, groupPort) {
 		const desired = readTargets(desiredRaw, "desired");
 		if (desired.kind === "malformed") throw markNonRetryable(new ProvisioningError(`desired Targets of TargetGroup ${logicalId} is not a list of ${TARGETS_WHAT}${targetsSecretCause(desired)} — the target group was not updated`, resourceType, logicalId, physicalId));
@@ -34027,7 +34062,7 @@ async function refuseCatalogMove(args) {
 		try {
 			callerAccount = await args.callerAccountId();
 		} catch (error) {
-			throw wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`Could not resolve the caller's account id (sts:GetCallerIdentity) to tell whether CatalogId ${mask(literal)} is this account's default Data Catalog, so cdkd did not update Glue ${args.noun} ${args.logicalId}: ${text}`, args.resourceType, args.logicalId, void 0, error instanceof Error ? error : void 0));
+			throw wrapGlueError(mask, args.debug, error, (text) => new ProvisioningError(`Could not resolve the caller's account id (sts:GetCallerIdentity) to tell whether CatalogId ${mask(literal)} is this account's default Data Catalog, so cdkd did not update Glue ${args.noun} ${args.logicalId}: ${text}`, args.resourceType, args.logicalId, void 0, error instanceof Error ? error : void 0));
 		}
 		if (literal === callerAccount) return;
 	}
@@ -34059,6 +34094,13 @@ function newGlueClients(region) {
 		}))
 	};
 }
+function wrapGlueError(mask, debug, error, build) {
+	const failure = describeAwsFailure(error);
+	if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+	debug(mask(build(failure.detail).message));
+	const wrapped = build(mask(failure.summary));
+	return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+}
 var GlueProvider = class {
 	client;
 	createClient;
@@ -34066,7 +34108,7 @@ var GlueProvider = class {
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Database", /* @__PURE__ */ new Set([
 		"DatabaseInput",
@@ -34165,6 +34207,7 @@ var GlueProvider = class {
 			stateful: true,
 			callerAccountId: this.callerAccountId,
 			warn: log.warn,
+			debug: log.debug,
 			mask: log.mask
 		});
 		const catalogId = updateCatalogId(properties["CatalogId"]);
@@ -34218,7 +34261,7 @@ var GlueProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Database ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to delete Glue Database ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createTable(logicalId, resourceType, properties, context) {
@@ -34297,6 +34340,7 @@ var GlueProvider = class {
 			stateful: true,
 			callerAccountId: this.callerAccountId,
 			warn: log.warn,
+			debug: log.debug,
 			mask: log.mask
 		});
 		const catalogId = updateCatalogId(properties["CatalogId"]);
@@ -34326,7 +34370,7 @@ var GlueProvider = class {
 				hint += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters and StorageDescriptor members read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
 				hint += ` Re-run the deploy to pick up the current values.`;
 			}
-			throw this.wrapMaskedError(log.mask, error, (detail) => new ProvisioningError(`Failed to update Glue Table ${logicalId}: ${detail}${hint}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log.mask, error, (detail) => new ProvisioningError(`Failed to update Glue Table ${logicalId}: ${hint ? withoutFinalPeriod(detail) : detail}${hint}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteTable(logicalId, physicalId, resourceType, properties, context) {
@@ -34361,7 +34405,7 @@ var GlueProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Table ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to delete Glue Table ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	preserveAwsManagedParameters(built, desiredParameters, previousParameters, liveParameters) {
@@ -34741,7 +34785,7 @@ var GlueWorkflowProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueWorkflowProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Workflow", /* @__PURE__ */ new Set([
 		"Name",
@@ -34820,7 +34864,7 @@ var GlueWorkflowProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Workflow ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue Workflow ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -34896,7 +34940,7 @@ var GlueSecurityConfigurationProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueSecurityConfigurationProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
@@ -34948,7 +34992,7 @@ var GlueSecurityConfigurationProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue SecurityConfiguration ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue SecurityConfiguration ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35089,7 +35133,7 @@ var GlueJobProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueJobProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Job", /* @__PURE__ */ new Set([
 		"Name",
@@ -35199,7 +35243,7 @@ var GlueJobProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Glue Job ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue Job ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35335,8 +35379,11 @@ function asRecord$1(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
 	return value;
 }
+function withoutFinalPeriod(text) {
+	return text.endsWith(".") ? text.slice(0, -1) : text;
+}
 function preUpdateReadFailureMessage(kind, iamAction, logicalId, detail) {
-	return `Failed to read the current Glue ${kind} ${logicalId} before update: ${detail}. cdkd reads the live ${kind.toLowerCase()} so AWS-managed Parameters (Apache Iceberg's table_type / metadata_location, a crawler's classification, Lake Formation markers) survive an update that Glue applies as a full replace. Grant ${iamAction} to the deploy identity — proceeding without the read would silently erase them.`;
+	return `Failed to read the current Glue ${kind} ${logicalId} before update: ${withoutFinalPeriod(detail)}. cdkd reads the live ${kind.toLowerCase()} so AWS-managed Parameters (Apache Iceberg's table_type / metadata_location, a crawler's classification, Lake Formation markers) survive an update that Glue applies as a full replace. Grant ${iamAction} to the deploy identity — proceeding without the read would silently erase them.`;
 }
 function coerceNumber(value) {
 	if (typeof value === "number") return value;
@@ -35383,7 +35430,7 @@ var GlueCrawlerProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueCrawlerProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Crawler", /* @__PURE__ */ new Set([
 		"Name",
@@ -35490,14 +35537,23 @@ var GlueCrawlerProvider = class {
 				log.debug(`Glue Crawler ${v(physicalId)} does not exist, skipping deletion`);
 				return;
 			}
+			let failure = error;
 			if (error instanceof CrawlerRunningException) {
 				log.debug(`Glue Crawler ${v(physicalId)} is running; stopping before delete and retrying`);
-				await this.stopCrawlerAndWait(physicalId, log);
-				await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
-				return;
+				try {
+					await this.stopCrawlerAndWait(physicalId, log);
+					await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
+					return;
+				} catch (retryError) {
+					if (retryError instanceof EntityNotFoundException) {
+						log.debug(`Glue Crawler ${v(physicalId)} does not exist, skipping deletion`);
+						return;
+					}
+					failure = retryError;
+				}
 			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Crawler ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			const cause = failure instanceof Error ? failure : void 0;
+			throw this.wrapMaskedError(log.mask, failure, (text) => new ProvisioningError(`Failed to delete Glue Crawler ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async stopCrawlerAndWait(physicalId, log = {
@@ -35645,7 +35701,7 @@ var GlueConnectionProvider = class {
 	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueConnectionProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
@@ -35707,6 +35763,7 @@ var GlueConnectionProvider = class {
 			stateful: false,
 			callerAccountId: this.callerAccountId,
 			warn: log.warn,
+			debug: log.debug,
 			mask: log.mask
 		});
 		const catalogId = updateCatalogId(properties["CatalogId"]);
@@ -35746,7 +35803,7 @@ var GlueConnectionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(log.mask(`Failed to delete Glue Connection ${logicalId}: ${describeAwsFailure(error).detail}`), resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to delete Glue Connection ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -35821,7 +35878,7 @@ var GlueTriggerProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("GlueTriggerProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		return wrapGlueError(mask, (message) => this.logger.debug(message), error, build);
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Trigger", /* @__PURE__ */ new Set([
 		"Name",
@@ -35919,7 +35976,9 @@ var GlueTriggerProvider = class {
 				await this.getClient().send(new StartTriggerCommand({ Name: physicalId }));
 			} catch (restartError) {
 				if (updateError === void 0) throw restartError;
-				log.warn(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${describeAwsFailure(restartError).detail}`);
+				const restartFailure = describeAwsFailure(restartError);
+				log.warn(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${restartFailure.summary}`);
+				if (restartFailure.redacted) log.debug(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${restartFailure.detail}`);
 			}
 			if (updateError !== void 0) throw updateError;
 			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
@@ -35971,7 +36030,7 @@ var GlueTriggerProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapMaskedError(context?.maskSecrets ?? ((text) => text), error, (text) => new ProvisioningError(`Failed to delete Glue Trigger ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -38035,7 +38094,10 @@ var SchedulerScheduleProvider = class {
 		const bag = getCurrentResourceSecrets();
 		if (bag === void 0 || typeof desiredGroup !== "string") return false;
 		if (typeof recordedGroup !== "string" || !recordedGroup.includes("{{resolve:")) return false;
-		return withoutPhysicalNameCopies(bag, () => redactSecretsForState(desiredGroup, bag)) !== recordedGroup;
+		return withoutPhysicalNameCopies(bag, () => redactForState(desiredGroup, {
+			provenance: "value-scan",
+			secrets: bag
+		})) !== recordedGroup;
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const groupName = this.groupNameOf(properties);
@@ -46716,4 +46778,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-BSUoljqw.js.map
+//# sourceMappingURL=provider-classes-CR4DtD8M.js.map