@go-to-k/cdkd 0.308.0 → 0.309.0

package/dist/{provider-classes-d9K3vBVh.js → provider-classes-DYke4HKr.js}

@@ -1,14 +1,14 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
 import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-TFGunWmV.js";
+import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbWaitStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-D94wh05t.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $c as carriesSecretMask, $s as canonicalLambdaFunctionName, A as beginDeleteWait, Ai as tagPlanWarning, An as redactedDeleteAddressFields, B as waitForIndexesSettled, Bl as stringifyValue, Bs as configIntegerRefusal, C as planContributorInsightsOp, Ci as markDeleteStarted, Cs as withoutSilentDropProperties, D as reverseMapTableContributorInsights, Di as readTagList, E as reverseMapIndexContributorInsights, Ei as planTagDiff, En as getCurrentProducerRegions, Er as replacedDeleteFailureVerdict, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fs as toCfnInteger, G as S3_AUTO_DELETE_OBJECTS_TAG, Ga as getAccountInfo, Gl as rewriteTemplateAssetReferences, Gs as requireConfigObject, H as planTimeToLive, Hi as getCurrentResourceSecrets, Hs as readConfigString, I as INDEX_SETTLE_POLL_INTERVAL_MS, Is as toFiniteNumber, J as getPriorAttempts, Jc as recoverMaskedOutput, Ji as slowCcOperationTimeoutMs, Ju as derivePartitionAndUrlSuffix, K as hasCdkAutoDeleteTag, Ks as requireConfigString, L as deleteTableWithIndexBusyRetry, Ll as timePhase, Ls as coerceCfnBoolean, M as deleteBudgetKey, Mi as stringifyIfAssigned, Ms as WARM_THROUGHPUT_MEMBERS, N as resolveDynamoDbDeleteBudgetClock, Ns as coerceWarmThroughput$1, O as stripIndexContributorInsights, Oi as refuseMalformedDesiredTags, On as REDACTED_DELETE_ADDRESS_SKIP_REASON, P as resolveDynamoDbDeleteBudgetMs, Ps as isWarmThroughputDecrease, Pt as revertNestedChildFromJournal, Qs as emrClusterInstancesReplaced, Qt as withApiLimit, R as maskedLogger, Ri as waitForLambdaFunctionActive, Rs as coerceCfnInteger, Rt as getCurrentNestedStackContext, S as indexDeclaresContributorInsights, Sc as snapshotPassProvenance, Si as isRefusedByName, Sr as awaitInFlightSibling, T as readContributorInsightsSpec, Ta as outputReferenceProvenanceOf, Tc as hasMaskableValues, Ti as DBPROXY_TAG_OPTIONS, U as readTtlSpec, Us as replayWarn, V as isTtlAlreadyDisabled, Vc as dynamicReferenceTokens, Vo as refuseMalformedNestedChildOutputs, Vs as configStringRefusal, W as ECR_AUTO_DELETE_IMAGES_TAG, Ws as requireConfigArray, Wu as decodeListingKey, Xc as recordAttributeIdCopy, Xi as unchangedBehindSecretReference, Xs as withRetry, Xt as isAccessDeniedError, Y as markRefusedBeforeApplying, Yc as physicalNameCopiesOf, Yi as onlySecretReferencesDiffer, Yt as chunks, Zs as ecsServiceLaunchTypeSetOrChanged, Zt as lookupEachName, _ as streamMemberRefusals, _a as s3BucketDomainName, ao as passedParameterClassesOf, at as isAbsoluteAssetPath, b as CONTRIBUTOR_INSIGHTS_KEY, ba as s3BucketWebsiteUrl, bc as redactForState, c as DynamoDBGlobalTableProvider, ca as observeThenDisableInstanceApiTermination, cd as displayAssemblyPath, d as declaredStreamPolicyMember, ec as lambdaFunctionNameForMask, f as declaredStreamTagsMember, fo as accountArgs, g as streamDeclaresTags, ga as s3BucketArn, gi as reserveStackCreateToken, h as streamDeclaresPolicy, ha as isSettledInstanceState, ia as markWaitAbandoned, it as findNestedTemplateTreeDefect, j as compensateRemovedDeletionProtection, ji as definedAttributes, jn as redactedDeleteAddressSkip, jt as getNestedRevertRun, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ki as tagMapAsList, kn as isRedactedRecordedValue, l as STREAM_POLICY_KEY, la as reDisableInstanceApiTermination, ld as renderAssemblyPathEscape, m as reverseMapStreamPolicy, mi as earliestDefined, mt as enclosingDeadlineRemainingMs, na as withIndeterminateGuard, no as parseWebACLArn, oa as ec2InstanceProtectionSite, ot as listNestedTemplateRows, p as planStreamMemberOps, pc as passedNoEchoParametersOf, pt as enclosingDeadlineExpired, q as isTruthyCfnBoolean, qu as canonicalizeRegion, ra as isWaitAbandonedError, sa as isTerminationProtectionPropagationError, sd as describeFileReadFailure, ss as refuseMalformedResourcesForDestroy, st as renderNestedTemplateTreeDefect, t as DeployEngine, ta as deleteSkipReason, tc as sameLambdaFunctionAddress, ti as secretNamedAttributeNamesOf, u as STREAM_TAGS_KEY, ua as reEnableInstanceApiTermination, ud as resolveAssemblyPath, v as streamPolicyMatchesDeclared, va as s3BucketDualStackDomainName, vi as acquireIdempotencyToken, w as planIndexContributorInsightsOps, wi as DBPROXY_TAGS_WHAT, wr as getStackRecords, x as contributorInsightsRefusals, xc as recordReferenceProvenanceEntry, xs as findSilentDropProperties, y as streamTagsMatchDeclared, ya as s3BucketRegionalDomainName, yc as markSameGenerationBag, ys as withheldAccountClause, z as relayedIndexBusyDelete, zc as withoutPhysicalNameCopies, zs as configBooleanRefusal, zt as withNestedStackContext } from "./deploy-engine-DSpxEUjC.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider--eWrOXce.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-DOPic-aS.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DOJPkECL.js";
-import { RDSProvider } from "./rds-provider-BPs9JSk_.js";
-import { NeptuneProvider } from "./neptune-provider-p59T8CFv.js";
-import { ASGProvider } from "./asg-provider-CsRMe_zh.js";
+import { $l as stringifyValue, $s as readConfigString, $t as lookupEachName, A as beginDeleteWait, Aa as s3BucketRegionalDomainName, Ai as isRefusedByName, Ar as awaitInFlightSibling, As as withheldAccountClause, B as waitForIndexesSettled, Bi as stringifyIfAssigned, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cd as resolveAssemblyPath, Co as accountArgs, D as reverseMapTableContributorInsights, Da as s3BucketArn, E as reverseMapIndexContributorInsights, Ea as isSettledInstanceState, Ec as passedNoEchoParametersOf, Ei as acquireIdempotencyToken, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fc as snapshotPassProvenance, Fi as readTagList, G as sendTtlWaitingOutRateLimit, Gs as isWarmThroughputDecrease, H as isTtlRateLimited, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as outputReferenceProvenanceOf, Ii as refuseMalformedDesiredTags, In as REDACTED_DELETE_ADDRESS_SKIP_REASON, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Js as coerceCfnBoolean, K as ECR_AUTO_DELETE_IMAGES_TAG, Ki as waitForLambdaFunctionActive, Ks as toCfnInteger, L as deleteTableWithIndexBusyRetry, Li as tagMapAsList, Ln as isRedactedRecordedValue, M as deleteBudgetKey, Mc as markSameGenerationBag, Mi as DBPROXY_TAGS_WHAT, Mr as getStackRecords, Ms as findSilentDropProperties, N as resolveDynamoDbDeleteBudgetClock, Nc as redactForState, Ni as DBPROXY_TAG_OPTIONS, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oa as s3BucketDomainName, P as resolveDynamoDbDeleteBudgetMs, Pc as recordReferenceProvenanceEntry, Pi as planTagDiff, Pn as getCurrentProducerRegions, Pr as replacedDeleteFailureVerdict, Ps as withoutSilentDropProperties, Qc as withoutPhysicalNameCopies, Qo as refuseMalformedNestedChildOutputs, Qs as configStringRefusal, Qt as isAccessDeniedError, R as maskedLogger, Rc as hasMaskableValues, Ri as tagPlanWarning, Rn as redactedDeleteAddressFields, S as indexDeclaresContributorInsights, Sd as renderAssemblyPathEscape, Si as earliestDefined, T as readContributorInsightsSpec, U as planTimeToLive, Us as WARM_THROUGHPUT_MEMBERS, V as isTtlAlreadyDisabled, Vt as withNestedStackContext, W as readTtlSpec, Ws as coerceWarmThroughput$1, X as getPriorAttempts, Xi as getCurrentResourceSecrets, Xl as timePhase, Xs as configBooleanRefusal, Y as isTruthyCfnBoolean, Ys as coerceCfnInteger, Z as markRefusedBeforeApplying, Zs as configIntegerRefusal, Zt as chunks, _ as streamMemberRefusals, _a as reDisableInstanceApiTermination, b as CONTRIBUTOR_INSIGHTS_KEY, bd as describeFileReadFailure, c as DynamoDBGlobalTableProvider, cc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, cl as physicalNameCopiesOf, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as isWaitAbandonedError, dc as emrClusterInstancesReplaced, ec as replayWarn, el as dynamicReferenceTokens, en as withApiLimit, f as declaredStreamTagsMember, fa as markWaitAbandoned, fc as canonicalLambdaFunctionName, fl as carriesSecretMask, g as streamDeclaresTags, ga as observeThenDisableInstanceApiTermination, go as passedParameterClassesOf, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ha as isTerminationProtectionPropagationError, ht as enclosingDeadlineExpired, ia as unchangedBehindSecretReference, iu as rewriteTemplateAssetReferences, j as compensateRemovedDeletionProtection, ja as s3BucketWebsiteUrl, ji as markDeleteStarted, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as s3BucketDualStackDomainName, l as STREAM_POLICY_KEY, la as deleteSkipReason, li as secretNamedAttributeNamesOf, ll as recordAttributeIdCopy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as ec2InstanceProtectionSite, mc as sameLambdaFunctionAddress, na as slowCcOperationTimeoutMs, nc as requireConfigObject, no as getAccountInfo, od as canonicalizeRegion, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pc as lambdaFunctionNameForMask, po as parseWebACLArn, q as S3_AUTO_DELETE_OBJECTS_TAG, qs as toFiniteNumber, ra as onlySecretReferencesDiffer, rc as requireConfigString, rd as decodeListingKey, sc as withRetry, sd as derivePartitionAndUrlSuffix, sl as recoverMaskedOutput, st as isAbsoluteAssetPath, t as DeployEngine, tc as requireConfigArray, u as STREAM_TAGS_KEY, ua as withIndeterminateGuard, uc as ecsServiceLaunchTypeSetOrChanged, v as streamPolicyMatchesDeclared, va as reEnableInstanceApiTermination, vs as refuseMalformedResourcesForDestroy, w as planIndexContributorInsightsOps, wi as reserveStackCreateToken, x as contributorInsightsRefusals, xd as displayAssemblyPath, y as streamTagsMatchDeclared, z as relayedIndexBusyDelete, zi as definedAttributes, zn as redactedDeleteAddressSkip } from "./deploy-engine-tQ0aqZMo.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BI8Acvps.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Bnt3Yt0k.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-BUG7NMWS.js";
+import { RDSProvider } from "./rds-provider-Qpf09VQv.js";
+import { NeptuneProvider } from "./neptune-provider-DmVmx69p.js";
+import { ASGProvider } from "./asg-provider-DQoKGfKH.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -16,7 +16,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListEventSourceMappingsCommand, ListLayerVersionsCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateNatGatewayAddressCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AttachVpnGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, DetachInternetGatewayCommand, DetachVpnGatewayCommand, DisassociateAddressCommand, DisassociateIamInstanceProfileCommand, DisassociateNatGatewayAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, ModifyVpcTenancyCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceIamInstanceProfileAssociationCommand, ReplaceNetworkAclAssociationCommand, ReplaceNetworkAclEntryCommand, ReplaceRouteCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, StartInstancesCommand, StopInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateKinesisStreamingDestinationCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteIntegrationCommand, DeleteIntegrationResponseCommand, DeleteMethodCommand, DeleteMethodResponseCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetAuthorizersCommand, GetDeploymentCommand, GetDeploymentsCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateDeploymentCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutPermissionCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -53,17 +53,17 @@ import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSu
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$22, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$23, UpdatePipeCommand } from "@aws-sdk/client-pipes";
-import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
-import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
+import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteFileSystemPolicyCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
+import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27 } from "@aws-sdk/client-s3vectors";
-import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3vectors";
+import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3-control";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
 const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
@@ -7924,6 +7924,13 @@ function inlineCodeFileNameForRuntime(runtime) {
 	if (runtime?.startsWith("python")) return "index.py";
 	return "index.js";
 }
+const SEPARATELY_APPLIED_KEYS = /* @__PURE__ */ new Set([
+	"Tags",
+	"ReservedConcurrentExecutions",
+	"RecursiveLoop",
+	"CodeSigningConfigArn",
+	"RuntimeManagementConfig"
+]);
 var LambdaFunctionProvider = class {
 	lambdaClient;
 	createClient = new LambdaCreateClientCache(() => this.lambdaClient);
@@ -8168,6 +8175,7 @@ var LambdaFunctionProvider = class {
 		}));
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		const log = lambdaOperationSinks(this.logger, context?.maskSecrets, [[physicalId, physicalId], [previousProperties["FunctionName"], physicalId]], properties);
 		const operationMask = log.mask;
@@ -8195,12 +8203,9 @@ var LambdaFunctionProvider = class {
 				"LoggingConfig",
 				"DurableConfig"
 			];
-			let hasConfigChanges = false;
-			for (const field of configFields) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field])) {
-				hasConfigChanges = true;
-				break;
-			}
-			if (hasConfigChanges) {
+			const changedConfigFields = [];
+			for (const field of configFields) if (JSON.stringify(properties[field]) !== JSON.stringify(previousProperties[field])) changedConfigFields.push(field);
+			if (changedConfigFields.length > 0) {
 				const configParams = {
 					FunctionName: physicalId,
 					Role: properties["Role"],
@@ -8222,6 +8227,7 @@ var LambdaFunctionProvider = class {
 					LoggingConfig: properties["LoggingConfig"],
 					DurableConfig: properties["DurableConfig"]
 				};
+				for (const field of changedConfigFields) markUnsettled(field);
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand(configParams));
 				log.debug(`Updated configuration for Lambda function ${log.value(physicalId)}`);
 				await this.waitForFunctionUpdated(logicalId, resourceType, physicalId, log);
@@ -8229,6 +8235,7 @@ var LambdaFunctionProvider = class {
 			const newCodeSigningConfigArn = properties["CodeSigningConfigArn"];
 			const codeSigningChanged = newCodeSigningConfigArn !== previousProperties["CodeSigningConfigArn"];
 			if (codeSigningChanged && newCodeSigningConfigArn === void 0) {
+				markUnsettled("CodeSigningConfigArn");
 				await this.lambdaClient.send(new DeleteFunctionCodeSigningConfigCommand({ FunctionName: physicalId }));
 				log.debug(`Detached CodeSigningConfigArn from Lambda function ${log.value(physicalId)} (template removed the property)`);
 			}
@@ -8249,6 +8256,8 @@ var LambdaFunctionProvider = class {
 					ImageUri: builtCode.ImageUri,
 					Architectures: architecturesChanged ? normalizeArchitectures(properties["Architectures"]) : void 0
 				};
+				markUnsettled("Code");
+				if (architecturesChanged) markUnsettled("Architectures");
 				await this.lambdaClient.send(new UpdateFunctionCodeCommand(codeParams));
 				log.debug(`Updated code for Lambda function ${log.value(physicalId)}`);
 				await this.waitForFunctionUpdated(logicalId, resourceType, physicalId, log);
@@ -8256,6 +8265,7 @@ var LambdaFunctionProvider = class {
 			const newRecursiveLoop = properties["RecursiveLoop"];
 			const prevRecursiveLoop = previousProperties["RecursiveLoop"];
 			if (newRecursiveLoop !== void 0 && newRecursiveLoop !== prevRecursiveLoop) {
+				markUnsettled("RecursiveLoop");
 				await this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
 					FunctionName: physicalId,
 					RecursiveLoop: newRecursiveLoop
@@ -8264,6 +8274,7 @@ var LambdaFunctionProvider = class {
 			}
 			const newReservedConcurrentExecutions = properties["ReservedConcurrentExecutions"];
 			if (newReservedConcurrentExecutions !== previousProperties["ReservedConcurrentExecutions"]) {
+				markUnsettled("ReservedConcurrentExecutions");
 				if (newReservedConcurrentExecutions === void 0) {
 					await this.lambdaClient.send(new DeleteFunctionConcurrencyCommand({ FunctionName: physicalId }));
 					log.debug(`Cleared ReservedConcurrentExecutions for Lambda function ${log.value(physicalId)} (template removed the property)`);
@@ -8276,6 +8287,7 @@ var LambdaFunctionProvider = class {
 				}
 			}
 			if (codeSigningChanged && newCodeSigningConfigArn !== void 0) {
+				markUnsettled("CodeSigningConfigArn");
 				await this.lambdaClient.send(new PutFunctionCodeSigningConfigCommand({
 					FunctionName: physicalId,
 					CodeSigningConfigArn: newCodeSigningConfigArn
@@ -8285,12 +8297,16 @@ var LambdaFunctionProvider = class {
 			const newRuntimeManagementConfig = properties["RuntimeManagementConfig"];
 			const prevRuntimeManagementConfig = previousProperties["RuntimeManagementConfig"];
 			if (newRuntimeManagementConfig?.["UpdateRuntimeOn"] !== prevRuntimeManagementConfig?.["UpdateRuntimeOn"] || newRuntimeManagementConfig?.["RuntimeVersionArn"] !== prevRuntimeManagementConfig?.["RuntimeVersionArn"]) {
+				markUnsettled("RuntimeManagementConfig");
 				await this.putRuntimeManagementConfig(physicalId, newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" });
 				log.debug(`Updated RuntimeManagementConfig for Lambda function ${log.value(physicalId)} to ${JSON.stringify(maskDeep(newRuntimeManagementConfig ?? { UpdateRuntimeOn: "Auto" }, operationMask))}`);
 			}
 			const getResponse = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }));
 			const functionArn = getResponse.Configuration?.FunctionArn;
-			await this.applyTagDiff(functionArn, physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log);
+			await this.applyTagDiff(functionArn, physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], log, {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -8377,13 +8393,17 @@ var LambdaFunctionProvider = class {
 		const subnets = raw["SubnetIds"];
 		return Array.isArray(subnets) && subnets.length > 0;
 	}
-	async applyTagDiff(functionArn, functionName, resourceType, logicalId, oldTagsRaw, newTagsRaw, log) {
+	async applyTagDiff(functionArn, functionName, resourceType, logicalId, oldTagsRaw, newTagsRaw, log, unsettled = {
+		forceUpsert: false,
+		beforeWrite: () => void 0
+	}) {
 		if (!functionArn) return;
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) log.warn(tagWarning);
-		const tagsToAdd = Object.fromEntries(plan.set);
+		const tagsToAdd = Object.fromEntries(unsettled.forceUpsert ? planTagDiff(void 0, newTagsRaw).set : plan.set);
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || Object.keys(tagsToAdd).length > 0) unsettled.beforeWrite();
 		if (tagsToRemove.length > 0) {
 			await this.lambdaClient.send(new UntagResourceCommand$1({
 				Resource: functionArn,
@@ -8623,6 +8643,43 @@ var LambdaFunctionProvider = class {
 			throw err;
 		}
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, names) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		const strict = async (read) => {
+			try {
+				return await read();
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException) return void 0;
+				throw error;
+			}
+		};
+		const set = (key, value) => {
+			if (value === void 0) delete out[key];
+			else out[key] = value;
+		};
+		if (names.has("ReservedConcurrentExecutions")) set("ReservedConcurrentExecutions", (await strict(() => this.lambdaClient.send(new GetFunctionConcurrencyCommand({ FunctionName: physicalId }))))?.ReservedConcurrentExecutions);
+		if (names.has("RecursiveLoop")) set("RecursiveLoop", (await strict(() => this.lambdaClient.send(new GetFunctionRecursionConfigCommand({ FunctionName: physicalId }))))?.RecursiveLoop);
+		if (names.has("RuntimeManagementConfig")) {
+			const r = await strict(() => this.lambdaClient.send(new GetRuntimeManagementConfigCommand({ FunctionName: physicalId })));
+			set("RuntimeManagementConfig", r?.UpdateRuntimeOn === void 0 ? void 0 : {
+				UpdateRuntimeOn: r.UpdateRuntimeOn,
+				...r.RuntimeVersionArn !== void 0 && { RuntimeVersionArn: r.RuntimeVersionArn }
+			});
+		}
+		if (names.has("CodeSigningConfigArn")) set("CodeSigningConfigArn", (await strict(() => this.lambdaClient.send(new GetFunctionCodeSigningConfigCommand({ FunctionName: physicalId }))))?.CodeSigningConfigArn);
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const cfg = (await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }))).Configuration;
+			if (cfg?.State !== "Pending" && cfg?.LastUpdateStatus !== "InProgress") return /* @__PURE__ */ new Set();
+			return new Set([...names].filter((name) => !SEPARATELY_APPLIED_KEYS.has(name)));
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		try {
 			const resp = await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: physicalId }));
@@ -12228,7 +12285,8 @@ var DynamoDBTableProvider = class {
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"], void 0, "create", {
 				logicalId,
-				resourceType
+				resourceType,
+				maskSecrets
 			});
 			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
 			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
@@ -12266,6 +12324,7 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		const maskSecrets = context?.maskSecrets ?? ((text) => text);
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
@@ -12309,7 +12368,10 @@ var DynamoDBTableProvider = class {
 				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
 			}
 			let latestStreamArn = table?.LatestStreamArn;
-			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			if (table?.TableArn) await this.applyTagDiff(table.TableArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
 			const liveBillingMode = table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
@@ -12368,6 +12430,7 @@ var DynamoDBTableProvider = class {
 					warn(`AWS::DynamoDB::Table ${logicalId}: this deploy removes global secondary index(es) ${removable.map((n) => maskSecrets(n)).join(", ")} and flips BillingMode to PROVISIONED. The removal would normally be applied BEFORE the flip, but ${reasons.join(" and ")}, so AWS rejects the flip either way. Nothing was removed.`);
 				} else if (removable.length > 0) {
 					debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
+					markUnsettled("GlobalSecondaryIndexes");
 					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0, maskSecrets);
 					for (const name of removable) preFlipDeletedIndexNames.add(name);
 				}
@@ -12414,6 +12477,10 @@ var DynamoDBTableProvider = class {
 					if (indexUpdates.length > 0) updateInput.GlobalSecondaryIndexUpdates = indexUpdates;
 					if (unspecified.length > 0) warn(`AWS::DynamoDB::Table ${logicalId}: flipping BillingMode to PROVISIONED, but the template declares no usable ProvisionedThroughput for live index(es) ${unspecified.map((n) => maskSecrets(n)).join(", ")}. AWS requires per-index capacity in the same UpdateTable and will reject the flip naming them. Declare GlobalSecondaryIndexes[].ProvisionedThroughput (both ReadCapacityUnits and WriteCapacityUnits) for each. An index this deploy REMOVES is deleted BEFORE the flip automatically, so a name here is one the template still keeps, one that exists in AWS but in neither the template nor cdkd state (created out of band), or one whose pre-flip removal was skipped for the reason warned above.`);
 				}
+				if (billingMode !== prevBillingMode) markUnsettled("BillingMode");
+				if (JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"])) markUnsettled("ProvisionedThroughput");
+				if (tableClassChanged) markUnsettled("TableClass");
+				if (updateInput.GlobalSecondaryIndexUpdates !== void 0) markUnsettled("GlobalSecondaryIndexes");
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
 				else await this.waitForTableActiveAfterUpdate(physicalId, 60);
@@ -12424,6 +12491,7 @@ var DynamoDBTableProvider = class {
 				if (properties["OnDemandThroughput"] || ceilingRemovals.length > 0) {
 					const declaredForSend = properties["OnDemandThroughput"] ? this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets) : {};
 					if (ceilingRemovals.length > 0) debug(`AWS::DynamoDB::Table ${logicalId}: removing the OnDemandThroughput ${ceilingRemovals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET}, DynamoDB's reset sentinel)`);
+					markUnsettled("OnDemandThroughput");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						OnDemandThroughput: withOnDemandCeilingRemovals(declaredForSend, ceilingRemovals)
@@ -12436,6 +12504,7 @@ var DynamoDBTableProvider = class {
 				this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 				const warmThroughputToSend = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 				if (warmThroughputToSend !== void 0 && !this.skipWarmThroughputDecrease(logicalId, physicalId, warmThroughputToSend, table?.WarmThroughput, maskSecrets)) {
+					markUnsettled("WarmThroughput");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						WarmThroughput: warmThroughputToSend
@@ -12451,6 +12520,7 @@ var DynamoDBTableProvider = class {
 				if (liveSseStatus === "UPDATING" || liveSseStatus === "ENABLING" || liveSseStatus === "DISABLING") liveTable = await this.waitForTableSseSettled(physicalId, maskSecrets);
 				const sseUpdate = sseSpecificationToSend(properties["SSESpecification"], previousProperties["SSESpecification"], liveTable?.SSEDescription, liveTable !== void 0);
 				if (sseUpdate !== void 0) {
+					markUnsettled("SSESpecification");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						SSESpecification: sseUpdate
@@ -12464,6 +12534,7 @@ var DynamoDBTableProvider = class {
 				const desiredDeletionProtection = rawDeletionProtection === void 0 ? false : coerceCfnBoolean(rawDeletionProtection);
 				if (desiredDeletionProtection === void 0) warn(`AWS::DynamoDB::Table ${logicalId}: DeletionProtectionEnabled is not a boolean, so it was not applied`);
 				else if (table?.DeletionProtectionEnabled !== desiredDeletionProtection) {
+					markUnsettled("DeletionProtectionEnabled");
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						DeletionProtectionEnabled: desiredDeletionProtection
@@ -12473,6 +12544,7 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["StreamSpecification"]) !== JSON.stringify(previousProperties["StreamSpecification"])) {
+				markUnsettled("StreamSpecification");
 				const newViewType = this.extractStreamViewType(properties["StreamSpecification"]);
 				const prevViewType = this.extractStreamViewType(previousProperties["StreamSpecification"]);
 				const liveStream = table?.StreamSpecification;
@@ -12520,22 +12592,38 @@ var DynamoDBTableProvider = class {
 				}
 				if (newViewType) await this.applyStreamMembers(logicalId, resourceType, physicalId, latestStreamArn, properties["StreamSpecification"], previousProperties["StreamSpecification"], mintedStream, maskSecrets, mintedStream ? preUpdateStreamArn : void 0, contentsUnknown);
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
-			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
+			if (context?.unsettledProperties?.has("GlobalSecondaryIndexes") === true && currentLiveIndexNames !== void 0) this.warnUndeclaredLiveIndexes(physicalId, currentLiveIndexNames, [previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"]], maskSecrets);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) {
+				markUnsettled("GlobalSecondaryIndexes");
+				await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
+			}
+			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) {
+				markUnsettled("PointInTimeRecoverySpecification");
+				await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
+			}
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
+				markUnsettled("TimeToLiveSpecification");
 				await this.applyTimeToLive(physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"], "update", {
 					logicalId,
-					resourceType
+					resourceType,
+					maskSecrets
 				});
 			}
 			if (JSON.stringify(properties["ResourcePolicy"]) !== JSON.stringify(previousProperties["ResourcePolicy"])) {
 				if (!table?.TableArn) throw new ProvisioningError(`Cannot apply ResourcePolicy change for DynamoDB table ${logicalId}: DescribeTable returned no TableArn`, resourceType, logicalId, physicalId);
+				markUnsettled("ResourcePolicy");
 				await this.applyResourcePolicy(table.TableArn, properties["ResourcePolicy"], previousProperties["ResourcePolicy"]);
 			}
-			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
-			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"], maskSecrets);
-			await this.applyIndexContributorInsights(physicalId, properties["GlobalSecondaryIndexes"], previousProperties["GlobalSecondaryIndexes"], maskSecrets);
+			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) {
+				markUnsettled("KinesisStreamSpecification");
+				await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
+			}
+			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) {
+				markUnsettled("ContributorInsightsSpecification");
+				await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"], maskSecrets);
+			}
+			await this.applyIndexContributorInsights(physicalId, properties["GlobalSecondaryIndexes"], previousProperties["GlobalSecondaryIndexes"], maskSecrets, () => markUnsettled("GlobalSecondaryIndexes"));
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -12673,15 +12761,19 @@ var DynamoDBTableProvider = class {
 			throw error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 		}
 	}
-	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, unsettled = {
+		forceUpsert: false,
+		beforeWrite: () => void 0
+	}) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
-		const tagsToAdd = [...plan.set].map(([k, v]) => ({
+		const tagsToAdd = [...unsettled.forceUpsert ? planTagDiff(void 0, newTagsRaw).set : plan.set].map(([k, v]) => ({
 			Key: k,
 			Value: v
 		}));
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || tagsToAdd.length > 0) unsettled.beforeWrite();
 		if (tagsToRemove.length > 0) {
 			await this.dynamoDBClient.send(new UntagResourceCommand$2({
 				ResourceArn: tableArn,
@@ -12732,6 +12824,7 @@ var DynamoDBTableProvider = class {
 			const retryLine = `Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`;
 			this.logger.debug(options.maskSecrets ? options.maskSecrets(retryLine) : retryLine);
 			await new Promise((resolve) => setTimeout(resolve, delayMs));
+			if (options.stopAtDeadline && enclosingDeadlineRemainingMs() <= 0) throw error;
 			delayMs = Math.min(delayMs * 2, 3e4);
 		}
 	}
@@ -12746,10 +12839,10 @@ var DynamoDBTableProvider = class {
 		let attributeName;
 		if (plan.kind === "none") return;
 		if (plan.kind === "disable-live") {
-			const live = (await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: tableName })), `read TTL on ${tableName}`)).TimeToLiveDescription;
+			const live = (await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: tableName })), `read TTL on ${tableName}`, void 0, { maskSecrets: ids.maskSecrets })).TimeToLiveDescription;
 			const status = live?.TimeToLiveStatus;
 			if (status !== "ENABLED" && status !== "ENABLING" || !live?.AttributeName) {
-				this.logger.debug(`TimeToLive already ${status ?? "DISABLED"} on DynamoDB table ${tableName}; nothing to disable`);
+				this.logger.debug(ids.maskSecrets(`TimeToLive already ${status ?? "DISABLED"} on DynamoDB table ${tableName}; nothing to disable`));
 				return;
 			}
 			enabled = false;
@@ -12759,22 +12852,28 @@ var DynamoDBTableProvider = class {
 			attributeName = plan.attributeName;
 		}
 		try {
-			await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
+			await sendTtlWaitingOutRateLimit(() => this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new UpdateTimeToLiveCommand({
 				TableName: tableName,
 				TimeToLiveSpecification: {
 					Enabled: enabled,
 					AttributeName: attributeName
 				}
-			})), `${enabled ? "set" : "disable"} TTL on ${tableName}`);
+			})), `${enabled ? "set" : "disable"} TTL on ${tableName}`, void 0, {
+				maskSecrets: ids.maskSecrets,
+				stopAtDeadline: true
+			}), {
+				what: ids.maskSecrets(`DynamoDB TimeToLive rate-limit wait on ${tableName}`),
+				announce: () => this.logger.info(ids.maskSecrets(`DynamoDB table ${ids.logicalId}: TimeToLive was changed recently, and AWS refuses another change until its rate-limit interval passes (up to about an hour). Retrying every minute, like CloudFormation, within the resource timeout.`))
+			});
 		} catch (error) {
 			if (!enabled && isTtlAlreadyDisabled(describeAwsFailure(error).detail)) {
-				this.logger.debug(`TimeToLive already disabled on DynamoDB table ${tableName}`);
+				this.logger.debug(ids.maskSecrets(`TimeToLive already disabled on DynamoDB table ${tableName}`));
 				return;
 			}
-			if (describeAwsFailure(error).detail.includes("Time to live has been modified multiple times")) throw new ProvisioningError(`DynamoDB table ${ids.logicalId}: AWS refused to ${enabled ? "enable" : "disable"} TimeToLive because it was already modified within DynamoDB's rate-limit interval. Wait for the interval to pass (up to about an hour), then redeploy.`, ids.resourceType, ids.logicalId, tableName, error instanceof Error ? error : void 0);
+			if (isTtlRateLimited(describeAwsFailure(error).detail)) throw new ProvisioningError(`DynamoDB table ${ids.logicalId}: AWS refused to ${enabled ? "enable" : "disable"} TimeToLive because it was already modified within DynamoDB's rate-limit interval, and kept refusing until the resource timeout ran out. Redeploy once the interval has passed (up to about an hour), or raise --resource-timeout.`, ids.resourceType, ids.logicalId, tableName, error instanceof Error ? error : void 0);
 			throw error;
 		}
-		this.logger.debug(`Set TimeToLive Enabled=${enabled} AttributeName=${attributeName} on DynamoDB table ${tableName}`);
+		this.logger.debug(ids.maskSecrets(`Set TimeToLive Enabled=${enabled} AttributeName=${attributeName} on DynamoDB table ${tableName}`));
 	}
 	extractResourcePolicyDocument(spec) {
 		if (spec === void 0 || spec === null) return void 0;
@@ -12987,12 +13086,15 @@ var DynamoDBTableProvider = class {
 		if (op === void 0) return;
 		await this.sendContributorInsightsOp(tableName, op, maskSecrets);
 	}
-	async applyIndexContributorInsights(tableName, desiredIndexes, previousIndexes, maskSecrets) {
+	async applyIndexContributorInsights(tableName, desiredIndexes, previousIndexes, maskSecrets, beforeSend = () => void 0) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const ops = planIndexContributorInsightsOps(desiredIndexes, previousIndexes, (indexName, reason) => warn(`${this.indexScopeAt(indexName, tableName, maskSecrets)}: ${reason}, so its Contributor Insights was left as it is. Fix the template value and re-deploy.`));
 		if (ops.length === 0) return;
 		await this.waitForTableAndIndexesActive(tableName);
-		for (const op of ops) await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+		for (const op of ops) {
+			beforeSend();
+			await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+		}
 	}
 	async sendContributorInsightsOp(tableName, op, maskSecrets) {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
@@ -13144,6 +13246,21 @@ var DynamoDBTableProvider = class {
 	indexScope(indexName, logicalId, maskSecrets) {
 		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on AWS::DynamoDB::Table ${logicalId}`;
 	}
+	warnUndeclaredLiveIndexes(physicalId, liveIndexNames, lists, maskSecrets) {
+		const named = /* @__PURE__ */ new Set();
+		for (const list of lists) {
+			if (!Array.isArray(list)) continue;
+			for (const entry of list) {
+				const name = typeof entry === "object" && entry !== null ? entry["IndexName"] : void 0;
+				if (typeof name === "string") named.add(name);
+			}
+		}
+		for (const name of liveIndexNames) {
+			if (named.has(name)) continue;
+			const secretDerived = maskSecrets(name) !== name || maskSecrets(physicalId) !== physicalId;
+			this.logger.warn(maskSecrets(`${this.indexScopeAt(name, physicalId, maskSecrets)} is live, but neither cdkd's record nor the template declares it, so cdkd left it in place while converging the unsettled GlobalSecondaryIndexes (CloudFormation never deletes an index it did not record). It may belong to another tool, or an earlier failed cdkd update may have created it; cdkd cannot tell which. If it should not exist, delete it ` + (secretDerived ? `with an UpdateTable GlobalSecondaryIndexUpdates Delete for the index.` : `with: aws dynamodb update-table --table-name ${physicalId} --global-secondary-index-updates '[{"Delete":{"IndexName":"${name}"}}]' (in the table's region)`)));
+		}
+	}
 	indexScopeAt(indexName, physicalId, maskSecrets) {
 		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${physicalId}`;
 	}
@@ -13430,6 +13547,62 @@ var DynamoDBTableProvider = class {
 			aws
 		};
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		if (out["BillingMode"] === "PAY_PER_REQUEST") delete out["ProvisionedThroughput"];
+		if (names.has("GlobalSecondaryIndexes")) {
+			out["GlobalSecondaryIndexes"] = projectIndexesOnto(out["GlobalSecondaryIndexes"], recordedProperties?.["GlobalSecondaryIndexes"], desiredProperties?.["GlobalSecondaryIndexes"]);
+			if (out["GlobalSecondaryIndexes"] === void 0) delete out["GlobalSecondaryIndexes"];
+		}
+		const strict = async (key, read) => {
+			if (!names.has(key)) return;
+			const value = await read();
+			if (value === void 0) delete out[key];
+			else out[key] = value;
+		};
+		await strict("PointInTimeRecoverySpecification", () => this.readPointInTimeRecovery(physicalId, true));
+		await strict("TimeToLiveSpecification", () => this.readTimeToLive(physicalId, true));
+		await strict("KinesisStreamSpecification", () => this.readKinesisStreamSpecification(physicalId, true));
+		await strict("ContributorInsightsSpecification", () => this.readTableContributorInsights(physicalId, true));
+		if (names.has("ResourcePolicy")) {
+			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
+			if (!table?.TableArn) throw new ProvisioningError(`DescribeTable returned no TableArn for the table, which reading its unsettled ResourcePolicy needs`, resourceType, logicalId, physicalId);
+			const tableArn = table.TableArn;
+			await strict("ResourcePolicy", () => this.readTableResourcePolicy(physicalId, tableArn, true));
+		}
+		return out;
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		const SEPARATE = /* @__PURE__ */ new Set([
+			"Tags",
+			"PointInTimeRecoverySpecification",
+			"TimeToLiveSpecification",
+			"ResourcePolicy",
+			"KinesisStreamSpecification",
+			"ContributorInsightsSpecification"
+		]);
+		try {
+			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
+			const moving = /* @__PURE__ */ new Set();
+			if (table?.TableStatus === "CREATING" || table?.TableStatus === "UPDATING" || table?.TableStatus === "DELETING") {
+				for (const name of names) if (!SEPARATE.has(name)) moving.add(name);
+			}
+			if (names.has("GlobalSecondaryIndexes") && (table?.GlobalSecondaryIndexes ?? []).some((index) => index.IndexStatus === "CREATING" || index.IndexStatus === "UPDATING" || index.IndexStatus === "DELETING")) moving.add("GlobalSecondaryIndexes");
+			const sse = table?.SSEDescription?.Status;
+			if (names.has("SSESpecification") && (sse === "ENABLING" || sse === "DISABLING" || sse === "UPDATING")) moving.add("SSESpecification");
+			if (names.has("TimeToLiveSpecification")) {
+				if ((await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription?.TimeToLiveStatus === "ENABLING") moving.add("TimeToLiveSpecification");
+			}
+			if (names.has("KinesisStreamSpecification")) {
+				if (((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).some((d) => d.DestinationStatus === "ENABLING" || d.DestinationStatus === "DISABLING" || d.DestinationStatus === "UPDATING")) moving.add("KinesisStreamSpecification");
+			}
+			return moving;
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		try {
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
@@ -13512,7 +13685,7 @@ var DynamoDBTableProvider = class {
 			throw err;
 		}
 	}
-	async readPointInTimeRecovery(physicalId) {
+	async readPointInTimeRecovery(physicalId, strict = false) {
 		try {
 			const pitrDesc = (await this.dynamoDBClient.send(new DescribeContinuousBackupsCommand({ TableName: physicalId }))).ContinuousBackupsDescription?.PointInTimeRecoveryDescription;
 			const pitrStatus = pitrDesc?.PointInTimeRecoveryStatus;
@@ -13521,11 +13694,12 @@ var DynamoDBTableProvider = class {
 			if (pitrStatus === "ENABLED" && pitrDesc?.RecoveryPeriodInDays !== void 0) pitr["RecoveryPeriodInDays"] = pitrDesc.RecoveryPeriodInDays;
 			return pitr;
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read PointInTimeRecovery for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readTimeToLive(physicalId) {
+	async readTimeToLive(physicalId, strict = false) {
 		try {
 			const ttlDesc = (await this.dynamoDBClient.send(new DescribeTimeToLiveCommand({ TableName: physicalId }))).TimeToLiveDescription;
 			if (ttlDesc?.TimeToLiveStatus === "ENABLED" && ttlDesc.AttributeName) return {
@@ -13534,11 +13708,12 @@ var DynamoDBTableProvider = class {
 			};
 			return;
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read TimeToLive for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readTableResourcePolicy(physicalId, tableArn) {
+	async readTableResourcePolicy(physicalId, tableArn, strict = false) {
 		try {
 			const rpResp = await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: tableArn }));
 			if (!rpResp.Policy) return void 0;
@@ -13548,11 +13723,12 @@ var DynamoDBTableProvider = class {
 			} catch {}
 			return { PolicyDocument: doc };
 		} catch (err) {
+			if (strict && !(err instanceof ResourceNotFoundException$1) && !(err instanceof PolicyNotFoundException)) throw err;
 			if (!(err instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not read ResourcePolicy for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readKinesisStreamSpecification(physicalId) {
+	async readKinesisStreamSpecification(physicalId, strict = false) {
 		try {
 			const active = ((await this.dynamoDBClient.send(new DescribeKinesisStreamingDestinationCommand({ TableName: physicalId }))).KinesisDataStreamDestinations ?? []).find((d) => d.DestinationStatus === "ACTIVE" || d.DestinationStatus === "ENABLING" || d.DestinationStatus === "UPDATING");
 			if (!active?.StreamArn) return void 0;
@@ -13560,15 +13736,17 @@ var DynamoDBTableProvider = class {
 			if (active.ApproximateCreationDateTimePrecision !== void 0) kspec["ApproximateCreationDateTimePrecision"] = active.ApproximateCreationDateTimePrecision;
 			return kspec;
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read KinesisStreamingDestination for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
 	}
-	async readTableContributorInsights(physicalId) {
+	async readTableContributorInsights(physicalId, strict = false) {
 		try {
 			const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
 			return reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
 		} catch (err) {
+			if (strict) throw err;
 			this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			return;
 		}
@@ -13692,6 +13870,22 @@ var DynamoDBTableProvider = class {
 function isTransientStreamReadFailure(err) {
 	return isThrottlingError(err) || isTransientServerError(err) || isAmbiguousOutcomeError(err) || err instanceof ResourceNotFoundException$1;
 }
+function projectIndexesOnto(live, recorded, desired) {
+	if (!Array.isArray(live)) return void 0;
+	const named = /* @__PURE__ */ new Set();
+	for (const list of [recorded, desired]) {
+		if (!Array.isArray(list)) continue;
+		for (const entry of list) {
+			const name = typeof entry === "object" && entry !== null ? entry["IndexName"] : void 0;
+			if (typeof name === "string") named.add(name);
+		}
+	}
+	const kept = live.filter((entry) => {
+		const name = typeof entry === "object" && entry !== null ? entry["IndexName"] : void 0;
+		return typeof name === "string" && named.has(name);
+	});
+	return kept.length > 0 ? kept : void 0;
+}
 
 //#endregion
 //#region src/provisioning/providers/logs-loggroup-provider.ts
@@ -16131,6 +16325,46 @@ const EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT = {
 	segments: ["gatewayId", "vpcId"]
 };
 const VPN_GATEWAY_ATTACHMENT_WAIT_MS = 6e5;
+const INSTANCE_STATE_WAIT_CAP_MS = 9e5;
+const INSTANCE_STATE_POLL_MS = 5e3;
+const STOPPED_AFTER_START_READS = 3;
+const PROFILE_DISASSOCIATING_POLLS = 15;
+const PROFILE_DISASSOCIATING_DELAY_MS = 2e3;
+function refusedBeforeApplying(error) {
+	return markRefusedBeforeApplying(markNonRetryable(error));
+}
+const STOPPABLE_INSTANCE_STATES = /* @__PURE__ */ new Set([
+	"pending",
+	"running",
+	"stopping",
+	"stopped"
+]);
+const instancesLeftStoppedByCdkd = /* @__PURE__ */ new Set();
+const instanceStoppedAfterStart = /* @__PURE__ */ new WeakSet();
+function isRecordedStandIn$1(value) {
+	if (Array.isArray(value)) return value.some(isRecordedStandIn$1);
+	if (value !== null && typeof value === "object") return Object.values(value).some(isRecordedStandIn$1);
+	return typeof value === "string" && (value === "***" || dynamicReferenceTokens(value).length > 0);
+}
+function instanceProfileKey(value) {
+	const fromArn = (arn) => arn.slice(arn.lastIndexOf("/") + 1);
+	if (typeof value === "string") {
+		const v = value.trim();
+		if (v === "") return void 0;
+		return v.startsWith("arn:") ? fromArn(v) : v;
+	}
+	if (value !== null && typeof value === "object") {
+		const obj = value;
+		if (typeof obj["Name"] === "string" && obj["Name"] !== "") return obj["Name"];
+		if (typeof obj["Arn"] === "string" && obj["Arn"] !== "") return fromArn(obj["Arn"]);
+	}
+}
+function sameStringSet(a, b) {
+	if (!Array.isArray(a) || !Array.isArray(b)) return a === b;
+	const sa = new Set(a.map(String));
+	const sb = new Set(b.map(String));
+	return sa.size === sb.size && [...sa].every((x) => sb.has(x));
+}
 const VPN_DETACH_IN_PROGRESS_ERRORS = /* @__PURE__ */ new Set(["IncorrectState"]);
 const EC2_ROUTE_ID_FORMAT = {
 	label: "Route",
@@ -16723,19 +16957,19 @@ var EC2Provider = class {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::EC2::InternetGateway": return this.updateInternetGateway(logicalId, physicalId);
+			case "AWS::EC2::InternetGateway": return this.updateTagsOnly(logicalId, physicalId, resourceType, false, properties, previousProperties, context);
 			case "AWS::EC2::EIP": return this.updateEip(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::EC2::RouteTable": return this.updateRouteTable(logicalId, physicalId);
+			case "AWS::EC2::RouteTable":
+			case "AWS::EC2::NetworkAcl": return this.updateTagsOnly(logicalId, physicalId, resourceType, true, properties, previousProperties, context);
 			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
 			case "AWS::EC2::SecurityGroup": return this.updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets, context?.replayingState === true, context?.recordedAttributes);
 			case "AWS::EC2::Instance": return this.updateInstance(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::NetworkAclEntry": return this.updateNetworkAclEntry(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::EC2::NetworkAcl":
-			case "AWS::EC2::SubnetNetworkAclAssociation": throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS provides no in-place Update API for this EC2 sub-resource type; every property change requires Delete + Create. Re-deploy with cdkd deploy --replace, or destroy + redeploy.");
+			case "AWS::EC2::SubnetNetworkAclAssociation": throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS provides no in-place Update API for this EC2 sub-resource type; every property change requires Delete + Create. Re-deploy with cdkd deploy --replace, or destroy + redeploy");
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -16976,6 +17210,10 @@ var EC2Provider = class {
 		this.logger.debug(`Updating VPC ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		try {
+			const tenancyOf = (v) => v == null ? "default" : String(v);
+			const newTenancy = tenancyOf(properties["InstanceTenancy"]);
+			const oldTenancy = tenancyOf(previousProperties["InstanceTenancy"]);
+			if (newTenancy !== oldTenancy && newTenancy !== "default") throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "destroy + redeploy the VPC (and the resources that depend on it). AWS changes InstanceTenancy in place only to default, and CloudFormation creates a new VPC for this change");
 			const asBool = (v) => {
 				if (v === void 0) return void 0;
 				return v === true || v === "true";
@@ -16992,6 +17230,10 @@ var EC2Provider = class {
 				VpcId: physicalId,
 				EnableDnsSupport: { Value: newDnsSupport }
 			}));
+			if (newTenancy !== oldTenancy) await this.ec2Client.send(new ModifyVpcTenancyCommand({
+				VpcId: physicalId,
+				InstanceTenancy: "default"
+			}));
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskerOrIdentity(context?.maskSecrets));
 			this.logger.debug(`Successfully updated VPC ${logicalId}`);
 			return {
@@ -17003,6 +17245,7 @@ var EC2Provider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update VPC ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
@@ -17272,8 +17515,20 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create InternetGateway ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	updateInternetGateway(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::InternetGateway", logicalId, "destroy + redeploy the InternetGateway. IGW properties are immutable in AWS"));
+	async updateTagsOnly(logicalId, physicalId, resourceType, vpcIdCreateOnly, properties, previousProperties, context) {
+		const label = resourceType.slice(10);
+		this.logger.debug(safeMsg`Updating ${label} ${logicalId}: ${physicalId}`);
+		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		if (vpcIdCreateOnly) {
+			const next = properties["VpcId"];
+			const prev = previousProperties["VpcId"];
+			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `destroy + redeploy the ${label} (and the resources that depend on it). VpcId is immutable in AWS`);
+		}
+		await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskerOrIdentity(context?.maskSecrets));
+		return {
+			physicalId,
+			wasReplaced: false
+		};
 	}
 	async deleteInternetGateway(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting InternetGateway ${logicalId}: ${physicalId}`);
@@ -18019,9 +18274,6 @@ var EC2Provider = class {
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create RouteTable ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
-	updateRouteTable(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::RouteTable", logicalId, "destroy + redeploy the RouteTable (and its associated Routes / SubnetRouteTableAssociations). VpcId is immutable."));
-	}
 	async deleteRouteTable(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting RouteTable ${logicalId}: ${physicalId}`);
 		try {
@@ -18180,7 +18432,7 @@ var EC2Provider = class {
 		}
 	}
 	updateSubnetRouteTableAssociation(logicalId, physicalId) {
-		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::SubnetRouteTableAssociation", logicalId, "destroy + redeploy the association. (SubnetId, RouteTableId) is immutable."));
+		return Promise.reject(new ResourceUpdateNotSupportedError("AWS::EC2::SubnetRouteTableAssociation", logicalId, "destroy + redeploy the association. (SubnetId, RouteTableId) is immutable"));
 	}
 	async deleteSubnetRouteTableAssociation(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting SubnetRouteTableAssociation ${logicalId}: ${physicalId}`);
@@ -18256,7 +18508,7 @@ var EC2Provider = class {
 		if (!Array.isArray(ingressRules) || ingressRules.length === 0) return;
 		await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 			GroupId: groupId,
-			IpPermissions: ingressRules.map((rule) => this.buildIpPermission(rule))
+			IpPermissions: ingressRules.map((rule) => this.buildIpPermission(rule, "ingress", true))
 		}));
 	}
 	async applyInlineEgress(groupId, egressRules) {
@@ -18902,9 +19154,12 @@ var EC2Provider = class {
 		this.logger.debug(`Updating EC2 Instance ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
 		this.guardTerminationProtectionRemoval(logicalId, physicalId, resourceType, properties, previousProperties, context);
+		const memberPlan = this.planInstanceMemberUpdates(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		try {
+			await this.prepareInstanceMemberUpdates(logicalId, physicalId, resourceType, memberPlan);
 			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskerOrIdentity(context?.maskSecrets));
 			await this.updateInstanceSecurityProps(physicalId, properties, previousProperties);
+			await this.applyInstanceMemberUpdates(logicalId, physicalId, resourceType, memberPlan);
 			const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
 			return {
 				physicalId,
@@ -18912,6 +19167,7 @@ var EC2Provider = class {
 				attributes: describedInstanceAttributes(physicalId, instance)
 			};
 		} catch (error) {
+			if (error instanceof CdkdError || isInterruptedWaitError(error)) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to update EC2 Instance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
@@ -18950,6 +19206,286 @@ var EC2Provider = class {
 			CpuCredits: newCpuCredits
 		}] }));
 	}
+	planInstanceMemberUpdates(logicalId, physicalId, resourceType, properties, previousProperties, context) {
+		const plan = {};
+		const removed = (key) => context?.removedProperties !== void 0 ? context.removedProperties.has(key) : previousProperties[key] !== void 0 && properties[key] === void 0;
+		const changed = (key, same) => {
+			const before = previousProperties[key];
+			const after = properties[key];
+			if (after === void 0 && !removed(key)) return false;
+			if (context?.changedProperties !== void 0 && !context.changedProperties.has(key)) return false;
+			if (isDeepStrictEqual(before, after)) {
+				if (context?.replayingState === true && isRecordedStandIn$1(after)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): both sides of the rollback record ${key} as a stand-in (an unresolved {{resolve:...}} reference or the redaction mask), so cdkd cannot tell whether it changed; the rollback leaves ${key} at its current AWS value.`);
+				return false;
+			}
+			return !(!isRecordedStandIn$1(before) && !isRecordedStandIn$1(after) && same(before, after));
+		};
+		const standInSkips = (key) => {
+			if (!isRecordedStandIn$1(properties[key])) return false;
+			if (context?.replayingState === true) {
+				this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored records ${key} as a stand-in (an unresolved {{resolve:...}} reference or the redaction mask), not a value cdkd can send; the rollback leaves ${key} at its current AWS value.`);
+				return true;
+			}
+			throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): ${key} holds a recorded stand-in (an unresolved {{resolve:...}} reference or the redaction mask), not a value cdkd can send. The instance was not updated; deploy from the template so the value resolves.`, resourceType, logicalId, physicalId));
+		};
+		if (changed("InstanceType", (a, b) => a === b)) {
+			if (properties["InstanceType"] === void 0) {
+				if (context?.replayingState === true) this.logger.warn(safeMsg`${logicalId} (${resourceType}): the state being restored does not declare InstanceType; the rollback leaves the instance type at its current AWS value.`);
+				else throw refusedBeforeApplying(new ProvisioningError(safeMsg`${logicalId} (${resourceType}): InstanceType was removed from the template, and CloudFormation fails that update for an existing instance. Keep it declared (set it to the instance's current type to leave it unchanged). The instance was not updated.`, resourceType, logicalId, physicalId));
+			} else if (!standInSkips("InstanceType")) plan.instanceType = requireConfigString(properties["InstanceType"], "", "AWS::EC2::Instance InstanceType");
+		}
+		if (changed("UserData", (a, b) => a === b)) {
+			const userData = properties["UserData"];
+			if (userData === void 0) plan.userData = /* @__PURE__ */ new Uint8Array(0);
+			else if (!standInSkips("UserData")) {
+				if (typeof userData !== "string") throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): UserData must be a base64 string (Fn::Base64), got a ${Array.isArray(userData) ? "list" : typeof userData}. The instance was not updated.`, resourceType, logicalId, physicalId));
+				plan.userData = new Uint8Array(Buffer.from(userData, "base64"));
+			}
+		}
+		if (changed("IamInstanceProfile", (a, b) => instanceProfileKey(a) === instanceProfileKey(b))) {
+			if (properties["IamInstanceProfile"] === void 0) plan.profile = { kind: "remove" };
+			else if (!standInSkips("IamInstanceProfile")) {
+				const desired = this.normalizeIamInstanceProfile(properties["IamInstanceProfile"]);
+				if (desired === void 0) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): IamInstanceProfile is neither a profile name, an ARN, nor an {Arn,Name} object. The instance was not updated.`, resourceType, logicalId, physicalId));
+				plan.profile = {
+					kind: "set",
+					...desired
+				};
+			}
+		}
+		if (changed("SecurityGroupIds", (a, b) => sameStringSet(a, b))) {
+			const groups = properties["SecurityGroupIds"];
+			if (groups === void 0) plan.securityGroups = { kind: "vpc-default" };
+			else {
+				const ids = Array.isArray(groups) ? groups : void 0;
+				if (ids === void 0 || ids.length === 0 || !ids.every((g) => typeof g === "string" && g !== "")) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): SecurityGroupIds must be a non-empty list of security group ids. The instance was not updated.`, resourceType, logicalId, physicalId));
+				if (!standInSkips("SecurityGroupIds")) plan.securityGroups = {
+					kind: "set",
+					ids
+				};
+			}
+		}
+		const beforeBdm = previousProperties["BlockDeviceMappings"];
+		const afterBdm = properties["BlockDeviceMappings"];
+		if (afterBdm !== void 0 && (context?.changedProperties === void 0 || context.changedProperties.has("BlockDeviceMappings")) && blockDeviceMappingsDifferOnlyInDeleteOnTermination(beforeBdm, afterBdm)) {
+			const flips = [];
+			afterBdm.forEach((m, i) => {
+				const before = beforeBdm[i];
+				const read = (x) => {
+					const ebs = x?.["Ebs"];
+					if (ebs === void 0 || ebs === null) return void 0;
+					return this.coerceBool(ebs["DeleteOnTermination"]) ?? true;
+				};
+				const want = read(m);
+				if (want !== void 0 && want !== read(before) && typeof m["DeviceName"] === "string") flips.push({
+					DeviceName: m["DeviceName"],
+					DeleteOnTermination: want
+				});
+			});
+			if (flips.length > 0) plan.deleteOnTermination = flips;
+		}
+		return plan;
+	}
+	async prepareInstanceMemberUpdates(logicalId, physicalId, resourceType, plan) {
+		const needsStop = plan.instanceType !== void 0 || plan.userData !== void 0;
+		const needsDefaultGroup = plan.securityGroups?.kind === "vpc-default";
+		if (!needsStop && !needsDefaultGroup) return;
+		const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
+		if (needsStop) {
+			const members = [plan.instanceType !== void 0 ? "InstanceType" : "", plan.userData !== void 0 ? "UserData" : ""].filter(Boolean).join(" and ");
+			if (instance?.RootDeviceType === "instance-store") throw markRefusedBeforeApplying(new ResourceUpdateNotSupportedError(resourceType, logicalId, `${members} can change only on a stopped instance, and an instance-store-backed instance cannot be stopped; CloudFormation replaces it. Re-deploy with cdkd deploy --replace.`));
+			const state = instance?.State?.Name;
+			if (!STOPPABLE_INSTANCE_STATES.has(state ?? "")) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} is ${state ?? "not returned by DescribeInstances"}, so its ${members} cannot be changed. The instance was not updated.`, resourceType, logicalId, physicalId));
+		}
+		if (needsDefaultGroup) plan.securityGroups = {
+			kind: "set",
+			ids: [await this.vpcDefaultSecurityGroupId(logicalId, physicalId, resourceType, instance?.VpcId)]
+		};
+	}
+	async applyInstanceMemberUpdates(logicalId, physicalId, resourceType, plan) {
+		const applied = [];
+		if (plan.securityGroups?.kind === "set") {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				Groups: plan.securityGroups.ids
+			}));
+			applied.push("the new SecurityGroupIds");
+		}
+		if (plan.profile !== void 0) {
+			await this.applyInstanceProfileChange(logicalId, physicalId, plan.profile);
+			applied.push(plan.profile.kind === "remove" ? "the IamInstanceProfile removed" : "the new IamInstanceProfile");
+		}
+		if (plan.deleteOnTermination !== void 0) {
+			await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+				InstanceId: physicalId,
+				BlockDeviceMappings: plan.deleteOnTermination.map((f) => ({
+					DeviceName: f.DeviceName,
+					Ebs: { DeleteOnTermination: f.DeleteOnTermination }
+				}))
+			}));
+			applied.push("the new DeleteOnTermination");
+		}
+		if (plan.instanceType === void 0 && plan.userData === void 0) {
+			if (instancesLeftStoppedByCdkd.has(physicalId)) {
+				let state = await this.readInstanceState(physicalId);
+				if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
+				if (state === "stopped") await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
+				instancesLeftStoppedByCdkd.delete(physicalId);
+			}
+			return;
+		}
+		let state = await this.readInstanceState(physicalId);
+		if (state === "pending") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "running");
+		else if (state === "stopping") state = await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
+		if (state !== "stopped" && state !== "running") throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} became ${state ?? "not returned by DescribeInstances"} during the update, so its InstanceType / UserData were not changed`, resourceType, logicalId, physicalId));
+		const startAfter = state === "running" || instancesLeftStoppedByCdkd.has(physicalId);
+		let phase = "stop";
+		let stopIssued = false;
+		try {
+			if (state === "running") {
+				this.logger.info(safeMsg`Stopping EC2 Instance ${logicalId} (${physicalId}) to change its ${plan.instanceType !== void 0 ? "InstanceType" : ""}${plan.instanceType !== void 0 && plan.userData !== void 0 ? " and " : ""}${plan.userData !== void 0 ? "UserData" : ""}; it is started again afterwards`);
+				await this.ec2Client.send(new StopInstancesCommand({ InstanceIds: [physicalId] }));
+				stopIssued = true;
+				await this.waitForInstanceState(logicalId, physicalId, resourceType, "stopped");
+			}
+			phase = "modify";
+			if (plan.instanceType !== void 0) {
+				await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+					InstanceId: physicalId,
+					InstanceType: { Value: plan.instanceType }
+				}));
+				applied.push("the new InstanceType");
+			}
+			if (plan.userData !== void 0) {
+				await this.ec2Client.send(new ModifyInstanceAttributeCommand({
+					InstanceId: physicalId,
+					UserData: { Value: plan.userData }
+				}));
+				applied.push("the new UserData");
+			}
+			if (!startAfter) return;
+			phase = "start";
+			await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
+			instancesLeftStoppedByCdkd.delete(physicalId);
+			if (process.env["CDKD_NO_WAIT"] === "true") {
+				this.logger.debug(safeMsg`Instance ${physicalId} started (skipping running-state wait per --no-wait)`);
+				return;
+			}
+			phase = "wait";
+			await this.waitForInstanceState(logicalId, physicalId, resourceType, "running", { stoppedIsTerminal: true });
+		} catch (error) {
+			const carries = applied.length === 0 ? "its previous settings" : `${applied.join(" and ")} already applied`;
+			const startCommand = `aws ec2 start-instances --instance-ids ${physicalId}`;
+			if (phase === "stop" && !stopIssued) throw error;
+			if (phase === "wait") {
+				if (instanceStoppedAfterStart.has(error)) {
+					instancesLeftStoppedByCdkd.add(physicalId);
+					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} stopped again right after cdkd started it, with ${carries}. Start it with: ${startCommand}`);
+				}
+				throw error;
+			}
+			if (!stopIssued && !startAfter) throw error;
+			if (phase !== "start" && !isInterruptedWaitError(error) && !enclosingDeadlineExpired()) {
+				let startFailure;
+				try {
+					await this.ec2Client.send(new StartInstancesCommand({ InstanceIds: [physicalId] }));
+				} catch (e) {
+					startFailure = e ?? /* @__PURE__ */ new Error("StartInstances failed");
+				}
+				if (startFailure === void 0) {
+					instancesLeftStoppedByCdkd.delete(physicalId);
+					this.logger.warn(safeMsg`${logicalId}: the InstanceType / UserData change failed after instance ${physicalId} was stopped; cdkd started it again, with ${carries}.`);
+				} else {
+					instancesLeftStoppedByCdkd.add(physicalId);
+					this.logger.warn(safeMsg`${logicalId}: instance ${physicalId} was stopped for an InstanceType / UserData change that failed, and starting it again failed too (${describeAwsFailure(startFailure).summary}); it is stopped, with ${carries}. Start it with: ${startCommand}`);
+				}
+				throw error;
+			}
+			instancesLeftStoppedByCdkd.add(physicalId);
+			this.logger.warn(phase === "stop" ? safeMsg`${logicalId}: instance ${physicalId} was being stopped for an InstanceType / UserData change that did not finish. Once it is stopped, start it with: ${startCommand}` : safeMsg`${logicalId}: instance ${physicalId} is stopped, with ${carries}; cdkd did not start it again. Start it with: ${startCommand}`);
+			throw error;
+		}
+	}
+	async readInstanceState(physicalId) {
+		return (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0]?.State?.Name;
+	}
+	async waitForInstanceState(logicalId, physicalId, resourceType, target, opts = {}) {
+		const watch = startInterruptWatch(`EC2 Instance ${logicalId} ${target} wait`);
+		const capAt = Date.now() + INSTANCE_STATE_WAIT_CAP_MS;
+		let last;
+		let stoppedReads = 0;
+		try {
+			for (;;) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				if (Math.min(enclosingDeadlineRemainingMs(), capAt - Date.now()) <= 0) throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): timed out waiting for instance ${physicalId} to be ${target} (last state: ${last ?? "none reported"})`, resourceType, logicalId, physicalId));
+				const previous = last;
+				last = await this.readInstanceState(physicalId);
+				if (last === target) return last;
+				stoppedReads = last === "stopped" ? stoppedReads + 1 : 0;
+				if (opts.stoppedIsTerminal === true && last === "stopped" && (previous === "pending" || stoppedReads >= STOPPED_AFTER_START_READS)) {
+					const stopped = markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} stopped again right after it was started; run \`aws ec2 describe-instances --instance-ids ${physicalId}\` and read StateReason for AWS's cause`, resourceType, logicalId, physicalId));
+					instanceStoppedAfterStart.add(stopped);
+					throw stopped;
+				}
+				if (last === "terminated" || last === "shutting-down" || last === void 0) throw markNonRetryable(new ProvisioningError(`${logicalId} (${resourceType}): instance ${physicalId} is ${last ?? "no longer returned by DescribeInstances"} while cdkd waited for it to be ${target}`, resourceType, logicalId, physicalId));
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				await this.sleep(Math.max(0, Math.min(INSTANCE_STATE_POLL_MS, enclosingDeadlineRemainingMs())));
+			}
+		} finally {
+			watch.dispose();
+		}
+	}
+	async vpcDefaultSecurityGroupId(logicalId, physicalId, resourceType, vpcId) {
+		const id = (vpcId === void 0 ? void 0 : await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [{
+			Name: "vpc-id",
+			Values: [vpcId]
+		}, {
+			Name: "group-name",
+			Values: ["default"]
+		}] })))?.SecurityGroups?.[0]?.GroupId;
+		if (id === void 0) throw refusedBeforeApplying(new ProvisioningError(`${logicalId} (${resourceType}): SecurityGroupIds was removed, and the default security group of instance ${physicalId}'s VPC (${vpcId ?? "unknown"}) could not be found to put in its place. The instance was not updated.`, resourceType, logicalId, physicalId));
+		return id;
+	}
+	async applyInstanceProfileChange(logicalId, physicalId, change) {
+		let assoc = await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
+			Name: "instance-id",
+			Values: [physicalId]
+		}] }));
+		for (let poll = 1; poll <= PROFILE_DISASSOCIATING_POLLS && (assoc.IamInstanceProfileAssociations ?? []).some((a) => a.State === "disassociating"); poll++) {
+			await this.sleep(PROFILE_DISASSOCIATING_DELAY_MS);
+			assoc = await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
+				Name: "instance-id",
+				Values: [physicalId]
+			}] }));
+		}
+		const current = assoc.IamInstanceProfileAssociations?.find((a) => a.State === "associated" || a.State === "associating");
+		if (change.kind === "remove") {
+			if (current?.AssociationId === void 0) return;
+			await this.ec2Client.send(new DisassociateIamInstanceProfileCommand({ AssociationId: current.AssociationId }));
+			return;
+		}
+		const spec = change.arn !== void 0 ? { Arn: change.arn } : { Name: change.name };
+		const maxAttempts = 10;
+		for (let attempt = 1;; attempt++) try {
+			if (current?.AssociationId !== void 0) await this.ec2Client.send(new ReplaceIamInstanceProfileAssociationCommand({
+				AssociationId: current.AssociationId,
+				IamInstanceProfile: spec
+			}));
+			else await this.ec2Client.send(new AssociateIamInstanceProfileCommand({
+				InstanceId: physicalId,
+				IamInstanceProfile: spec
+			}));
+			return;
+		} catch (error) {
+			const msg = describeAwsFailure(error).detail;
+			if (this.isInstanceProfilePropagationError(msg) && attempt < maxAttempts) {
+				this.logger.debug(safeMsg`IAM instance profile not yet propagated for ${logicalId} (${physicalId}) (attempt ${attempt}/${maxAttempts}: ${msg}), retrying in ${attempt}s...`);
+				await this.sleep(attempt * 1e3);
+				continue;
+			}
+			throw error;
+		}
+	}
 	shallowEqual(a, b) {
 		if (b === void 0) return false;
 		const ra = a;
@@ -19140,7 +19676,7 @@ var EC2Provider = class {
 		const raw = obj["CPUCredits"] ?? obj["CpuCredits"];
 		return typeof raw === "string" ? raw : void 0;
 	}
-	buildIpPermission(properties, direction = "ingress") {
+	buildIpPermission(properties, direction = "ingress", inline = false) {
 		const ipProtocol = properties["IpProtocol"] ?? "-1";
 		const fromPort = properties["FromPort"];
 		const toPort = properties["ToPort"];
@@ -19161,8 +19697,9 @@ var EC2Provider = class {
 			permission.Ipv6Ranges = [ipv6Range];
 		}
 		const peerGroupId = direction === "egress" ? properties["DestinationSecurityGroupId"] : properties["SourceSecurityGroupId"];
-		if (peerGroupId) {
-			const groupPair = { GroupId: peerGroupId };
+		const peerGroupName = inline && direction === "ingress" ? properties["SourceSecurityGroupName"] : void 0;
+		if (peerGroupId || peerGroupName) {
+			const groupPair = peerGroupId ? { GroupId: peerGroupId } : { GroupName: peerGroupName };
 			if (direction === "ingress") {
 				const peerOwnerId = properties["SourceSecurityGroupOwnerId"];
 				if (peerOwnerId) groupPair.UserId = peerOwnerId;
@@ -19183,6 +19720,7 @@ var EC2Provider = class {
 			const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
 			const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
 			const peerOwner = direction === "ingress" ? rule["SourceSecurityGroupOwnerId"] : void 0;
+			const peerName = direction === "ingress" ? rule["SourceSecurityGroupName"] : void 0;
 			return JSON.stringify({
 				p: sgProtocolKey(rule["IpProtocol"]),
 				f: rule["FromPort"] ?? null,
@@ -19190,6 +19728,7 @@ var EC2Provider = class {
 				c4: rule["CidrIp"] ?? null,
 				c6: rule["CidrIpv6"] ?? null,
 				peer: peerKey ?? null,
+				peerName: peerKey ? null : peerName ?? null,
 				peerOwner: peerOwner ?? null,
 				pl: prefixKey ?? null,
 				d: rule["Description"] ?? null
@@ -19218,7 +19757,7 @@ var EC2Provider = class {
 				}));
 				else await this.ec2Client.send(new RevokeSecurityGroupIngressCommand({
 					GroupId: groupId,
-					IpPermissions: [this.buildIpPermission(rule, "ingress")]
+					IpPermissions: [this.buildIpPermission(rule, "ingress", true)]
 				}));
 			} catch (error) {
 				if (!this.isNotFoundError(error)) throw error;
@@ -19231,7 +19770,7 @@ var EC2Provider = class {
 			}));
 			else await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
-				IpPermissions: [this.buildIpPermission(rule, "ingress")]
+				IpPermissions: [this.buildIpPermission(rule, "ingress", true)]
 			}));
 		} catch (error) {
 			if (!(error instanceof Error && error.message.includes("already exists"))) throw error;
@@ -19364,7 +19903,7 @@ var EC2Provider = class {
 		const egress = properties["Egress"] ?? false;
 		const parts = physicalId.split("|");
 		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
-		if (typeof networkAclId !== "string" || ruleNumber === void 0 || parts[0] !== networkAclId || parts[1] !== String(ruleNumber) || parts[2] !== String(egress)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "NetworkAclId, RuleNumber and Egress identify the entry and are createOnly; a change to any of them requires a new entry. Re-deploy with cdkd deploy --replace, or destroy + redeploy.");
+		if (typeof networkAclId !== "string" || ruleNumber === void 0 || parts[0] !== networkAclId || parts[1] !== String(ruleNumber) || parts[2] !== String(egress)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "NetworkAclId, RuleNumber and Egress identify the entry and are createOnly; a change to any of them requires a new entry. Re-deploy with cdkd deploy --replace, or destroy + redeploy");
 		if (properties["Protocol"] == null || !properties["RuleAction"]) throw new ProvisioningError(`Protocol and RuleAction are required for NetworkAclEntry ${logicalId}`, resourceType, logicalId, physicalId);
 		const ruleParams = networkAclEntryRuleParams(properties, properties["Icmp"] !== void 0 && properties["IcmpTypeCode"] !== void 0 && JSON.stringify(properties["Icmp"]) === JSON.stringify(previousProperties["Icmp"]) && JSON.stringify(properties["IcmpTypeCode"]) !== JSON.stringify(previousProperties["IcmpTypeCode"]));
 		if (context?.desiredFromAwsReadback === true && ruleParams.CidrBlock !== void 0 && ruleParams.Ipv6CidrBlock !== void 0) {
@@ -24558,6 +25097,8 @@ function camelToPascalCaseKeys(value, preserveKeys) {
 
 //#endregion
 //#region src/provisioning/providers/agentcore-runtime-provider.ts
+const CFN_MAP_KEYS = /* @__PURE__ */ new Set(["Tags", "AdvertisedScopeMapping"]);
+const SDK_MAP_KEYS = /* @__PURE__ */ new Set(["tags", "advertisedScopeMapping"]);
 var AgentCoreRuntimeProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreRuntimeProvider");
@@ -24595,16 +25136,16 @@ var AgentCoreRuntimeProvider = class {
 				agentRuntimeName,
 				roleArn
 			};
-			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"]);
-			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"]);
+			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"], CFN_MAP_KEYS);
+			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"], CFN_MAP_KEYS);
 			if (properties["Description"] !== void 0) input["description"] = properties["Description"];
-			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"]);
+			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"], CFN_MAP_KEYS);
 			if (properties["ProtocolConfiguration"] !== void 0) {
 				const proto = properties["ProtocolConfiguration"];
 				if (typeof proto === "string") input["protocolConfiguration"] = { serverProtocol: proto };
-				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto);
+				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto, CFN_MAP_KEYS);
 			}
-			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"]);
+			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
 			const response = await this.client.send(new CreateAgentRuntimeCommand(input));
@@ -24630,16 +25171,16 @@ var AgentCoreRuntimeProvider = class {
 				agentRuntimeId: physicalId,
 				roleArn
 			};
-			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"]);
-			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"]);
+			if (properties["AgentRuntimeArtifact"] !== void 0) input["agentRuntimeArtifact"] = pascalToCamelCaseKeys(properties["AgentRuntimeArtifact"], CFN_MAP_KEYS);
+			if (properties["NetworkConfiguration"] !== void 0) input["networkConfiguration"] = pascalToCamelCaseKeys(properties["NetworkConfiguration"], CFN_MAP_KEYS);
 			if (properties["Description"] !== void 0) input["description"] = properties["Description"];
-			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"]);
+			if (properties["AuthorizerConfiguration"] !== void 0) input["authorizerConfiguration"] = pascalToCamelCaseKeys(properties["AuthorizerConfiguration"], CFN_MAP_KEYS);
 			if (properties["ProtocolConfiguration"] !== void 0) {
 				const proto = properties["ProtocolConfiguration"];
 				if (typeof proto === "string") input["protocolConfiguration"] = { serverProtocol: proto };
-				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto);
+				else input["protocolConfiguration"] = pascalToCamelCaseKeys(proto, CFN_MAP_KEYS);
 			}
-			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"]);
+			if (properties["LifecycleConfiguration"] !== void 0 && typeof properties["LifecycleConfiguration"] === "object" && properties["LifecycleConfiguration"] !== null && Object.keys(properties["LifecycleConfiguration"]).length > 0) input["lifecycleConfiguration"] = pascalToCamelCaseKeys(properties["LifecycleConfiguration"], CFN_MAP_KEYS);
 			if (properties["EnvironmentVariables"] !== void 0) input["environmentVariables"] = properties["EnvironmentVariables"];
 			if (properties["ClientToken"] !== void 0) input["clientToken"] = properties["ClientToken"];
 			const response = await this.client.send(new UpdateAgentRuntimeCommand(input));
@@ -24681,7 +25222,7 @@ var AgentCoreRuntimeProvider = class {
 		if (response.agentRuntimeVersion !== void 0) attributes["AgentRuntimeVersion"] = response.agentRuntimeVersion;
 		if (response.status !== void 0) attributes["Status"] = response.status;
 		if (response.createdAt !== void 0) attributes["CreatedAt"] = response.createdAt.toISOString();
-		if (response.workloadIdentityDetails !== void 0) attributes["WorkloadIdentityDetails"] = camelToPascalCaseKeys(response.workloadIdentityDetails);
+		if (response.workloadIdentityDetails !== void 0) attributes["WorkloadIdentityDetails"] = camelToPascalCaseKeys(response.workloadIdentityDetails, SDK_MAP_KEYS);
 		return attributes;
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -24710,17 +25251,17 @@ var AgentCoreRuntimeProvider = class {
 		const result = {};
 		if (resp.agentRuntimeName !== void 0) result["AgentRuntimeName"] = resp.agentRuntimeName;
 		if (resp.roleArn !== void 0) result["RoleArn"] = resp.roleArn;
-		if (resp.agentRuntimeArtifact !== void 0) result["AgentRuntimeArtifact"] = camelToPascalCaseKeys(resp.agentRuntimeArtifact);
-		if (resp.networkConfiguration !== void 0) result["NetworkConfiguration"] = camelToPascalCaseKeys(resp.networkConfiguration);
+		if (resp.agentRuntimeArtifact !== void 0) result["AgentRuntimeArtifact"] = camelToPascalCaseKeys(resp.agentRuntimeArtifact, SDK_MAP_KEYS);
+		if (resp.networkConfiguration !== void 0) result["NetworkConfiguration"] = camelToPascalCaseKeys(resp.networkConfiguration, SDK_MAP_KEYS);
 		result["Description"] = resp.description ?? "";
-		if (resp.authorizerConfiguration !== void 0) result["AuthorizerConfiguration"] = camelToPascalCaseKeys(resp.authorizerConfiguration);
+		if (resp.authorizerConfiguration !== void 0) result["AuthorizerConfiguration"] = camelToPascalCaseKeys(resp.authorizerConfiguration, SDK_MAP_KEYS);
 		if (resp.protocolConfiguration !== void 0) {
 			const proto = resp.protocolConfiguration;
 			const keys = Object.keys(proto);
 			if (keys.length === 1 && keys[0] === "serverProtocol" && typeof proto["serverProtocol"] === "string") result["ProtocolConfiguration"] = proto["serverProtocol"];
-			else result["ProtocolConfiguration"] = camelToPascalCaseKeys(resp.protocolConfiguration);
+			else result["ProtocolConfiguration"] = camelToPascalCaseKeys(resp.protocolConfiguration, SDK_MAP_KEYS);
 		}
-		if (resp.lifecycleConfiguration !== void 0) result["LifecycleConfiguration"] = camelToPascalCaseKeys(resp.lifecycleConfiguration);
+		if (resp.lifecycleConfiguration !== void 0) result["LifecycleConfiguration"] = camelToPascalCaseKeys(resp.lifecycleConfiguration, SDK_MAP_KEYS);
 		if (resp.environmentVariables !== void 0) result["EnvironmentVariables"] = resp.environmentVariables;
 		return result;
 	}
@@ -29871,7 +30412,7 @@ var DocDBProvider = class {
 			createdResourceId = response.DBCluster?.DbClusterResourceId;
 			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
-			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
+			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier);
 			return {
 				physicalId: dbClusterIdentifier,
 				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
@@ -30026,7 +30567,7 @@ var DocDBProvider = class {
 			createdResourceId = response.DBInstance?.DbiResourceId;
 			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
-			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
+			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(logicalId, dbInstanceIdentifier);
 			return {
 				physicalId: dbInstanceIdentifier,
 				attributes: instanceAttributes(await this.describeDBInstance(dbInstanceIdentifier))
@@ -30161,7 +30702,7 @@ var DocDBProvider = class {
 	}
 	requireClusterWhileWaiting(cluster, logicalId, change) {
 		if (cluster === void 0) throw new Error(safeMsg`DescribeDBClusters returned no cluster for DocDB DBCluster ${logicalId} while waiting for its new ${change}`);
-		if (isTerminalDbStatus(cluster.Status)) throw new Error(safeMsg`DocDB DBCluster ${logicalId} entered status ${cluster.Status ?? ""} while applying its new ${change}`);
+		if (isTerminalDbWaitStatus(cluster.Status)) throw new Error(safeMsg`DocDB DBCluster ${logicalId} entered status ${cluster.Status ?? ""} while applying its new ${change}`);
 		return cluster;
 	}
 	async waitForClusterPortApplied(dbClusterIdentifier, logicalId, port, maxWaitMs = 18e5) {
@@ -30210,13 +30751,14 @@ var DocDBProvider = class {
 			remainingMs: enclosingDeadlineRemainingMs()
 		});
 	}
-	async waitForClusterAvailable(dbClusterIdentifier, maxWaitMs = 18e5) {
+	async waitForClusterAvailable(logicalId, dbClusterIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
 		let delay = 5e3;
 		while (Date.now() - startTime < maxWaitMs) {
 			const status = (await this.describeDBCluster(dbClusterIdentifier))?.Status;
 			this.logger.debug(`DocDB DBCluster ${dbClusterIdentifier} status: ${status}`);
 			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`DocDB DBCluster ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
 			await this.sleep(delay);
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -30240,13 +30782,14 @@ var DocDBProvider = class {
 		}
 		throw new Error(`Timed out waiting for DocDB DBCluster ${logicalId} to be deleted`);
 	}
-	async waitForInstanceAvailable(dbInstanceIdentifier, maxWaitMs = 18e5) {
+	async waitForInstanceAvailable(logicalId, dbInstanceIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
 		let delay = 1e4;
 		while (Date.now() - startTime < maxWaitMs) {
 			const status = (await this.describeDBInstance(dbInstanceIdentifier))?.DBInstanceStatus;
 			this.logger.debug(`DocDB DBInstance ${dbInstanceIdentifier} status: ${status}`);
 			if (status === "available") return;
+			if (isTerminalDbWaitStatus(status)) throw new Error(safeMsg`DocDB DBInstance ${logicalId} entered status ${status ?? ""} while being created, which it does not leave on its own`);
 			await this.sleep(delay);
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -30511,6 +31054,18 @@ var DocDBSubnetGroupProvider = class {
 function isZoneDisabledForMutationError(error) {
 	return error instanceof Error && error.message.includes("is marked disabled for mutation");
 }
+function declaresAcceleratedRecovery(properties, acceptReadSideKey = false) {
+	const features = properties["HostedZoneFeatures"];
+	if (isTruthyCfnBoolean(features?.["EnableAcceleratedRecovery"])) return true;
+	const legacyStatus = features?.["AcceleratedRecoveryStatus"];
+	return acceptReadSideKey && features?.["EnableAcceleratedRecovery"] === void 0 && typeof legacyStatus === "string" && ACCELERATED_RECOVERY_ON_STATUSES.has(legacyStatus);
+}
+const ACCELERATED_RECOVERY_ON_STATUSES = /* @__PURE__ */ new Set([
+	"ENABLED",
+	"ENABLING",
+	"ENABLING_HOSTED_ZONE_LOCKED",
+	"DISABLE_FAILED"
+]);
 var HostedZoneNameNotFoundError = class HostedZoneNameNotFoundError extends ProvisioningError {
 	constructor(message, resourceType, logicalId, physicalId, cause) {
 		super(message, resourceType, logicalId, physicalId, cause);
@@ -30726,26 +31281,29 @@ var Route53Provider = class {
 			}
 			await this.applyHostedZoneTags(zoneId, properties, logicalId, void 0, mask);
 			await this.applyQueryLoggingConfig(zoneId, properties, logicalId);
-			if (properties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED") try {
-				await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
-					HostedZoneId: zoneId,
-					EnableAcceleratedRecovery: true
-				}));
-			} catch (uhfError) {
-				this.logger.error(`UpdateHostedZoneFeatures failed for ${zoneId} after CreateHostedZone — rolling back the hosted zone to keep deploy retry idempotent`);
+			if (declaresAcceleratedRecovery(properties)) {
 				try {
-					await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
-					await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
-					zoneRolledBack = true;
-					callerReferenceToken.release();
-				} catch (deleteError) {
-					const head = `Best-effort rollback DeleteHostedZone for ${zoneId} also failed: `;
-					const m = maskerOrIdentity(mask);
-					this.logger.warn(m(`${head}${this.warnFailureText(head, deleteError, mask)} The operator may need to clean up the orphan zone.`));
+					await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
+						HostedZoneId: zoneId,
+						EnableAcceleratedRecovery: true
+					}));
+				} catch (uhfError) {
+					this.logger.error(`UpdateHostedZoneFeatures failed for ${zoneId} after CreateHostedZone — rolling back the hosted zone to keep deploy retry idempotent`);
+					try {
+						await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
+						await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
+						zoneRolledBack = true;
+						callerReferenceToken.release();
+					} catch (deleteError) {
+						const head = `Best-effort rollback DeleteHostedZone for ${zoneId} also failed: `;
+						const m = maskerOrIdentity(mask);
+						this.logger.warn(m(`${head}${this.warnFailureText(head, deleteError, mask)} The operator may need to clean up the orphan zone.`));
+					}
+					const cause = uhfError instanceof Error ? uhfError : void 0;
+					markAuxiliaryFailure(uhfError, logicalId);
+					throw this.wrapCaughtError(mask, uhfError, (text) => new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${text}`, resourceType, logicalId, zoneId, cause));
 				}
-				const cause = uhfError instanceof Error ? uhfError : void 0;
-				markAuxiliaryFailure(uhfError, logicalId);
-				throw this.wrapCaughtError(mask, uhfError, (text) => new ProvisioningError(`Failed to enable Accelerated Recovery on hosted zone ${logicalId} (${zoneId}): ${text}`, resourceType, logicalId, zoneId, cause));
+				await this.waitForAcceleratedRecoveryFeatureSettled(zoneId, logicalId, resourceType, true, true);
 			}
 			const nameServers = response.DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully created hosted zone ${logicalId}: ${zoneId}`);
@@ -30823,12 +31381,15 @@ var Route53Provider = class {
 			await this.applyHostedZoneTags(physicalId, properties, logicalId, previousProperties, mask);
 			await this.applyQueryLoggingConfig(physicalId, properties, logicalId, previousProperties);
 			await this.syncVPCAssociations(physicalId, properties, logicalId);
-			const prevEnabled = previousProperties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED";
-			const nextEnabled = properties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED";
-			if (prevEnabled !== nextEnabled) await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
-				HostedZoneId: physicalId,
-				EnableAcceleratedRecovery: nextEnabled
-			}));
+			const prevEnabled = declaresAcceleratedRecovery(previousProperties, true);
+			const nextEnabled = declaresAcceleratedRecovery(properties, context?.desiredFromAwsReadback === true);
+			if (prevEnabled !== nextEnabled) {
+				await this.getClient().send(new UpdateHostedZoneFeaturesCommand({
+					HostedZoneId: physicalId,
+					EnableAcceleratedRecovery: nextEnabled
+				}));
+				await this.waitForAcceleratedRecoveryFeatureSettled(physicalId, logicalId, resourceType, nextEnabled);
+			}
 			const nameServers = (await this.getClient().send(new GetHostedZoneCommand({ Id: physicalId }))).DelegationSet?.NameServers ?? [];
 			this.logger.debug(`Successfully updated hosted zone ${logicalId}`);
 			if (context?.desiredFromAwsReadback !== true && declaresNoVpcs(properties["VPCs"]) && Array.isArray(previousProperties["VPCs"]) && previousProperties["VPCs"].length > 0) this.logger.warn(context?.replayingState ? safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs is absent from the state being restored, so the rollback leaves the zone's VPC associations in place. ${VPCS_KEPT_ON_REMOVAL_NOTE}` : safeMsg`${logicalId} (AWS::Route53::HostedZone): VPCs was removed from the template, and the zone keeps its current VPC associations, as CloudFormation leaves them. ${VPCS_KEPT_ON_REMOVAL_NOTE}`);
@@ -31083,25 +31644,43 @@ var Route53Provider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete record set ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType) {
+	async waitForAcceleratedRecoveryFeatureSettled(zoneId, logicalId, resourceType, enabled, freshZone = false) {
+		const verb = enabled ? "enable" : "disable";
+		await this.waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType, {
+			blocked: `the hosted zone ${logicalId} can be deployed`,
+			retry: `after the ${verb} of Accelerated Recovery (hosted zone ${logicalId}); re-run the deploy once the transition settles`,
+			settledAt: enabled ? "ENABLED" : "DISABLED",
+			freshZone
+		});
+	}
+	async waitForAcceleratedRecoveryMutable(zoneId, logicalId, resourceType, purpose = {
+		blocked: `the record set ${logicalId} can be deleted`,
+		retry: `(record set ${logicalId}); re-run the destroy once the transition settles`
+	}) {
 		const client = this.getClient();
 		const parsedInterval = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_INTERVAL_MS"] ?? "15000", 10);
 		const pollIntervalMs = Number.isFinite(parsedInterval) && parsedInterval > 0 ? parsedInterval : 15e3;
 		const parsedTimeout = Number.parseInt(process.env["CDKD_R53_ACCEL_RECOVERY_POLL_TIMEOUT_MS"] ?? "600000", 10);
 		const timeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? parsedTimeout : 6e5;
 		const deadline = Date.now() + timeoutMs;
-		const TERMINAL_FAILED = /* @__PURE__ */ new Set(["ENABLE_FAILED", "DISABLE_FAILED"]);
-		const MUTABLE = /* @__PURE__ */ new Set(["ENABLED", "DISABLED"]);
+		const TERMINAL_FAILED = new Set(purpose.settledAt === "ENABLED" ? ["ENABLE_FAILED"] : purpose.settledAt === "DISABLED" ? ["DISABLE_FAILED"] : ["ENABLE_FAILED", "DISABLE_FAILED"]);
+		const MUTABLE = new Set(purpose.settledAt !== void 0 ? [purpose.settledAt] : ["ENABLED", "DISABLED"]);
+		let sawTransition = purpose.settledAt === void 0 || purpose.freshZone === true;
+		let lastStatus;
 		while (Date.now() < deadline) {
 			let status;
 			try {
 				status = (await client.send(new GetHostedZoneCommand({ Id: zoneId }))).HostedZone?.Features?.AcceleratedRecoveryStatus;
 			} catch (err) {
-				if (err instanceof Error && err.name === "NoSuchHostedZone") return;
+				if (err instanceof Error && err.name === "NoSuchHostedZone" && purpose.settledAt === void 0) return;
 				throw err;
 			}
-			if (status === void 0 || MUTABLE.has(status)) return;
-			if (TERMINAL_FAILED.has(status)) throw new ProvisioningError(`Cannot mutate hosted zone ${zoneId}: AcceleratedRecoveryStatus is '${status}' — operator must resolve before the record set ${logicalId} can be deleted`, resourceType, logicalId, zoneId);
+			if (status === void 0) {
+				if (purpose.settledAt !== "ENABLED") return;
+			} else if (MUTABLE.has(status)) return;
+			lastStatus = status;
+			if (status?.includes("ING") === true) sawTransition = true;
+			if (status !== void 0 && sawTransition && TERMINAL_FAILED.has(status)) throw new ProvisioningError(`Cannot mutate hosted zone ${zoneId}: AcceleratedRecoveryStatus is '${status}' — operator must resolve before ${purpose.blocked}`, resourceType, logicalId, zoneId);
 			this.logger.debug(`Polling AcceleratedRecoveryStatus for ${zoneId}: ${status} (waiting for a mutable state, will re-poll in ~${pollIntervalMs}ms)`);
 			const sliceEnd = Math.min(Date.now() + pollIntervalMs, deadline);
 			while (Date.now() < sliceEnd) {
@@ -31110,7 +31689,7 @@ var Route53Provider = class {
 				await new Promise((resolve) => setTimeout(resolve, tick));
 			}
 		}
-		throw new ProvisioningError(`Timed out after ${timeoutMs}ms waiting for AcceleratedRecoveryStatus to reach a mutable state on hosted zone ${zoneId} (record set ${logicalId}); re-run the destroy once the transition settles`, resourceType, logicalId, zoneId);
+		throw new ProvisioningError(`Timed out after ${timeoutMs}ms waiting for AcceleratedRecoveryStatus to reach a mutable state on hosted zone ${zoneId} ${purpose.retry}${purpose.settledAt !== void 0 ? ` (last status: ${lastStatus ?? "none"})` : ""}`, resourceType, logicalId, zoneId);
 	}
 	buildResourceRecordSet(properties) {
 		const name = properties["Name"];
@@ -31418,7 +31997,8 @@ var Route53Provider = class {
 			const bare = resp.DelegationSet.Id.replace(/^\/delegationset\//, "");
 			result["DelegationSetId"] = properties?.["DelegationSetId"] === `/delegationset/${bare}` ? `/delegationset/${bare}` : bare;
 		}
-		if (resp.HostedZone.Features?.AcceleratedRecoveryStatus !== void 0) result["HostedZoneFeatures"] = { AcceleratedRecoveryStatus: resp.HostedZone.Features.AcceleratedRecoveryStatus };
+		const acceleratedRecoveryStatus = resp.HostedZone.Features?.AcceleratedRecoveryStatus;
+		if (acceleratedRecoveryStatus !== void 0) result["HostedZoneFeatures"] = { EnableAcceleratedRecovery: ACCELERATED_RECOVERY_ON_STATUSES.has(acceleratedRecoveryStatus) };
 		if (resp.HostedZone.Config?.PrivateZone === true) result["VPCs"] = (resp.VPCs ?? []).map((v) => {
 			const out = {};
 			if (v.VPCId !== void 0) out["VPCId"] = v.VPCId;
@@ -33179,7 +33759,7 @@ var CognitoUserPoolProvider = class {
 //#region src/provisioning/providers/elasticache-provider.ts
 const CACHE_DELETE_WAIT_MS = Math.max(6e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "DELETE"));
 const NODE_TYPE_MODIFY_WAIT_MS = Math.max(36e5, slowCcOperationTimeoutMs("AWS::ElastiCache::CacheCluster", "UPDATE"));
-const NODE_TYPE_DROPPED_AFTER_MS = 12e4;
+const MODIFY_DROPPED_AFTER_MS = 12e4;
 function availabilityZonesNotCovered(a, b) {
 	const remaining = [...b];
 	const out = [];
@@ -33190,6 +33770,27 @@ function availabilityZonesNotCovered(a, b) {
 	}
 	return out;
 }
+function nodesToRemove(nodes, desiredCount, desiredZones) {
+	const remainingZones = desiredZones === void 0 ? void 0 : [...desiredZones];
+	const named = nodes.filter((n) => n.id !== void 0);
+	const keep = /* @__PURE__ */ new Set();
+	const unnamed = nodes.length - named.length;
+	const byIdDesc = [...named].sort((a, b) => a.id < b.id ? 1 : a.id > b.id ? -1 : 0);
+	for (const node of byIdDesc) {
+		if (keep.size + unnamed >= desiredCount) break;
+		if (remainingZones === void 0) {
+			keep.add(node.id);
+			continue;
+		}
+		const i = node.zone === void 0 ? -1 : remainingZones.indexOf(node.zone);
+		if (i >= 0) {
+			remainingZones.splice(i, 1);
+			keep.add(node.id);
+		}
+	}
+	if (keep.size + unnamed < desiredCount) return void 0;
+	return named.map((n) => n.id).filter((id) => !keep.has(id)).sort();
+}
 var ElastiCacheProvider = class {
 	client;
 	createClient;
@@ -33407,7 +34008,8 @@ var ElastiCacheProvider = class {
 			const sgIds = rawSgIds && rawSgIds.length > 0 ? rawSgIds : void 0;
 			const notificationTopicArn = properties["NotificationTopicArn"];
 			const desiredNodeType = properties["CacheNodeType"];
-			const placement = await this.newNodePlacement(physicalId, properties, previousProperties);
+			const nodeChanges = await this.planNodeChanges(logicalId, physicalId, resourceType, properties, previousProperties);
+			const placement = nodeChanges.placement;
 			this.warnNotAppliedInPlace(logicalId, properties, previousProperties, placement);
 			await this.getClient().send(new ModifyCacheClusterCommand({
 				CacheClusterId: physicalId,
@@ -33417,6 +34019,7 @@ var ElastiCacheProvider = class {
 					NewAvailabilityZones: placement.newAvailabilityZones,
 					...placement.azMode !== void 0 && { AZMode: placement.azMode }
 				},
+				...nodeChanges.removeIds.length > 0 && { CacheNodeIdsToRemove: nodeChanges.removeIds },
 				SecurityGroupIds: sgIds,
 				CacheParameterGroupName: properties["CacheParameterGroupName"],
 				EngineVersion: properties["EngineVersion"],
@@ -33431,7 +34034,7 @@ var ElastiCacheProvider = class {
 				ApplyImmediately: true
 			}));
 			this.logger.debug(`Successfully updated CacheCluster ${logicalId}`);
-			if (desiredNodeType !== void 0) await this.waitForClusterAvailable(physicalId, NODE_TYPE_MODIFY_WAIT_MS, desiredNodeType);
+			if (desiredNodeType !== void 0 || nodeChanges.removeIds.length > 0) await this.waitForClusterAvailable(physicalId, NODE_TYPE_MODIFY_WAIT_MS, desiredNodeType, nodeChanges.removeIds);
 			else await this.waitForClusterAvailable(physicalId);
 			const described = await this.describeCacheCluster(physicalId);
 			this.warnTransitEncryptionNotApplied(logicalId, properties, previousProperties, described?.TransitEncryptionEnabled);
@@ -33495,15 +34098,37 @@ var ElastiCacheProvider = class {
 		const state = current === true ? "ENABLED" : "DISABLED";
 		this.logger.warn(safeMsg`CacheCluster ${logicalId}: the cluster still has encryption in transit ${state} ` + safeMsg`(the template now says TransitEncryptionEnabled: ${String(next)}). ` + "ModifyCacheCluster cannot change it, and CloudFormation leaves it unchanged too; to change it, replace the cluster, for example by changing its logical ID.");
 	}
-	async newNodePlacement(physicalId, properties, previousProperties) {
-		const desired = properties["PreferredAvailabilityZones"];
-		if (!Array.isArray(desired) || desired.length === 0) return void 0;
-		if (isDeepStrictEqual(desired, previousProperties["PreferredAvailabilityZones"]) && String(properties["NumCacheNodes"]) === String(previousProperties["NumCacheNodes"])) return;
-		const newAvailabilityZones = availabilityZonesNotCovered(desired, ((await this.describeCacheCluster(physicalId))?.CacheNodes ?? []).map((n) => n.CustomerAvailabilityZone).filter((az) => typeof az === "string"));
-		if (newAvailabilityZones.length === 0) return void 0;
+	async planNodeChanges(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const none = {
+			placement: void 0,
+			removeIds: []
+		};
+		const desiredZones = properties["PreferredAvailabilityZones"];
+		const zones = Array.isArray(desiredZones) && desiredZones.length > 0 ? desiredZones : void 0;
+		if (!(String(properties["NumCacheNodes"]) !== String(previousProperties["NumCacheNodes"])) && (zones === void 0 || isDeepStrictEqual(zones, previousProperties["PreferredAvailabilityZones"]))) return none;
+		if (zones === void 0 && !(Number(properties["NumCacheNodes"]) < Number(previousProperties["NumCacheNodes"]))) return none;
+		const liveNodes = ((await this.describeCacheCluster(physicalId))?.CacheNodes ?? []).map((n) => ({
+			id: n.CacheNodeId,
+			zone: n.CustomerAvailabilityZone
+		}));
+		const desiredCount = properties["NumCacheNodes"] != null ? Number(properties["NumCacheNodes"]) : void 0;
+		const previousCount = Number(previousProperties["NumCacheNodes"]);
+		const templateLowered = Number(properties["NumCacheNodes"]) < previousCount;
+		let removeIds = [];
+		if (templateLowered && desiredCount !== void 0 && desiredCount < liveNodes.length) {
+			if (liveNodes.length !== previousCount) throw new ProvisioningError(safeMsg`Cannot update CacheCluster ${logicalId}: the template lowers NumCacheNodes from ${String(previousCount)} ` + safeMsg`to ${String(desiredCount)}, but the cluster has ${String(liveNodes.length)} nodes, so ` + "the removal would delete nodes the template change does not account for. Deploy NumCacheNodes set to the live count first, then lower it.", resourceType, logicalId, physicalId);
+			const plan = nodesToRemove(liveNodes, desiredCount, zones);
+			if (plan === void 0) throw new ProvisioningError(safeMsg`Cannot update CacheCluster ${logicalId}: lowering NumCacheNodes to ${String(desiredCount)} ` + "with this PreferredAvailabilityZones list needs a node removed and a node added in a zone no live node occupies, in one update, which ModifyCacheCluster cannot do. Replace the cluster (for example by changing its logical ID), or list only zones the kept nodes occupy.", resourceType, logicalId, physicalId);
+			removeIds = plan;
+			this.logger.info(safeMsg`CacheCluster ${logicalId}: NumCacheNodes ${String(previousProperties["NumCacheNodes"])} -> ${String(desiredCount)}, removing cache nodes ${removeIds.join(", ")}`);
+		}
+		const newAvailabilityZones = zones === void 0 || removeIds.length > 0 ? [] : availabilityZonesNotCovered(zones, liveNodes.filter((n) => n.id === void 0 || !removeIds.includes(n.id)).map((n) => n.zone).filter((z) => typeof z === "string"));
 		return {
-			newAvailabilityZones,
-			azMode: properties["AZMode"]
+			placement: newAvailabilityZones.length > 0 ? {
+				newAvailabilityZones,
+				azMode: properties["AZMode"]
+			} : void 0,
+			removeIds
 		};
 	}
 	warnNotAppliedInPlace(logicalId, properties, previousProperties, placement) {
@@ -33577,7 +34202,7 @@ var ElastiCacheProvider = class {
 			ShowCacheNodeInfo: true
 		}))).CacheClusters?.[0];
 	}
-	async waitForClusterAvailable(cacheClusterId, maxWaitMs = 6e5, expectedNodeType) {
+	async waitForClusterAvailable(cacheClusterId, maxWaitMs = 6e5, expectedNodeType, removedNodeIds = []) {
 		const startTime = Date.now();
 		let delay = 1e4;
 		while (Date.now() - startTime < maxWaitMs) {
@@ -33585,12 +34210,14 @@ var ElastiCacheProvider = class {
 			const status = cluster?.CacheClusterStatus;
 			this.logger.debug(`CacheCluster ${cacheClusterId} status: ${status}`);
 			const liveNodeType = cluster?.CacheNodeType;
-			if (status === "available" && (expectedNodeType === void 0 || liveNodeType === expectedNodeType)) return;
-			if (expectedNodeType !== void 0 && status === "available" && cluster?.PendingModifiedValues?.CacheNodeType === void 0 && Date.now() - startTime > NODE_TYPE_DROPPED_AFTER_MS) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is available with node type ${liveNodeType} and no node-type change pending; the change to ${expectedNodeType} was not applied. Check the cluster's events (aws elasticache describe-events) for the reason, then deploy again.`);
+			const removalDone = removedNodeIds.length === 0 || cluster?.CacheNodes !== void 0 && !cluster.CacheNodes.some((n) => n.CacheNodeId !== void 0 && removedNodeIds.includes(n.CacheNodeId));
+			if (status === "available" && removalDone && (expectedNodeType === void 0 || liveNodeType === expectedNodeType)) return;
+			if (!removalDone && status === "available" && (cluster?.PendingModifiedValues?.CacheNodeIdsToRemove ?? []).length === 0 && Date.now() - startTime > MODIFY_DROPPED_AFTER_MS) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is available and still lists cache nodes ${removedNodeIds.join(", ")} with no removal pending; the removal was not applied. Check the cluster's events (aws elasticache describe-events) for the reason, then deploy again.`);
+			if (expectedNodeType !== void 0 && liveNodeType !== expectedNodeType && status === "available" && cluster?.PendingModifiedValues?.CacheNodeType === void 0 && Date.now() - startTime > MODIFY_DROPPED_AFTER_MS) throw new Error(safeMsg`CacheCluster ${cacheClusterId} is available with node type ${liveNodeType} and no node-type change pending; the change to ${expectedNodeType} was not applied. Check the cluster's events (aws elasticache describe-events) for the reason, then deploy again.`);
 			await this.sleep(delay);
 			delay = Math.min(delay * 2, 1e4);
 		}
-		throw new Error(expectedNodeType === void 0 ? `Timed out waiting for CacheCluster ${cacheClusterId} to become available` : safeMsg`Timed out waiting for CacheCluster ${cacheClusterId} to become available with node type ${expectedNodeType}`);
+		throw new Error(expectedNodeType === void 0 && removedNodeIds.length === 0 ? `Timed out waiting for CacheCluster ${cacheClusterId} to become available` : safeMsg`Timed out waiting for CacheCluster ${cacheClusterId} to become available` + (expectedNodeType === void 0 ? "" : safeMsg` with node type ${expectedNodeType}`) + (removedNodeIds.length === 0 ? "" : safeMsg` without cache nodes ${removedNodeIds.join(", ")}`));
 	}
 	async waitForClusterDeleted(logicalId, cacheClusterId, maxWaitMs = 6e5) {
 		const startTime = Date.now();
@@ -37831,15 +38458,20 @@ function desiredGlueTags(raw, resourceType, logicalId, physicalId) {
 	const tags = refuseMalformedDesiredTags(tagMapAsList(raw), resourceType, logicalId, physicalId, "Tags", GLUE_TAGS_WHAT);
 	return tags.length > 0 ? Object.fromEntries(tags.map((t) => [t.Key, t.Value])) : void 0;
 }
-async function applyGlueTagDiff(client, resourceArn, recorded, desired, resourceType, logicalId, warn) {
+async function applyGlueTagDiff(client, resourceArn, recorded, desired, resourceType, logicalId, warn, unsettled = {
+	forceUpsert: false,
+	beforeWrite: () => void 0
+}) {
 	const plan = planTagDiff(tagMapAsList(recorded), tagMapAsList(desired));
 	const warning = tagPlanWarning(plan, resourceType, logicalId);
 	if (warning !== void 0) warn(warning);
-	if (plan.set.size === 0 && plan.remove.length === 0) return;
+	const toSet = unsettled.forceUpsert ? planTagDiff([], tagMapAsList(desired)).set : plan.set;
+	if (toSet.size === 0 && plan.remove.length === 0) return;
+	unsettled.beforeWrite();
 	const arn = await resourceArn();
-	if (plan.set.size > 0) await client.send(new TagResourceCommand$19({
+	if (toSet.size > 0) await client.send(new TagResourceCommand$19({
 		ResourceArn: arn,
-		TagsToAdd: Object.fromEntries(plan.set)
+		TagsToAdd: Object.fromEntries(toSet)
 	}));
 	if (plan.remove.length > 0) await client.send(new UntagResourceCommand$20({
 		ResourceArn: arn,
@@ -37874,6 +38506,28 @@ const crawlerLeftInPlaceWarning = (logicalId, names, caller) => {
 	const cfnKeeps = names.includes("LineageConfiguration") ? "" : `, as CloudFormation leaves ${one ? "it" : "them"}`;
 	return caller === "rollback" ? safeMsg`${logicalId} (AWS::Glue::Crawler): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateCrawler keeps a setting it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::Glue::Crawler): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template and ${one ? "keeps its" : "keep their"} current AWS value${cfnKeeps}; UpdateCrawler keeps a setting it is not sent. Declare the intended value explicitly to change it.`;
 };
+const CRAWLER_UPDATE_KEYS = [
+	"Role",
+	"Targets",
+	"Classifiers",
+	"Configuration",
+	"CrawlerSecurityConfiguration",
+	"DatabaseName",
+	"Description",
+	"LakeFormationConfiguration",
+	"LineageConfiguration",
+	"RecrawlPolicy",
+	"Schedule",
+	"SchemaChangePolicy",
+	"TablePrefix"
+];
+const TRIGGER_UPDATE_KEYS = [
+	"Description",
+	"Schedule",
+	"Actions",
+	"Predicate",
+	"EventBatchingCondition"
+];
 var GlueCrawlerProvider = class {
 	client;
 	createClient;
@@ -37956,6 +38610,7 @@ var GlueCrawlerProvider = class {
 		const { value: v } = log;
 		log.debug(`Updating Glue Crawler ${logicalId}: ${v(physicalId)}`);
 		desiredGlueTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		try {
 			const updateInput = {
 				Name: physicalId,
@@ -37963,6 +38618,7 @@ var GlueCrawlerProvider = class {
 				...properties["Targets"] !== void 0 && { Targets: toSdkCrawlerTargets(properties["Targets"]) },
 				...buildCrawlerCommonFields(properties)
 			};
+			for (const key of CRAWLER_UPDATE_KEYS) if (JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key])) markUnsettled(key);
 			try {
 				await this.getClient().send(new UpdateCrawlerCommand(updateInput));
 			} catch (err) {
@@ -37972,7 +38628,10 @@ var GlueCrawlerProvider = class {
 					await this.getClient().send(new UpdateCrawlerCommand(updateInput));
 				} else throw err;
 			}
-			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
+			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn, {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			if (!context?.desiredFromAwsReadback) {
 				const removed = context?.removedProperties;
 				const leftInPlace = [];
@@ -38448,6 +39107,7 @@ var GlueTriggerProvider = class {
 		const { value: v } = log;
 		log.debug(`Updating Glue Trigger ${logicalId}: ${v(physicalId)}`);
 		desiredGlueTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		try {
 			let restart = false;
 			try {
@@ -38467,6 +39127,7 @@ var GlueTriggerProvider = class {
 				...properties["EventBatchingCondition"] !== void 0 && { EventBatchingCondition: properties["EventBatchingCondition"] }
 			};
 			let updateError;
+			for (const key of TRIGGER_UPDATE_KEYS) if (JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key])) markUnsettled(key);
 			try {
 				await this.getClient().send(new UpdateTriggerCommand({
 					Name: physicalId,
@@ -38484,7 +39145,10 @@ var GlueTriggerProvider = class {
 				if (restartFailure.redacted) log.debug(`Failed to re-activate Glue Trigger ${v(physicalId)} after a failed update: ${restartFailure.detail}`);
 			}
 			if (updateError !== void 0) throw updateError;
-			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn);
+			await applyGlueTagDiff(this.getClient(), () => this.resourceArn(physicalId), previousProperties["Tags"], properties["Tags"], resourceType, logicalId, log.warn, {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			return {
 				physicalId,
 				wasReplaced: false
@@ -38494,6 +39158,14 @@ var GlueTriggerProvider = class {
 			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to update Glue Trigger ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const state = (await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State;
+			return state === "ACTIVATING" || state === "DEACTIVATING" || state === "CREATING" || state === "UPDATING" ? new Set([...names].filter((name) => name !== "Tags")) : /* @__PURE__ */ new Set();
+		} catch {
+			return names;
+		}
+	}
 	async waitForTriggerDeactivated(physicalId) {
 		for (let attempt = 0; attempt < TRIGGER_DEACTIVATE_MAX_ATTEMPTS; attempt++) {
 			try {
@@ -40052,6 +40724,7 @@ function previousMetricNames(value) {
 	const expanded = expandShardLevelMetrics(value);
 	return isUsableMetricsList(expanded) ? expanded : [];
 }
+const DEFAULT_MAX_RECORD_SIZE_KIB = 1024;
 function readMaxRecordSize(value, mask) {
 	if (value == null) return { kind: "absent" };
 	if (typeof value === "number" && Number.isFinite(value)) return {
@@ -40248,6 +40921,7 @@ var KinesisStreamProvider = class {
 		const desiredRetention = readRetentionHours(properties["RetentionPeriodHours"], mask);
 		if (desiredRetention.kind === "unusable" && context?.replayingState !== true) throw new ProvisioningError(desiredRetention.reason, resourceType, logicalId, physicalId);
 		if (desiredRetention.kind === "unusable") warn(`${desiredRetention.reason}. Replaying a state record, so the retention period of ${physicalId} is left as it is rather than refusing the restore`);
+		const markUnsettled = (key) => context?.markUnsettled?.(key);
 		const previousRetention = readRetentionHours(previousProperties["RetentionPeriodHours"], mask);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -40257,6 +40931,7 @@ var KinesisStreamProvider = class {
 			if (modeChanged) {
 				const streamArn = await this.resolveStreamArn(physicalId);
 				this.logger.debug(`Switching stream mode for ${physicalId}: from ${oldStreamMode} to ${streamMode}`);
+				markUnsettled("StreamModeDetails");
 				await this.getClient().send(new UpdateStreamModeCommand({
 					StreamARN: streamArn,
 					StreamModeDetails: { StreamMode: streamMode }
@@ -40265,9 +40940,10 @@ var KinesisStreamProvider = class {
 			}
 			if (streamMode === "PROVISIONED") {
 				const newShardCount = Number(properties["ShardCount"] ?? 1);
-				const oldShardCount = modeChanged ? await this.getOpenShardCount(physicalId) : Number(previousProperties["ShardCount"] ?? 1);
+				const oldShardCount = modeChanged || context?.unsettledProperties?.has("StreamModeDetails") === true ? await this.getOpenShardCount(physicalId) : Number(previousProperties["ShardCount"] ?? 1);
 				if (newShardCount !== oldShardCount) {
 					this.logger.debug(`Updating shard count for ${physicalId}: from ${oldShardCount} to ${newShardCount}`);
+					markUnsettled("ShardCount");
 					await this.getClient().send(new UpdateShardCountCommand({
 						StreamName: physicalId,
 						TargetShardCount: newShardCount,
@@ -40280,6 +40956,7 @@ var KinesisStreamProvider = class {
 			const effectiveOldRetention = previousRetention.kind === "usable" ? previousRetention.hours ?? 24 : 24;
 			if (desiredRetention.kind !== "unusable" && effectiveNewRetention !== effectiveOldRetention) {
 				this.logger.debug(`Updating retention period for ${physicalId}: from ${effectiveOldRetention} to ${effectiveNewRetention}`);
+				markUnsettled("RetentionPeriodHours");
 				if (effectiveNewRetention > effectiveOldRetention) await this.getClient().send(new IncreaseStreamRetentionPeriodCommand({
 					StreamName: physicalId,
 					RetentionPeriodHours: effectiveNewRetention
@@ -40290,7 +40967,10 @@ var KinesisStreamProvider = class {
 				}));
 				await this.waitForStreamActive(physicalId);
 			}
-			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], {
+				forceUpsert: context?.unsettledProperties?.has("Tags") === true,
+				beforeWrite: () => markUnsettled("Tags")
+			});
 			const newEncryption = properties["StreamEncryption"];
 			const oldEncryption = previousProperties["StreamEncryption"];
 			const oldIsKms = isKmsEncryption(oldEncryption);
@@ -40298,6 +40978,7 @@ var KinesisStreamProvider = class {
 			const oldKeyId = oldIsKms ? oldEncryption["KeyId"] : void 0;
 			const newKeyId = newIsKms ? newEncryption["KeyId"] : void 0;
 			if (oldIsKms !== newIsKms || oldIsKms && newIsKms && oldKeyId !== newKeyId) {
+				markUnsettled("StreamEncryption");
 				if (oldIsKms) {
 					await this.getClient().send(new StopStreamEncryptionCommand({
 						StreamName: physicalId,
@@ -40317,17 +40998,18 @@ var KinesisStreamProvider = class {
 			}
 			const desiredSizeRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"], mask);
 			if (desiredSizeRead.kind === "unusable") warn(`${desiredSizeRead.reason}. Leaving the maximum record size on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
-			const newMaxRecordSize = comparableRecordSize(properties["MaxRecordSizeInKiB"], mask);
-			const oldMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"], mask);
-			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== oldMaxRecordSize) {
-				this.logger.debug(`Updating max record size for ${physicalId}: from ${oldMaxRecordSize ?? "no value"} to ${newMaxRecordSize}`);
+			const newMaxRecordSize = desiredSizeRead.kind === "absent" ? DEFAULT_MAX_RECORD_SIZE_KIB : comparableRecordSize(properties["MaxRecordSizeInKiB"], mask);
+			const recordedMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"], mask);
+			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== (recordedMaxRecordSize ?? DEFAULT_MAX_RECORD_SIZE_KIB)) {
+				this.logger.debug(`Updating max record size for ${physicalId}: from ${recordedMaxRecordSize ?? "no value"} to ${newMaxRecordSize}`);
+				markUnsettled("MaxRecordSizeInKiB");
 				await this.getClient().send(new UpdateMaxRecordSizeCommand({
 					StreamARN: await this.resolveStreamArn(physicalId),
 					MaxRecordSizeInKiB: newMaxRecordSize
 				}));
 				await this.waitForStreamActive(physicalId);
 			}
-			await this.reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn);
+			await this.reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn, markUnsettled);
 			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
 			let desiredMetrics;
 			if (desiredRead.kind === "unusable") warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
@@ -40336,7 +41018,9 @@ var KinesisStreamProvider = class {
 				const desiredSet = desiredRead.kind === "usable" ? desiredRead.metrics : [];
 				const previousSet = previousMetricNames(previousProperties["DesiredShardLevelMetrics"]);
 				const toDisable = previousSet.filter((m) => !desiredSet.includes(m));
+				if (context?.unsettledProperties?.has("DesiredShardLevelMetrics") === true) await this.warnUndeclaredLiveMetrics(physicalId, [...previousSet, ...desiredSet], warn, mask);
 				const toEnable = desiredSet.filter((m) => !previousSet.includes(m));
+				if (toDisable.length > 0 || toEnable.length > 0) markUnsettled("DesiredShardLevelMetrics");
 				if (toDisable.length > 0) {
 					this.logger.debug(`Disabling ${toDisable.length} shard-level metric(s) on ${physicalId}`);
 					await this.getClient().send(new DisableEnhancedMonitoringCommand({
@@ -40448,7 +41132,7 @@ var KinesisStreamProvider = class {
 			throw error;
 		}
 	}
-	async reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn) {
+	async reconcileDistributionStrategy(physicalId, streamMode, properties, previousProperties, mask, warn, markUnsettled) {
 		const desired = readDistributionStrategy(properties["RecordDistributionStrategy"], mask);
 		if (desired.kind === "unusable") {
 			warn(`${desired.reason}. Leaving the record distribution strategy on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
@@ -40466,6 +41150,7 @@ var KinesisStreamProvider = class {
 			target = DEFAULT_RECORD_DISTRIBUTION_STRATEGY;
 		}
 		this.logger.debug(mask(safeMsg`Updating record distribution strategy for ${physicalId}: from ${recorded ?? "no value"} to ${target}`));
+		markUnsettled("RecordDistributionStrategy");
 		await this.getClient().send(new UpdateStreamRecordDistributionStrategyCommand({
 			StreamARN: await this.resolveStreamArn(physicalId),
 			RecordDistributionStrategy: target
@@ -40494,12 +41179,16 @@ var KinesisStreamProvider = class {
 		if (resourceType !== "AWS::Kinesis::Stream") return [];
 		return ["DesiredShardLevelMetrics"];
 	}
-	async applyTagDiff(streamName, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+	async applyTagDiff(streamName, resourceType, logicalId, oldTagsRaw, newTagsRaw, unsettled = {
+		forceUpsert: false,
+		beforeWrite: () => void 0
+	}) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
-		const tagsToAdd = Object.fromEntries(plan.set);
+		const tagsToAdd = Object.fromEntries(unsettled.forceUpsert ? planTagDiff(void 0, newTagsRaw).set : plan.set);
 		const tagsToRemove = plan.remove;
+		if (tagsToRemove.length > 0 || Object.keys(tagsToAdd).length > 0) unsettled.beforeWrite();
 		if (tagsToRemove.length > 0) {
 			await this.getClient().send(new RemoveTagsFromStreamCommand({
 				StreamName: streamName,
@@ -40515,6 +41204,46 @@ var KinesisStreamProvider = class {
 			this.logger.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Kinesis stream ${streamName}`);
 		}
 	}
+	async warnUndeclaredLiveMetrics(physicalId, named, warn, mask) {
+		let live;
+		try {
+			live = ((await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.EnhancedMonitoring ?? []).flatMap((entry) => entry.ShardLevelMetrics ?? []);
+		} catch {
+			return;
+		}
+		const expandedLive = expandShardLevelMetrics(live);
+		const undeclared = (Array.isArray(expandedLive) ? expandedLive : live).filter((metric) => metric !== "ALL" && !named.includes(metric));
+		if (undeclared.length === 0) return;
+		const secretDerived = mask(physicalId) !== physicalId;
+		warn(`Kinesis stream ${physicalId} has shard-level metrics enabled that neither cdkd's record nor the template declares (${undeclared.join(", ")}), so cdkd left them enabled while converging the unsettled DesiredShardLevelMetrics (CloudFormation never disables a metric it did not record). Another tool may have enabled them, or an earlier failed cdkd update may have; cdkd cannot tell which. If they should be off, disable them ` + (secretDerived ? `with DisableEnhancedMonitoring for those metrics.` : `with: aws kinesis disable-enhanced-monitoring --stream-name ${physicalId} --shard-level-metrics ${undeclared.join(" ")} (in the stream's region)`));
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (typeof live !== "object" || live === null) return live;
+		const out = { ...live };
+		if (names.has("DesiredShardLevelMetrics") && Array.isArray(out["DesiredShardLevelMetrics"])) {
+			const named = new Set([recordedProperties, desiredProperties].flatMap((bag) => {
+				const expanded = expandShardLevelMetrics(bag?.["DesiredShardLevelMetrics"]);
+				return isUsableMetricsList(expanded) ? expanded : [];
+			}));
+			const liveMetrics = expandShardLevelMetrics(out["DesiredShardLevelMetrics"]);
+			out["DesiredShardLevelMetrics"] = (Array.isArray(liveMetrics) ? liveMetrics : []).filter((metric) => typeof metric === "string" && named.has(metric));
+		}
+		if (!names.has("ShardCount")) return out;
+		return {
+			...out,
+			ShardCount: await this.getOpenShardCount(physicalId)
+		};
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const status = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.StreamStatus;
+			if (status !== "UPDATING" && status !== "CREATING") return /* @__PURE__ */ new Set();
+			return new Set([...names].filter((name) => name !== "Tags"));
+		} catch {
+			return names;
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType, _properties) {
 		if (resourceType !== "AWS::Kinesis::Stream") return void 0;
 		let stream;
@@ -41280,6 +42009,13 @@ function pipeIdentityToken(name, arn, creationTime) {
 	return `${arn}@${Math.floor(ms / 1e3)}`;
 }
 const SETTLED_STATES = /* @__PURE__ */ new Set(["RUNNING", "STOPPED"]);
+const MOVING_STATES = /* @__PURE__ */ new Set([
+	"CREATING",
+	"UPDATING",
+	"STARTING",
+	"STOPPING",
+	"DELETING"
+]);
 const PIPE_POLL_INTERVAL_MS = 5e3;
 const PIPE_SETTLE_MAX_WAIT_MS = 9e5;
 const PIPE_DELETE_MAX_WAIT_MS = 6e5;
@@ -41573,13 +42309,19 @@ var PipesPipeProvider = class {
 				};
 				const sourceParameters = toUpdateSourceParameters(desired["SourceParameters"], previousProperties["SourceParameters"]);
 				if (sourceParameters !== void 0) input.SourceParameters = sourceParameters;
+				for (const key of this.changedPipeFields(desired, previousProperties)) context?.markUnsettled?.(key);
 				const accepted = await this.getClient().send(new UpdatePipeCommand(input));
 				settled = await this.waitForSettled(physicalId, logicalId, resourceType, "update", mask, accepted.LastModifiedTime);
 			}
-			const plan = planTagDiff(tagMapAsList(previousProperties["Tags"]), tagMapAsList(desiredTags));
+			const recordedPlan = planTagDiff(tagMapAsList(previousProperties["Tags"]), tagMapAsList(desiredTags));
+			const plan = context?.unsettledProperties?.has("Tags") === true ? {
+				...recordedPlan,
+				set: planTagDiff([], tagMapAsList(desiredTags)).set
+			} : recordedPlan;
 			const warning = tagPlanWarning(plan, resourceType, logicalId);
 			if (warning) this.logger.warn(warning);
 			if (plan.set.size > 0 || plan.remove.length > 0) {
+				context?.markUnsettled?.("Tags");
 				settled ??= await this.describe(physicalId);
 				const arn = settled.Arn;
 				if (!arn) throw new Error("DescribePipe returned no Arn, which tagging needs");
@@ -41739,10 +42481,30 @@ var PipesPipeProvider = class {
 		return value;
 	}
 	pipeFieldsChanged(desired, previous) {
+		return this.changedPipeFields(desired, previous).length > 0;
+	}
+	changedPipeFields(desired, previous) {
 		const keys = /* @__PURE__ */ new Set([...Object.keys(desired), ...Object.keys(previous)]);
 		keys.delete("Tags");
-		for (const key of keys) if (JSON.stringify(desired[key]) !== JSON.stringify(previous[key])) return true;
-		return false;
+		return [...keys].filter((key) => JSON.stringify(desired[key]) !== JSON.stringify(previous[key]));
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		try {
+			const state = (await this.describe(physicalId)).CurrentState;
+			if (state === void 0 || !MOVING_STATES.has(state)) return /* @__PURE__ */ new Set();
+			return new Set([...names].filter((name) => name !== "Tags"));
+		} catch {
+			return names;
+		}
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (typeof live !== "object" || live === null) return live;
+		const state = (await this.describe(physicalId)).CurrentState;
+		if (state === void 0 || !state.endsWith("_FAILED")) return live;
+		const out = { ...live };
+		for (const name of names) delete out[name];
+		return out;
 	}
 	async readStateForDelete(name) {
 		try {
@@ -41905,6 +42667,7 @@ var EFSProvider = class {
 	providerRegion = ambientRegion();
 	logger = getLogger().child("EFSProvider");
 	unconfirmedCreationTokens = /* @__PURE__ */ new Map();
+	removalDefaults = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["BackupPolicy", { Status: "DISABLED" }], ["FileSystemProtection", { ReplicationOverwriteProtection: "ENABLED" }]])]]);
 	handledProperties = /* @__PURE__ */ new Map([
 		["AWS::EFS::FileSystem", /* @__PURE__ */ new Set([
 			"FileSystemTags",
@@ -41976,13 +42739,56 @@ var EFSProvider = class {
 	}
 	update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
 		switch (resourceType) {
 			case "AWS::EFS::FileSystem": return this.updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			case "AWS::EFS::MountTarget": return this.updateMountTarget(logicalId, physicalId, resourceType, properties, log);
-			case "AWS::EFS::AccessPoint": return Promise.reject(new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS EFS AccessPoint has no in-place update API — there is no UpdateAccessPoint command; every property change requires DeleteAccessPoint + CreateAccessPoint. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack."));
+			case "AWS::EFS::AccessPoint": return this.updateAccessPoint(logicalId, physicalId, resourceType, properties, previousProperties, log);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
+	async applyTagDiff(resourceId, resourceType, logicalId, recorded, desired, log) {
+		const plan = planTagDiff(recorded, desired);
+		const warning = tagPlanWarning(plan, resourceType, logicalId);
+		if (warning !== void 0) log.warn(warning);
+		if (plan.remove.length > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new UntagResourceCommand$24({
+			ResourceId: resourceId,
+			TagKeys: plan.remove
+		})), `UntagResource ${resourceId}`, log);
+		if (plan.set.size > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new TagResourceCommand$23({
+			ResourceId: resourceId,
+			Tags: [...plan.set].map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		})), `TagResource ${resourceId}`, log);
+	}
+	async updateAccessPoint(logicalId, physicalId, resourceType, properties, previousProperties, log) {
+		const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+		const sameExceptSecretLeaves = (desired, recorded) => {
+			if (desired !== void 0 && typeof recorded === "string" && holdsSecretDerivedEntry(recorded)) return true;
+			if (Array.isArray(desired) && Array.isArray(recorded)) return desired.length === recorded.length && desired.every((d, i) => sameExceptSecretLeaves(d, recorded[i]));
+			if (isPlainObject(desired) && isPlainObject(recorded)) return [.../* @__PURE__ */ new Set([...Object.keys(desired), ...Object.keys(recorded)])].every((k) => sameExceptSecretLeaves(desired[k], recorded[k]));
+			return isDeepStrictEqual(desired, recorded);
+		};
+		const keys = /* @__PURE__ */ new Set([...Object.keys(properties), ...Object.keys(previousProperties)]);
+		for (const key of keys) {
+			if (key === "AccessPointTags") continue;
+			if (!sameExceptSecretLeaves(properties[key], previousProperties[key])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EFS AccessPoint ${key} changed or was removed, and it is immutable on AWS — there is no UpdateAccessPoint command, and only AccessPointTags can change in place; any other property change requires DeleteAccessPoint + CreateAccessPoint. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		refuseMalformedDesiredTags(properties["AccessPointTags"], resourceType, logicalId, physicalId, "AccessPointTags");
+		try {
+			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["AccessPointTags"], properties["AccessPointTags"], log);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update EFS AccessPoint ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		}
+	}
 	async updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties, log) {
 		for (const key of [
 			"Encrypted",
@@ -42006,7 +42812,9 @@ var EFSProvider = class {
 		const backupChanged = changed("BackupPolicy");
 		const policyChanged = changed("FileSystemPolicy") || changed("BypassPolicyLockoutSafetyCheck");
 		const protectionChanged = changed("FileSystemProtection");
-		if (!throughputModeChanged && !provisionedChanged && !lifecycleChanged && !backupChanged && !policyChanged && !protectionChanged) {
+		const tagsChanged = changed("FileSystemTags");
+		if (tagsChanged) refuseMalformedDesiredTags(properties["FileSystemTags"], resourceType, logicalId, physicalId, "FileSystemTags");
+		if (!throughputModeChanged && !provisionedChanged && !lifecycleChanged && !backupChanged && !policyChanged && !protectionChanged && !tagsChanged) {
 			log.debug(`No mutable diff for EFS FileSystem ${logicalId}, skipping update`);
 			return {
 				physicalId,
@@ -42025,8 +42833,12 @@ var EFSProvider = class {
 			}
 			if (lifecycleChanged) await this.applyLifecyclePolicies(physicalId, properties["LifecyclePolicies"], log, previousProperties["LifecyclePolicies"]);
 			if (backupChanged) await this.applyBackupPolicy(physicalId, properties["BackupPolicy"], log);
-			if (policyChanged) await this.applyFileSystemPolicy(physicalId, properties["FileSystemPolicy"], properties["BypassPolicyLockoutSafetyCheck"], log);
+			if (policyChanged) {
+				if (properties["FileSystemPolicy"] === void 0 && previousProperties["FileSystemPolicy"] !== void 0) await this.deleteFileSystemPolicy(physicalId, log);
+				else await this.applyFileSystemPolicy(physicalId, properties["FileSystemPolicy"], properties["BypassPolicyLockoutSafetyCheck"], log);
+			}
 			if (protectionChanged) await this.applyFileSystemProtection(physicalId, properties["FileSystemProtection"], log);
+			if (tagsChanged) await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["FileSystemTags"], properties["FileSystemTags"], log);
 			log.debug(`Successfully updated EFS FileSystem ${logicalId}`);
 			return {
 				physicalId,
@@ -42234,6 +43046,10 @@ var EFSProvider = class {
 		})), `set FileSystemPolicy on ${fileSystemId}`, log);
 		log.debug(`Set FileSystemPolicy on EFS FileSystem ${fileSystemId}`);
 	}
+	async deleteFileSystemPolicy(fileSystemId, log) {
+		await this.retryOnTransientControlPlane(() => this.getClient().send(new DeleteFileSystemPolicyCommand({ FileSystemId: fileSystemId })), `delete FileSystemPolicy on ${fileSystemId}`, log);
+		log.debug(`Deleted FileSystemPolicy on EFS FileSystem ${fileSystemId}`);
+	}
 	async applyFileSystemProtection(fileSystemId, spec, log) {
 		if (spec === void 0 || spec === null) return;
 		const protection = spec.ReplicationOverwriteProtection;
@@ -42742,6 +43558,23 @@ const routeTableDelta = (next, prev) => {
 		...remove.length > 0 && { remove }
 	};
 };
+const STALE_FAILED_READS = 3;
+const ALIAS_NON_BLOCKING_ACTIONS = /* @__PURE__ */ new Set(["STORAGE_OPTIMIZATION", "IOPS_OPTIMIZATION"]);
+const runningAliasBlockingActions = (fs) => (fs.AdministrativeActions ?? []).filter((a) => (a.Status === "PENDING" || a.Status === "IN_PROGRESS") && !ALIAS_NON_BLOCKING_ACTIONS.has(a.AdministrativeActionType ?? "")).map((a) => a.AdministrativeActionType ?? "unknown");
+const isAdministrativeActionInProgress = (error) => error instanceof Error && error.name === "BadRequest" && /in progress/i.test(describeAwsFailure(error).detail);
+const isTransientFsxError = (error) => {
+	const name = error instanceof Error ? error.name : "";
+	return name === "ThrottlingException" || name === "ServiceLimitExceeded" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(describeAwsFailure(error).detail);
+};
+const aliasDelta = (next, prev) => {
+	const names = (value) => new Set((Array.isArray(value) ? value : []).filter((v) => typeof v === "string").map((v) => v.toLowerCase()));
+	const nextNames = names(next);
+	const prevNames = names(prev);
+	return {
+		add: [...nextNames].filter((n) => !prevNames.has(n)),
+		remove: [...prevNames].filter((n) => !nextNames.has(n))
+	};
+};
 const TOP_LEVEL_IMMUTABLE_PROPS = [
 	"FileSystemType",
 	"SubnetIds",
@@ -43144,11 +43977,16 @@ var FSxFileSystemProvider = class {
 			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 		}
 		const variantConfigKey = this.detectVariantConfigKey(properties, previousProperties);
-		const { diff: variantDiff, hasMutableDiff: variantHasMutableDiff, leftInPlace } = variantConfigKey ? this.computeVariantConfigDiff(resourceType, logicalId, variantConfigKey, properties[variantConfigKey] ?? {}, previousProperties[variantConfigKey] ?? {}) : {
+		const { diff: variantDiff, hasMutableDiff: variantHasMutableDiff, leftInPlace, aliases } = variantConfigKey ? this.computeVariantConfigDiff(resourceType, logicalId, variantConfigKey, properties[variantConfigKey] ?? {}, previousProperties[variantConfigKey] ?? {}) : {
 			diff: {},
 			hasMutableDiff: false,
-			leftInPlace: []
+			leftInPlace: [],
+			aliases: {
+				add: [],
+				remove: []
+			}
 		};
+		const aliasesChanged = aliases.add.length > 0 || aliases.remove.length > 0;
 		const leftInPlaceNames = [...TOP_LEVEL_LEFT_IN_PLACE_PROPS.filter((key) => properties[key] === void 0 && previousProperties[key] !== void 0), ...leftInPlace.map((key) => `${variantConfigKey}.${key}`)];
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
@@ -43169,7 +44007,7 @@ var FSxFileSystemProvider = class {
 		const typeVersionChanged = sendsChange("FileSystemTypeVersion");
 		const networkTypeChanged = sendsChange("NetworkType");
 		const tagsChanged = changed("Tags");
-		if (!variantHasMutableDiff && !storageCapacityChanged && !storageTypeChanged && !typeVersionChanged && !networkTypeChanged && !tagsChanged) {
+		if (!variantHasMutableDiff && !storageCapacityChanged && !storageTypeChanged && !typeVersionChanged && !networkTypeChanged && !aliasesChanged && !tagsChanged) {
 			this.logger.debug(`No mutable diff for FSx FileSystem ${logicalId}, skipping update`);
 			warnLeftInPlace();
 			return {
@@ -43179,6 +44017,7 @@ var FSxFileSystemProvider = class {
 		}
 		this.logger.debug(`Updating FSx FileSystem ${logicalId}: ${physicalId}`);
 		try {
+			const deadline = Date.now() + this.maxWaitMs;
 			const needsUpdateCall = variantHasMutableDiff || storageCapacityChanged || storageTypeChanged || typeVersionChanged || networkTypeChanged;
 			let updatedFs;
 			if (needsUpdateCall) {
@@ -43193,8 +44032,9 @@ var FSxFileSystemProvider = class {
 				}))).FileSystem?.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.Status === "PENDING" || a.Status === "IN_PROGRESS"));
 				const requestTimes = respPendingActions.map((a) => a.RequestTime?.getTime()).filter((t) => t !== void 0);
 				const actionThresholdMs = requestTimes.length > 0 ? Math.min(...requestTimes) : callTimeMs - 6e4;
-				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0, context?.maskSecrets);
+				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0, deadline, context?.maskSecrets);
 			}
+			if (aliasesChanged) await this.applyAliasDelta(physicalId, logicalId, resourceType, aliases, deadline);
 			if (tagsChanged) await this.applyTagDiff(physicalId, resourceType, logicalId, properties["Tags"], previousProperties["Tags"]);
 			if (!updatedFs) try {
 				updatedFs = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0];
@@ -43222,11 +44062,20 @@ var FSxFileSystemProvider = class {
 		const keys = /* @__PURE__ */ new Set([...Object.keys(next), ...Object.keys(prev)]);
 		const diff = {};
 		const leftInPlace = [];
+		let aliases = {
+			add: [],
+			remove: []
+		};
 		let hasMutableDiff = false;
 		for (const key of keys) {
 			const nextVal = next[key];
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
+			if (configKey === "OpenZFSConfiguration" && key === "Options") continue;
+			if (configKey === "WindowsConfiguration" && key === "Aliases") {
+				aliases = aliasDelta(nextVal, prevVal);
+				continue;
+			}
 			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 			if (nextVal === void 0 && key !== "RouteTableIds") {
 				leftInPlace.push(key);
@@ -43242,7 +44091,8 @@ var FSxFileSystemProvider = class {
 		return {
 			diff,
 			hasMutableDiff,
-			leftInPlace
+			leftInPlace,
+			aliases
 		};
 	}
 	unmappedMutableSubprop(ctx, key) {
@@ -43374,6 +44224,104 @@ var FSxFileSystemProvider = class {
 		}
 		return true;
 	}
+	async applyAliasDelta(physicalId, logicalId, resourceType, delta, deadline) {
+		await this.waitForNoAdministrativeAction(physicalId, logicalId, resourceType, deadline);
+		const live = new Map((await this.describeAliases(physicalId)).map((a) => [a.Name?.toLowerCase(), a.Lifecycle]));
+		const retryAdd = delta.add.filter((n) => {
+			const lifecycle = live.get(n);
+			return lifecycle === "CREATE_FAILED" || lifecycle === "DELETING" || lifecycle === "DELETE_FAILED";
+		});
+		const awaitGone = [...delta.remove, ...retryAdd];
+		const sendRemove = awaitGone.filter((n) => live.has(n) && live.get(n) !== "DELETING");
+		const sendAdd = delta.add.filter((n) => live.get(n) !== "AVAILABLE" && live.get(n) !== "CREATING");
+		if (sendRemove.length > 0) await this.sendAliasCall(physicalId, logicalId, resourceType, () => new DisassociateFileSystemAliasesCommand({
+			FileSystemId: physicalId,
+			Aliases: sendRemove
+		}), deadline);
+		if (awaitGone.length > 0) await this.waitForAliases(physicalId, logicalId, resourceType, awaitGone, "gone", deadline);
+		if (sendAdd.length > 0) await this.sendAliasCall(physicalId, logicalId, resourceType, () => new AssociateFileSystemAliasesCommand({
+			FileSystemId: physicalId,
+			Aliases: sendAdd
+		}), deadline);
+		if (delta.add.length > 0) await this.waitForAliases(physicalId, logicalId, resourceType, delta.add, "AVAILABLE", deadline);
+	}
+	async describeAliases(physicalId) {
+		const aliases = [];
+		let nextToken;
+		do {
+			const resp = await this.getClient().send(new DescribeFileSystemAliasesCommand({
+				FileSystemId: physicalId,
+				NextToken: nextToken
+			}));
+			aliases.push(...resp.Aliases ?? []);
+			nextToken = resp.NextToken;
+		} while (nextToken);
+		return aliases;
+	}
+	async waitForNoAdministrativeAction(physicalId, logicalId, resourceType, deadline) {
+		const transientState = { count: 0 };
+		let running = [];
+		while (Date.now() < deadline) {
+			const fs = await this.describeForPoll(physicalId, transientState);
+			if (fs) {
+				running = runningAliasBlockingActions(fs);
+				if (running.length === 0) return;
+				this.logger.debug(safeMsg`FSx FileSystem ${physicalId}: waiting for ${running.join(", ")} to finish before changing DNS aliases...`);
+			}
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(safeMsg`Timed out waiting for FSx FileSystem ${physicalId} administrative actions (${running.join(", ") || "unknown"}) to finish before changing its DNS aliases (${Math.round(this.maxWaitMs / 6e4)} min). Re-deploy once they complete.`, resourceType, logicalId, physicalId);
+	}
+	async sendAliasCall(physicalId, logicalId, resourceType, command, deadline) {
+		for (;;) try {
+			const call = command();
+			if (call instanceof AssociateFileSystemAliasesCommand) await this.getClient().send(call);
+			else await this.getClient().send(call);
+			return;
+		} catch (error) {
+			if (!isAdministrativeActionInProgress(error)) throw error;
+			if (Date.now() >= deadline) {
+				let running = [];
+				try {
+					running = ((await this.describeForPoll(physicalId, { count: 0 }))?.AdministrativeActions ?? []).filter((a) => a.Status === "PENDING" || a.Status === "IN_PROGRESS").map((a) => a.AdministrativeActionType ?? "unknown");
+				} catch {}
+				throw new ProvisioningError(safeMsg`Timed out changing FSx FileSystem ${physicalId} DNS aliases: FSx kept refusing the call while an administrative action (${running.join(", ") || "unknown"}) is in progress (${Math.round(this.maxWaitMs / 6e4)} min). Re-deploy once it completes.`, resourceType, logicalId, physicalId, error);
+			}
+			this.logger.debug(safeMsg`FSx FileSystem ${physicalId}: DNS alias call refused while an administrative action is in progress, re-sending...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+	}
+	async waitForAliases(physicalId, logicalId, resourceType, names, target, deadline) {
+		const failedLifecycle = target === "AVAILABLE" ? "CREATE_FAILED" : "DELETE_FAILED";
+		const transitionLifecycle = target === "AVAILABLE" ? "CREATING" : "DELETING";
+		const seenTransition = /* @__PURE__ */ new Set();
+		const failedReads = /* @__PURE__ */ new Map();
+		let transient = 0;
+		while (Date.now() < deadline) {
+			let aliases;
+			try {
+				aliases = await this.describeAliases(physicalId);
+				transient = 0;
+			} catch (error) {
+				if (!isTransientFsxError(error) || transient >= 5) throw error;
+				transient += 1;
+				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+				continue;
+			}
+			const byName = new Map(aliases.map((a) => [a.Name?.toLowerCase(), a.Lifecycle]));
+			for (const n of names) {
+				const lifecycle = byName.get(n);
+				if (lifecycle === transitionLifecycle) seenTransition.add(n);
+				failedReads.set(n, lifecycle === failedLifecycle ? (failedReads.get(n) ?? 0) + 1 : 0);
+			}
+			const failed = names.filter((n) => byName.get(n) === failedLifecycle && (seenTransition.has(n) || (failedReads.get(n) ?? 0) >= STALE_FAILED_READS));
+			if (failed.length > 0) throw new ProvisioningError(safeMsg`FSx FileSystem ${physicalId}: DNS alias ${failed.join(", ")} entered ${failedLifecycle}. Check the alias name and the file system's Active Directory, then re-deploy.`, resourceType, logicalId, physicalId);
+			if (names.every((n) => target === "AVAILABLE" ? byName.get(n) === "AVAILABLE" : !byName.has(n))) return;
+			this.logger.debug(safeMsg`FSx FileSystem ${physicalId}: waiting for DNS aliases ${names.join(", ")} to be ${target}...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(safeMsg`Timed out waiting for FSx FileSystem ${physicalId} DNS aliases ${names.join(", ")} to be ${target} (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, physicalId);
+	}
 	async applyTagDiff(physicalId, resourceType, logicalId, nextTags, prevTags) {
 		const plan = planTagDiff(prevTags, nextTags);
 		const arn = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0]?.ResourceARN;
@@ -43385,19 +44333,23 @@ var FSxFileSystemProvider = class {
 			Value
 		}));
 		const toRemove = plan.remove;
-		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$23({
+		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$24({
 			ResourceARN: arn,
 			Tags: toSet
 		}));
-		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$24({
+		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$25({
 			ResourceARN: arn,
 			TagKeys: toRemove
 		}));
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting FSx FileSystem ${logicalId}: ${physicalId}`);
 		try {
-			await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: physicalId }));
+			const openZfsOptions = this.toDeleteOpenZFSOptions(properties);
+			await this.getClient().send(new DeleteFileSystemCommand$1({
+				FileSystemId: physicalId,
+				...openZfsOptions && { OpenZFSConfiguration: { Options: openZfsOptions } }
+			}));
 		} catch (error) {
 			if (error instanceof FileSystemNotFound$1) {
 				const clientRegion = await this.getClient().config.region();
@@ -43413,6 +44365,14 @@ var FSxFileSystemProvider = class {
 		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType, context?.maskSecrets);
 		this.logger.debug(`Successfully deleted FSx FileSystem ${logicalId}`);
 	}
+	toDeleteOpenZFSOptions(properties) {
+		if (properties?.["FileSystemType"] !== "OPENZFS") return void 0;
+		const config = properties["OpenZFSConfiguration"];
+		if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
+		const options = config["Options"];
+		if (!Array.isArray(options) || options.length === 0) return void 0;
+		return options.map((o) => String(o));
+	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
 		if (resourceType !== "AWS::FSx::FileSystem") return "unknown";
 		if (!FILE_SYSTEM_ID_PATTERN.test(journaledPhysicalId) || !FILE_SYSTEM_ID_PATTERN.test(record.physicalId)) return "unknown";
@@ -43443,9 +44403,8 @@ var FSxFileSystemProvider = class {
 			transientState.count = 0;
 			return response.FileSystems?.[0];
 		} catch (error) {
-			const name = error instanceof Error ? error.name : "";
 			const msg = describeAwsFailure(error).detail;
-			if ((name === "ThrottlingException" || name === "ServiceLimitExceeded" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+			if (isTransientFsxError(error) && transientState.count < maxConsecutiveTransient) {
 				transientState.count += 1;
 				this.logger.debug(`Transient DescribeFileSystems error while polling ${fileSystemId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
 				return;
@@ -43466,11 +44425,10 @@ var FSxFileSystemProvider = class {
 		}
 		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} to become AVAILABLE (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
 	}
-	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation, mask) {
-		const startTime = Date.now();
+	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation, deadline, mask) {
 		const transientState = { count: 0 };
 		let seenTrackedAction = false;
-		while (Date.now() - startTime < this.maxWaitMs) {
+		while (Date.now() < deadline) {
 			const fs = await this.describeForPoll(fileSystemId, transientState);
 			if (fs) {
 				const updateActions = (fs.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.RequestTime === void 0 || a.RequestTime.getTime() >= actionThresholdMs));
@@ -43659,13 +44617,26 @@ var FSxFileSystemProvider = class {
 	canonicalizeDriftProperties(resourceType, properties) {
 		if (resourceType !== "AWS::FSx::FileSystem") return properties;
 		const lustre = properties["LustreConfiguration"];
-		if (typeof lustre !== "object" || lustre === null || Array.isArray(lustre)) return properties;
+		if (typeof lustre !== "object" || lustre === null || Array.isArray(lustre)) return this.canonicalizeWindowsAliases(properties);
 		const log = lustre["LogConfiguration"];
-		if (typeof log !== "object" || log === null || Array.isArray(log) || JSON.stringify(log) !== JSON.stringify({ Level: "DISABLED" })) return properties;
+		if (typeof log !== "object" || log === null || Array.isArray(log) || JSON.stringify(log) !== JSON.stringify({ Level: "DISABLED" })) return this.canonicalizeWindowsAliases(properties);
 		const { LogConfiguration: _disabled, ...rest } = lustre;
-		return {
+		return this.canonicalizeWindowsAliases({
 			...properties,
 			LustreConfiguration: rest
+		});
+	}
+	canonicalizeWindowsAliases(properties) {
+		const windows = properties["WindowsConfiguration"];
+		if (typeof windows !== "object" || windows === null || Array.isArray(windows)) return properties;
+		const aliases = windows["Aliases"];
+		if (!Array.isArray(aliases) || aliases.every((a) => typeof a !== "string" || a === a.toLowerCase())) return properties;
+		return {
+			...properties,
+			WindowsConfiguration: {
+				...windows,
+				Aliases: aliases.map((a) => typeof a === "string" ? a.toLowerCase() : a)
+			}
 		};
 	}
 	getDriftUnknownPaths(resourceType) {
@@ -43675,7 +44646,8 @@ var FSxFileSystemProvider = class {
 			"BackupId",
 			"WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password",
 			"OntapConfiguration.FsxAdminPassword",
-			"OpenZFSConfiguration.RootVolumeConfiguration"
+			"OpenZFSConfiguration.RootVolumeConfiguration",
+			"OpenZFSConfiguration.Options"
 		];
 	}
 	getDriftUnorderedPaths(resourceType) {
@@ -43805,6 +44777,12 @@ const toNumber$2 = (v) => {
 const jsonEqual$2 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const addInstanceGroupsLatch = new AmbiguousCreateLatch("emr:AddInstanceGroups");
 const groupsCreatedByThisProcess = new RecentIdSet();
+const MOVING_GROUP_STATES = /* @__PURE__ */ new Set([
+	"PROVISIONING",
+	"BOOTSTRAPPING",
+	"RESIZING",
+	"RECONFIGURING"
+]);
 var EMRInstanceGroupConfigProvider = class {
 	disableCcApiFallback = true;
 	client;
@@ -44005,6 +44983,7 @@ var EMRInstanceGroupConfigProvider = class {
 		this.logger.debug(`Updating EMR instance group ${logicalId}: ${physicalId}`);
 		try {
 			if (instanceCountChanged) {
+				context?.markUnsettled?.("InstanceCount");
 				await this.getClient().send(new ModifyInstanceGroupsCommand({
 					...jobFlowId && { ClusterId: jobFlowId },
 					InstanceGroups: [{
@@ -44017,6 +44996,7 @@ var EMRInstanceGroupConfigProvider = class {
 			if (autoScalingChanged) {
 				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
 				const policy = properties["AutoScalingPolicy"];
+				context?.markUnsettled?.("AutoScalingPolicy");
 				if (policy) await this.getClient().send(new PutAutoScalingPolicyCommand({
 					ClusterId: jobFlowId,
 					InstanceGroupId: physicalId,
@@ -44100,6 +45080,27 @@ var EMRInstanceGroupConfigProvider = class {
 		}
 		throw new ProvisioningError(`Timed out waiting for EMR instance group ${groupId} to reach RUNNING with ${expectedCount} instance(s) (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, groupId);
 	}
+	async readUnsettled(physicalId, logicalId, resourceType, _names, recordedProperties) {
+		const jobFlowId = recordedProperties?.["JobFlowId"];
+		if (typeof jobFlowId !== "string" || jobFlowId === "") throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} has no JobFlowId (the cluster id) recorded, so cdkd cannot read the group to converge what an earlier failed update left unsettled`, resourceType, logicalId, physicalId);
+		const group = await this.findGroupForPoll(jobFlowId, physicalId, { count: 0 }, 0);
+		if (group === void 0) return void 0;
+		return {
+			...group.RunningInstanceCount !== void 0 && { InstanceCount: group.RunningInstanceCount },
+			...group.AutoScalingPolicy !== void 0 && { AutoScalingPolicy: group.AutoScalingPolicy }
+		};
+	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names, recordedProperties) {
+		if (!names.has("InstanceCount")) return /* @__PURE__ */ new Set();
+		const jobFlowId = recordedProperties?.["JobFlowId"];
+		if (typeof jobFlowId !== "string" || jobFlowId === "") return /* @__PURE__ */ new Set();
+		try {
+			const state = (await this.findGroupForPoll(jobFlowId, physicalId, { count: 0 }, 0))?.Status?.State;
+			return state !== void 0 && MOVING_GROUP_STATES.has(state) ? /* @__PURE__ */ new Set(["InstanceCount"]) : /* @__PURE__ */ new Set();
+		} catch {
+			return /* @__PURE__ */ new Set(["InstanceCount"]);
+		}
+	}
 	async findGroupForPoll(clusterId, groupId, transientState, maxConsecutiveTransient = 5) {
 		try {
 			let marker;
@@ -45761,7 +46762,7 @@ var FirehoseProvider = class {
 	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Firehose delivery stream ${logicalId}: ${physicalId}`);
 		const desiredEncryption = readEncryptionInput(properties[ENCRYPTION_KEY], context?.desiredFromAwsReadback === true);
-		const encryptionChanged = !sameEncryptionInput(properties[ENCRYPTION_KEY], desiredEncryption, previousProperties[ENCRYPTION_KEY]);
+		const encryptionChanged = !sameEncryptionInput(properties[ENCRYPTION_KEY], desiredEncryption, previousProperties[ENCRYPTION_KEY]) || context?.unsettledProperties?.has(ENCRYPTION_KEY) === true && desiredEncryption.kind !== "unusable";
 		let encryptionSkipped = false;
 		if (encryptionChanged && desiredEncryption.kind === "unusable") {
 			const message = `${ENCRYPTION_KEY} of Firehose delivery stream ${logicalId} is not an object with a string KeyType (and a string KeyARN, if any)`;
@@ -45830,7 +46831,7 @@ var FirehoseProvider = class {
 			const prevDest = previousProperties[activeDest] ?? {};
 			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applySnowflakeDestinationUpdate(logicalId, physicalId, nextDest);
 		}
-		if (encryptionChanged && desiredEncryption.kind !== "unusable") await this.applyEncryptionUpdate(logicalId, physicalId, resourceType, desiredEncryption, maskerOrIdentity(context?.maskSecrets));
+		if (encryptionChanged && desiredEncryption.kind !== "unusable") await this.applyEncryptionUpdate(logicalId, physicalId, resourceType, desiredEncryption, maskerOrIdentity(context?.maskSecrets), context?.markUnsettled);
 		const description = await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 		this.warnUnappliedS3BackupMode(logicalId, properties, unappliedS3BackupModeDestination(properties, previousProperties, destKey, context?.changedProperties), description.DeliveryStreamDescription);
 		const desc = description.DeliveryStreamDescription;
@@ -45911,7 +46912,7 @@ var FirehoseProvider = class {
 			}))
 		}));
 	}
-	async applyEncryptionUpdate(logicalId, physicalId, resourceType, desired, mask) {
+	async applyEncryptionUpdate(logicalId, physicalId, resourceType, desired, mask, markUnsettled) {
 		const settled = await this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
 			what: "settle",
 			done: (enc) => enc?.Status !== "ENABLING" && enc?.Status !== "DISABLING"
@@ -45919,8 +46920,9 @@ var FirehoseProvider = class {
 		if (desired.kind === "absent") {
 			if (settled?.Status !== "ENABLED" && settled?.Status !== "DISABLING_FAILED") return;
 			this.refuseToStartTransition(logicalId, physicalId, resourceType, "disable");
+			markUnsettled?.(ENCRYPTION_KEY);
 			await this.getClient().send(new StopDeliveryStreamEncryptionCommand({ DeliveryStreamName: physicalId }));
-			await this.warnIfUnfinished(logicalId, "StopDeliveryStreamEncryption", () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
+			await this.warnIfUnfinished(logicalId, "StopDeliveryStreamEncryption", markUnsettled, () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
 				what: "disable",
 				done: (enc) => enc === void 0 || enc.Status === "DISABLED",
 				inProgress: "DISABLING",
@@ -45931,6 +46933,7 @@ var FirehoseProvider = class {
 		}
 		if (encryptionMatches(settled, desired)) return;
 		this.refuseToStartTransition(logicalId, physicalId, resourceType, "enable");
+		markUnsettled?.(ENCRYPTION_KEY);
 		await this.getClient().send(new StartDeliveryStreamEncryptionCommand({
 			DeliveryStreamName: physicalId,
 			DeliveryStreamEncryptionConfigurationInput: {
@@ -45938,7 +46941,7 @@ var FirehoseProvider = class {
 				...desired.keyArn !== void 0 && { KeyARN: desired.keyArn }
 			}
 		}));
-		await this.warnIfUnfinished(logicalId, "StartDeliveryStreamEncryption", () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
+		await this.warnIfUnfinished(logicalId, "StartDeliveryStreamEncryption", markUnsettled, () => this.waitForEncryption(logicalId, physicalId, resourceType, mask, {
 			what: "enable",
 			done: (enc) => encryptionMatches(enc, desired),
 			inProgress: "ENABLING",
@@ -45946,12 +46949,12 @@ var FirehoseProvider = class {
 			staleFailure: settled?.Status === "ENABLING_FAILED"
 		}));
 	}
-	async warnIfUnfinished(logicalId, call, wait) {
+	async warnIfUnfinished(logicalId, call, markUnsettled, wait) {
 		try {
 			return await wait();
 		} catch (error) {
 			const outcome = typeof error === "object" && error !== null && terminalEncryptionFailures.has(error) ? "AWS reported the change failed, so the stream may no longer match" : "the stream may still finish the change, so it may no longer match";
-			this.logger.warn(safeMsg`Firehose delivery stream ${logicalId}: ${call} was sent but the encryption change did not finish; ${outcome} the previous setting cdkd keeps recorded. Run 'cdkd drift' to compare, then 'cdkd drift --revert' to apply the recorded setting or 'cdkd drift --accept' to record the stream's.`);
+			this.logger.warn(safeMsg`Firehose delivery stream ${logicalId}: ${call} was sent but the encryption change did not finish; ${outcome} the previous setting cdkd keeps recorded. `.concat(markUnsettled === void 0 ? "Run 'cdkd drift' to compare, then 'cdkd drift --revert' to apply the recorded setting or 'cdkd drift --accept' to record the stream's." : `cdkd records ${ENCRYPTION_KEY} as unsettled, so the next 'cdkd deploy' reads the stream and applies the template's setting. To keep the stream as it ends up instead, run 'cdkd drift --accept' once the stream no longer reads ENABLING or DISABLING (an accept during the transition keeps the key unsettled).`));
 			throw error;
 		}
 	}
@@ -46369,6 +47372,15 @@ var FirehoseProvider = class {
 		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
 		return result;
 	}
+	async unsettledInTransition(physicalId, _logicalId, _resourceType, names) {
+		if (!names.has(ENCRYPTION_KEY)) return /* @__PURE__ */ new Set();
+		try {
+			const status = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription?.DeliveryStreamEncryptionConfiguration?.Status;
+			return status === "ENABLING" || status === "DISABLING" ? /* @__PURE__ */ new Set([ENCRYPTION_KEY]) : /* @__PURE__ */ new Set();
+		} catch {
+			return /* @__PURE__ */ new Set([ENCRYPTION_KEY]);
+		}
+	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		let desc;
 		try {
@@ -46916,6 +47928,7 @@ var CloudTrailProvider = class {
 //#endregion
 //#region src/provisioning/providers/codebuild-provider.ts
 const DEFAULT_PROJECT_VISIBILITY = "PRIVATE";
+const DEFAULT_ENCRYPTION_KEY = "alias/aws/s3";
 function readVisibility(properties, mask) {
 	const visibility = properties["Visibility"];
 	const role = properties["ResourceAccessRole"];
@@ -47194,6 +48207,9 @@ var CodeBuildProvider = class {
 			const input = this.mapProperties(() => physicalId, properties);
 			input.name = physicalId;
 			if (properties["BuildBatchConfig"] == null && previousProperties["BuildBatchConfig"] != null) input.buildBatchConfig = {};
+			const declaredKey = (value) => value != null && value !== "";
+			if (!declaredKey(properties["EncryptionKey"]) && declaredKey(previousProperties["EncryptionKey"])) input.encryptionKey = DEFAULT_ENCRYPTION_KEY;
+			if (properties["Tags"] == null && previousProperties["Tags"] != null) input.tags = [];
 			const updated = await this.getClient().send(new UpdateProjectCommand(input));
 			const desiredVisibility = readVisibility(properties, mask);
 			const recorded = readVisibility(previousProperties, mask);
@@ -47680,11 +48696,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !Object.hasOwn(newTagMap, k));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$25({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$26({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$24({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$25({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -48127,7 +49143,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = plan.remove;
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$26({
+					await this.getClient().send(new UntagResourceCommand$27({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -48135,7 +49151,7 @@ var DLMLifecyclePolicyProvider = class {
 				}
 				const tagsToAdd = Object.fromEntries(plan.set);
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$25({
+					await this.getClient().send(new TagResourceCommand$26({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -48299,11 +49315,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${mask(physicalId)}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$26({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$27({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$27({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$28({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -48586,12 +49602,12 @@ var S3DirectoryBucketProvider = class {
 			if (removedKeys.length > 0 || tagsToApply.length > 0) {
 				const accountId = await this.getAccountId();
 				const resourceArn = await this.buildBucketArn(physicalId, accountId);
-				if (removedKeys.length > 0) await this.getS3ControlClient().send(new UntagResourceCommand$28({
+				if (removedKeys.length > 0) await this.getS3ControlClient().send(new UntagResourceCommand$29({
 					AccountId: accountId,
 					ResourceArn: resourceArn,
 					TagKeys: removedKeys
 				}));
-				if (tagsToApply.length > 0) await this.getS3ControlClient().send(new TagResourceCommand$27({
+				if (tagsToApply.length > 0) await this.getS3ControlClient().send(new TagResourceCommand$28({
 					AccountId: accountId,
 					ResourceArn: resourceArn,
 					Tags: tagsToApply
@@ -49439,7 +50455,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(safeMsg`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone ` + `or state is out-of-sync. Refusing to silently drop the tag update. If the table was deleted out-of-band, drop just this resource's record with the command below, filling in the construct path the CDK app gave this resource — its aws:cdk:path Metadata entry in the synthesized template.\nClean up with: cdkd orphan ${commandHole("constructPath")}`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$29({
+			await this.getClient().send(new UntagResourceCommand$30({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -49448,7 +50464,7 @@ var S3TablesProvider = class {
 			throw this.wrapCaughtError(mask, err, (text) => new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${sentence(text)} State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause));
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$28({
+			await this.getClient().send(new TagResourceCommand$29({
 				resourceArn,
 				tags: upserts
 			}));
@@ -49466,7 +50482,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$29({
+			await this.getClient().send(new UntagResourceCommand$30({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -49475,7 +50491,7 @@ var S3TablesProvider = class {
 			throw this.wrapCaughtError(mask, err, (text) => new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${sentence(text)} State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause));
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$28({
+			await this.getClient().send(new TagResourceCommand$29({
 				resourceArn,
 				tags: upserts
 			}));
@@ -50595,4 +51611,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-d9K3vBVh.js.map
+//# sourceMappingURL=provider-classes-DYke4HKr.js.map