@go-to-k/cdkd 0.302.3 → 0.302.4

package/dist/{provider-classes-CDtquwkU.js → provider-classes-B52ogqNj.js}

@@ -1,14 +1,15 @@
 import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, w as generateResourceNameWithFallback } from "./aws-failure-text-e_ddrDDo.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as plainOrDescribed, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as commandHole, H as observeThenDisableProtection, In as hasClauseBreak, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qt as ambientClientDefaults, Rn as pasteableCommand, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Un as shellQuote, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wn as withheldTargetClause, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Yn as isNameCollisionError, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _r as isThrottlingError, _t as createMaskedLogSinks, a as onlySecretDerived, at as startInterruptWatch, b as isInsideWindow, br as wrapMaskedAwsError, bt as maskDeep, c as recordedPrincipalsRepair, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as clientDefaultsFor, er as markNameCollision, et as renderDisableCommand, fr as isRetryableTransientError, ft as logicalIdShown, g as AmbiguousCreateLatch, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as THROTTLING_ERROR_NAMES, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, kt as isAuxiliaryFailure, lr as isAmbiguousOutcomeError, lt as compositeIdFormatMessage, nn as AccountIdUnavailableError, nr as relayedNameCollision, o as readPrincipalLists, or as explicitDenyPolicyKind, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as isTransientServerError, pt as packCompositeId, q as userPoolProtectionSite, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, tn as credentialFingerprint, tr as markReplayMayCollide, u as clearOnUpdateRemoval, ur as isExplicitDenyError, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, y as createAttemptKey, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-OtGPguLH.js";
+import { $ as UNNAMEABLE_ID_CLAUSE, $n as isNameCollisionError, A as isQuotableImportValue, B as deleteWithProtectionCompensation, Bn as hasClauseBreak, C as setBounded, Cn as ProvisioningError, Cr as markRedactedCause, Ct as isSecretDerivedValue, D as VALUE_NOT_SHOWN, E as assertRegionMatch, Et as withDerivedNameMasks, F as resolveExplicitPhysicalId, Ft as markAuxiliaryFailure, G as logGroupProtectionSite, Hn as pasteableCommand, It as markCreatedBeforeFailure, J as rdsFamilyProtectionSite, Jn as withheldTargetClause, K as observeThenDisableProtection, L as ProtectionFlipRegistry, Lt as markSupersedesEarlierCreate, M as quotedRemedyLogicalId, N as refusalTypeShown, Nt as isAuxiliaryFailure, O as isPlainImportJson, P as remedyLogicalId, S as replayedSendWindow, Sr as markNonRetryable, St as createMaskedRetryLogger, T as RESOURCE_NOT_FOUND, Tn as ResourceUpdateNotSupportedError, Tt as maskerOrIdentity, Vn as isInertUnquoted, W as isTerminalDeleteFailure, Wn as plainOrDescribed, Xt as injectiveKey, Z as userPoolProtectionSite, Zt as injectiveKeyPrefix, _ as RecentIdSet, _r as isTransientServerError, _t as packCompositeId, a as onlySecretDerived, an as credentialFingerprint, ar as markReplayMayCollide, b as isInsideWindow, br as isMarkedNonRetryable, bt as stateOrphanRecordRemedy, c as recordedPrincipalsRepair, cn as CdkdError, ct as isInterruptedWaitError, et as WITHHELD_AWS_COMMAND, ft as canonicalizeRoute53QueryName, g as AmbiguousCreateLatch, gr as isRetryableTransientError, gt as logicalIdShown, h as AMBIGUOUS_LATCH_TTL_MS, ht as compositeIdSkipResult, i as holdsSecretDerivedEntry, in as clientDefaultsFor, ir as markNameCollision, it as renderDisableCommand, j as normalizeAwsTagsToCfn, k as isPlainImportValue, kt as clearCreatedBeforeFailure, lt as startInterruptWatch, mr as isExplicitDenyError, mt as compositeIdSeparatorRefusal, nn as ambientClientDefaults, nt as pasteableAwsCommand, o as readPrincipalLists, on as AccountIdUnavailableError, or as relayedNameCollision, p as withRemovalDefaults, pr as isAmbiguousOutcomeError, pt as compositeIdFormatMessage, q as protectionFlipKey, qn as shellQuote, r as SECRET_DERIVED_READ_LIVE, rn as ambientCredentialConfig, rt as protectedReplacementAdvice, tn as withPasteableAwsProfile, tt as isAwsCliLiteral, u as clearOnUpdateRemoval, ur as explicitDenyPolicyKind, ut as ElapsedBudgetRegistry, v as ambiguousAttemptLead, w as withoutServerErrorRetries, wr as wrapMaskedAwsError, wt as maskDeep, x as replayFollowedAmbiguousAttempt, xr as isThrottlingError, xt as createMaskedLogSinks, y as createAttemptKey, yr as THROTTLING_ERROR_NAMES, yt as segmentAfterAnchor, z as deleteAfterProtectionFlipWithFinalSnapshot, zn as commandHole } from "./iam-policy-targets-DBAi38y_.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { An as awaitInFlightSibling, Ar as isRefusedByName, Bc as decodeListingKey, Bo as isWarmThroughputDecrease, Br as stringifyIfAssigned, C as hasCdkAutoDeleteTag, Ci as s3BucketArn, Di as s3BucketWebsiteUrl, Do as findSilentDropProperties, Dt as lookupEachName, E as markRefusedBeforeApplying, Ei as s3BucketRegionalDomainName, Er as acquireIdempotencyToken, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fr as readTagList, Go as configBooleanRefusal, Gt as getCurrentProducerRegions, Ho as toFiniteNumber, I as isAbsoluteAssetPath, Ir as refuseMalformedDesiredTags, Is as stringifyValue, Jo as readConfigString, Jt as isRedactedRecordedValue, Ko as configIntegerRefusal, Kr as waitForLambdaFunctionActive, L as listNestedTemplateRows, Lr as tagMapAsList, Mi as outputReferenceProvenanceOf, Mn as getStackRecords, Mr as DBPROXY_TAGS_WHAT, Nr as DBPROXY_TAG_OPTIONS, Ot as withApiLimit, Pn as replacedDeleteFailureVerdict, Pr as planTagDiff, Qi as getAccountInfo, Qo as requireConfigString, R as renderNestedTemplateTreeDefect, Ro as WARM_THROUGHPUT_MEMBERS, Rr as tagPlanWarning, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as isSettledInstanceState, Sr as earliestDefined, T as getPriorAttempts, Ti as s3BucketDualStackDomainName, To as withheldAccountClause, Tt as chunks, Uc as canonicalizeRegion, Uo as coerceCfnBoolean, Vo as toCfnInteger, Vs as rewriteTemplateAssetReferences, W as enclosingDeadlineRemainingMs, Wc as derivePartitionAndUrlSuffix, Wo as coerceCfnInteger, Xo as requireConfigArray, Xr as getCurrentResourceSecrets, Xt as redactedDeleteAddressSkip, Yo as replayWarn, Yt as redactedDeleteAddressFields, Zo as requireConfigObject, _ as deleteTableWithIndexBusyRetry, _i as reEnableInstanceApiTermination, as as sameLambdaFunctionAddress, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ca as parseWebACLArn, ci as deleteSkipReason, d as compensateRemovedDeletionProtection, da as passedParameterClassesOf, di as markWaitAbandoned, el as describeFileReadFailure, f as deleteBudgetKey, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reDisableInstanceApiTermination, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as observeThenDisableInstanceApiTermination, ht as withNestedStackContext, is as lambdaFunctionNameForMask, jr as markDeleteStarted, ko as withoutSilentDropProperties, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as withIndeterminateGuard, lr as secretNamedAttributeNamesOf, m as resolveDynamoDbDeleteBudgetMs, mi as isTerminationProtectionPropagationError, mt as getCurrentNestedStackContext, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, ns as withRetry, p as resolveDynamoDbDeleteBudgetClock, pi as ec2InstanceProtectionSite, po as refuseMalformedResourcesForDestroy, qa as refuseMalformedNestedChildOutputs, qo as configStringRefusal, qt as REDACTED_DELETE_ADDRESS_SKIP_REASON, ri as unchangedBehindSecretReference, rl as resolveAssemblyPath, rs as canonicalLambdaFunctionName, st as getNestedRevertRun, t as DeployEngine, tl as displayAssemblyPath, u as beginDeleteWait, ui as isWaitAbandonedError, ut as revertNestedChildFromJournal, v as maskedLogger, va as accountArgs, w as isTruthyCfnBoolean, wi as s3BucketDomainName, wr as reserveStackCreateToken, x as ECR_AUTO_DELETE_IMAGES_TAG, y as relayedIndexBusyDelete, zo as coerceWarmThroughput$1, zr as definedAttributes } from "./deploy-engine-D9SDE-Pj.js";
+import { An as awaitInFlightSibling, Ar as isRefusedByName, Bc as decodeListingKey, Bo as isWarmThroughputDecrease, Br as stringifyIfAssigned, C as hasCdkAutoDeleteTag, Ci as s3BucketArn, Di as s3BucketWebsiteUrl, Do as findSilentDropProperties, Dt as lookupEachName, E as markRefusedBeforeApplying, Ei as s3BucketRegionalDomainName, Er as acquireIdempotencyToken, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fr as readTagList, Go as configBooleanRefusal, Gt as getCurrentProducerRegions, Ho as toFiniteNumber, I as isAbsoluteAssetPath, Ir as refuseMalformedDesiredTags, Is as stringifyValue, Jo as readConfigString, Jt as isRedactedRecordedValue, Ko as configIntegerRefusal, Kr as waitForLambdaFunctionActive, L as listNestedTemplateRows, Lr as tagMapAsList, Mi as outputReferenceProvenanceOf, Mn as getStackRecords, Mr as DBPROXY_TAGS_WHAT, Nr as DBPROXY_TAG_OPTIONS, Ot as withApiLimit, Pn as replacedDeleteFailureVerdict, Pr as planTagDiff, Qi as getAccountInfo, Qo as requireConfigString, R as renderNestedTemplateTreeDefect, Ro as WARM_THROUGHPUT_MEMBERS, Rr as tagPlanWarning, S as S3_AUTO_DELETE_OBJECTS_TAG, Si as isSettledInstanceState, Sr as earliestDefined, T as getPriorAttempts, Ti as s3BucketDualStackDomainName, To as withheldAccountClause, Tt as chunks, Uc as canonicalizeRegion, Uo as coerceCfnBoolean, Vo as toCfnInteger, Vs as rewriteTemplateAssetReferences, W as enclosingDeadlineRemainingMs, Wc as derivePartitionAndUrlSuffix, Wo as coerceCfnInteger, Xo as requireConfigArray, Xr as getCurrentResourceSecrets, Xt as redactedDeleteAddressSkip, Yo as replayWarn, Yt as redactedDeleteAddressFields, Zo as requireConfigObject, _ as deleteTableWithIndexBusyRetry, _i as reEnableInstanceApiTermination, as as sameLambdaFunctionAddress, b as waitForIndexesSettled, c as DynamoDBGlobalTableProvider, ca as parseWebACLArn, ci as deleteSkipReason, d as compensateRemovedDeletionProtection, da as passedParameterClassesOf, di as markWaitAbandoned, el as describeFileReadFailure, f as deleteBudgetKey, g as INDEX_SETTLE_POLL_INTERVAL_MS, gi as reDisableInstanceApiTermination, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hi as observeThenDisableInstanceApiTermination, ht as withNestedStackContext, is as lambdaFunctionNameForMask, jr as markDeleteStarted, ko as withoutSilentDropProperties, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, li as withIndeterminateGuard, lr as secretNamedAttributeNamesOf, m as resolveDynamoDbDeleteBudgetMs, mi as isTerminationProtectionPropagationError, mt as getCurrentNestedStackContext, ni as slowCcOperationTimeoutMs, nl as renderAssemblyPathEscape, ns as withRetry, p as resolveDynamoDbDeleteBudgetClock, pi as ec2InstanceProtectionSite, po as refuseMalformedResourcesForDestroy, qa as refuseMalformedNestedChildOutputs, qo as configStringRefusal, qt as REDACTED_DELETE_ADDRESS_SKIP_REASON, ri as unchangedBehindSecretReference, rl as resolveAssemblyPath, rs as canonicalLambdaFunctionName, st as getNestedRevertRun, t as DeployEngine, tl as displayAssemblyPath, u as beginDeleteWait, ui as isWaitAbandonedError, ut as revertNestedChildFromJournal, v as maskedLogger, va as accountArgs, w as isTruthyCfnBoolean, wi as s3BucketDomainName, wr as reserveStackCreateToken, x as ECR_AUTO_DELETE_IMAGES_TAG, y as relayedIndexBusyDelete, zo as coerceWarmThroughput$1, zr as definedAttributes } from "./deploy-engine-CN2w5GAK.js";
 import { D as markSameGenerationBag, F as redactForState, H as recordReferenceProvenanceEntry, Jt as physicalNameCopiesOf, Tt as dynamicReferenceTokens, W as snapshotPassProvenance, Y as hasMaskableValues, Yt as recordAttributeIdCopy, m as passedNoEchoParametersOf, nn as carriesSecretMask, qt as recoverMaskedOutput, xt as withoutPhysicalNameCopies } from "./secret-redaction-BHWS-PZK.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-Q1sv3tF1.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DSbJoNKe.js";
-import { RDSProvider } from "./rds-provider-ByCpdpUq.js";
-import { NeptuneProvider } from "./neptune-provider-DjVgEWGf.js";
-import { ASGProvider } from "./asg-provider-DCrwgSCZ.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-Cv7YzUwO.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CAibYjpk.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-D0e5Ryd_.js";
+import { RDSProvider } from "./rds-provider-C6jYh60H.js";
+import { NeptuneProvider } from "./neptune-provider-BcENx6g8.js";
+import { ASGProvider } from "./asg-provider-CGqU-6sj.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -27110,6 +27111,16 @@ const RETAINED_ON_REMOVAL = [
 	"DebugLogging",
 	"VpcSecurityGroupIds"
 ];
+const CFN_KEEPS_ON_REMOVAL$1 = /* @__PURE__ */ new Set([
+	"RequireTLS",
+	"IdleClientTimeout",
+	"DebugLogging",
+	"VpcSecurityGroupIds"
+]);
+const authRemovalRefused = (properties) => {
+	const scheme = properties["DefaultAuthScheme"];
+	return scheme === void 0 || scheme === "NONE";
+};
 var RDSDBProxyProvider = class {
 	rdsClient;
 	createClient;
@@ -27213,6 +27224,7 @@ var RDSDBProxyProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && this.removedRetained(properties, previousProperties, context).includes("Auth") && authRemovalRefused(properties)) throw markNonRetryable(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): Auth was removed from the template, but AWS requires Auth while DefaultAuthScheme is NONE or unset, and CloudFormation's update fails on the same change. Declare Auth again; nothing was changed.`, resourceType, logicalId, physicalId));
 		const client = this.getClient();
 		const { mask } = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["DBProxyName"], physicalId]]);
 		for (const field of [
@@ -27261,13 +27273,17 @@ var RDSDBProxyProvider = class {
 		};
 	}
 	warnOnRetainedRemovals(logicalId, resourceType, properties, previousProperties, context) {
-		const removed = context?.removedProperties;
-		const retained = [];
-		for (const key of RETAINED_ON_REMOVAL) if (removed !== void 0 ? removed.has(key) : previousProperties[key] !== void 0 && properties[key] === void 0) retained.push(key);
+		const retained = this.removedRetained(properties, previousProperties, context);
 		if (retained.length === 0) return;
 		const one = retained.length === 1;
 		const names = `${one ? "property" : "properties"} ${retained.join(", ")}`;
-		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ModifyDBProxy keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; ModifyDBProxy keeps a setting it is not sent, so the proxy keeps its current value. Declare the property with the value you want to change it.`);
+		this.logger.warn(context?.replayingState === true ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ModifyDBProxy keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : retained.every((key) => CFN_KEEPS_ON_REMOVAL$1.has(key)) ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; ModifyDBProxy keeps a setting it is not sent. Declare the property with the value you want to change it.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; ModifyDBProxy keeps a setting it is not sent, so the proxy keeps its current value. Declare the property with the value you want to change it.`);
+	}
+	removedRetained(properties, previousProperties, context) {
+		const removed = context?.removedProperties;
+		const retained = [];
+		for (const key of RETAINED_ON_REMOVAL) if (removed !== void 0 ? removed.has(key) : previousProperties[key] !== void 0 && properties[key] === void 0) retained.push(key);
+		return retained;
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const client = this.getClient();
@@ -27810,7 +27826,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					ConnectionPoolConfig: connectionPoolConfig
 				}));
 			} catch (error) {
-				throw markAuxiliaryFailure(this.wrapError(error, "CREATE (pool config)", resourceType, logicalId, void 0), logicalId);
+				throw markAuxiliaryFailure(this.wrapError(error, "CREATE (pool config)", resourceType, logicalId, void 0, mask), logicalId);
 			}
 		}
 		if (dbClusterIdentifiers.length > 0 || dbInstanceIdentifiers.length > 0) {
@@ -27823,7 +27839,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					DBInstanceIdentifiers: dbInstanceIdentifiers.length > 0 ? dbInstanceIdentifiers : void 0
 				}));
 			} catch (error) {
-				throw this.wrapError(error, "CREATE (register targets)", resourceType, logicalId, void 0);
+				throw this.wrapError(error, "CREATE (register targets)", resourceType, logicalId, void 0, mask);
 			}
 		}
 		let targetGroupArn;
@@ -27833,7 +27849,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				TargetGroupName: targetGroupName
 			}))).TargetGroups?.[0]?.TargetGroupArn;
 		} catch (error) {
-			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (describe)", resourceType, logicalId, void 0), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
+			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (describe)", resourceType, logicalId, void 0, mask), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
 		}
 		if (!targetGroupArn) throw await this.retireRegistrationAfterFailedCreate(new ProvisioningError(`Failed to recover TargetGroupArn for ${dbProxyName}/${targetGroupName} after create`, resourceType, logicalId), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
 		if (tags.length > 0) try {
@@ -27842,7 +27858,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				Tags: tags
 			}));
 		} catch (error) {
-			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (add tags)", resourceType, logicalId, void 0), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets, {
+			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (add tags)", resourceType, logicalId, void 0, mask), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets, {
 				logicalId,
 				resourceType,
 				physicalId: targetGroupArn
@@ -27957,7 +27973,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					ConnectionPoolConfig: newPool ?? {}
 				}));
 			} catch (error) {
-				throw this.wrapError(error, "UPDATE (pool config)", resourceType, logicalId, physicalId);
+				throw this.wrapError(error, "UPDATE (pool config)", resourceType, logicalId, physicalId, mask);
 			}
 		}
 		const clustersToRemove = missingIdentifiers(prev.lists.DBClusterIdentifiers, next.lists.DBClusterIdentifiers);
@@ -27974,7 +27990,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					DBInstanceIdentifiers: instancesToRemove.length > 0 ? instancesToRemove : void 0
 				}));
 			} catch (error) {
-				if (!(error instanceof DBProxyTargetNotFoundFault)) throw this.wrapError(error, "UPDATE (deregister)", resourceType, logicalId, physicalId);
+				if (!(error instanceof DBProxyTargetNotFoundFault)) throw this.wrapError(error, "UPDATE (deregister)", resourceType, logicalId, physicalId, mask);
 			}
 		}
 		if (clustersToAdd.length > 0 || instancesToAdd.length > 0) {
@@ -27987,7 +28003,7 @@ var RDSDBProxyTargetGroupProvider = class {
 					DBInstanceIdentifiers: instancesToAdd.length > 0 ? instancesToAdd : void 0
 				}));
 			} catch (error) {
-				throw this.wrapError(error, "UPDATE (register)", resourceType, logicalId, physicalId);
+				throw this.wrapError(error, "UPDATE (register)", resourceType, logicalId, physicalId, mask);
 			}
 		}
 		const tagsToRemove = tagPlan.remove;
@@ -28001,7 +28017,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				TagKeys: tagsToRemove
 			}));
 		} catch (error) {
-			throw this.wrapError(error, "UPDATE (remove tags)", resourceType, logicalId, physicalId);
+			throw this.wrapError(error, "UPDATE (remove tags)", resourceType, logicalId, physicalId, mask);
 		}
 		if (tagsToAdd.length > 0) try {
 			await client.send(new AddTagsToResourceCommand$2({
@@ -28009,7 +28025,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				Tags: tagsToAdd
 			}));
 		} catch (error) {
-			throw this.wrapError(error, "UPDATE (add tags)", resourceType, logicalId, physicalId);
+			throw this.wrapError(error, "UPDATE (add tags)", resourceType, logicalId, physicalId, mask);
 		}
 		return {
 			physicalId,
@@ -28073,7 +28089,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				this.logger.debug(mask(`${mask(dbProxyName)}/${mask(targetGroupName)} or its target is already gone, treating as success`));
 				return;
 			}
-			throw this.wrapError(error, "DELETE", resourceType, logicalId, physicalId);
+			throw this.wrapError(error, "DELETE", resourceType, logicalId, physicalId, mask);
 		}
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -28166,7 +28182,9 @@ var RDSDBProxyTargetGroupProvider = class {
 				targets = aws`${targets} --db-instance-identifiers`;
 				for (const id of instances) targets = aws`${targets} ${id}`;
 			}
-			original.message += ` The targets this create registered are still registered and could not be deregistered (${describeAwsFailure(cleanupError).detail}). Manual cleanup: ` + aws`aws rds deregister-db-proxy-targets --db-proxy-name ${dbProxyName} --target-group-name ${targetGroupName}${targets}`.render();
+			const cleanupFailure = describeAwsFailure(cleanupError);
+			if (cleanupFailure.redacted) this.logger.debug(maskerOrIdentity(maskSecrets)(`Deregistering the targets a failed create registered failed: ${cleanupFailure.detail}`));
+			original.message += ` The targets this create registered are still registered and could not be deregistered (${cleanupFailure.summary.replace(/\.$/, "")}). Manual cleanup: ` + aws`aws rds deregister-db-proxy-targets --db-proxy-name ${dbProxyName} --target-group-name ${targetGroupName}${targets}`.render();
 			if (leftBehind) markCreatedBeforeFailure(original, leftBehind.logicalId, leftBehind.resourceType, leftBehind.physicalId);
 			return original;
 		}
@@ -28182,7 +28200,8 @@ var RDSDBProxyTargetGroupProvider = class {
 			if (error instanceof DBProxyNotFoundFault || targetGroupName !== void 0 && error instanceof DBProxyTargetGroupNotFoundFault) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`${dbProxyName}/${targetGroupName ?? "*"} is already gone; the record needs no deregistration`);
+				const mask = maskerOrIdentity(context?.maskSecrets);
+				this.logger.debug(mask(`${mask(dbProxyName)}/${targetGroupName === void 0 ? "*" : mask(targetGroupName)} is already gone; the record needs no deregistration`));
 				return true;
 			}
 			this.logger.debug(safeMsg`Could not confirm whether the proxy of DB proxy target group ${logicalId} still exists (${error instanceof Error ? error.name : "unknown error"}); keeping the skip`);
@@ -28211,10 +28230,13 @@ var RDSDBProxyTargetGroupProvider = class {
 		} while (marker);
 		return live;
 	}
-	wrapError(error, op, resourceType, logicalId, physicalId) {
-		const message = error instanceof Error ? error.message : String(error);
+	wrapError(error, op, resourceType, logicalId, physicalId, mask) {
 		const cause = error instanceof Error ? error : void 0;
-		return new ProvisioningError(`${op} failed for ${logicalId}: ${message}`, resourceType, logicalId, physicalId, cause);
+		const build = (text) => new ProvisioningError(`${op} failed for ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		this.logger.debug(mask(build(failure.detail).message));
+		return markRedactedCause(build(`${failure.summary}${relayedNameCollision(failure.detail)}`));
 	}
 };
 function withoutKey(bag, key) {
@@ -28297,8 +28319,6 @@ function instanceAttributes(instance) {
 function isDbIdentifier(id) {
 	return id.length <= 63 && /^[A-Za-z](?:-?[A-Za-z0-9])*$/.test(id);
 }
-const FINAL_SNAPSHOT_SETTLE_WAIT_MS = 9e5;
-const FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS = 6e4;
 var DocDBProvider = class {
 	docdbClient;
 	createClient;
@@ -28497,14 +28517,15 @@ var DocDBProvider = class {
 				if (!isDocDBNotFoundError(disableError, "DBClusterNotFoundFault")) this.logger.debug(maskerOrIdentity(context?.maskSecrets)(`Could not disable deletion protection for DocDB DBCluster ${logicalId}: ${describeAwsFailure(disableError).detail}`));
 			}
 			const finalSnapshotId = context?.finalSnapshotIdentifier;
-			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.waitForProtectionOffBeforeFinalSnapshot(logicalId, physicalId);
-			await this.getClient().send(new DeleteDBClusterCommand$1({
+			const sendDelete = () => this.getClient().send(new DeleteDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
 				...finalSnapshotId ? {
 					SkipFinalSnapshot: false,
 					FinalDBSnapshotIdentifier: finalSnapshotId
 				} : { SkipFinalSnapshot: true }
 			}));
+			if (finalSnapshotId && flip.flippedOffByThisRun && !flip.deleteAccepted) await this.deleteAfterProtectionFlip(logicalId, physicalId, sendDelete);
+			else await sendDelete();
 			flip.deleteAccepted = true;
 			if (finalSnapshotId) this.logger.info(`Deleting DocDB DBCluster ${logicalId} with a final snapshot (DeletionPolicy: Snapshot)`);
 			this.logger.debug(`Successfully initiated deletion of DocDB DBCluster ${logicalId}`);
@@ -28557,13 +28578,21 @@ var DocDBProvider = class {
 		this.logger.debug(`Updating DocDB DBInstance ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
-			await this.getClient().send(new ModifyDBInstanceCommand$1({
-				DBInstanceIdentifier: physicalId,
-				DBInstanceClass: properties["DBInstanceClass"],
-				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
-				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
-				ApplyImmediately: true
-			}));
+			await modifyDbInstanceWhenAvailable({
+				send: () => this.getClient().send(new ModifyDBInstanceCommand$1({
+					DBInstanceIdentifier: physicalId,
+					DBInstanceClass: properties["DBInstanceClass"],
+					PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
+					AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+					ApplyImmediately: true
+				})),
+				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
+				sleep: (ms) => this.sleep(ms),
+				logger: this.logger,
+				label: "DocDB DBInstance",
+				logicalId,
+				remainingMs: enclosingDeadlineRemainingMs()
+			});
 			this.logger.debug(`Successfully updated DocDB DBInstance ${logicalId}`);
 			const described = await this.describeDBInstance(physicalId);
 			if (described?.DBInstanceArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
@@ -28682,21 +28711,24 @@ var DocDBProvider = class {
 		}
 		throw new Error(`Timed out waiting for DocDB DBCluster ${logicalId} to apply its new VPC security groups`);
 	}
-	async waitForProtectionOffBeforeFinalSnapshot(logicalId, physicalId, maxWaitMs = FINAL_SNAPSHOT_SETTLE_WAIT_MS) {
-		const budgetMs = Math.min(maxWaitMs, enclosingDeadlineRemainingMs() - FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS);
-		if (budgetMs <= 0) throw new Error(`--remove-protection turned DeletionProtection off, but the resource timeout leaves no time to wait for the cluster to return to 'available', which the final snapshot its DeletionPolicy asks for needs. The delete was not sent and the guard is put back; re-run the destroy with a longer --resource-timeout`);
-		const startTime = Date.now();
-		let delay = 5e3;
-		for (;;) {
-			const current = await this.describeDBCluster(physicalId);
-			if (current === void 0) return;
-			if (current.DeletionProtection === false && current.Status !== "modifying") return;
-			if (Date.now() - startTime + delay >= budgetMs) break;
-			this.logger.debug(safeMsg`DocDB DBCluster ${logicalId}: waiting for the DeletionProtection change to settle before the final snapshot (status ${current.Status ?? "unknown"})`);
-			await this.sleep(delay);
-			delay = Math.min(delay * 2, 1e4);
-		}
-		throw new Error(`--remove-protection turned DeletionProtection off, but the cluster did not return to 'available' within ${Math.max(1, Math.round(budgetMs / 6e4))} minutes, and the final snapshot its DeletionPolicy asks for needs it. The delete was not sent and the guard is put back; re-run the destroy once the cluster is 'available'`);
+	async deleteAfterProtectionFlip(logicalId, physicalId, send) {
+		await deleteAfterProtectionFlipWithFinalSnapshot({
+			stateFault: "InvalidDBClusterStateFault",
+			send,
+			noun: "cluster",
+			label: "DocDB DBCluster",
+			logicalId,
+			read: async () => {
+				const current = await this.describeDBCluster(physicalId);
+				return current === void 0 ? void 0 : {
+					deletionProtection: current.DeletionProtection,
+					status: current.Status
+				};
+			},
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
 	}
 	async waitForClusterAvailable(dbClusterIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
@@ -40829,11 +40861,24 @@ const TOP_LEVEL_LEFT_IN_PLACE_PROPS = [
 	"FileSystemTypeVersion",
 	"NetworkType"
 ];
+const CFN_KEEPS_ON_REMOVAL = /* @__PURE__ */ new Set([
+	"FileSystemTypeVersion",
+	"LustreConfiguration.AutoImportPolicy",
+	"LustreConfiguration.DataCompressionType",
+	"LustreConfiguration.WeeklyMaintenanceStartTime",
+	"OpenZFSConfiguration.AutomaticBackupRetentionDays",
+	"OpenZFSConfiguration.CopyTagsToBackups",
+	"OpenZFSConfiguration.CopyTagsToVolumes",
+	"OpenZFSConfiguration.DailyAutomaticBackupStartTime",
+	"OpenZFSConfiguration.DiskIopsConfiguration",
+	"OpenZFSConfiguration.WeeklyMaintenanceStartTime"
+]);
 const leftInPlaceWarning$2 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
-	return caller === "rollback" ? safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; UpdateFileSystem keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} no longer declared; UpdateFileSystem keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
+	if (caller === "rollback") return safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} absent from the state being restored; UpdateFileSystem keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.`;
+	return names.every((name) => CFN_KEEPS_ON_REMOVAL.has(name)) ? safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} no longer declared and ${one ? "keeps its" : "keep their"} current AWS value, as CloudFormation leaves ${one ? "it" : "them"}; UpdateFileSystem keeps a setting it is not sent. Declare the intended value explicitly to change it.` : safeMsg`${logicalId} (AWS::FSx::FileSystem): ${subject} ${names.join(", ")} ${verb} no longer declared; UpdateFileSystem keeps a setting it is not sent and cdkd sends no reset, so the current AWS value stays in place. Declare the intended value explicitly to change it.`;
 };
 const toNumber$3 = (v) => v === void 0 ? void 0 : Number(v);
 const toBoolean$1 = (v) => {
@@ -47952,4 +47997,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-CDtquwkU.js.map
+//# sourceMappingURL=provider-classes-B52ogqNj.js.map