@go-to-k/cdkd 0.302.1 → 0.302.2

package/dist/{provider-classes-B2_u4Fg0.js → provider-classes-CUKmyCQ8.js}

@@ -1,13 +1,14 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback } from "./aws-failure-text-e_ddrDDo.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as plainOrDescribed, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as commandHole, H as observeThenDisableProtection, In as hasClauseBreak, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qt as ambientClientDefaults, Rn as pasteableCommand, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Un as shellQuote, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wn as withheldTargetClause, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Yn as isNameCollisionError, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as isThrottlingError, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, br as wrapMaskedAwsError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as clientDefaultsFor, er as markNameCollision, et as renderDisableCommand, fr as isRetryableTransientError, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as THROTTLING_ERROR_NAMES, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as isAmbiguousOutcomeError, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as relayedNameCollision, o as readPrincipalLists, or as explicitDenyPolicyKind, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as isTransientServerError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, tn as credentialFingerprint, tr as markReplayMayCollide, u as clearOnUpdateRemoval, ur as isExplicitDenyError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, y as createAttemptKey, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-CmHNH1DY.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as plainOrDescribed, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as commandHole, H as observeThenDisableProtection, In as hasClauseBreak, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qt as ambientClientDefaults, Rn as pasteableCommand, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Un as shellQuote, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wn as withheldTargetClause, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Yn as isNameCollisionError, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as isThrottlingError, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, br as wrapMaskedAwsError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as clientDefaultsFor, er as markNameCollision, et as renderDisableCommand, fr as isRetryableTransientError, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as THROTTLING_ERROR_NAMES, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, kt as isAuxiliaryFailure, lr as isAmbiguousOutcomeError, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as relayedNameCollision, o as readPrincipalLists, or as explicitDenyPolicyKind, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as isTransientServerError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, tn as credentialFingerprint, tr as markReplayMayCollide, u as clearOnUpdateRemoval, ur as isExplicitDenyError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, y as createAttemptKey, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-OtGPguLH.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { Ar as markDeleteStarted, Bo as toCfnInteger, C as hasCdkAutoDeleteTag, Ci as s3BucketDomainName, Cr as reserveStackCreateToken, Cs as redactForState, Dt as withApiLimit, E as markRefusedBeforeApplying, Ei as s3BucketWebsiteUrl, Eo as findSilentDropProperties, Et as lookupEachName, F as findNestedTemplateTreeDefect, Fr as refuseMalformedDesiredTags, Go as configIntegerRefusal, Gr as waitForLambdaFunctionActive, Ho as coerceCfnBoolean, Hs as withoutPhysicalNameCopies, I as isAbsoluteAssetPath, Ir as tagMapAsList, Jo as replayWarn, Jt as redactedDeleteAddressFields, Ka as refuseMalformedNestedChildOutputs, Kl as canonicalizeRegion, Ko as configStringRefusal, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, L as listNestedTemplateRows, Lo as WARM_THROUGHPUT_MEMBERS, Lr as tagPlanWarning, Mr as DBPROXY_TAG_OPTIONS, Nn as replacedDeleteFailureVerdict, Nr as planTagDiff, Oo as withoutSilentDropProperties, Os as hasMaskableValues, Pr as readTagList, Qs as recordAttributeIdCopy, R as renderNestedTemplateTreeDefect, Ro as coerceWarmThroughput$1, Rr as definedAttributes, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as s3BucketArn, Ss as markSameGenerationBag, T as getPriorAttempts, Ti as s3BucketRegionalDomainName, Tr as acquireIdempotencyToken, Ts as snapshotPassProvenance, Tt as isAccessDeniedError, Ul as decodeListingKey, Uo as coerceCfnInteger, Vo as toFiniteNumber, Wc as rewriteTemplateAssetReferences, Wo as configBooleanRefusal, Ws as dynamicReferenceTokens, Wt as getCurrentProducerRegions, Xo as requireConfigObject, Xs as recoverMaskedOutput, Yo as requireConfigArray, Yr as getCurrentResourceSecrets, Yt as redactedDeleteAddressSkip, Zi as getAccountInfo, Zo as requireConfigString, Zs as physicalNameCopiesOf, _ as deleteTableWithIndexBusyRetry, _a as accountArgs, au as renderAssemblyPathEscape, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ci as withIndeterminateGuard, cr as secretNamedAttributeNamesOf, d as compensateRemovedDeletionProtection, f as deleteBudgetKey, fi as ec2InstanceProtectionSite, fo as refuseMalformedResourcesForDestroy, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reEnableInstanceApiTermination, gs as passedNoEchoParametersOf, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as reDisableInstanceApiTermination, is as sameLambdaFunctionAddress, iu as displayAssemblyPath, ji as outputReferenceProvenanceOf, jn as getStackRecords, jr as DBPROXY_TAGS_WHAT, kn as awaitInFlightSibling, kr as isRefusedByName, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as isWaitAbandonedError, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mi as observeThenDisableInstanceApiTermination, mt as withNestedStackContext, ni as unchangedBehindSecretReference, ns as canonicalLambdaFunctionName, ot as getNestedRevertRun, ou as resolveAssemblyPath, p as resolveDynamoDbDeleteBudgetClock, pi as isTerminationProtectionPropagationError, pt as getCurrentNestedStackContext, ql as derivePartitionAndUrlSuffix, qo as readConfigString, qt as isRedactedRecordedValue, rs as lambdaFunctionNameForMask, ru as describeFileReadFailure, sa as parseWebACLArn, si as deleteSkipReason, t as DeployEngine, tc as carriesSecretMask, ti as slowCcOperationTimeoutMs, ts as withRetry, u as beginDeleteWait, ua as passedParameterClassesOf, ui as markWaitAbandoned, v as maskedLogger, w as isTruthyCfnBoolean, wi as s3BucketDualStackDomainName, wo as withheldAccountClause, ws as recordReferenceProvenanceEntry, wt as chunks, x as ECR_AUTO_DELETE_IMAGES_TAG, xi as isSettledInstanceState, xr as earliestDefined, y as relayedIndexBusyDelete, zc as stringifyValue, zo as isWarmThroughputDecrease, zr as stringifyIfAssigned } from "./deploy-engine-CYVt2NQR.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-R1GC6KcT.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CvRs5pV_.js";
-import { RDSProvider } from "./rds-provider-CmKbYAvr.js";
-import { NeptuneProvider } from "./neptune-provider-DzTl6-74.js";
-import { ASGProvider } from "./asg-provider-BpRcm_UB.js";
+import { An as awaitInFlightSibling, Ar as isRefusedByName, Bc as decodeListingKey, Bo as isWarmThroughputDecrease, Br as stringifyIfAssigned, C as hasCdkAutoDeleteTag, Ci as s3BucketArn, Di as s3BucketWebsiteUrl, Do as findSilentDropProperties, Dt as lookupEachName, E as markRefusedBeforeApplying, Ei as s3BucketRegionalDomainName, Er as acquireIdempotencyToken, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fr as readTagList, Go as configBooleanRefusal, Gt as getCurrentProducerRegions, Ho as toFiniteNumber, I as isAbsoluteAssetPath, Ir as refuseMalformedDesiredTags, Is as stringifyValue, Jo as readConfigString, Jt as isRedactedRecordedValue, Ko as configIntegerRefusal, Kr as waitForLambdaFunctionActive, L as listNestedTemplateRows, Lr as tagMapAsList, Mi as outputReferenceProvenanceOf, Mn as getStackRecords, Mr as DBPROXY_TAGS_WHAT, Nr as DBPROXY_TAG_OPTIONS, Ot as withApiLimit, Pn as replacedDeleteFailureVerdict, Pr as planTagDiff, Qi as getAccountInfo, Qo as requireConfigString, R as renderNestedTemplateTreeDefect, Ro as WARM_THROUGHPUT_MEMBERS, Rr as tagPlanWarning, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as isSettledInstanceState, Sr as earliestDefined, T as getPriorAttempts, Ti as s3BucketDualStackDomainName, To as withheldAccountClause, Tt as chunks, Uc as canonicalizeRegion, Uo as coerceCfnBoolean, Vo as toCfnInteger, Vs as rewriteTemplateAssetReferences, W as enclosingDeadlineRemainingMs, Wc as derivePartitionAndUrlSuffix, Wo as coerceCfnInteger, Xo as requireConfigArray, Xr as getCurrentResourceSecrets, Xt as redactedDeleteAddressSkip, Yo as replayWarn, Yt as redactedDeleteAddressFields, Zo as requireConfigObject, _ as deleteTableWithIndexBusyRetry, _i as reEnableInstanceApiTermination, as as sameLambdaFunctionAddress, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ca as parseWebACLArn, ci as deleteSkipReason, d as compensateRemovedDeletionProtection, da as passedParameterClassesOf, di as markWaitAbandoned, el as describeFileReadFailure, f as deleteBudgetKey, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reDisableInstanceApiTermination, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as observeThenDisableInstanceApiTermination, ht as withNestedStackContext, is as lambdaFunctionNameForMask, jr as markDeleteStarted, ko as withoutSilentDropProperties, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as withIndeterminateGuard, lr as secretNamedAttributeNamesOf, m as resolveDynamoDbDeleteBudgetMs, mi as isTerminationProtectionPropagationError, mt as getCurrentNestedStackContext, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, ns as withRetry, p as resolveDynamoDbDeleteBudgetClock, pi as ec2InstanceProtectionSite, po as refuseMalformedResourcesForDestroy, qa as refuseMalformedNestedChildOutputs, qo as configStringRefusal, qt as REDACTED_DELETE_ADDRESS_SKIP_REASON, ri as unchangedBehindSecretReference, rl as resolveAssemblyPath, rs as canonicalLambdaFunctionName, st as getNestedRevertRun, t as DeployEngine, tl as displayAssemblyPath, u as beginDeleteWait, ui as isWaitAbandonedError, ut as revertNestedChildFromJournal, v as maskedLogger, va as accountArgs, w as isTruthyCfnBoolean, wi as s3BucketDomainName, wr as reserveStackCreateToken, x as ECR_AUTO_DELETE_IMAGES_TAG, y as relayedIndexBusyDelete, zo as coerceWarmThroughput$1, zr as definedAttributes } from "./deploy-engine-B_xWnZ4Q.js";
+import { D as markSameGenerationBag, F as redactForState, H as recordReferenceProvenanceEntry, Jt as physicalNameCopiesOf, Tt as dynamicReferenceTokens, W as snapshotPassProvenance, Y as hasMaskableValues, Yt as recordAttributeIdCopy, m as passedNoEchoParametersOf, nn as carriesSecretMask, qt as recoverMaskedOutput, xt as withoutPhysicalNameCopies } from "./secret-redaction-BHWS-PZK.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-TdX7t0Ac.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DDJHp1K3.js";
+import { RDSProvider } from "./rds-provider-Bxh9YW5y.js";
+import { NeptuneProvider } from "./neptune-provider-CUoBJ6Ys.js";
+import { ASGProvider } from "./asg-provider-B5RKfCs2.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -597,7 +598,11 @@ var IAMManagedPolicyProvider = class {
 	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMManagedPolicyProvider");
 	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::ManagedPolicy", /* @__PURE__ */ new Set([
 		"ManagedPolicyName",
@@ -1457,8 +1462,18 @@ var IAMAccessKeyProvider = class {
 	iamClient;
 	createClient = new IamCreateClientCache(() => this.iamClient);
 	logger = getLogger().child("IAMAccessKeyProvider");
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapMaskedError(log, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(log.mask, error, build);
+		log.debug(build(log.mask(failure.detail)).message);
+		const wrapped = build(`${log.mask(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
+	warnFailureSentence(log, lead, error) {
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return `${log.value(failure.detail)}.`;
+		log.debug(`${lead}: ${log.value(failure.detail)}`);
+		return log.value(failure.summary);
 	}
 	disableCcApiFallback = true;
 	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::AccessKey", /* @__PURE__ */ new Set([
@@ -1499,7 +1514,8 @@ var IAMAccessKeyProvider = class {
 					}));
 					leftBehindKeyId = void 0;
 				} catch (cleanupError) {
-					log.warn(`Failed to clean up IAM access key ${logicalId} (${v(accessKeyId)}) minted by a partial CreateAccessKey response: ${v(describeAwsFailure(cleanupError).detail)}. Manual deletion may be required: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
+					const lead = `Failed to clean up IAM access key ${logicalId} (${v(accessKeyId)}) minted by a partial CreateAccessKey response`;
+					log.warn(`${lead}: ${this.warnFailureSentence(log, lead, cleanupError)} Manual deletion may be required: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
 				}
 				throw new Error("CreateAccessKey returned no AccessKeyId/SecretAccessKey");
 			}
@@ -1518,7 +1534,8 @@ var IAMAccessKeyProvider = class {
 					leftBehindKeyId = void 0;
 					log.debug(`Cleaned up partially-created IAM access key ${logicalId} (${v(accessKeyId)}) after status wiring failure`);
 				} catch (cleanupError) {
-					log.warn(`Failed to clean up partially-created IAM access key ${logicalId} (${v(accessKeyId)}): ${v(describeAwsFailure(cleanupError).detail)}. Manual deletion may be required before the next deploy: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
+					const lead = `Failed to clean up partially-created IAM access key ${logicalId} (${v(accessKeyId)})`;
+					log.warn(`${lead}: ${this.warnFailureSentence(log, lead, cleanupError)} Manual deletion may be required before the next deploy: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -1527,7 +1544,8 @@ var IAMAccessKeyProvider = class {
 			if (replayFollowedAmbiguousAttempt(response)) try {
 				await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log, "replayed");
 			} catch (reconcileError) {
-				log.warn(`Could not check user ${v(userName)} for an access key left by the replayed CreateAccessKey for ${logicalId}: ${v(describeAwsFailure(reconcileError).detail)}. List the user's keys and delete any that no deploy records: ${aws`aws iam list-access-keys --user-name ${userName}`.render()}`);
+				const lead = `Could not check user ${v(userName)} for an access key left by the replayed CreateAccessKey for ${logicalId}`;
+				log.warn(`${lead}: ${this.warnFailureSentence(log, lead, reconcileError)} List the user's keys and delete any that no deploy records: ${aws`aws iam list-access-keys --user-name ${userName}`.render()}`);
 			}
 			return {
 				physicalId: accessKeyId,
@@ -1540,7 +1558,7 @@ var IAMAccessKeyProvider = class {
 			const reconciled = await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log);
 			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) leftBehindKeyId = void 0;
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (leftBehindKeyId !== void 0) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
 				markNonRetryable(thrown);
@@ -1584,7 +1602,8 @@ var IAMAccessKeyProvider = class {
 				}));
 				deleted.add(accessKeyId);
 			} catch (error) {
-				log.warn(`Failed to delete the orphaned IAM access key ${v(accessKeyId)} for user ${v(userName)}: ${v(describeAwsFailure(error).detail)}. Manual deletion may be required: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
+				const lead = `Failed to delete the orphaned IAM access key ${v(accessKeyId)} for user ${v(userName)}`;
+				log.warn(`${lead}: ${this.warnFailureSentence(log, lead, error)} Manual deletion may be required: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
 			}
 		}
 		return deleted;
@@ -1611,7 +1630,8 @@ var IAMAccessKeyProvider = class {
 				marker = page.IsTruncated ? page.Marker : void 0;
 			} while (marker);
 		} catch (error) {
-			log.warn(`Could not list existing access keys for user ${v(userName)} while creating ${logicalId}: ${v(describeAwsFailure(error).detail)}. Orphan detection is DISABLED for this create, so a retried attempt may leave an unusable but ACTIVE access key on the user. Grant iam:ListAccessKeys, or check the user's keys after the deploy: ${aws`aws iam list-access-keys --user-name ${userName}`.render()}`);
+			const lead = `Could not list existing access keys for user ${v(userName)} while creating ${logicalId}`;
+			log.warn(`${lead}: ${this.warnFailureSentence(log, lead, error)} Orphan detection is DISABLED for this create, so a retried attempt may leave an unusable but ACTIVE access key on the user. Grant iam:ListAccessKeys, or check the user's keys after the deploy: ${aws`aws iam list-access-keys --user-name ${userName}`.render()}`);
 			return;
 		}
 		return keys;
@@ -1642,7 +1662,7 @@ var IAMAccessKeyProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update IAM access key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update IAM access key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -1665,7 +1685,7 @@ var IAMAccessKeyProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete IAM access key ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(createMaskedLogSinks(this.logger, context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete IAM access key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -11293,8 +11313,14 @@ var LambdaNetworkConnectorProvider = class {
 	async waitForSettled(arn, logicalId, operation) {
 		for (let attempt = 1; attempt <= MAX_POLL_ATTEMPTS; attempt++) {
 			const resp = await this.client.send(new GetNetworkConnectorCommand({ Identifier: arn }));
-			if (resp.State === "FAILED" || resp.State === "DELETING" || resp.State === "DELETE_FAILED" || resp.State === "INACTIVE") throw new TerminalConnectorStateError(`Lambda network connector ${logicalIdShown(logicalId)} entered ${resp.State}: ${resp.StateReason ?? resp.StateReasonCode ?? "no reason given"}`);
-			if (operation === "update" && resp.LastUpdateStatus === "Failed") throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} update failed: ${resp.LastUpdateStatusReason ?? resp.LastUpdateStatusReasonCode ?? "no reason given"}`);
+			if (resp.State === "FAILED" || resp.State === "DELETING" || resp.State === "DELETE_FAILED" || resp.State === "INACTIVE") throw this.wrapStatusReasonError(`Lambda network connector ${logicalIdShown(logicalId)} entered ${resp.State}`, {
+				code: resp.StateReasonCode,
+				message: resp.StateReason
+			}, (message, options) => new TerminalConnectorStateError(message, options));
+			if (operation === "update" && resp.LastUpdateStatus === "Failed") throw this.wrapStatusReasonError(`Lambda network connector ${logicalIdShown(logicalId)} update failed`, {
+				code: resp.LastUpdateStatusReasonCode,
+				message: resp.LastUpdateStatusReason
+			}, (message, options) => new Error(message, options));
 			if (resp.State === "ACTIVE" && resp.LastUpdateStatus !== "InProgress") return resp;
 			await sleep$1(POLL_INTERVAL_MS$2);
 		}
@@ -11309,15 +11335,28 @@ var LambdaNetworkConnectorProvider = class {
 				if (error instanceof ResourceNotFoundException$10) return;
 				throw error;
 			}
-			if (resp.State === "DELETE_FAILED") throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} entered DELETE_FAILED: ${resp.StateReason ?? resp.StateReasonCode ?? "no reason given"}`);
+			if (resp.State === "DELETE_FAILED") throw this.wrapStatusReasonError(`Lambda network connector ${logicalIdShown(logicalId)} entered DELETE_FAILED`, {
+				code: resp.StateReasonCode,
+				message: resp.StateReason
+			}, (message, options) => new Error(message, options));
 			await sleep$1(POLL_INTERVAL_MS$2);
 		}
 		throw new Error(`Lambda network connector ${logicalIdShown(logicalId)} was not fully deleted within ${MAX_POLL_ATTEMPTS * POLL_INTERVAL_MS$2 / 1e3}s.`);
 	}
+	wrapStatusReasonError(prefix, reason, build) {
+		const text = describeAwsStatusReason(reason, reason.code || "no reason given");
+		if (!text.redacted) return build(`${prefix}: ${text.detail}`);
+		this.logger.debug(safeMsg`${prefix}: ${text.detail}`);
+		return markRedactedCause(build(`${prefix}: ${text.summary}`, { cause: new Error(text.detail) }));
+	}
 	wrapError(operation, logicalId, resourceType, physicalId, error) {
 		if (error instanceof ProvisioningError) return error;
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`Failed to ${operation} Lambda network connector ${logicalIdShown(logicalId)}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`Failed to ${operation} Lambda network connector ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		this.logger.debug(build(failure.detail).message);
+		return markRedactedCause(build(`${failure.summary}${relayedNameCollision(failure.detail)}`));
 	}
 };
 var TerminalConnectorStateError = class extends Error {};
@@ -12449,7 +12488,8 @@ var DynamoDBTableProvider = class {
 			try {
 				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
 			} catch (observeError) {
-				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${describeAwsFailure(observeError).detail}`);
+				const mask = maskerOrIdentity(context?.maskSecrets);
+				this.logger.debug(mask(safeMsg`Could not read DeletionProtectionEnabled on ${mask(physicalId)} before disabling it: ${mask(describeAwsFailure(observeError).detail)}`));
 			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
@@ -12460,10 +12500,10 @@ var DynamoDBTableProvider = class {
 			try {
 				await this.waitForTableActiveAfterUpdate(physicalId, 60, budget);
 			} catch (waitErr) {
-				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after disabling protection: ${describeAwsFailure(waitErr).detail}`);
+				this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not wait for table ${physicalId} ACTIVE after disabling protection: ${describeAwsFailure(waitErr).detail}`));
 			}
 		} catch (flipError) {
-			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
+			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`));
 		}
 		try {
 			const reArmPolls = () => {
@@ -13469,8 +13509,13 @@ var LogsLogGroupProvider = class {
 		this.logsClient = awsClients.cloudWatchLogs;
 		this.stsClient = awsClients.sts;
 	}
-	wrapMaskedError(mask, error, build) {
-		return wrapMaskedAwsError(mask, error, build);
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
+		const wrapped = build(`${mask(failure.summary)}${relay}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
 		if (properties["LogGroupName"]) return void 0;
@@ -13588,7 +13633,7 @@ var LogsLogGroupProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const mask = maskerOrIdentity(context?.maskSecrets);
-			const thrown = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create log group ${logicalId}: ${text}`, resourceType, logicalId, logGroupName, cause));
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create log group ${logicalId}: ${text}`, resourceType, logicalId, logGroupName, cause));
 			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, logGroupName);
 			throw thrown;
 		}
@@ -13604,7 +13649,7 @@ var LogsLogGroupProvider = class {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			const mask = maskerOrIdentity(context?.maskSecrets);
-			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to update log group ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update log group ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -13756,6 +13801,7 @@ var LogsLogGroupProvider = class {
 				flip,
 				logger: this.logger,
 				physicalId,
+				mask: context?.maskSecrets,
 				guardName: "DeletionProtectionEnabled",
 				observe: async () => {
 					return ((await this.logsClient.send(new DescribeLogGroupsCommand({ logGroupNamePrefix: physicalId }))).logGroups?.find((g) => g.logGroupName === physicalId))?.deletionProtectionEnabled === true;
@@ -13769,7 +13815,7 @@ var LogsLogGroupProvider = class {
 			});
 			this.logger.debug(`Disabled DeletionProtectionEnabled on log group ${logicalId} before delete`);
 		} catch (flipError) {
-			this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
+			this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`));
 		}
 		try {
 			await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName: physicalId }));
@@ -13783,7 +13829,7 @@ var LogsLogGroupProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete log group ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete log group ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	logGoneOnDelete(logicalId, physicalId, context) {
@@ -14792,6 +14838,17 @@ var SSMParameterProvider = class SSMParameterProvider {
 		"Policies",
 		"DataType"
 	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::SSM::Parameter", /* @__PURE__ */ new Set([
+		"Name",
+		"Type",
+		"Value",
+		"Description",
+		"Tags",
+		"AllowedPattern",
+		"Tier",
+		"Policies",
+		"DataType"
+	])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.ssmClient = awsClients.ssm;
@@ -22701,6 +22758,14 @@ const CACHE_BEHAVIOR_QUANTITY_FIELDS = [
 var CloudFrontDistributionProvider = class {
 	cloudFrontClient;
 	logger = getLogger().child("CloudFrontDistributionProvider");
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFront::Distribution", /* @__PURE__ */ new Set(["DistributionConfig", "Tags"])]]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -22745,7 +22810,7 @@ var CloudFrontDistributionProvider = class {
 				throw markNonRetryable(new ProvisioningError(maskSecrets(`Failed to create CloudFront Distribution ${logicalId}: CloudFront refused the create because this deploy's CallerReference had been used before, which means an EARLIER attempt of this same create succeeded and cdkd never received its response. That distribution is LIVE, is not in cdkd state, and 'cdkd destroy' will not remove it — it bills until you delete it by hand. CloudFront does not return CallerReference from ListDistributions, so find it with 'aws cloudfront list-distributions' and match on ${this.orphanSearchHint(properties, maskSecrets)}; then disable and delete it (or import it with 'cdkd import') before re-running. The AWS error is on this error's cause.`), resourceType, logicalId, void 0, cause));
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CloudFront Distribution ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(maskSecrets, error, (text) => new ProvisioningError(`Failed to create CloudFront Distribution ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	orphanSearchHint(properties, maskSecrets) {
@@ -22777,7 +22842,7 @@ var CloudFrontDistributionProvider = class {
 			const getResponse = await this.cloudFrontClient.send(new GetDistributionCommand({ Id: physicalId }));
 			const domainName = getResponse.Distribution?.DomainName;
 			const arn = getResponse.Distribution?.ARN;
-			await this.applyTagDiff(arn, previousProperties["Tags"], properties["Tags"], physicalId, logicalId, resourceType);
+			await this.applyTagDiff(arn, previousProperties["Tags"], properties["Tags"], physicalId, logicalId, resourceType, context?.maskSecrets);
 			await this.settleDistribution(logicalId, physicalId);
 			this.logger.debug(`Updated CloudFront Distribution ${physicalId}`);
 			return {
@@ -22792,7 +22857,7 @@ var CloudFrontDistributionProvider = class {
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudFront Distribution ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update CloudFront Distribution ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -22843,7 +22908,7 @@ var CloudFrontDistributionProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete CloudFront Distribution ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -23240,7 +23305,7 @@ var CloudFrontDistributionProvider = class {
 			upserts
 		};
 	}
-	async applyTagDiff(arn, previousTags, newTags, physicalId, logicalId, resourceType) {
+	async applyTagDiff(arn, previousTags, newTags, physicalId, logicalId, resourceType, mask) {
 		const { removed, upserts } = this.computeTagDiff(previousTags, newTags, resourceType, logicalId);
 		if (removed.length === 0 && upserts.length === 0) return;
 		if (!arn) throw new ProvisioningError(`CloudFront Distribution ${physicalId}: GetDistribution returned no ARN; cannot apply tag diff (removed=${removed.length}, upserts=${upserts.length}). Refusing to silently drop the tag update — retry on next deploy or check SDK version.`, resourceType, logicalId, physicalId);
@@ -23261,7 +23326,7 @@ var CloudFrontDistributionProvider = class {
 			}
 		} catch (err) {
 			const cause = err instanceof Error ? err : void 0;
-			throw new ProvisioningError(`CloudFront Distribution ${physicalId}: tag diff failed (removed=${removed.length}, upserts=${upserts.length}): ${describeAwsFailure(err).detail}. UpdateDistribution succeeded but TagResource/UntagResource did not — state has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(mask, err, (text) => new ProvisioningError(`CloudFront Distribution ${physicalId}: tag diff failed (removed=${removed.length}, upserts=${upserts.length}): ${text}${text.endsWith(".") ? "" : "."} UpdateDistribution succeeded but TagResource/UntagResource did not — state has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async import(input) {
@@ -26241,6 +26306,7 @@ var ELBv2Provider = class {
 				flip,
 				logger: this.logger,
 				physicalId,
+				mask: context?.maskSecrets,
 				guardName: "deletion_protection.enabled",
 				observe: async () => {
 					return ((await this.getClient().send(new DescribeLoadBalancerAttributesCommand({ LoadBalancerArn: physicalId }))).Attributes ?? []).some((a) => a.Key === "deletion_protection.enabled" && a.Value === "true");
@@ -26257,7 +26323,7 @@ var ELBv2Provider = class {
 			});
 			this.logger.debug(`Disabled deletion_protection.enabled on LoadBalancer ${logicalId} before delete`);
 		} catch (flipError) {
-			if (!this.isNotFoundError(flipError)) this.logger.debug(`Could not disable deletion_protection.enabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
+			if (!this.isNotFoundError(flipError)) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion_protection.enabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`));
 		}
 		try {
 			await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: physicalId }));
@@ -28183,6 +28249,14 @@ async function attachDocDBTags(client, logger, result, arn) {
 
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
+function masterUserPasswordToSend(properties, previousProperties, context) {
+	const desired = properties["MasterUserPassword"];
+	if (desired === void 0 || desired === null) return void 0;
+	const changedProperties = context?.changedProperties;
+	if (changedProperties !== void 0) return changedProperties.has("MasterUserPassword") ? desired : void 0;
+	const recorded = previousProperties["MasterUserPassword"];
+	return typeof desired === "string" && typeof recorded === "string" && recorded === desired && dynamicReferenceTokens(recorded).length === 0 && recorded !== "***" ? void 0 : desired;
+}
 function clusterAttributes(cluster) {
 	return definedAttributes({
 		Endpoint: cluster?.Endpoint,
@@ -28207,6 +28281,8 @@ function instanceAttributes(instance) {
 function isDbIdentifier(id) {
 	return id.length <= 63 && /^[A-Za-z](?:-?[A-Za-z0-9])*$/.test(id);
 }
+const FINAL_SNAPSHOT_SETTLE_WAIT_MS = 9e5;
+const FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS = 6e4;
 var DocDBProvider = class {
 	docdbClient;
 	createClient;
@@ -28263,9 +28339,9 @@ var DocDBProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
-			case "AWS::DocDB::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::DocDB::DBCluster": return this.updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::DocDB::DBInstance": return this.updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -28317,7 +28393,7 @@ var DocDBProvider = class {
 			throw thrown;
 		}
 	}
-	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating DocDB DBCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
@@ -28332,12 +28408,16 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				...sendVpcSgIds && { VpcSecurityGroupIds: vpcSgIds },
-				MasterUserPassword: properties["MasterUserPassword"],
+				MasterUserPassword: masterUserPasswordToSend(properties, previousProperties, context),
 				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
 				ApplyImmediately: true
 			}));
 			this.logger.debug(`Successfully updated DocDB DBCluster ${logicalId}`);
 			const described = await this.describeDBCluster(physicalId);
+			if (process.env["CDKD_NO_WAIT"] !== "true" && securityGroupListChanged(sendVpcSgIds ? vpcSgIds : void 0, previousProperties["VpcSecurityGroupIds"])) {
+				await this.waitForSecurityGroupsApplied(physicalId, logicalId, (sendVpcSgIds ? vpcSgIds : void 0) ?? []);
+				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterSecurityGroupChange(member.DBInstanceIdentifier);
+			}
 			if (described?.DBClusterArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			return {
 				physicalId,
@@ -28385,6 +28465,7 @@ var DocDBProvider = class {
 					flip,
 					logger: this.logger,
 					physicalId,
+					mask: context?.maskSecrets,
 					guardName: "DeletionProtection",
 					observe: async () => (await this.describeDBCluster(physicalId))?.DeletionProtection === true,
 					disable: async () => {
@@ -28397,9 +28478,10 @@ var DocDBProvider = class {
 				});
 				this.logger.debug(`Disabled DeletionProtection on DocDB DBCluster ${logicalId} before delete`);
 			} catch (disableError) {
-				if (!isDocDBNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(`Could not disable deletion protection for DocDB DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`);
+				if (!isDocDBNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for DocDB DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`));
 			}
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
+			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.waitForProtectionOffBeforeFinalSnapshot(logicalId, physicalId);
 			await this.getClient().send(new DeleteDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
 				...finalSnapshotId ? {
@@ -28552,6 +28634,54 @@ var DocDBProvider = class {
 		if (typeof found.resourceId !== "string" || found.resourceId === "") throw new Error(`${api} returned no resource id`);
 		return found.resourceId;
 	}
+	async waitForMemberAfterSecurityGroupChange(dbInstanceIdentifier, maxWaitMs = 18e5) {
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			let status;
+			try {
+				status = (await this.describeDBInstance(dbInstanceIdentifier))?.DBInstanceStatus;
+			} catch (error) {
+				if (isDocDBNotFoundError(error, "DBInstanceNotFoundFault")) return;
+				throw error;
+			}
+			if (status !== "modifying") return;
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for a member instance of the cluster to finish applying its new VPC security groups`);
+	}
+	async waitForSecurityGroupsApplied(dbClusterIdentifier, logicalId, expected, maxWaitMs = 18e5) {
+		const want = [...new Set(expected)].sort().join(" ");
+		const startTime = Date.now();
+		let delay = 5e3;
+		while (Date.now() - startTime < maxWaitMs) {
+			const cluster = await this.describeDBCluster(dbClusterIdentifier);
+			const groups = cluster?.VpcSecurityGroups ?? [];
+			const ids = groups.map((group) => group.VpcSecurityGroupId ?? "").sort().join(" ");
+			if (cluster !== void 0 && cluster.Status !== "modifying" && groups.every((group) => group.Status === "active") && ids === want) return;
+			this.logger.debug(safeMsg`DocDB DBCluster ${logicalId} security groups not settled yet (status ${cluster?.Status ?? "unknown"})`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`Timed out waiting for DocDB DBCluster ${logicalId} to apply its new VPC security groups`);
+	}
+	async waitForProtectionOffBeforeFinalSnapshot(logicalId, physicalId, maxWaitMs = FINAL_SNAPSHOT_SETTLE_WAIT_MS) {
+		const budgetMs = Math.min(maxWaitMs, enclosingDeadlineRemainingMs() - FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS);
+		if (budgetMs <= 0) throw new Error(`--remove-protection turned DeletionProtection off, but the resource timeout leaves no time to wait for the cluster to return to 'available', which the final snapshot its DeletionPolicy asks for needs. The delete was not sent and the guard is put back; re-run the destroy with a longer --resource-timeout`);
+		const startTime = Date.now();
+		let delay = 5e3;
+		for (;;) {
+			const current = await this.describeDBCluster(physicalId);
+			if (current === void 0) return;
+			if (current.DeletionProtection === false && current.Status !== "modifying") return;
+			if (Date.now() - startTime + delay >= budgetMs) break;
+			this.logger.debug(safeMsg`DocDB DBCluster ${logicalId}: waiting for the DeletionProtection change to settle before the final snapshot (status ${current.Status ?? "unknown"})`);
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+		throw new Error(`--remove-protection turned DeletionProtection off, but the cluster did not return to 'available' within ${Math.max(1, Math.round(budgetMs / 6e4))} minutes, and the final snapshot its DeletionPolicy asks for needs it. The delete was not sent and the guard is put back; re-run the destroy once the cluster is 'available'`);
+	}
 	async waitForClusterAvailable(dbClusterIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
 		let delay = 5e3;
@@ -28704,6 +28834,11 @@ var DocDBProvider = class {
 		return null;
 	}
 };
+function securityGroupListChanged(sent, previous) {
+	if (sent === void 0) return false;
+	const before = Array.isArray(previous) ? previous.filter((id) => typeof id === "string") : [];
+	return [...sent].sort().join(" ") !== [...before].sort().join(" ");
+}
 
 //#endregion
 //#region src/provisioning/providers/docdb-subnet-group-provider.ts
@@ -30621,6 +30756,15 @@ var CognitoUserPoolProvider = class {
 	protectionFlips = new ProtectionFlipRegistry();
 	preFlipPools = /* @__PURE__ */ new WeakMap();
 	emailOmittedFlips = /* @__PURE__ */ new WeakMap();
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		const m = maskerOrIdentity(mask);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const relay = isAuxiliaryFailure(error) ? "" : relayedNameCollision(failure.detail);
+		const wrapped = build(`${m(failure.summary)}${relay}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Set([
 		"UserPoolName",
 		"AutoVerifiedAttributes",
@@ -30771,11 +30915,13 @@ var CognitoUserPoolProvider = class {
 					this.logger.debug(`Rolled back partially-created Cognito User Pool ${createdUserPoolId}`);
 				} catch (rollbackError) {
 					poolLeftBehind = true;
-					this.logger.warn(`Failed to roll back partially-created Cognito User Pool ${createdUserPoolId}: ${describeAwsFailure(rollbackError).detail}`);
+					const rollbackFailure = describeAwsFailure(rollbackError);
+					if (rollbackFailure.redacted) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Rollback of partially-created Cognito User Pool ${createdUserPoolId} failed: ${rollbackFailure.detail}`));
+					this.logger.warn(`Failed to roll back partially-created Cognito User Pool ${createdUserPoolId}: ${rollbackFailure.summary}`);
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, poolName, cause);
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${text}`, resourceType, logicalId, poolName, cause));
 			if (poolLeftBehind && createdUserPoolId) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
 				markNonRetryable(thrown);
@@ -30997,7 +31143,7 @@ var CognitoUserPoolProvider = class {
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError || error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Cognito User Pool ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update Cognito User Pool ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema, deletionProtected = false) {
@@ -31095,7 +31241,8 @@ var CognitoUserPoolProvider = class {
 							failure = bareError;
 						}
 						if (readOn && !(failure instanceof ResourceNotFoundException$11)) {
-							this.logger.debug(safeMsg`Writing DeletionProtection back on ${physicalId} failed: ${describeAwsFailure(failure).detail}`);
+							const mask = maskerOrIdentity(context?.maskSecrets);
+							this.logger.debug(mask(safeMsg`Writing DeletionProtection back on ${mask(physicalId)} failed: ${mask(describeAwsFailure(failure).detail)}`));
 							return "read-on-write-failed";
 						}
 						throw failure;
@@ -31137,6 +31284,7 @@ var CognitoUserPoolProvider = class {
 						flip,
 						logger: this.logger,
 						physicalId,
+						mask: context?.maskSecrets,
 						guardName: "DeletionProtection",
 						observe: async () => {
 							observedPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId })).catch((error) => {
@@ -31163,12 +31311,12 @@ var CognitoUserPoolProvider = class {
 								return;
 							}
 							this.logger.debug(`Disabling DeletionProtection on Cognito User Pool ${physicalId} before deletion (--remove-protection)`);
-							await this.disableUserPoolDeletionProtection(physicalId, observedPool, flip);
+							await this.disableUserPoolDeletionProtection(physicalId, observedPool, flip, maskerOrIdentity(context?.maskSecrets));
 						}
 					});
 				} catch (flipError) {
 					if (isTransientCognitoFailure(flipError)) throw flipError;
-					this.logger.debug(`Could not disable DeletionProtection for ${physicalId}: ${describeAwsFailure(flipError).detail}`);
+					this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable DeletionProtection for ${physicalId}: ${describeAwsFailure(flipError).detail}`));
 				}
 				if (transientReadError !== void 0) throw transientReadError;
 			}
@@ -31183,7 +31331,7 @@ var CognitoUserPoolProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Cognito User Pool ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Cognito User Pool ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async sendEchoedDeletionProtection(physicalId, pool, value, opts = {}) {
@@ -31206,7 +31354,7 @@ var CognitoUserPoolProvider = class {
 			return "without-email";
 		}
 	}
-	async disableUserPoolDeletionProtection(physicalId, pool, flip) {
+	async disableUserPoolDeletionProtection(physicalId, pool, flip, mask) {
 		if (this.preFlipPools.get(flip)?.ambiguous) this.preFlipPools.delete(flip);
 		const observedOn = pool.DeletionProtection === "ACTIVE";
 		try {
@@ -31221,7 +31369,7 @@ var CognitoUserPoolProvider = class {
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
-				this.warnGuardLeftOn(physicalId, echoError);
+				this.warnGuardLeftOn(physicalId, mask, echoError);
 				throw echoError;
 			}
 			try {
@@ -31242,7 +31390,7 @@ var CognitoUserPoolProvider = class {
 					if (isAmbiguousWriteFailure(bareError)) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool with DeletionProtection alone ` + safeMsg`(the pool's own configuration was refused) answered ${describeAwsFailure(bareError).summary}; ` + safeMsg`if that write landed, the pool's self sign-up, Lambda triggers and advanced ` + safeMsg`security were reset. Retrying the delete.`);
 					throw bareError;
 				}
-				this.warnGuardLeftOn(physicalId, bareError, echoError);
+				this.warnGuardLeftOn(physicalId, mask, bareError, echoError);
 				throw bareError;
 			}
 			const kept = this.preFlipPools.get(flip);
@@ -31254,15 +31402,15 @@ var CognitoUserPoolProvider = class {
 				kept.ambiguous = false;
 				kept.echoedSince = false;
 			}
-			this.logger.debug(safeMsg`UpdateUserPool refused the echoed configuration of ${physicalId}: ${describeAwsFailure(echoError).detail}`);
+			this.logger.debug(mask(safeMsg`UpdateUserPool refused the echoed configuration of ${mask(physicalId)}: ${mask(describeAwsFailure(echoError).detail)}`));
 			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the pool's own configuration ` + safeMsg`echoed back (${describeAwsFailure(echoError).summary}), so DeletionProtection was ` + safeMsg`turned off alone. That write resets the settings it omits -- self sign-up, Lambda ` + safeMsg`triggers and advanced security among them -- which stays that way if the delete fails.`);
 		}
 	}
-	warnGuardLeftOn(physicalId, error, echoError) {
+	warnGuardLeftOn(physicalId, mask, error, echoError) {
 		const name = typeof error === "object" && error !== null ? String(error.name) : "";
 		const accessHint = /AccessDenied|NotAuthorized|Unauthorized/.test(name) ? " The caller needs cognito-idp:UpdateUserPool." : "";
 		const echoClause = echoError === void 0 ? "" : safeMsg`; the pool's own settings sent back were refused first (${describeAwsFailure(echoError).summary})`;
-		this.logger.debug(safeMsg`UpdateUserPool did not turn DeletionProtection off on ${physicalId}: ${describeAwsFailure(error).detail}`);
+		this.logger.debug(mask(safeMsg`UpdateUserPool did not turn DeletionProtection off on ${mask(physicalId)}: ${mask(describeAwsFailure(error).detail)}`));
 		const refused = error instanceof Error && isAwsAuthoredFailure(error);
 		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${describeAwsFailure(error).summary})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${describeAwsFailure(error).summary})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
 	}
@@ -31379,6 +31527,14 @@ var ElastiCacheProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("ElastiCacheProvider");
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
 		"CacheSubnetGroupName",
 		"CacheSubnetGroupDescription",
@@ -31428,17 +31584,19 @@ var ElastiCacheProvider = class {
 		this.getClient();
 		return this.createClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
+		const mask = context?.maskSecrets;
 		switch (resourceType) {
-			case "AWS::ElastiCache::SubnetGroup": return this.createSubnetGroup(logicalId, resourceType, properties);
-			case "AWS::ElastiCache::CacheCluster": return this.createCacheCluster(logicalId, resourceType, properties);
+			case "AWS::ElastiCache::SubnetGroup": return this.createSubnetGroup(logicalId, resourceType, properties, mask);
+			case "AWS::ElastiCache::CacheCluster": return this.createCacheCluster(logicalId, resourceType, properties, mask);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, previousProperties, _context) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const mask = context?.maskSecrets;
 		switch (resourceType) {
-			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, mask);
+			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -31449,7 +31607,7 @@ var ElastiCacheProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createSubnetGroup(logicalId, resourceType, properties) {
+	async createSubnetGroup(logicalId, resourceType, properties, mask) {
 		this.logger.debug(`Creating CacheSubnetGroup ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const cacheSubnetGroupName = properties["CacheSubnetGroupName"] || generatedNameFor("AWS::ElastiCache::SubnetGroup", logicalId);
@@ -31467,10 +31625,10 @@ var ElastiCacheProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CacheSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, cacheSubnetGroupName, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CacheSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, cacheSubnetGroupName, cause));
 		}
 	}
-	async updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
 		this.logger.debug(`Updating CacheSubnetGroup ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
@@ -31494,7 +31652,7 @@ var ElastiCacheProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CacheSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CacheSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteSubnetGroup(logicalId, physicalId, resourceType, context) {
@@ -31510,10 +31668,10 @@ var ElastiCacheProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CacheSubnetGroup ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete CacheSubnetGroup ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async createCacheCluster(logicalId, resourceType, properties) {
+	async createCacheCluster(logicalId, resourceType, properties, mask) {
 		this.logger.debug(`Creating CacheCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const cacheClusterId = properties["ClusterName"] || generatedNameFor("AWS::ElastiCache::CacheCluster", logicalId);
@@ -31564,12 +31722,12 @@ var ElastiCacheProvider = class {
 				attributes
 			};
 		} catch (error) {
-			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create CacheCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, cacheClusterId, error instanceof Error ? error : void 0);
+			const thrown = error instanceof ProvisioningError ? error : this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create CacheCluster ${logicalId}: ${text}`, resourceType, logicalId, cacheClusterId, error instanceof Error ? error : void 0));
 			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, cacheClusterId);
 			throw thrown;
 		}
 	}
-	async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties, mask) {
 		this.logger.debug(`Updating CacheCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
@@ -31615,7 +31773,7 @@ var ElastiCacheProvider = class {
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CacheCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update CacheCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteCacheCluster(logicalId, physicalId, resourceType, context) {
@@ -31642,7 +31800,7 @@ var ElastiCacheProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete CacheCluster ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete CacheCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	buildLogDeliveryConfigurationsForUpdate(newConfigs, previousConfigs) {
@@ -35920,6 +36078,25 @@ function pickDefined(obj) {
 	}
 	return out;
 }
+const CRAWLER_LEFT_IN_PLACE_ON_REMOVAL = [
+	"DatabaseName",
+	"Description",
+	"Classifiers",
+	"TablePrefix",
+	"Schedule",
+	"SchemaChangePolicy",
+	"RecrawlPolicy",
+	"LineageConfiguration",
+	"LakeFormationConfiguration",
+	"Configuration",
+	"CrawlerSecurityConfiguration"
+];
+const crawlerLeftInPlaceWarning = (logicalId, names, caller) => {
+	const one = names.length === 1;
+	const subject = one ? "property" : "properties";
+	const cfnKeeps = names.includes("LineageConfiguration") ? "" : `, as CloudFormation leaves ${one ? "it" : "them"}`;
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::Glue::Crawler): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateCrawler keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::Glue::Crawler): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value${cfnKeeps}; UpdateCrawler keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
+};
 var GlueCrawlerProvider = class {
 	client;
 	createClient;
@@ -35947,6 +36124,13 @@ var GlueCrawlerProvider = class {
 		"CrawlerSecurityConfiguration",
 		"Tags"
 	])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::Glue::Crawler", /* @__PURE__ */ new Set([
+		"Name",
+		"Role",
+		"Targets",
+		"Tags",
+		...CRAWLER_LEFT_IN_PLACE_ON_REMOVAL
+	])]]);
 	getClient() {
 		if (!this.client) ({client: this.client, createClient: this.createClient} = newGlueClients(this.providerRegion));
 		return this.client;
@@ -36012,6 +36196,12 @@ var GlueCrawlerProvider = class {
 				} else throw err;
 			}
 			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
+			if (!context?.desiredFromAwsReadback) {
+				const removed = context?.removedProperties;
+				const leftInPlace = [];
+				for (const key of CRAWLER_LEFT_IN_PLACE_ON_REMOVAL) if (removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties?.[key] !== void 0) leftInPlace.push(key);
+				if (leftInPlace.length > 0) log.warn(crawlerLeftInPlaceWarning(logicalId, leftInPlace, context?.replayingState ? "rollback" : "deploy"));
+			}
 			return {
 				physicalId,
 				wasReplaced: false
@@ -37264,7 +37454,14 @@ var BudgetsBudgetProvider = class {
 	}
 	wrapBudgetError(mask, error, verb, logicalId, resourceType, physicalId) {
 		const cause = error instanceof Error ? error : void 0;
-		return wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`Failed to ${verb} budget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		return this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to ${verb} budget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+	}
+	wrapMaskedError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error)) return build(mask(failure.detail));
+		if (!failure.redacted) return wrapMaskedAwsError(mask, error, build);
+		this.logger.debug(mask(build(mask(failure.detail)).message));
+		return markRedactedCause(build(`${mask(failure.summary)}${relayedNameCollision(failure.detail)}`));
 	}
 	getCreateClient() {
 		this.getClient();
@@ -37427,7 +37624,8 @@ var BudgetsBudgetProvider = class {
 				try {
 					await this.addNotificationsOnly(accountId, physicalId, newNotifications);
 				} catch (error) {
-					throw new ProvisioningError(`Failed to update budget ${logicalId}: adding ${newNotifications.length} desired notification(s) beside every notification the budget already holds (the recorded NotificationsWithSubscribers is not a list cdkd can read, so none was deleted; a budget allows at most 5 notifications and 10 email subscribers each): ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+					const cause = error instanceof Error ? error : void 0;
+					throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to update budget ${logicalId}: adding ${newNotifications.length} desired notification(s) beside every notification the budget already holds (the recorded NotificationsWithSubscribers is not a list cdkd can read, so none was deleted; a budget allows at most 5 notifications and 10 email subscribers each): ${text}`, resourceType, logicalId, physicalId, cause));
 				}
 				this.logger.warn(safeMsg`The recorded NotificationsWithSubscribers of budget ${logicalId} is not a list cdkd can read, so cdkd deleted no notification or subscriber and only added the desired ones. Delete any the template no longer names yourself.`);
 			}
@@ -37605,7 +37803,7 @@ var BudgetsBudgetProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete budget ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete budget ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -37619,7 +37817,7 @@ var BudgetsBudgetProvider = class {
 			return await this.budgetArn(accountId, physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapMaskedError(maskerOrIdentity(void 0), error, (text) => new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async import(input) {
@@ -38480,6 +38678,14 @@ var SchedulerScheduleProvider = class {
 	client;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("SchedulerScheduleProvider");
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Scheduler::Schedule", /* @__PURE__ */ new Set([
 		"Name",
 		"GroupName",
@@ -38575,7 +38781,7 @@ var SchedulerScheduleProvider = class {
 		}
 		return result;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		const name = properties["Name"] ?? generatedNameFor("AWS::Scheduler::Schedule", logicalId);
 		const groupName = this.groupNameOf(properties);
 		this.logger.debug(`Creating Schedule ${logicalId}: ${name}${groupName ? ` (group: ${groupName})` : ""}`);
@@ -38595,7 +38801,7 @@ var SchedulerScheduleProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Schedule ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create Schedule ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async readIdentity(name, groupName) {
@@ -38699,7 +38905,7 @@ var SchedulerScheduleProvider = class {
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Schedule ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update Schedule ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async deleteByRecordedIdentity(logicalId, physicalId, resourceType, recorded, context) {
@@ -38810,7 +39016,7 @@ var SchedulerScheduleProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Schedule ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Schedule ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -38820,7 +39026,7 @@ var SchedulerScheduleProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const customGroupHint = error instanceof ResourceNotFoundException$13 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
-			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? safeStringify(error)}.${customGroupHint}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(void 0, error, (text) => new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${text}${text.endsWith(".") ? "" : "."}${customGroupHint}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
@@ -39068,6 +39274,14 @@ var PipesPipeProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("PipesPipeProvider");
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	options;
 	sleep = (ms) => this.options.sleep ? this.options.sleep(ms) : new Promise((r) => setTimeout(r, ms));
 	now = () => this.options.now ? this.options.now() : Date.now();
@@ -39139,7 +39353,7 @@ var PipesPipeProvider = class {
 			createdIdentity = pipeIdentityToken(name, created?.Arn, created?.CreationTime);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Pipe ${logicalId}: ${mask(cause?.message ?? safeStringify(error))}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create Pipe ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 		let settled;
 		try {
@@ -39211,7 +39425,7 @@ var PipesPipeProvider = class {
 			if (error instanceof ProvisioningError) throw error;
 			if (error instanceof NotFoundException$6) assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Pipe ${logicalId}: ${mask(cause?.message ?? safeStringify(error))}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update Pipe ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 		return {
 			physicalId,
@@ -39232,7 +39446,7 @@ var PipesPipeProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Pipe ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete Pipe ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 		await waitForGoneAfterDelete({
 			what: `Pipe ${physicalId}`,
@@ -39283,13 +39497,14 @@ var PipesPipeProvider = class {
 			throw error;
 		}
 	}
-	async getAttribute(physicalId, _resourceType, attributeName, _logicalId) {
+	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
 		let response;
 		try {
 			response = await this.describe(physicalId);
 		} catch (error) {
 			if (error instanceof NotFoundException$6) return void 0;
-			throw error;
+			if (!describeAwsFailure(error).redacted) throw error;
+			throw this.wrapCaughtError(void 0, error, (text) => new ProvisioningError(`Failed to read ${attributeName} of Pipe ${physicalId}: ${text}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0));
 		}
 		return this.attributesOf(response)[attributeName];
 	}
@@ -39385,8 +39600,11 @@ var PipesPipeProvider = class {
 					if (settled && (!needsEvidence || sawUnsettled || this.now() - startedAt >= PIPE_POLL_INTERVAL_MS)) return response;
 					if (!settled) sawUnsettled = true;
 					if (state !== void 0 && state.endsWith("_FAILED") && !stale) {
-						const reason = response.StateReason ? `: ${mask(response.StateReason)}` : "";
-						throw markNonRetryable(new ProvisioningError(`Pipe ${logicalId} ${phase} failed: AWS reports ${state}${reason}`, resourceType, logicalId, name));
+						const reason = describeAwsStatusReason({ message: response.StateReason }, "");
+						const build = (text, cause) => new ProvisioningError(`Pipe ${logicalId} ${phase} failed: AWS reports ${state}${text}`, resourceType, logicalId, name, cause);
+						if (!reason.redacted) throw markNonRetryable(build(""));
+						this.logger.debug(mask(build(`: ${mask(reason.detail)}`).message));
+						throw markNonRetryable(markRedactedCause(build(`. ${reason.summary}`, new Error(reason.detail))));
 					}
 					this.logger.debug(mask(`Pipe ${name} state: ${state ?? "unknown"}, waiting to settle`));
 				} catch (error) {
@@ -39403,7 +39621,7 @@ var PipesPipeProvider = class {
 		}
 	}
 	async retireFailedCreate(name, logicalId, resourceType, error, mask, createdIdentity) {
-		const original = error instanceof Error ? error : new Error(String(error));
+		const original = describeAwsFailure(error).redacted ? this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create Pipe ${logicalId}: ${text}`, resourceType, logicalId, name, error instanceof Error ? error : void 0)) : error;
 		const leftBehind = () => markNonRetryable(markCreatedBeforeFailure(original, logicalId, resourceType, name, createdIdentity));
 		const orphaned = async (why) => {
 			const aws = pasteableAwsCommand(mask);
@@ -41783,6 +42001,7 @@ var EMRClusterProvider = class {
 					flip,
 					logger: this.logger,
 					physicalId,
+					mask: context?.maskSecrets,
 					guardName: "TerminationProtected",
 					observe: () => Promise.resolve(current?.TerminationProtected === true),
 					disable: async () => {
@@ -42837,7 +43056,8 @@ var FirehoseProvider = class {
 					ProcessingConfiguration: httpConfig["ProcessingConfiguration"],
 					RetryOptions: httpConfig["RetryOptions"],
 					S3BackupMode: httpConfig["S3BackupMode"],
-					S3Configuration: httpConfig["S3Configuration"] ? this.mapS3DestinationConfiguration(httpConfig["S3Configuration"]) : void 0
+					S3Configuration: httpConfig["S3Configuration"] ? this.mapS3DestinationConfiguration(httpConfig["S3Configuration"]) : void 0,
+					SecretsManagerConfiguration: httpConfig["SecretsManagerConfiguration"]
 				};
 			}
 			if (properties["RedshiftDestinationConfiguration"]) {
@@ -42850,7 +43070,11 @@ var FirehoseProvider = class {
 					Password: rsConfig["Password"],
 					S3Configuration: rsConfig["S3Configuration"] ? this.mapS3DestinationConfiguration(rsConfig["S3Configuration"]) : void 0,
 					CloudWatchLoggingOptions: rsConfig["CloudWatchLoggingOptions"],
-					ProcessingConfiguration: rsConfig["ProcessingConfiguration"]
+					ProcessingConfiguration: rsConfig["ProcessingConfiguration"],
+					RetryOptions: rsConfig["RetryOptions"],
+					S3BackupMode: rsConfig["S3BackupMode"],
+					S3BackupConfiguration: rsConfig["S3BackupConfiguration"] ? this.mapS3DestinationConfiguration(rsConfig["S3BackupConfiguration"]) : void 0,
+					SecretsManagerConfiguration: rsConfig["SecretsManagerConfiguration"]
 				};
 			}
 			if (properties["ElasticsearchDestinationConfiguration"]) {
@@ -42867,7 +43091,9 @@ var FirehoseProvider = class {
 					S3BackupMode: esConfig["S3BackupMode"],
 					S3Configuration: esConfig["S3Configuration"] ? this.mapS3DestinationConfiguration(esConfig["S3Configuration"]) : void 0,
 					CloudWatchLoggingOptions: esConfig["CloudWatchLoggingOptions"],
-					ProcessingConfiguration: esConfig["ProcessingConfiguration"]
+					ProcessingConfiguration: esConfig["ProcessingConfiguration"],
+					VpcConfiguration: esConfig["VpcConfiguration"],
+					DocumentIdOptions: esConfig["DocumentIdOptions"]
 				};
 			}
 			if (properties["AmazonopensearchserviceDestinationConfiguration"]) {
@@ -42884,7 +43110,9 @@ var FirehoseProvider = class {
 					S3BackupMode: aosConfig["S3BackupMode"],
 					S3Configuration: aosConfig["S3Configuration"] ? this.mapS3DestinationConfiguration(aosConfig["S3Configuration"]) : void 0,
 					CloudWatchLoggingOptions: aosConfig["CloudWatchLoggingOptions"],
-					ProcessingConfiguration: aosConfig["ProcessingConfiguration"]
+					ProcessingConfiguration: aosConfig["ProcessingConfiguration"],
+					VpcConfiguration: aosConfig["VpcConfiguration"],
+					DocumentIdOptions: aosConfig["DocumentIdOptions"]
 				};
 			}
 			if (properties["SplunkDestinationConfiguration"]) {
@@ -42898,7 +43126,9 @@ var FirehoseProvider = class {
 					S3Configuration: splunkConfig["S3Configuration"] ? this.mapS3DestinationConfiguration(splunkConfig["S3Configuration"]) : void 0,
 					RetryOptions: splunkConfig["RetryOptions"],
 					CloudWatchLoggingOptions: splunkConfig["CloudWatchLoggingOptions"],
-					ProcessingConfiguration: splunkConfig["ProcessingConfiguration"]
+					ProcessingConfiguration: splunkConfig["ProcessingConfiguration"],
+					BufferingHints: splunkConfig["BufferingHints"],
+					SecretsManagerConfiguration: splunkConfig["SecretsManagerConfiguration"]
 				};
 			}
 			if (properties["AmazonOpenSearchServerlessDestinationConfiguration"]) {
@@ -42912,7 +43142,8 @@ var FirehoseProvider = class {
 					S3BackupMode: aossConfig["S3BackupMode"],
 					S3Configuration: aossConfig["S3Configuration"] ? this.mapS3DestinationConfiguration(aossConfig["S3Configuration"]) : void 0,
 					CloudWatchLoggingOptions: aossConfig["CloudWatchLoggingOptions"],
-					ProcessingConfiguration: aossConfig["ProcessingConfiguration"]
+					ProcessingConfiguration: aossConfig["ProcessingConfiguration"],
+					VpcConfiguration: aossConfig["VpcConfiguration"]
 				};
 			}
 			if (properties["DeliveryStreamEncryptionConfigurationInput"]) {
@@ -43153,6 +43384,9 @@ var FirehoseProvider = class {
 			result.S3BackupConfiguration = this.mapS3DestinationConfiguration(backupConfig);
 		}
 		if (config["DataFormatConversionConfiguration"] !== void 0) result.DataFormatConversionConfiguration = config["DataFormatConversionConfiguration"];
+		if (config["DynamicPartitioningConfiguration"] !== void 0) result.DynamicPartitioningConfiguration = config["DynamicPartitioningConfiguration"];
+		if (config["FileExtension"] !== void 0) result.FileExtension = config["FileExtension"];
+		if (config["CustomTimeZone"] !== void 0) result.CustomTimeZone = config["CustomTimeZone"];
 		return result;
 	}
 	mapExtendedS3ConfigToUpdate(config) {
@@ -43177,6 +43411,9 @@ var FirehoseProvider = class {
 		if (config["S3BackupMode"] !== void 0) result.S3BackupMode = config["S3BackupMode"];
 		if (config["S3BackupConfiguration"] !== void 0) result.S3BackupUpdate = this.mapS3ConfigToUpdate(config["S3BackupConfiguration"]);
 		if (config["DataFormatConversionConfiguration"] !== void 0) result.DataFormatConversionConfiguration = config["DataFormatConversionConfiguration"];
+		if (config["DynamicPartitioningConfiguration"] !== void 0) result.DynamicPartitioningConfiguration = config["DynamicPartitioningConfiguration"];
+		if (config["FileExtension"] !== void 0) result.FileExtension = config["FileExtension"];
+		if (config["CustomTimeZone"] !== void 0) result.CustomTimeZone = config["CustomTimeZone"];
 		return result;
 	}
 	async applyRedshiftDestinationUpdate(logicalId, physicalId, nextConfig) {
@@ -43542,6 +43779,8 @@ function mapExtendedS3DescriptionToCfn(desc) {
 	out["ProcessingConfiguration"] = pickDefinedDeep(desc["ProcessingConfiguration"]) ?? {};
 	out["DataFormatConversionConfiguration"] = pickDefinedDeep(desc["DataFormatConversionConfiguration"]) ?? {};
 	out["DynamicPartitioningConfiguration"] = pickDefinedDeep(desc["DynamicPartitioningConfiguration"]) ?? {};
+	if (desc["FileExtension"] !== void 0) out["FileExtension"] = desc["FileExtension"];
+	if (desc["CustomTimeZone"] !== void 0) out["CustomTimeZone"] = desc["CustomTimeZone"];
 	if (desc["S3BackupDescription"]) out["S3BackupConfiguration"] = mapS3DescriptionToCfn(desc["S3BackupDescription"]);
 	else out["S3BackupConfiguration"] = {};
 	return out;
@@ -43642,6 +43881,14 @@ var CloudTrailProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("CloudTrailProvider");
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Map([["IsMultiRegionTrail", false], ["EnableLogFileValidation", false]])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
 		"S3BucketName",
@@ -43677,7 +43924,7 @@ var CloudTrailProvider = class {
 		this.getClient();
 		return this.createClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating CloudTrail Trail ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const s3BucketName = properties["S3BucketName"];
@@ -43744,7 +43991,7 @@ var CloudTrailProvider = class {
 		} catch (error) {
 			if (trailCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create CloudTrail Trail ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create CloudTrail Trail ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (createdTrailArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdTrailArn);
 			throw thrown;
 		}
@@ -43832,7 +44079,7 @@ var CloudTrailProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -43857,7 +44104,7 @@ var CloudTrailProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const failure = new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			const failure = this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete CloudTrail Trail ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 			throw stripped ? markDeleteStarted(failure) : failure;
 		}
 	}
@@ -44938,6 +45185,14 @@ var DLMLifecyclePolicyProvider = class {
 	createClient;
 	providerRegion = ambientRegion();
 	logger = getLogger().child("DLMLifecyclePolicyProvider");
+	wrapCaughtError(mask, error, build) {
+		const m = maskerOrIdentity(mask);
+		const failure = describeAwsFailure(error);
+		if (!failure.redacted) return wrapMaskedAwsError(m, error, build);
+		this.logger.debug(m(build(m(failure.detail)).message));
+		const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
+		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
+	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Set([
 		"Description",
 		"ExecutionRoleArn",
@@ -45061,7 +45316,7 @@ var DLMLifecyclePolicyProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to create DLM Lifecycle Policy ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -45108,7 +45363,7 @@ var DLMLifecyclePolicyProvider = class {
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DLM Lifecycle Policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -45124,7 +45379,7 @@ var DLMLifecyclePolicyProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DLM Lifecycle Policy ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async getAttribute(physicalId, resourceType, attributeName, logicalId) {
@@ -45134,7 +45389,7 @@ var DLMLifecyclePolicyProvider = class {
 			return await this.fetchPolicyArn(physicalId);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to resolve Arn for DLM Lifecycle Policy ${physicalId}: ${cause?.message ?? safeStringify(error)}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(void 0, error, (text) => new ProvisioningError(`Failed to resolve Arn for DLM Lifecycle Policy ${physicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
@@ -47410,4 +47665,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-B2_u4Fg0.js.map
+//# sourceMappingURL=provider-classes-CUKmyCQ8.js.map