@go-to-k/cdkd 0.304.1 → 0.305.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{asg-provider-BKJrVAH4.js → asg-provider-C8HDzpYh.js} +2 -2
- package/dist/{asg-provider-BKJrVAH4.js.map → asg-provider-C8HDzpYh.js.map} +1 -1
- package/dist/cli.js +2 -2
- package/dist/{deploy-engine-Dwe6OnF_.js → deploy-engine-BdqMXegu.js} +4 -4
- package/dist/{deploy-engine-Dwe6OnF_.js.map → deploy-engine-BdqMXegu.js.map} +1 -1
- package/dist/{iam-role-provider-bQvjvq2x.js → iam-role-provider-mYhK_-VN.js} +2 -2
- package/dist/{iam-role-provider-bQvjvq2x.js.map → iam-role-provider-mYhK_-VN.js.map} +1 -1
- package/dist/index.js +2 -2
- package/dist/{neptune-provider-CIAyTNad.js → neptune-provider-DvFVCaYo.js} +2 -2
- package/dist/{neptune-provider-CIAyTNad.js.map → neptune-provider-DvFVCaYo.js.map} +1 -1
- package/dist/{program-DuL51vnF.js → program-CUklr39z.js} +20 -5
- package/dist/program-CUklr39z.js.map +1 -0
- package/dist/{provider-classes-Rf-SVs3I.js → provider-classes-L1a3Wl0g.js} +46 -11
- package/dist/{provider-classes-Rf-SVs3I.js.map → provider-classes-L1a3Wl0g.js.map} +1 -1
- package/dist/{rds-provider-p_5gnXcp.js → rds-provider-CjasAFV5.js} +2 -2
- package/dist/{rds-provider-p_5gnXcp.js.map → rds-provider-CjasAFV5.js.map} +1 -1
- package/dist/{version-EpZTW7nR.js → version-Cp2r-ot9.js} +2 -2
- package/dist/{version-EpZTW7nR.js.map → version-Cp2r-ot9.js.map} +1 -1
- package/package.json +2 -2
- package/dist/program-DuL51vnF.js.map +0 -1
|
@@ -2,13 +2,13 @@ import { r as getAwsClients } from "./aws-clients-WQOzP1x4.js";
|
|
|
2
2
|
import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-Durl920o.js";
|
|
3
3
|
import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, dt as startInterruptWatch, ft as ElapsedBudgetRegistry, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, ut as isInterruptedWaitError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-OyoL9Woo.js";
|
|
4
4
|
import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
|
|
5
|
-
import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-
|
|
6
|
-
import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-
|
|
7
|
-
import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-
|
|
5
|
+
import { $r as markDeleteStarted, Aa as parseWebACLArn, Ai as deleteSkipReason, Ba as accountArgs, C as hasCdkAutoDeleteTag, Ds as sameLambdaFunctionAddress, Dt as lookupEachName, E as markRefusedBeforeApplying, Es as lambdaFunctionNameForMask, Et as isAccessDeniedError, F as findNestedTemplateTreeDefect, Fi as ec2InstanceProtectionSite, Fo as refuseMalformedResourcesForDestroy, Fu as resolveAssemblyPath, Gi as s3BucketArn, Gs as markSameGenerationBag, I as isAbsoluteAssetPath, Ii as isTerminationProtectionPropagationError, Ji as s3BucketRegionalDomainName, Jr as acquireIdempotencyToken, Js as snapshotPassProvenance, Ki as s3BucketDomainName, Kr as reserveStackCreateToken, Ks as redactForState, L as listNestedTemplateRows, Li as observeThenDisableInstanceApiTermination, Mi as isWaitAbandonedError, Mu as describeFileReadFailure, Na as passedParameterClassesOf, Ni as markWaitAbandoned, Nu as displayAssemblyPath, Ot as withApiLimit, Pu as renderAssemblyPathEscape, Qn as awaitInFlightSibling, Qr as isRefusedByName, R as renderNestedTemplateTreeDefect, Ri as reDisableInstanceApiTermination, S as S3_AUTO_DELETE_OBJECTS_TAG, T as getPriorAttempts, Ti as unchangedBehindSecretReference, Ts as canonicalLambdaFunctionName, Tt as chunks, W as enclosingDeadlineRemainingMs, Wi as isSettledInstanceState, Wr as earliestDefined, Yi as s3BucketWebsiteUrl, Yo as findSilentDropProperties, Zo as withoutSilentDropProperties, Zs as hasMaskableValues, _ as deleteTableWithIndexBusyRetry, _s as replayWarn, ai as tagMapAsList, an as isRedactedRecordedValue, b as waitForIndexesSettled, ba as getAccountInfo, bc as physicalNameCopiesOf, bs as requireConfigString, c as DynamoDBGlobalTableProvider, ci as stringifyIfAssigned, cl as timePhase, cs as isWarmThroughputDecrease, d as compensateRemovedDeletionProtection, dc as withoutPhysicalNameCopies, dl as stringifyValue, ds as coerceCfnBoolean, ea as outputReferenceProvenanceOf, ei as DBPROXY_TAGS_WHAT, er as getStackRecords, f as deleteBudgetKey, fs as coerceCfnInteger, g as INDEX_SETTLE_POLL_INTERVAL_MS, gl as rewriteTemplateAssetReferences, gs as readConfigString, h as DELETE_INDEX_WAIT_PROCEED_NOTE, ho as refuseMalformedNestedChildOutputs, hs as configStringRefusal, ht as withNestedStackContext, hu as decodeListingKey, ii as refuseMalformedDesiredTags, in as REDACTED_DELETE_ADDRESS_SKIP_REASON, ji as withIndeterminateGuard, jr as secretNamedAttributeNamesOf, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ls as toCfnInteger, m as resolveDynamoDbDeleteBudgetMs, mi as waitForLambdaFunctionActive, ms as configIntegerRefusal, mt as getCurrentNestedStackContext, ni as planTagDiff, nn as getCurrentProducerRegions, nr as replacedDeleteFailureVerdict, oi as tagPlanWarning, on as redactedDeleteAddressFields, os as WARM_THROUGHPUT_MEMBERS, p as resolveDynamoDbDeleteBudgetClock, pc as dynamicReferenceTokens, ps as configBooleanRefusal, qi as s3BucketDualStackDomainName, qo as withheldAccountClause, qs as recordReferenceProvenanceEntry, ri as readTagList, si as definedAttributes, sn as redactedDeleteAddressSkip, ss as coerceWarmThroughput$1, st as getNestedRevertRun, t as DeployEngine, ti as DBPROXY_TAG_OPTIONS, u as beginDeleteWait, us as toFiniteNumber, ut as revertNestedChildFromJournal, v as maskedLogger, vi as getCurrentResourceSecrets, vs as requireConfigArray, vu as canonicalizeRegion, w as isTruthyCfnBoolean, wc as carriesSecretMask, wi as slowCcOperationTimeoutMs, ws as withRetry, x as ECR_AUTO_DELETE_IMAGES_TAG, xc as recordAttributeIdCopy, y as relayedIndexBusyDelete, yc as recoverMaskedOutput, ys as requireConfigObject, yu as derivePartitionAndUrlSuffix, zi as reEnableInstanceApiTermination, zs as passedNoEchoParametersOf } from "./deploy-engine-BdqMXegu.js";
|
|
6
|
+
import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-mYhK_-VN.js";
|
|
7
|
+
import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CUklr39z.js";
|
|
8
8
|
import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DfY7rzvu.js";
|
|
9
|
-
import { RDSProvider } from "./rds-provider-
|
|
10
|
-
import { NeptuneProvider } from "./neptune-provider-
|
|
11
|
-
import { ASGProvider } from "./asg-provider-
|
|
9
|
+
import { RDSProvider } from "./rds-provider-CjasAFV5.js";
|
|
10
|
+
import { NeptuneProvider } from "./neptune-provider-DvFVCaYo.js";
|
|
11
|
+
import { ASGProvider } from "./asg-provider-C8HDzpYh.js";
|
|
12
12
|
import { createHash, randomUUID } from "node:crypto";
|
|
13
13
|
import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
|
|
14
14
|
import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
|
|
@@ -37882,6 +37882,8 @@ var KMSProvider = class {
|
|
|
37882
37882
|
const mask = context?.maskSecrets;
|
|
37883
37883
|
properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
|
|
37884
37884
|
refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
|
|
37885
|
+
const immutableChanged = changedImmutableKeyProperties(properties, previousProperties);
|
|
37886
|
+
if (immutableChanged.length > 0 && !await this.liveKeyMatches(physicalId, properties, immutableChanged, logicalId)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, immutableKeySuggestion(immutableChanged));
|
|
37885
37887
|
const newEnabled = templateBool(properties["Enabled"]);
|
|
37886
37888
|
const enabledChange = newEnabled === templateBool(previousProperties["Enabled"]) ? void 0 : newEnabled === false ? "disable" : "enable";
|
|
37887
37889
|
try {
|
|
@@ -37927,7 +37929,8 @@ var KMSProvider = class {
|
|
|
37927
37929
|
await this.getClient().send(new PutKeyPolicyCommand({
|
|
37928
37930
|
KeyId: physicalId,
|
|
37929
37931
|
PolicyName: "default",
|
|
37930
|
-
Policy: newPolicyStr
|
|
37932
|
+
Policy: newPolicyStr,
|
|
37933
|
+
...templateBool(properties["BypassPolicyLockoutSafetyCheck"]) === true && { BypassPolicyLockoutSafetyCheck: true }
|
|
37931
37934
|
}));
|
|
37932
37935
|
} else if (policyRemoved && newKeyPolicy === void 0) {
|
|
37933
37936
|
this.logger.debug(safeMsg`Resetting key policy for KMS Key ${logicalId} to the default`);
|
|
@@ -37948,6 +37951,20 @@ var KMSProvider = class {
|
|
|
37948
37951
|
throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to update KMS Key ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
|
|
37949
37952
|
}
|
|
37950
37953
|
}
|
|
37954
|
+
async liveKeyMatches(physicalId, properties, changed, logicalId) {
|
|
37955
|
+
let md;
|
|
37956
|
+
try {
|
|
37957
|
+
md = (await this.getClient().send(new DescribeKeyCommand({ KeyId: physicalId }))).KeyMetadata;
|
|
37958
|
+
} catch {
|
|
37959
|
+
return false;
|
|
37960
|
+
}
|
|
37961
|
+
if (!md) return false;
|
|
37962
|
+
const live = immutableKeyShape(md);
|
|
37963
|
+
const desired = immutableKeyShape(properties);
|
|
37964
|
+
const matches = changed.every((name) => isDeepStrictEqual(desired[name], live[name]));
|
|
37965
|
+
if (matches) this.logger.debug(safeMsg`KMS Key ${logicalId}: the live key already holds the desired ${changed.join(", ")}; the record differed`);
|
|
37966
|
+
return matches;
|
|
37967
|
+
}
|
|
37951
37968
|
async sendRotation(send, justEnabled, resourceType, logicalId, physicalId) {
|
|
37952
37969
|
try {
|
|
37953
37970
|
await send();
|
|
@@ -38178,6 +38195,23 @@ var KMSProvider = class {
|
|
|
38178
38195
|
return null;
|
|
38179
38196
|
}
|
|
38180
38197
|
};
|
|
38198
|
+
function immutableKeyShape(properties) {
|
|
38199
|
+
return {
|
|
38200
|
+
KeySpec: properties["KeySpec"] ?? "SYMMETRIC_DEFAULT",
|
|
38201
|
+
KeyUsage: properties["KeyUsage"] ?? "ENCRYPT_DECRYPT",
|
|
38202
|
+
MultiRegion: templateBool(properties["MultiRegion"]) === true,
|
|
38203
|
+
Origin: properties["Origin"] ?? "AWS_KMS"
|
|
38204
|
+
};
|
|
38205
|
+
}
|
|
38206
|
+
function changedImmutableKeyProperties(properties, previousProperties) {
|
|
38207
|
+
const desired = immutableKeyShape(properties);
|
|
38208
|
+
const previous = immutableKeyShape(previousProperties);
|
|
38209
|
+
return Object.keys(desired).filter((name) => !isDeepStrictEqual(desired[name], previous[name]));
|
|
38210
|
+
}
|
|
38211
|
+
function immutableKeySuggestion(changed) {
|
|
38212
|
+
const one = changed.length === 1;
|
|
38213
|
+
return `${changed.join(", ")} changed, and KMS fixes ${one ? "it" : "them"} when the key is created (CloudFormation fails this update too). To keep the key, restore the previous ${one ? "value" : "values"}. To replace it, re-deploy with --replace, plus --force-stateful-recreation unless the key's UpdateReplacePolicy is Retain; without Retain the old key is scheduled for deletion, and data encrypted under it cannot be decrypted once that deletion completes`;
|
|
38214
|
+
}
|
|
38181
38215
|
function templateBool(value) {
|
|
38182
38216
|
if (value === void 0 || value === null) return void 0;
|
|
38183
38217
|
if (typeof value === "string") return value.toLowerCase() === "true";
|
|
@@ -47014,7 +47048,7 @@ var S3DirectoryBucketProvider = class {
|
|
|
47014
47048
|
},
|
|
47015
47049
|
Location: {
|
|
47016
47050
|
Name: azId,
|
|
47017
|
-
Type: "AvailabilityZone"
|
|
47051
|
+
Type: dataRedundancy === "SingleLocalZone" ? "LocalZone" : "AvailabilityZone"
|
|
47018
47052
|
},
|
|
47019
47053
|
...includeTags ? { Tags: tags } : {}
|
|
47020
47054
|
}
|
|
@@ -47128,15 +47162,16 @@ var S3DirectoryBucketProvider = class {
|
|
|
47128
47162
|
} while (continuationToken);
|
|
47129
47163
|
}
|
|
47130
47164
|
async readCurrentState(physicalId, _logicalId, _resourceType) {
|
|
47165
|
+
let locationType;
|
|
47131
47166
|
try {
|
|
47132
|
-
await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId }));
|
|
47167
|
+
locationType = (await this.s3Client.send(new HeadBucketCommand({ Bucket: physicalId })))?.BucketLocationType;
|
|
47133
47168
|
} catch (err) {
|
|
47134
47169
|
const e = err;
|
|
47135
47170
|
if (e.name === "NotFound" || e.name === "NoSuchBucket" || e.name === "BucketNotFound") return RESOURCE_NOT_FOUND;
|
|
47136
47171
|
throw err;
|
|
47137
47172
|
}
|
|
47138
47173
|
const result = { BucketName: physicalId };
|
|
47139
|
-
if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = "SingleAvailabilityZone";
|
|
47174
|
+
if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = locationType === "LocalZone" ? "SingleLocalZone" : "SingleAvailabilityZone";
|
|
47140
47175
|
result["Tags"] = await this.readTags(physicalId);
|
|
47141
47176
|
return result;
|
|
47142
47177
|
}
|
|
@@ -48983,4 +49018,4 @@ var ACMCertificateProvider = class {
|
|
|
48983
49018
|
|
|
48984
49019
|
//#endregion
|
|
48985
49020
|
export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
|
|
48986
|
-
//# sourceMappingURL=provider-classes-
|
|
49021
|
+
//# sourceMappingURL=provider-classes-L1a3Wl0g.js.map
|