@go-to-k/cdkd 0.304.0 → 0.305.0

package/dist/{provider-classes-BFBQvibT.js → provider-classes-L1a3Wl0g.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients } from "./aws-clients-WQOzP1x4.js";
-import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-w5_iao51.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-BjIucCAN.js";
+import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-Durl920o.js";
+import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-OyoL9Woo.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-DDrfjG42.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-CGCxsMm1.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CfVIS2Wq.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-9kYr_0bT.js";
-import { RDSProvider } from "./rds-provider-A9nRiwdN.js";
-import { NeptuneProvider } from "./neptune-provider-DMyUUOlw.js";
-import { ASGProvider } from "./asg-provider-CpubivcT.js";
+import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-BdqMXegu.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-mYhK_-VN.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CUklr39z.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DfY7rzvu.js";
+import { RDSProvider } from "./rds-provider-CjasAFV5.js";
+import { NeptuneProvider } from "./neptune-provider-DvFVCaYo.js";
+import { ASGProvider } from "./asg-provider-C8HDzpYh.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -14774,13 +14774,18 @@ var SecretsManagerSecretProvider = class {
 					}));
 				}
 				if (newReplicas && newReplicas.length > 0) {
-					const oldRegionSet = new Set((oldReplicas || []).map((r) => r["Region"]));
-					const regionsToAdd = newReplicas.filter((r) => !oldRegionSet.has(r["Region"]));
+					const AWS_MANAGED_SECRETS_KEY = "alias/aws/secretsmanager";
+					const replicaKey = (k) => k === void 0 || k === "" || k === AWS_MANAGED_SECRETS_KEY ? AWS_MANAGED_SECRETS_KEY : JSON.stringify(k);
+					const oldKeyByRegion = new Map((oldReplicas || []).map((r) => [r["Region"], replicaKey(r["KmsKeyId"])]));
+					const regionsToAdd = newReplicas.filter((r) => {
+						const region = r["Region"];
+						return !oldKeyByRegion.has(region) || oldKeyByRegion.get(region) !== replicaKey(r["KmsKeyId"]);
+					});
 					if (regionsToAdd.length > 0) await this.smClient.send(new ReplicateSecretToRegionsCommand({
 						SecretId: physicalId,
 						AddReplicaRegions: regionsToAdd.map((r) => ({
 							Region: r["Region"],
-							KmsKeyId: r["KmsKeyId"]
+							KmsKeyId: r["KmsKeyId"] || void 0
 						}))
 					}));
 				}
@@ -14832,13 +14837,37 @@ var SecretsManagerSecretProvider = class {
 			warn: (message) => logger.warn(mask(message))
 		};
 	}
+	async replicaRegionsBlockingDelete(error, physicalId) {
+		const refusal = error;
+		if (refusal?.name !== "InvalidParameterException" || typeof refusal.message !== "string" || !/replica/i.test(refusal.message)) return;
+		const regions = ((await this.smClient.send(new DescribeSecretCommand({ SecretId: physicalId })).catch(() => void 0))?.ReplicationStatus ?? []).map((r) => r.Region).filter((r) => typeof r === "string" && r.length > 0);
+		return regions.length > 0 ? regions : void 0;
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting secret ${logicalId}: ${physicalId}`);
+		const deleteSecret = () => this.smClient.send(new DeleteSecretCommand({
+			SecretId: physicalId,
+			ForceDeleteWithoutRecovery: true
+		}));
+		let unremovedReplicaRegions;
 		try {
-			await this.smClient.send(new DeleteSecretCommand({
-				SecretId: physicalId,
-				ForceDeleteWithoutRecovery: true
-			}));
+			try {
+				await deleteSecret();
+			} catch (error) {
+				const regions = await this.replicaRegionsBlockingDelete(error, physicalId);
+				if (!regions) throw error;
+				try {
+					await this.smClient.send(new RemoveRegionsFromReplicationCommand({
+						SecretId: physicalId,
+						RemoveReplicaRegions: regions
+					}));
+				} catch (removeError) {
+					unremovedReplicaRegions = regions;
+					throw removeError;
+				}
+				this.logger.debug(safeMsg`Removed replica regions ${regions.join(", ")} from secret ${physicalId} before deleting it`);
+				await deleteSecret();
+			}
 			this.logger.debug(`Successfully deleted secret ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$3) {
@@ -14848,7 +14877,10 @@ var SecretsManagerSecretProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete secret ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+			const mask = maskerOrIdentity(context?.maskSecrets);
+			const regions = unremovedReplicaRegions?.join(" ");
+			const step = regions ? ` (removing its replica regions ${regions} first, which DeleteSecret requires). Remove them, then re-run destroy: aws secretsmanager remove-regions-from-replication --secret-id ${mask(physicalId)} --remove-replica-regions ${regions}` : "";
+			const thrown = this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to delete secret ${logicalId}: ${text}${step}`, resourceType, logicalId, physicalId, cause));
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
@@ -37850,6 +37882,8 @@ var KMSProvider = class {
 		const mask = context?.maskSecrets;
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const immutableChanged = changedImmutableKeyProperties(properties, previousProperties);
+		if (immutableChanged.length > 0 && !await this.liveKeyMatches(physicalId, properties, immutableChanged, logicalId)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, immutableKeySuggestion(immutableChanged));
 		const newEnabled = templateBool(properties["Enabled"]);
 		const enabledChange = newEnabled === templateBool(previousProperties["Enabled"]) ? void 0 : newEnabled === false ? "disable" : "enable";
 		try {
@@ -37895,7 +37929,8 @@ var KMSProvider = class {
 				await this.getClient().send(new PutKeyPolicyCommand({
 					KeyId: physicalId,
 					PolicyName: "default",
-					Policy: newPolicyStr
+					Policy: newPolicyStr,
+					...templateBool(properties["BypassPolicyLockoutSafetyCheck"]) === true && { BypassPolicyLockoutSafetyCheck: true }
 				}));
 			} else if (policyRemoved && newKeyPolicy === void 0) {
 				this.logger.debug(safeMsg`Resetting key policy for KMS Key ${logicalId} to the default`);
@@ -37916,6 +37951,20 @@ var KMSProvider = class {
 			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async liveKeyMatches(physicalId, properties, changed, logicalId) {
+		let md;
+		try {
+			md = (await this.getClient().send(new DescribeKeyCommand({ KeyId: physicalId }))).KeyMetadata;
+		} catch {
+			return false;
+		}
+		if (!md) return false;
+		const live = immutableKeyShape(md);
+		const desired = immutableKeyShape(properties);
+		const matches = changed.every((name) => isDeepStrictEqual(desired[name], live[name]));
+		if (matches) this.logger.debug(safeMsg`KMS Key ${logicalId}: the live key already holds the desired ${changed.join(", ")}; the record differed`);
+		return matches;
+	}
 	async sendRotation(send, justEnabled, resourceType, logicalId, physicalId) {
 		try {
 			await send();
@@ -38146,6 +38195,23 @@ var KMSProvider = class {
 		return null;
 	}
 };
+function immutableKeyShape(properties) {
+	return {
+		KeySpec: properties["KeySpec"] ?? "SYMMETRIC_DEFAULT",
+		KeyUsage: properties["KeyUsage"] ?? "ENCRYPT_DECRYPT",
+		MultiRegion: templateBool(properties["MultiRegion"]) === true,
+		Origin: properties["Origin"] ?? "AWS_KMS"
+	};
+}
+function changedImmutableKeyProperties(properties, previousProperties) {
+	const desired = immutableKeyShape(properties);
+	const previous = immutableKeyShape(previousProperties);
+	return Object.keys(desired).filter((name) => !isDeepStrictEqual(desired[name], previous[name]));
+}
+function immutableKeySuggestion(changed) {
+	const one = changed.length === 1;
+	return `${changed.join(", ")} changed, and KMS fixes ${one ? "it" : "them"} when the key is created (CloudFormation fails this update too). To keep the key, restore the previous ${one ? "value" : "values"}. To replace it, re-deploy with --replace, plus --force-stateful-recreation unless the key's UpdateReplacePolicy is Retain; without Retain the old key is scheduled for deletion, and data encrypted under it cannot be decrypted once that deletion completes`;
+}
 function templateBool(value) {
 	if (value === void 0 || value === null) return void 0;
 	if (typeof value === "string") return value.toLowerCase() === "true";
@@ -46752,8 +46818,7 @@ var S3VectorsProvider = class {
 	async createVectorBucket(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 VectorBucket ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const vectorBucketName = properties["VectorBucketName"];
-		if (!vectorBucketName) throw new ProvisioningError(`VectorBucketName is required for S3 VectorBucket ${logicalId}`, resourceType, logicalId);
+		const vectorBucketName = properties["VectorBucketName"] || generatedNameFor("AWS::S3Vectors::VectorBucket", logicalId);
 		const encryptionConfiguration = properties["EncryptionConfiguration"];
 		const tagRecord = Object.fromEntries(desiredTags.map((t) => [t.Key, t.Value]));
 		const tags = Object.keys(tagRecord).length > 0 ? tagRecord : void 0;
@@ -46983,7 +47048,7 @@ var S3DirectoryBucketProvider = class {
 					},
 					Location: {
 						Name: azId,
-						Type: "AvailabilityZone"
+						Type: dataRedundancy === "SingleLocalZone" ? "LocalZone" : "AvailabilityZone"
 					},
 					...includeTags ? { Tags: tags } : {}
 				}
@@ -47097,15 +47162,16 @@ var S3DirectoryBucketProvider = class {
 		} while (continuationToken);
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let locationType;
 		try {
-			await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId }));
+			locationType = (await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId })))?.BucketLocationType;
 		} catch (err) {
 			const e = err;
 			if (e.name === "NotFound" || e.name === "NoSuchBucket" || e.name === "BucketNotFound") return RESOURCE_NOT_FOUND;
 			throw err;
 		}
 		const result = { BucketName: physicalId };
-		if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = "SingleAvailabilityZone";
+		if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = locationType === "LocalZone" ? "SingleLocalZone" : "SingleAvailabilityZone";
 		result["Tags"] = await this.readTags(physicalId);
 		return result;
 	}
@@ -48952,4 +49018,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-BFBQvibT.js.map
+//# sourceMappingURL=provider-classes-L1a3Wl0g.js.map