@go-to-k/cdkd 0.303.3 → 0.304.1

package/dist/{provider-classes-MEnHTWQs.js → provider-classes-Rf-SVs3I.js}

@@ -1,17 +1,17 @@
-import { r as getAwsClients } from "./aws-clients-BJ7dmM_T.js";
-import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-w5_iao51.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-NZn9Idzv.js";
+import { r as getAwsClients } from "./aws-clients-WQOzP1x4.js";
+import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-Durl920o.js";
+import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-OyoL9Woo.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-hkkKHd7Q.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DWNqJC8n.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-6n7mQJ_G.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-f79-MmD9.js";
-import { RDSProvider } from "./rds-provider-D85k2Kx_.js";
-import { NeptuneProvider } from "./neptune-provider-CrzS-Bb7.js";
-import { ASGProvider } from "./asg-provider-C78Etom_.js";
+import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-Dwe6OnF_.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-bQvjvq2x.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DuL51vnF.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DfY7rzvu.js";
+import { RDSProvider } from "./rds-provider-p_5gnXcp.js";
+import { NeptuneProvider } from "./neptune-provider-CIAyTNad.js";
+import { ASGProvider } from "./asg-provider-BKJrVAH4.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
-import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
+import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -28,12 +28,12 @@ import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, De
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$6, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$7, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-elasticache";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import { CreateWebFunctionEndpointCommand, CreateWebFunctionRevisionCommand, DeleteWebFunctionEndpointCommand, DeleteWebFunctionRevisionCommand, GetWebFunctionEndpointCommand, GetWebFunctionRevisionCommand, LambdaWebClient, ListWebFunctionRevisionsCommand, ResourceNotFoundException as ResourceNotFoundException$9, UpdateWebFunctionEndpointCommand } from "@aws-sdk/client-lambda-web";
 import { CreateNetworkConnectorCommand, DeleteNetworkConnectorCommand, GetNetworkConnectorCommand, LambdaCoreClient, ResourceNotFoundException as ResourceNotFoundException$10, UpdateNetworkConnectorCommand } from "@aws-sdk/client-lambda-core";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, DisabledException, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
@@ -1836,6 +1836,9 @@ async function readPrincipalSides(opts) {
 const DEPLOY_SKIP_CAVEAT$2 = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, remove the memberships by hand.";
 const USER_NAME_MAX_LENGTH = 64;
 const GROUP_NAME_MAX_LENGTH = 128;
+function iamPathOf(value) {
+	return value || "/";
+}
 function derivedNamePairs(resourceType, logicalId, properties) {
 	const spec = resourceType === "AWS::IAM::User" ? {
 		key: "UserName",
@@ -2037,6 +2040,14 @@ var IAMUserGroupProvider = class {
 		});
 		if (groups.unmatchedKinds.length > 0) log.warn(`The recorded Groups of IAM user ${logicalId} is secret-derived, and IAM lists memberships the template does not name: cdkd removes the user from none of them, since IAM's list includes memberships made elsewhere. Remove the user by hand from any that this list used to name.`);
 		try {
+			const newPath = iamPathOf(properties["Path"]);
+			if (newPath !== iamPathOf(previousProperties["Path"])) {
+				await this.iamClient.send(new UpdateUserCommand({
+					UserName: physicalId,
+					NewPath: newPath
+				}));
+				log.debug(`Moved user ${v(physicalId)} to path ${v(newPath)}`);
+			}
 			await this.applyUserTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
 			const newPermBoundary = properties["PermissionsBoundary"];
 			const oldPermBoundary = previousProperties["PermissionsBoundary"];
@@ -2375,6 +2386,14 @@ var IAMUserGroupProvider = class {
 		const { value: v } = log;
 		log.debug(`Updating IAM group ${logicalId}: ${v(physicalId)}`);
 		try {
+			const newPath = iamPathOf(properties["Path"]);
+			if (newPath !== iamPathOf(previousProperties["Path"])) {
+				await this.iamClient.send(new UpdateGroupCommand({
+					GroupName: physicalId,
+					NewPath: newPath
+				}));
+				log.debug(`Moved group ${v(physicalId)} to path ${v(newPath)}`);
+			}
 			await this.updateGroupManagedPolicies(physicalId, properties["ManagedPolicyArns"], previousProperties["ManagedPolicyArns"], log);
 			await this.updateGroupInlinePolicies(physicalId, properties["Policies"], previousProperties["Policies"], log, claimed);
 			const getGroupResponse = await this.iamClient.send(new GetGroupCommand({ GroupName: physicalId }));
@@ -11230,7 +11249,7 @@ var LambdaNetworkConnectorProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(safeMsg`Creating Lambda network connector ${logicalId}`);
-		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const tagList = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const name = typeof properties["Name"] === "string" && properties["Name"] !== "" ? properties["Name"] : generatedNameFor("AWS::Lambda::NetworkConnector", logicalId);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, void 0);
 		const createToken = acquireIdempotencyToken({
@@ -11269,7 +11288,7 @@ var LambdaNetworkConnectorProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		assertRegionMatch(context?.expectedRegion ? await this.client.config.region() : void 0, context?.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
-		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const vpc = this.readVpcEgress(properties, logicalId, resourceType, physicalId);
 		const updateRole = this.readOperatorRole(properties, logicalId, resourceType, physicalId, context);
 		if (typeof previousProperties["OperatorRole"] === "string" && properties["OperatorRole"] === void 0 && context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`OperatorRole cannot be removed in place for Lambda network connector ${logicalIdShown(logicalId)}: cdkd sends no role when the template declares none, so the current one would stay attached. Set it to another role, or replace the connector (change its Name).`, resourceType, logicalId, physicalId);
@@ -11407,7 +11426,7 @@ var LambdaNetworkConnectorProvider = class {
 		throw new ProvisioningError(message, resourceType, logicalId, physicalId);
 	}
 	async reconcileTags(physicalId, resourceType, logicalId, newTags, oldTags) {
-		const plan = planTagDiff(oldTags, newTags);
+		const plan = planTagDiff(oldTags, newTags, DBPROXY_TAG_OPTIONS);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
 		if (plan.remove.length > 0) await this.lambda.send(new UntagResourceCommand$1({
@@ -14755,13 +14774,18 @@ var SecretsManagerSecretProvider = class {
 					}));
 				}
 				if (newReplicas && newReplicas.length > 0) {
-					const oldRegionSet = new Set((oldReplicas || []).map((r) => r["Region"]));
-					const regionsToAdd = newReplicas.filter((r) => !oldRegionSet.has(r["Region"]));
+					const AWS_MANAGED_SECRETS_KEY = "alias/aws/secretsmanager";
+					const replicaKey = (k) => k === void 0 || k === "" || k === AWS_MANAGED_SECRETS_KEY ? AWS_MANAGED_SECRETS_KEY : JSON.stringify(k);
+					const oldKeyByRegion = new Map((oldReplicas || []).map((r) => [r["Region"], replicaKey(r["KmsKeyId"])]));
+					const regionsToAdd = newReplicas.filter((r) => {
+						const region = r["Region"];
+						return !oldKeyByRegion.has(region) || oldKeyByRegion.get(region) !== replicaKey(r["KmsKeyId"]);
+					});
 					if (regionsToAdd.length > 0) await this.smClient.send(new ReplicateSecretToRegionsCommand({
 						SecretId: physicalId,
 						AddReplicaRegions: regionsToAdd.map((r) => ({
 							Region: r["Region"],
-							KmsKeyId: r["KmsKeyId"]
+							KmsKeyId: r["KmsKeyId"] || void 0
 						}))
 					}));
 				}
@@ -14813,13 +14837,37 @@ var SecretsManagerSecretProvider = class {
 			warn: (message) => logger.warn(mask(message))
 		};
 	}
+	async replicaRegionsBlockingDelete(error, physicalId) {
+		const refusal = error;
+		if (refusal?.name !== "InvalidParameterException" || typeof refusal.message !== "string" || !/replica/i.test(refusal.message)) return;
+		const regions = ((await this.smClient.send(new DescribeSecretCommand({ SecretId: physicalId })).catch(() => void 0))?.ReplicationStatus ?? []).map((r) => r.Region).filter((r) => typeof r === "string" && r.length > 0);
+		return regions.length > 0 ? regions : void 0;
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting secret ${logicalId}: ${physicalId}`);
+		const deleteSecret = () => this.smClient.send(new DeleteSecretCommand({
+			SecretId: physicalId,
+			ForceDeleteWithoutRecovery: true
+		}));
+		let unremovedReplicaRegions;
 		try {
-			await this.smClient.send(new DeleteSecretCommand({
-				SecretId: physicalId,
-				ForceDeleteWithoutRecovery: true
-			}));
+			try {
+				await deleteSecret();
+			} catch (error) {
+				const regions = await this.replicaRegionsBlockingDelete(error, physicalId);
+				if (!regions) throw error;
+				try {
+					await this.smClient.send(new RemoveRegionsFromReplicationCommand({
+						SecretId: physicalId,
+						RemoveReplicaRegions: regions
+					}));
+				} catch (removeError) {
+					unremovedReplicaRegions = regions;
+					throw removeError;
+				}
+				this.logger.debug(safeMsg`Removed replica regions ${regions.join(", ")} from secret ${physicalId} before deleting it`);
+				await deleteSecret();
+			}
 			this.logger.debug(`Successfully deleted secret ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$3) {
@@ -14829,7 +14877,10 @@ var SecretsManagerSecretProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete secret ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const mask = maskerOrIdentity(context?.maskSecrets);
+			const regions = unremovedReplicaRegions?.join(" ");
+			const step = regions ? ` (removing its replica regions ${regions} first, which DeleteSecret requires). Remove them, then re-run destroy: aws secretsmanager remove-regions-from-replication --secret-id ${mask(physicalId)} --remove-replica-regions ${regions}` : "";
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to delete secret ${logicalId}: ${text}${step}`, resourceType, logicalId, physicalId, cause));
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
@@ -46733,8 +46784,7 @@ var S3VectorsProvider = class {
 	async createVectorBucket(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 VectorBucket ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const vectorBucketName = properties["VectorBucketName"];
-		if (!vectorBucketName) throw new ProvisioningError(`VectorBucketName is required for S3 VectorBucket ${logicalId}`, resourceType, logicalId);
+		const vectorBucketName = properties["VectorBucketName"] || generatedNameFor("AWS::S3Vectors::VectorBucket", logicalId);
 		const encryptionConfiguration = properties["EncryptionConfiguration"];
 		const tagRecord = Object.fromEntries(desiredTags.map((t) => [t.Key, t.Value]));
 		const tags = Object.keys(tagRecord).length > 0 ? tagRecord : void 0;
@@ -48549,6 +48599,18 @@ function isCertificateInUseError(error) {
 	const message = describeAwsFailure(error).detail;
 	return /ResourceInUseException|in use/i.test(message);
 }
+const VALIDATION_RECORD_TTL = 300;
+function dnsValidationZones(properties) {
+	const zones = /* @__PURE__ */ new Map();
+	const options = properties["DomainValidationOptions"];
+	if (properties["ValidationMethod"] !== "DNS" || !Array.isArray(options)) return zones;
+	for (const option of options) {
+		const domain = option["DomainName"];
+		const zone = option["HostedZoneId"];
+		if (typeof domain === "string" && domain && typeof zone === "string" && zone) zones.set(domain, zone);
+	}
+	return zones;
+}
 var ACMCertificateProvider = class {
 	acmClient;
 	logger = getLogger().child("ACMCertificateProvider");
@@ -48594,11 +48656,13 @@ var ACMCertificateProvider = class {
 		const input = { DomainName: domainName };
 		if (properties["ValidationMethod"]) input["ValidationMethod"] = properties["ValidationMethod"];
 		if (Array.isArray(properties["SubjectAlternativeNames"])) input["SubjectAlternativeNames"] = properties["SubjectAlternativeNames"];
-		if (Array.isArray(properties["DomainValidationOptions"])) input["DomainValidationOptions"] = properties["DomainValidationOptions"].map((opt) => {
-			const cleaned = { DomainName: opt["DomainName"] };
-			if (opt["ValidationDomain"]) cleaned["ValidationDomain"] = opt["ValidationDomain"];
-			return cleaned;
-		}).filter((opt) => opt["DomainName"]);
+		if (Array.isArray(properties["DomainValidationOptions"])) {
+			const options = properties["DomainValidationOptions"].filter((opt) => opt["DomainName"] && opt["ValidationDomain"]).map((opt) => ({
+				DomainName: opt["DomainName"],
+				ValidationDomain: opt["ValidationDomain"]
+			}));
+			if (options.length > 0) input["DomainValidationOptions"] = options;
+		}
 		if (properties["CertificateAuthorityArn"]) input["CertificateAuthorityArn"] = properties["CertificateAuthorityArn"];
 		if (properties["KeyAlgorithm"]) input["KeyAlgorithm"] = properties["KeyAlgorithm"];
 		const options = {};
@@ -48619,7 +48683,7 @@ var ACMCertificateProvider = class {
 			if (!certificateArn) throw new ProvisioningError(`RequestCertificate succeeded but no CertificateArn returned for ${logicalId}`, resourceType, logicalId);
 			requestedArn = certificateArn;
 			this.logger.debug(`Requested ACM certificate: ${certificateArn}`);
-			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId, resourceType);
+			if (!(process.env["CDKD_NO_WAIT"] === "true")) await this.waitForCertificateIssued(certificateArn, logicalId, resourceType, dnsValidationZones(properties));
 			else this.logger.warn(`Skipping wait for ACM certificate ${logicalId} (CDKD_NO_WAIT=true). Downstream consumers (CloudFront / ALB) will fail until the cert reaches ISSUED.`);
 			idempotencyToken.release();
 			return {
@@ -48820,8 +48884,9 @@ var ACMCertificateProvider = class {
 		}
 		return null;
 	}
-	async waitForCertificateIssued(certificateArn, logicalId, resourceType) {
+	async waitForCertificateIssued(certificateArn, logicalId, resourceType, zones = /* @__PURE__ */ new Map()) {
 		this.logger.debug(`Waiting for ACM certificate ${certificateArn} to reach ISSUED status...`);
+		const written = /* @__PURE__ */ new Map();
 		let interrupted = false;
 		let lastValidationOptions;
 		const sigintHandler = () => {
@@ -48843,7 +48908,8 @@ var ACMCertificateProvider = class {
 				}
 				if (status === "FAILED" || status === "VALIDATION_TIMED_OUT" || status === "INACTIVE" || status === "REVOKED" || status === "EXPIRED") throw new ProvisioningError(`ACM certificate ${logicalIdShown(logicalId)} ${isPlainImportValue(certificateArn) ? `(${certificateArn})` : VALUE_NOT_SHOWN} entered terminal status ${status} during validation. Check ACM console / DNS records to diagnose.`, resourceType, logicalId, certificateArn);
 				if (status === "PENDING_VALIDATION") {
-					const rendered = this.renderValidationOptions(validations);
+					await this.writeValidationRecords(validations, zones, written, certificateArn, logicalId, resourceType);
+					const rendered = this.renderValidationOptions(validations.filter((v) => !(v.DomainName && zones.has(v.DomainName))));
 					if (rendered !== void 0 && rendered !== lastValidationOptions) {
 						this.logger.info(rendered);
 						lastValidationOptions = rendered;
@@ -48859,6 +48925,34 @@ var ACMCertificateProvider = class {
 			process.removeListener("SIGINT", sigintHandler);
 		}
 	}
+	async writeValidationRecords(validations, zones, written, certificateArn, logicalId, resourceType) {
+		for (const validation of validations) {
+			const zone = validation.DomainName ? zones.get(validation.DomainName) : void 0;
+			const record = validation.ResourceRecord;
+			if (!zone || !record?.Name || !record.Value) continue;
+			if (written.get(zone)?.has(record.Name)) continue;
+			try {
+				await getAwsClients().route53.send(new ChangeResourceRecordSetsCommand({
+					HostedZoneId: zone,
+					ChangeBatch: { Changes: [{
+						Action: "UPSERT",
+						ResourceRecordSet: {
+							Name: record.Name,
+							Type: "CNAME",
+							TTL: VALIDATION_RECORD_TTL,
+							ResourceRecords: [{ Value: record.Value }]
+						}
+					}] }
+				}));
+			} catch (error) {
+				throw new ProvisioningError(safeMsg`ACM certificate ${displayIdent(logicalId)} could not get its DNS validation record ${displayIdent(record.Name)} written to hosted zone ${displayIdent(zone)}: ${describeAwsFailure(error).summary}. The caller needs route53:ChangeResourceRecordSets on that zone.`, resourceType, logicalId, certificateArn, error instanceof Error ? error : void 0);
+			}
+			const inZone = written.get(zone) ?? /* @__PURE__ */ new Set();
+			inZone.add(record.Name);
+			written.set(zone, inZone);
+			this.logger.info(safeMsg`Wrote DNS validation record ${displayIdent(record.Name)} to hosted zone ${displayIdent(zone)} for ${displayIdent(validation.DomainName)}`);
+		}
+	}
 	renderValidationOptions(validations) {
 		const lines = ["ACM certificate is PENDING_VALIDATION. Add the following DNS records to validate:"];
 		for (const v of validations) if (v.ValidationMethod === "DNS" && v.ResourceRecord) {
@@ -48889,4 +48983,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-MEnHTWQs.js.map
+//# sourceMappingURL=provider-classes-Rf-SVs3I.js.map