@go-to-k/cdkd 0.301.5 → 0.301.7

package/dist/{provider-classes-DPwEHVDJ.js → provider-classes-BWo7K01p.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as explicitDenyPolicyKind, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zn as markNameCollision, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isRetryableTransientError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as THROTTLING_ERROR_NAMES, ct as canonicalizeRoute53QueryName, dr as markNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, et as renderDisableCommand, fr as markRedactedCause, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isMarkedNonRetryable, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, o as readPrincipalLists, or as isTransientServerError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as wrapMaskedAwsError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isExplicitDenyError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-BkeM7IXi.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dr as isThrottlingError, dt as compositeIdSkipResult, en as clientDefaultsFor, er as explicitDenyPolicyKind, et as renderDisableCommand, fr as markNonRetryable, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isExplicitDenyError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as THROTTLING_ERROR_NAMES, lt as compositeIdFormatMessage, mr as wrapMaskedAwsError, nn as AccountIdUnavailableError, o as readPrincipalLists, or as isRetryableTransientError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as markRedactedCause, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, rr as isAmbiguousOutcomeError, sr as isTransientServerError, tn as credentialFingerprint, u as clearOnUpdateRemoval, ur as isMarkedNonRetryable, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-LyArt3ew.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $i as accountArgs, Ao as replayWarn, Bo as sameLambdaFunctionAddress, C as getPriorAttempts, Cn as awaitInFlightSibling, Co as toFiniteNumber, Dc as rewriteTemplateAssetReferences, Dn as replacedDeleteFailureVerdict, Do as configIntegerRefusal, Dr as waitForLambdaFunctionActive, Dt as withApiLimit, Eo as configBooleanRefusal, Es as dynamicReferenceTokens, Et as lookupEachName, F as listNestedTemplateRows, Gl as renderAssemblyPathEscape, Gr as isWaitAbandonedError, I as renderNestedTemplateTreeDefect, Ja as refuseMalformedResourcesForDestroy, Jr as ec2InstanceProtectionSite, Jt as redactedDeleteAddressFields, Ki as passedParameterClassesOf, Kl as resolveAssemblyPath, Kn as secretNamedAttributeNamesOf, Kr as markWaitAbandoned, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Ml as canonicalizeRegion, Mo as requireConfigObject, Ms as recoverMaskedOutput, N as findNestedTemplateTreeDefect, Ni as getAccountInfo, Nl as derivePartitionAndUrlSuffix, No as requireConfigString, Ns as physicalNameCopiesOf, Oa as refuseMalformedNestedChildOutputs, Oo as configStringRefusal, P as isAbsoluteAssetPath, Ps as recordAttributeIdCopy, Qo as passedNoEchoParametersOf, Qr as reEnableInstanceApiTermination, Ro as canonicalLambdaFunctionName, Rr as unchangedBehindSecretReference, S as isTruthyCfnBoolean, Sc as stringifyValue, So as toCfnInteger, Tn as getStackRecords, To as coerceCfnInteger, Tt as isAccessDeniedError, Ui as parseWebACLArn, Ul as describeFileReadFailure, Ur as deleteSkipReason, Wl as displayAssemblyPath, Wr as withIndeterminateGuard, Wt as getCurrentProducerRegions, Xr as observeThenDisableInstanceApiTermination, Yr as isTerminationProtectionPropagationError, Yt as redactedDeleteAddressSkip, Zr as reDisableInstanceApiTermination, _ as deleteTableWithIndexBusyRetry, _r as refuseMalformedDesiredTags, ai as s3BucketDomainName, b as S3_AUTO_DELETE_OBJECTS_TAG, bo as coerceWarmThroughput$1, br as definedAttributes, bs as snapshotPassProvenance, c as DynamoDBGlobalTableProvider, ci as s3BucketWebsiteUrl, co as findSilentDropProperties, cr as reserveStackCreateToken, d as compensateRemovedDeletionProtection, dr as isRefusedByName, f as deleteBudgetKey, fr as markDeleteStarted, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as readTagList, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hr as planTagDiff, ii as s3BucketArn, jo as requireConfigArray, jr as getCurrentResourceSecrets, kl as decodeListingKey, ko as readConfigString, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mr as DBPROXY_TAG_OPTIONS, mt as withNestedStackContext, oi as s3BucketDualStackDomainName, oo as withheldAccountClause, or as earliestDefined, os as hasMaskableValues, ot as getNestedRevertRun, p as resolveDynamoDbDeleteBudgetClock, pi as outputReferenceProvenanceOf, pr as DBPROXY_TAGS_WHAT, pt as getCurrentNestedStackContext, qt as isRedactedRecordedValue, ri as isSettledInstanceState, si as s3BucketRegionalDomainName, t as DeployEngine, u as beginDeleteWait, uo as withoutSilentDropProperties, ur as acquireIdempotencyToken, v as waitForIndexesSettled, vr as tagMapAsList, vs as markSameGenerationBag, w as markRefusedBeforeApplying, wo as coerceCfnBoolean, ws as withoutPhysicalNameCopies, wt as chunks, x as hasCdkAutoDeleteTag, xo as isWarmThroughputDecrease, xr as stringifyIfAssigned, xs as redactSecretsForState, y as ECR_AUTO_DELETE_IMAGES_TAG, yo as WARM_THROUGHPUT_MEMBERS, yr as tagPlanWarning, ys as recordReferenceProvenanceEntry, zo as lambdaFunctionNameForMask } from "./deploy-engine-HAvm8vSI.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CTpDWSUG.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DmPDfDhE.js";
-import { RDSProvider } from "./rds-provider-CxB94DZy.js";
-import { NeptuneProvider } from "./neptune-provider-CXhoiT-P.js";
-import { ASGProvider } from "./asg-provider-DHB498Xq.js";
+import { $i as accountArgs, Ao as replayWarn, Bl as displayAssemblyPath, Bo as sameLambdaFunctionAddress, C as getPriorAttempts, Cc as rewriteTemplateAssetReferences, Cn as awaitInFlightSibling, Co as toFiniteNumber, Dn as replacedDeleteFailureVerdict, Do as configIntegerRefusal, Dr as waitForLambdaFunctionActive, Dt as withApiLimit, Eo as configBooleanRefusal, Es as dynamicReferenceTokens, Et as lookupEachName, F as listNestedTemplateRows, Gr as isWaitAbandonedError, Hl as resolveAssemblyPath, I as renderNestedTemplateTreeDefect, Ja as refuseMalformedResourcesForDestroy, Jr as ec2InstanceProtectionSite, Jt as redactedDeleteAddressFields, Ki as passedParameterClassesOf, Kn as secretNamedAttributeNamesOf, Kr as markWaitAbandoned, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Mo as requireConfigObject, Ms as recoverMaskedOutput, N as findNestedTemplateTreeDefect, Ni as getAccountInfo, No as requireConfigString, Ns as physicalNameCopiesOf, Oa as refuseMalformedNestedChildOutputs, Ol as canonicalizeRegion, Oo as configStringRefusal, P as isAbsoluteAssetPath, Ps as recordAttributeIdCopy, Qo as passedNoEchoParametersOf, Qr as reEnableInstanceApiTermination, Ro as canonicalLambdaFunctionName, Rr as unchangedBehindSecretReference, S as isTruthyCfnBoolean, So as toCfnInteger, Tl as decodeListingKey, Tn as getStackRecords, To as coerceCfnInteger, Tt as isAccessDeniedError, Ui as parseWebACLArn, Ur as deleteSkipReason, Vl as renderAssemblyPathEscape, Wr as withIndeterminateGuard, Wt as getCurrentProducerRegions, Xr as observeThenDisableInstanceApiTermination, Yr as isTerminationProtectionPropagationError, Yt as redactedDeleteAddressSkip, Zr as reDisableInstanceApiTermination, _ as deleteTableWithIndexBusyRetry, _r as refuseMalformedDesiredTags, ai as s3BucketDomainName, b as S3_AUTO_DELETE_OBJECTS_TAG, bo as coerceWarmThroughput$1, br as definedAttributes, bs as snapshotPassProvenance, c as DynamoDBGlobalTableProvider, ci as s3BucketWebsiteUrl, co as findSilentDropProperties, cr as reserveStackCreateToken, d as compensateRemovedDeletionProtection, dr as isRefusedByName, f as deleteBudgetKey, fr as markDeleteStarted, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as readTagList, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hr as planTagDiff, ii as s3BucketArn, jo as requireConfigArray, jr as getCurrentResourceSecrets, kl as derivePartitionAndUrlSuffix, ko as readConfigString, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mr as DBPROXY_TAG_OPTIONS, mt as withNestedStackContext, oi as s3BucketDualStackDomainName, oo as withheldAccountClause, or as earliestDefined, os as hasMaskableValues, ot as getNestedRevertRun, p as resolveDynamoDbDeleteBudgetClock, pi as outputReferenceProvenanceOf, pr as DBPROXY_TAGS_WHAT, pt as getCurrentNestedStackContext, qt as isRedactedRecordedValue, ri as isSettledInstanceState, si as s3BucketRegionalDomainName, t as DeployEngine, u as beginDeleteWait, uo as withoutSilentDropProperties, ur as acquireIdempotencyToken, v as waitForIndexesSettled, vc as stringifyValue, vr as tagMapAsList, vs as markSameGenerationBag, w as markRefusedBeforeApplying, wo as coerceCfnBoolean, ws as withoutPhysicalNameCopies, wt as chunks, x as hasCdkAutoDeleteTag, xo as isWarmThroughputDecrease, xr as stringifyIfAssigned, xs as redactForState, y as ECR_AUTO_DELETE_IMAGES_TAG, yo as WARM_THROUGHPUT_MEMBERS, yr as tagPlanWarning, ys as recordReferenceProvenanceEntry, zl as describeFileReadFailure, zo as lambdaFunctionNameForMask } from "./deploy-engine-zLKsm0IM.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BnStRZFM.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CiTz5-_D.js";
+import { RDSProvider } from "./rds-provider-DagnUCn-.js";
+import { NeptuneProvider } from "./neptune-provider-BlpYIZQP.js";
+import { ASGProvider } from "./asg-provider-C14GB-Hy.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -18,7 +18,7 @@ import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
-import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
+import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, DistributionAlreadyExists, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
@@ -14586,7 +14586,10 @@ var SecretsManagerSecretProvider = class {
 	}
 	asPersisted(bag) {
 		const secrets = getCurrentResourceSecrets();
-		return secrets !== void 0 && secrets.size > 0 ? redactSecretsForState(bag, secrets) : bag;
+		return secrets !== void 0 && secrets.size > 0 ? redactForState(bag, {
+			provenance: "value-scan",
+			secrets
+		}) : bag;
 	}
 	generateSecretString(config, options) {
 		const refusal = generateMemberRefusal(config);
@@ -15377,6 +15380,25 @@ function sanitizeDeadLetterConfig(value) {
 	if (typeof arn !== "string" || arn.length === 0) return void 0;
 	return { Arn: arn };
 }
+function policyDocument(value) {
+	if (value === void 0 || value === null || value === "") return void 0;
+	return typeof value === "string" ? value : JSON.stringify(value);
+}
+function policyKey(value) {
+	const doc = policyDocument(value);
+	if (doc === void 0) return void 0;
+	try {
+		return JSON.stringify(sortKeys(JSON.parse(doc)));
+	} catch {
+		return doc;
+	}
+}
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map(sortKeys);
+	if (typeof value !== "object" || value === null) return value;
+	const record = value;
+	return Object.fromEntries(Object.keys(record).sort().map((key) => [key, sortKeys(record[key])]));
+}
 var EventBridgeBusProvider = class {
 	eventBridgeClient;
 	logger = getLogger().child("EventBridgeBusProvider");
@@ -15390,6 +15412,14 @@ var EventBridgeBusProvider = class {
 		"DeadLetterConfig",
 		"LogConfig"
 	])]]);
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::Events::EventBus", /* @__PURE__ */ new Map([
+		["Description", ""],
+		["KmsKeyIdentifier", ""],
+		["LogConfig", {
+			Level: "OFF",
+			IncludeDetail: "NONE"
+		}]
+	])]]);
 	constructor() {
 		this.eventBridgeClient = getAwsClients().eventBridge;
 	}
@@ -15406,11 +15436,19 @@ var EventBridgeBusProvider = class {
 		});
 		return this.createClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	wrapMaskedError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(failure.detail).message));
+		return markRedactedCause(build(mask(failure.summary)));
+	}
+	async create(logicalId, resourceType, properties, context) {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const name = properties["Name"];
 		if (!name) throw new ProvisioningError(`Name is required for EventBus ${logicalId}`, resourceType, logicalId);
 		this.logger.debug(`Creating EventBus ${logicalId}: ${name}`);
+		let busCreated = false;
 		try {
 			const createParams = { Name: name };
 			if (properties["EventSourceName"]) createParams.EventSourceName = properties["EventSourceName"];
@@ -15421,7 +15459,12 @@ var EventBridgeBusProvider = class {
 			if (dlcCreate) createParams.DeadLetterConfig = dlcCreate;
 			if (properties["LogConfig"] !== void 0) createParams.LogConfig = properties["LogConfig"];
 			const response = await (await this.getCreateClient()).send(new CreateEventBusCommand(createParams));
-			if (properties["Policy"]) {}
+			busCreated = true;
+			const policy = policyDocument(properties["Policy"]);
+			if (policy !== void 0) await this.eventBridgeClient.send(new PutPermissionCommand({
+				EventBusName: name,
+				Policy: policy
+			}));
 			return {
 				physicalId: name,
 				attributes: definedAttributes({
@@ -15430,22 +15473,26 @@ var EventBridgeBusProvider = class {
 				})
 			};
 		} catch (error) {
+			if (busCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create EventBus ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapMaskedError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create EventBus ${logicalId}: ${text}`, resourceType, logicalId, busCreated ? name : void 0, cause));
+			if (busCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, name);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.eventBridgeClient.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EventBus ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update EventBus ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating EventBus ${logicalId}: ${physicalId}`);
 		const descChanged = properties["Description"] !== previousProperties["Description"];
 		const kmsChanged = properties["KmsKeyIdentifier"] !== previousProperties["KmsKeyIdentifier"];
@@ -15458,10 +15505,16 @@ var EventBridgeBusProvider = class {
 			if (properties["DeadLetterConfig"] !== void 0) {
 				const dlcUpdate = sanitizeDeadLetterConfig(properties["DeadLetterConfig"]);
 				if (dlcUpdate) updateParams.DeadLetterConfig = dlcUpdate;
-			}
+			} else if ((context?.removedProperties?.has("DeadLetterConfig") ?? previousProperties["DeadLetterConfig"] !== void 0) && sanitizeDeadLetterConfig(previousProperties["DeadLetterConfig"]) !== void 0) updateParams.DeadLetterConfig = { Arn: "" };
 			if (properties["LogConfig"] !== void 0) updateParams.LogConfig = properties["LogConfig"];
 			await this.eventBridgeClient.send(new UpdateEventBusCommand(updateParams));
 		}
+		const policy = policyDocument(properties["Policy"]);
+		if (policy !== void 0 && policyKey(policy) !== policyKey(previousProperties["Policy"])) await this.eventBridgeClient.send(new PutPermissionCommand({
+			EventBusName: physicalId,
+			Policy: policy
+		}));
+		else if (policy === void 0 && (context?.removedProperties?.has("Policy") ?? policyDocument(previousProperties["Policy"]) !== void 0)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): Policy was removed from the template; the bus keeps its current resource policy, as CloudFormation leaves it. Remove its statements with 'aws events remove-permission' if they should go.`);
 		const plan = planTagDiff(previousProperties["Tags"], properties["Tags"]);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
@@ -15752,6 +15805,12 @@ const lostCreateNoun = (what, sent, adjective) => sent.length === 0 ? `${adjecti
 function isCreateTagsDenial(error) {
 	return isNamedError(error, CREATE_TAGS_DENIAL_NAMES) && describeAwsFailure(error).detail.includes("ec2:CreateTags");
 }
+const CDKD_NOTES = /* @__PURE__ */ new WeakMap();
+function redactedEc2FailureText(error, failure) {
+	if (!(error instanceof Error)) return failure.summary;
+	const collision = isNameCollisionError(failure.detail) ? " AWS reports that it already exists." : "";
+	return `${failure.summary}${collision}${CDKD_NOTES.get(error) ?? ""}`;
+}
 const CREATE_TAGS_DENIAL_NAMES = /* @__PURE__ */ new Set(["UnauthorizedOperation"]);
 const IDEMPOTENT_MISMATCH_NAMES = /* @__PURE__ */ new Set(["IdempotentParameterMismatch"]);
 const OWN_WRITE_READ_ATTEMPTS = 5;
@@ -16026,7 +16085,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EC2 resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update EC2 resource ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -16267,7 +16326,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create VPC ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create VPC ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindId !== void 0) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 				markNonRetryable(thrown);
@@ -16307,7 +16366,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update VPC ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteVpc(logicalId, physicalId, resourceType, context) {
@@ -16332,7 +16391,7 @@ var EC2Provider = class {
 				continue;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete VPC ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getVpcAttribute(physicalId, attributeName) {
@@ -16427,7 +16486,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create Subnet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create Subnet ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 			throw thrown;
 		}
@@ -16463,7 +16522,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Subnet ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update Subnet ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async waitForSubnetMapPublicIp(subnetId, expected) {
@@ -16502,7 +16561,7 @@ var EC2Provider = class {
 				continue;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Subnet ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete Subnet ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async cleanupSubnetLambdaEnis(subnetId) {
@@ -16571,7 +16630,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create InternetGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create InternetGateway ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	updateInternetGateway(logicalId, physicalId) {
@@ -16590,7 +16649,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete InternetGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete InternetGateway ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	eipPhysicalId(logicalId, publicIp, allocationId, options) {
@@ -16689,7 +16748,7 @@ var EC2Provider = class {
 				this.logger.warn(safeMsg`Failed to release partially-created EIP ${logicalId} (${allocatedId}): ${describeAwsFailure(cleanupError).detail}. Manual release may be required: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 release-address --allocation-id ${allocatedId}`.render()}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create EIP ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create EIP ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (createdId !== void 0) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
 				markNonRetryable(thrown);
@@ -16760,7 +16819,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete EIP ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete EIP ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getEipAttribute(physicalId, attributeName) {
@@ -16803,7 +16862,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create VPCGatewayAttachment ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create VPCGatewayAttachment ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	updateVpcGatewayAttachment(logicalId, physicalId) {
@@ -16828,7 +16887,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete VPCGatewayAttachment ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete VPCGatewayAttachment ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createNatGateway(logicalId, resourceType, properties) {
@@ -16874,7 +16933,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create NatGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create NatGateway ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (createdId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
 			throw thrown;
 		}
@@ -16895,7 +16954,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete NatGateway ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete NatGateway ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 		this.logger.debug(`Waiting for NatGateway ${physicalId} to reach deleted state...`);
 		try {
@@ -16935,7 +16994,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create RouteTable ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create RouteTable ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	updateRouteTable(logicalId, physicalId) {
@@ -16954,7 +17013,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete RouteTable ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete RouteTable ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createRoute(logicalId, resourceType, properties, onMultipleDestinations, maskSecrets) {
@@ -17009,7 +17068,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Route ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create Route ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -17035,7 +17094,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Route ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update Route ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteRoute(logicalId, physicalId, resourceType, context) {
@@ -17058,7 +17117,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Route ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete Route ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createSubnetRouteTableAssociation(logicalId, resourceType, properties) {
@@ -17078,7 +17137,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SubnetRouteTableAssociation ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create SubnetRouteTableAssociation ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	updateSubnetRouteTableAssociation(logicalId, physicalId) {
@@ -17097,7 +17156,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SubnetRouteTableAssociation ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete SubnetRouteTableAssociation ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createSecurityGroup(logicalId, resourceType, properties) {
@@ -17148,7 +17207,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create SecurityGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create SecurityGroup ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 			throw thrown;
 		}
@@ -17201,7 +17260,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SecurityGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update SecurityGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteSecurityGroup(logicalId, physicalId, resourceType, context) {
@@ -17219,15 +17278,14 @@ var EC2Provider = class {
 				else this.logger.debug(`SecurityGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
-			const msg = describeAwsFailure(error).detail;
-			if (msg.includes("dependent object") && attempt < maxAttempts) {
+			if (describeAwsFailure(error).detail.includes("dependent object") && attempt < maxAttempts) {
 				await this.cleanupSecurityGroupLambdaEnis(physicalId);
 				this.logger.debug(`SecurityGroup ${physicalId} has dependent objects (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`);
 				await new Promise((resolve) => setTimeout(resolve, attempt * 5e3));
 				continue;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SecurityGroup ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete SecurityGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async cleanupSecurityGroupLambdaEnis(groupId) {
@@ -17356,7 +17414,7 @@ var EC2Provider = class {
 				};
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to create SecurityGroupIngress ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const failure = this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create SecurityGroupIngress ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			const lookup = getPriorAttempts(logicalId);
 			if (authorizeDefinitelyNotApplied(error) && !earlierSendAmbiguous && lookup?.possiblyLanded() !== true) markRefusedBeforeApplying(failure);
 			else lookup?.notePossiblyLanded();
@@ -17550,7 +17608,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update SecurityGroupIngress ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update SecurityGroupIngress ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	withoutDescription(value) {
@@ -17626,7 +17684,7 @@ var EC2Provider = class {
 				return notMatched();
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete SecurityGroupIngress ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete SecurityGroupIngress ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createInstance(logicalId, resourceType, properties, context) {
@@ -17711,7 +17769,7 @@ var EC2Provider = class {
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create EC2 Instance ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create EC2 Instance ${logicalId}: ${text}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
 			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
 			throw thrown;
 		}
@@ -17809,7 +17867,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async updateInstanceSecurityProps(physicalId, properties, previousProperties) {
@@ -17900,7 +17958,7 @@ var EC2Provider = class {
 				continue;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to terminate EC2 Instance ${logicalId}: ${msg}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to terminate EC2 Instance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getInstanceAttribute(physicalId, attributeName) {
@@ -18120,7 +18178,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create NetworkAcl ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create NetworkAcl ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async deleteNetworkAcl(logicalId, physicalId, resourceType, context) {
@@ -18136,7 +18194,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete NetworkAcl ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete NetworkAcl ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createNetworkAclEntry(logicalId, resourceType, properties, context) {
@@ -18193,7 +18251,7 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create NetworkAclEntry ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create NetworkAclEntry ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async deleteNetworkAclEntry(logicalId, physicalId, resourceType, context) {
@@ -18224,7 +18282,7 @@ var EC2Provider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete NetworkAclEntry ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to delete NetworkAclEntry ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createSubnetNetworkAclAssociation(logicalId, resourceType, properties) {
@@ -18258,7 +18316,7 @@ var EC2Provider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SubnetNetworkAclAssociation ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(error, (text) => new ProvisioningError(`Failed to create SubnetNetworkAclAssociation ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async sendTaggedCreate(logicalId, tagResourceType, tags, send) {
@@ -18294,7 +18352,9 @@ var EC2Provider = class {
 				this.logger.debug(safeMsg`Create of ${logicalId} without tags was refused: ${untaggedDetail}`);
 				const explicit = isExplicitDenyError(untaggedDetail);
 				const kind = explicit ? explicitDenyPolicyKind(untaggedDetail) : void 0;
-				taggedError.message = `${taggedError.message} The create without tags was refused too (UnauthorizedOperation)${explicit ? `; explicit deny${kind !== void 0 ? ` (${kind})` : ""}` : ""}.`;
+				const note = ` The create without tags was refused too (UnauthorizedOperation)${explicit ? `; explicit deny${kind !== void 0 ? ` (${kind})` : ""}` : ""}.`;
+				taggedError.message = `${taggedError.message}${note}`;
+				CDKD_NOTES.set(taggedError, note);
 				if (explicit) markNonRetryable(taggedError);
 				throw taggedError;
 			}
@@ -18363,6 +18423,13 @@ var EC2Provider = class {
 			delay = Math.min(delay * 2, maxDelayMs);
 		}
 	}
+	wrapCaughtError(error, build) {
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return build(failure.detail);
+		this.logger.debug(build(failure.detail).message);
+		const wrapped = build(redactedEc2FailureText(error, failure));
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	isDependencyViolationError(error) {
 		if (!(error instanceof Error)) return false;
 		const code = error.Code ?? "";
@@ -38082,7 +38149,10 @@ var SchedulerScheduleProvider = class {
 		const bag = getCurrentResourceSecrets();
 		if (bag === void 0 || typeof desiredGroup !== "string") return false;
 		if (typeof recordedGroup !== "string" || !recordedGroup.includes("{{resolve:")) return false;
-		return withoutPhysicalNameCopies(bag, () => redactSecretsForState(desiredGroup, bag)) !== recordedGroup;
+		return withoutPhysicalNameCopies(bag, () => redactForState(desiredGroup, {
+			provenance: "value-scan",
+			secrets: bag
+		})) !== recordedGroup;
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const groupName = this.groupNameOf(properties);
@@ -46763,4 +46833,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DPwEHVDJ.js.map
+//# sourceMappingURL=provider-classes-BWo7K01p.js.map