@go-to-k/cdkd 0.309.0 → 0.310.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -2,13 +2,13 @@ import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9
2
2
  import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
3
3
  import { $ as userPoolProtectionSite, $t as injectiveKeyPrefix, A as isPlainImportJson, C as setBounded, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, Et as maskDeep, F as refusalTypeShown, Ft as isAuxiliaryFailure, G as isTerminalDbWaitStatus, H as deleteWithProtectionCompensation, Hn as hasClauseBreak, I as remedyLogicalId, J as observeThenDisableProtection, K as isTerminalDeleteFailure, Kn as plainOrDescribed, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, N as normalizeAwsTagsToCfn, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Qt as injectiveKey, Rt as markCreatedBeforeFailure, S as replayedSendWindow, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, V as deleteAfterProtectionFlipWithFinalSnapshot, Vn as commandHole, Wn as pasteableCommand, X as rdsFamilyProtectionSite, Xn as withheldTargetClause, Y as protectionFlipKey, Yn as shellQuote, _ as RecentIdSet, _r as isRetryableTransientError, _t as compositeIdSkipResult, a as onlySecretDerived, an as ambientCredentialConfig, ar as markNameCollision, at as protectedReplacementAdvice, b as isInsideWindow, br as THROTTLING_ERROR_NAMES, c as recordedPrincipalsRepair, cn as AccountIdUnavailableError, dr as explicitDenyPolicyKind, ft as isInterruptedWaitError, g as AmbiguousCreateLatch, gt as compositeIdSeparatorRefusal, h as AMBIGUOUS_LATCH_TTL_MS, hr as isExplicitDenyError, ht as compositeIdFormatMessage, i as holdsSecretDerivedEntry, in as ambientClientDefaults, it as pasteableAwsCommand, j as isPlainImportValue, jt as clearCreatedBeforeFailure, k as VALUE_NOT_SHOWN, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nt as WITHHELD_AWS_COMMAND, o as readPrincipalLists, on as clientDefaultsFor, or as markReplayMayCollide, ot as renderDisableCommand, p as withRemovalDefaults, pt as startInterruptWatch, q as logGroupProtectionSite, r as SECRET_DERIVED_READ_LIVE, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tt as UNNAMEABLE_ID_CLAUSE, u as clearOnUpdateRemoval, un as CdkdError, v as ambiguousAttemptLead, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, x as replayFollowedAmbiguousAttempt, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, y as createAttemptKey, yt as packCompositeId, z as ProtectionFlipRegistry, zt as markSupersedesEarlierCreate } from "./iam-policy-targets-D94wh05t.js";
4
4
  import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
5
- import { $l as stringifyValue, $s as readConfigString, $t as lookupEachName, A as beginDeleteWait, Aa as s3BucketRegionalDomainName, Ai as isRefusedByName, Ar as awaitInFlightSibling, As as withheldAccountClause, B as waitForIndexesSettled, Bi as stringifyIfAssigned, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cd as resolveAssemblyPath, Co as accountArgs, D as reverseMapTableContributorInsights, Da as s3BucketArn, E as reverseMapIndexContributorInsights, Ea as isSettledInstanceState, Ec as passedNoEchoParametersOf, Ei as acquireIdempotencyToken, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fc as snapshotPassProvenance, Fi as readTagList, G as sendTtlWaitingOutRateLimit, Gs as isWarmThroughputDecrease, H as isTtlRateLimited, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as outputReferenceProvenanceOf, Ii as refuseMalformedDesiredTags, In as REDACTED_DELETE_ADDRESS_SKIP_REASON, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Js as coerceCfnBoolean, K as ECR_AUTO_DELETE_IMAGES_TAG, Ki as waitForLambdaFunctionActive, Ks as toCfnInteger, L as deleteTableWithIndexBusyRetry, Li as tagMapAsList, Ln as isRedactedRecordedValue, M as deleteBudgetKey, Mc as markSameGenerationBag, Mi as DBPROXY_TAGS_WHAT, Mr as getStackRecords, Ms as findSilentDropProperties, N as resolveDynamoDbDeleteBudgetClock, Nc as redactForState, Ni as DBPROXY_TAG_OPTIONS, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oa as s3BucketDomainName, P as resolveDynamoDbDeleteBudgetMs, Pc as recordReferenceProvenanceEntry, Pi as planTagDiff, Pn as getCurrentProducerRegions, Pr as replacedDeleteFailureVerdict, Ps as withoutSilentDropProperties, Qc as withoutPhysicalNameCopies, Qo as refuseMalformedNestedChildOutputs, Qs as configStringRefusal, Qt as isAccessDeniedError, R as maskedLogger, Rc as hasMaskableValues, Ri as tagPlanWarning, Rn as redactedDeleteAddressFields, S as indexDeclaresContributorInsights, Sd as renderAssemblyPathEscape, Si as earliestDefined, T as readContributorInsightsSpec, U as planTimeToLive, Us as WARM_THROUGHPUT_MEMBERS, V as isTtlAlreadyDisabled, Vt as withNestedStackContext, W as readTtlSpec, Ws as coerceWarmThroughput$1, X as getPriorAttempts, Xi as getCurrentResourceSecrets, Xl as timePhase, Xs as configBooleanRefusal, Y as isTruthyCfnBoolean, Ys as coerceCfnInteger, Z as markRefusedBeforeApplying, Zs as configIntegerRefusal, Zt as chunks, _ as streamMemberRefusals, _a as reDisableInstanceApiTermination, b as CONTRIBUTOR_INSIGHTS_KEY, bd as describeFileReadFailure, c as DynamoDBGlobalTableProvider, cc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, cl as physicalNameCopiesOf, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as isWaitAbandonedError, dc as emrClusterInstancesReplaced, ec as replayWarn, el as dynamicReferenceTokens, en as withApiLimit, f as declaredStreamTagsMember, fa as markWaitAbandoned, fc as canonicalLambdaFunctionName, fl as carriesSecretMask, g as streamDeclaresTags, ga as observeThenDisableInstanceApiTermination, go as passedParameterClassesOf, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ha as isTerminationProtectionPropagationError, ht as enclosingDeadlineExpired, ia as unchangedBehindSecretReference, iu as rewriteTemplateAssetReferences, j as compensateRemovedDeletionProtection, ja as s3BucketWebsiteUrl, ji as markDeleteStarted, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as s3BucketDualStackDomainName, l as STREAM_POLICY_KEY, la as deleteSkipReason, li as secretNamedAttributeNamesOf, ll as recordAttributeIdCopy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as ec2InstanceProtectionSite, mc as sameLambdaFunctionAddress, na as slowCcOperationTimeoutMs, nc as requireConfigObject, no as getAccountInfo, od as canonicalizeRegion, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pc as lambdaFunctionNameForMask, po as parseWebACLArn, q as S3_AUTO_DELETE_OBJECTS_TAG, qs as toFiniteNumber, ra as onlySecretReferencesDiffer, rc as requireConfigString, rd as decodeListingKey, sc as withRetry, sd as derivePartitionAndUrlSuffix, sl as recoverMaskedOutput, st as isAbsoluteAssetPath, t as DeployEngine, tc as requireConfigArray, u as STREAM_TAGS_KEY, ua as withIndeterminateGuard, uc as ecsServiceLaunchTypeSetOrChanged, v as streamPolicyMatchesDeclared, va as reEnableInstanceApiTermination, vs as refuseMalformedResourcesForDestroy, w as planIndexContributorInsightsOps, wi as reserveStackCreateToken, x as contributorInsightsRefusals, xd as displayAssemblyPath, y as streamTagsMatchDeclared, z as relayedIndexBusyDelete, zi as definedAttributes, zn as redactedDeleteAddressSkip } from "./deploy-engine-tQ0aqZMo.js";
6
- import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BI8Acvps.js";
7
- import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Bnt3Yt0k.js";
5
+ import { $l as stringifyValue, $s as readConfigString, $t as lookupEachName, A as beginDeleteWait, Aa as s3BucketRegionalDomainName, Ai as isRefusedByName, Ar as awaitInFlightSibling, As as withheldAccountClause, B as waitForIndexesSettled, Bi as stringifyIfAssigned, Bt as getCurrentNestedStackContext, C as planContributorInsightsOp, Cd as resolveAssemblyPath, Co as accountArgs, D as reverseMapTableContributorInsights, Da as s3BucketArn, E as reverseMapIndexContributorInsights, Ea as isSettledInstanceState, Ec as passedNoEchoParametersOf, Ei as acquireIdempotencyToken, F as DELETE_INDEX_WAIT_PROCEED_NOTE, Fc as snapshotPassProvenance, Fi as readTagList, G as sendTtlWaitingOutRateLimit, Gs as isWarmThroughputDecrease, H as isTtlRateLimited, I as INDEX_SETTLE_POLL_INTERVAL_MS, Ia as outputReferenceProvenanceOf, Ii as refuseMalformedDesiredTags, In as REDACTED_DELETE_ADDRESS_SKIP_REASON, It as revertNestedChildFromJournal, J as hasCdkAutoDeleteTag, Js as coerceCfnBoolean, K as ECR_AUTO_DELETE_IMAGES_TAG, Ki as waitForLambdaFunctionActive, Ks as toCfnInteger, L as deleteTableWithIndexBusyRetry, Li as tagMapAsList, Ln as isRedactedRecordedValue, M as deleteBudgetKey, Mc as markSameGenerationBag, Mi as DBPROXY_TAGS_WHAT, Mr as getStackRecords, Ms as findSilentDropProperties, N as resolveDynamoDbDeleteBudgetClock, Nc as redactForState, Ni as DBPROXY_TAG_OPTIONS, Nt as getNestedRevertRun, O as stripIndexContributorInsights, Oa as s3BucketDomainName, P as resolveDynamoDbDeleteBudgetMs, Pc as recordReferenceProvenanceEntry, Pi as planTagDiff, Pn as getCurrentProducerRegions, Pr as replacedDeleteFailureVerdict, Ps as withoutSilentDropProperties, Qc as withoutPhysicalNameCopies, Qo as refuseMalformedNestedChildOutputs, Qs as configStringRefusal, Qt as isAccessDeniedError, R as maskedLogger, Rc as hasMaskableValues, Ri as tagPlanWarning, Rn as redactedDeleteAddressFields, S as indexDeclaresContributorInsights, Sd as renderAssemblyPathEscape, Si as earliestDefined, T as readContributorInsightsSpec, U as planTimeToLive, Us as WARM_THROUGHPUT_MEMBERS, V as isTtlAlreadyDisabled, Vt as withNestedStackContext, W as readTtlSpec, Ws as coerceWarmThroughput$1, X as getPriorAttempts, Xi as getCurrentResourceSecrets, Xl as timePhase, Xs as configBooleanRefusal, Y as isTruthyCfnBoolean, Ys as coerceCfnInteger, Z as markRefusedBeforeApplying, Zs as configIntegerRefusal, Zt as chunks, _ as streamMemberRefusals, _a as reDisableInstanceApiTermination, b as CONTRIBUTOR_INSIGHTS_KEY, bd as describeFileReadFailure, c as DynamoDBGlobalTableProvider, cc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, cl as physicalNameCopiesOf, ct as listNestedTemplateRows, d as declaredStreamPolicyMember, da as isWaitAbandonedError, dc as emrClusterInstancesReplaced, ec as replayWarn, el as dynamicReferenceTokens, en as withApiLimit, f as declaredStreamTagsMember, fa as markWaitAbandoned, fc as canonicalLambdaFunctionName, fl as carriesSecretMask, g as streamDeclaresTags, ga as observeThenDisableInstanceApiTermination, go as passedParameterClassesOf, gt as enclosingDeadlineRemainingMs, h as streamDeclaresPolicy, ha as isTerminationProtectionPropagationError, ht as enclosingDeadlineExpired, ia as unchangedBehindSecretReference, iu as rewriteTemplateAssetReferences, j as compensateRemovedDeletionProtection, ja as s3BucketWebsiteUrl, ji as markDeleteStarted, k as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ka as s3BucketDualStackDomainName, l as STREAM_POLICY_KEY, la as deleteSkipReason, li as secretNamedAttributeNamesOf, ll as recordAttributeIdCopy, lt as renderNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as ec2InstanceProtectionSite, mc as sameLambdaFunctionAddress, na as slowCcOperationTimeoutMs, nc as requireConfigObject, no as getAccountInfo, od as canonicalizeRegion, ot as findNestedTemplateTreeDefect, p as planStreamMemberOps, pc as lambdaFunctionNameForMask, po as parseWebACLArn, q as S3_AUTO_DELETE_OBJECTS_TAG, qs as toFiniteNumber, ra as onlySecretReferencesDiffer, rc as requireConfigString, rd as decodeListingKey, sc as withRetry, sd as derivePartitionAndUrlSuffix, sl as recoverMaskedOutput, st as isAbsoluteAssetPath, t as DeployEngine, tc as requireConfigArray, u as STREAM_TAGS_KEY, ua as withIndeterminateGuard, uc as ecsServiceLaunchTypeSetOrChanged, v as streamPolicyMatchesDeclared, va as reEnableInstanceApiTermination, vs as refuseMalformedResourcesForDestroy, w as planIndexContributorInsightsOps, wi as reserveStackCreateToken, x as contributorInsightsRefusals, xd as displayAssemblyPath, y as streamTagsMatchDeclared, z as relayedIndexBusyDelete, zi as definedAttributes, zn as redactedDeleteAddressSkip } from "./deploy-engine-DZO2SOQJ.js";
6
+ import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BWw7I-SZ.js";
7
+ import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CS420Kx9.js";
8
8
  import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-BUG7NMWS.js";
9
- import { RDSProvider } from "./rds-provider-Qpf09VQv.js";
10
- import { NeptuneProvider } from "./neptune-provider-DmVmx69p.js";
11
- import { ASGProvider } from "./asg-provider-DQoKGfKH.js";
9
+ import { RDSProvider } from "./rds-provider-BqwTQeS-.js";
10
+ import { NeptuneProvider } from "./neptune-provider-8kjFmR1l.js";
11
+ import { ASGProvider } from "./asg-provider-I1bFHVsO.js";
12
12
  import { createHash, randomUUID } from "node:crypto";
13
13
  import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
14
14
  import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -57,7 +57,7 @@ import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand
57
57
  import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
58
58
  import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
59
59
  import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
60
- import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
60
+ import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventConfigurationCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventConfigurationCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
61
61
  import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
62
62
  import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
63
63
  import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
@@ -46521,6 +46521,9 @@ function liveEncryptionAsCfn(live) {
46521
46521
  }
46522
46522
  const ENCRYPTION_POLL_INTERVAL_MS = 5e3;
46523
46523
  const ENCRYPTION_POLL_MAX_ATTEMPTS = 120;
46524
+ const ACTIVE_POLL_INTERVAL_MS = 5e3;
46525
+ const ACTIVE_POLL_MAX_ATTEMPTS = 360;
46526
+ const ACTIVE_DEADLINE_MARGIN_MS = 2e3;
46524
46527
  const terminalEncryptionFailures = /* @__PURE__ */ new WeakSet();
46525
46528
  function isReadableTagList(value) {
46526
46529
  if (value === void 0 || value === null) return true;
@@ -46738,7 +46741,7 @@ var FirehoseProvider = class {
46738
46741
  createdStreamName = physicalId;
46739
46742
  const arn = response.DeliveryStreamARN;
46740
46743
  this.logger.debug(`Successfully created Firehose delivery stream ${logicalId}: ${physicalId}`);
46741
- await this.waitForActive(physicalId, logicalId);
46744
+ await this.waitForActive(physicalId, logicalId, resourceType, maskerOrIdentity(context?.maskSecrets));
46742
46745
  return {
46743
46746
  physicalId,
46744
46747
  attributes: { Arn: arn }
@@ -47437,18 +47440,59 @@ var FirehoseProvider = class {
47437
47440
  }
47438
47441
  return null;
47439
47442
  }
47440
- async waitForActive(streamName, logicalId) {
47441
- const maxAttempts = 30;
47442
- for (let attempt = 1; attempt <= maxAttempts; attempt++) {
47443
- const status = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: streamName }))).DeliveryStreamDescription?.DeliveryStreamStatus;
47444
- if (status === "ACTIVE") {
47445
- this.logger.debug(`Firehose ${logicalId} is ACTIVE`);
47446
- return;
47443
+ async waitForActive(streamName, logicalId, resourceType, mask) {
47444
+ const watch = startInterruptWatch(`Firehose ${logicalId} create`);
47445
+ try {
47446
+ let last;
47447
+ let deadlineNear = false;
47448
+ for (let attempt = 1; attempt <= ACTIVE_POLL_MAX_ATTEMPTS; attempt++) {
47449
+ if (watch.isInterrupted()) throw watch.onInterrupted();
47450
+ if (enclosingDeadlineRemainingMs() <= ACTIVE_DEADLINE_MARGIN_MS) {
47451
+ deadlineNear = true;
47452
+ break;
47453
+ }
47454
+ const resp = await this.describeBeforeDeadline(streamName);
47455
+ if (resp === "deadline") {
47456
+ deadlineNear = true;
47457
+ break;
47458
+ }
47459
+ const description = resp.DeliveryStreamDescription;
47460
+ last = description?.DeliveryStreamStatus;
47461
+ if (last === "ACTIVE") {
47462
+ this.logger.debug(`Firehose ${logicalId} is ACTIVE`);
47463
+ return;
47464
+ }
47465
+ if (last !== void 0 && last.endsWith("_FAILED")) {
47466
+ const failure = description?.FailureDescription;
47467
+ throw markNonRetryable(new ProvisioningError(`Firehose delivery stream ${logicalId} did not become ACTIVE: AWS reports ${last}` + (failure ? ` (${mask(`${failure.Type ?? ""}: ${failure.Details ?? ""}`)})` : ""), resourceType, logicalId, streamName));
47468
+ }
47469
+ this.logger.debug(`Firehose ${logicalId} status: ${last} (attempt ${attempt}/${ACTIVE_POLL_MAX_ATTEMPTS})`);
47470
+ if (watch.isInterrupted()) throw watch.onInterrupted();
47471
+ if (enclosingDeadlineRemainingMs() <= 7e3) {
47472
+ deadlineNear = true;
47473
+ break;
47474
+ }
47475
+ await new Promise((resolve) => setTimeout(resolve, ACTIVE_POLL_INTERVAL_MS));
47447
47476
  }
47448
- this.logger.debug(`Firehose ${logicalId} status: ${status} (attempt ${attempt}/${maxAttempts})`);
47449
- await new Promise((resolve) => setTimeout(resolve, 2e3));
47477
+ throw markNonRetryable(new ProvisioningError((deadlineNear ? `The resource timeout would expire while waiting for Firehose delivery stream ${logicalId} to become ACTIVE ` : `Timed out waiting for Firehose delivery stream ${logicalId} to become ACTIVE `) + `(last status: ${last ?? "none reported"})`, resourceType, logicalId, streamName));
47478
+ } finally {
47479
+ watch.dispose();
47480
+ }
47481
+ }
47482
+ async describeBeforeDeadline(streamName) {
47483
+ const command = new DescribeDeliveryStreamCommand({ DeliveryStreamName: streamName });
47484
+ const remaining = enclosingDeadlineRemainingMs();
47485
+ if (!Number.isFinite(remaining)) return this.getClient().send(command);
47486
+ const abort = new AbortController();
47487
+ const timer = setTimeout(() => abort.abort(), Math.max(0, remaining - ACTIVE_DEADLINE_MARGIN_MS));
47488
+ try {
47489
+ return await this.getClient().send(command, { abortSignal: abort.signal });
47490
+ } catch (error) {
47491
+ if (abort.signal.aborted) return "deadline";
47492
+ throw error;
47493
+ } finally {
47494
+ clearTimeout(timer);
47450
47495
  }
47451
- this.logger.warn(`Firehose ${logicalId} did not reach ACTIVE after ${maxAttempts} attempts`);
47452
47496
  }
47453
47497
  };
47454
47498
  function pickDefinedDeep(input) {
@@ -47576,6 +47620,77 @@ function resolveCloudWatchLogsPair(properties) {
47576
47620
  roleArn: desiredRole
47577
47621
  };
47578
47622
  }
47623
+ function readListBlock(raw, path) {
47624
+ if (raw == null) return { kind: "absent" };
47625
+ try {
47626
+ return {
47627
+ kind: "list",
47628
+ value: requireConfigArray(raw, path)
47629
+ };
47630
+ } catch (error) {
47631
+ return {
47632
+ kind: "unusable",
47633
+ detail: describeAwsFailure(error).detail
47634
+ };
47635
+ }
47636
+ }
47637
+ function listOf(read) {
47638
+ return read.kind === "list" ? read.value : void 0;
47639
+ }
47640
+ function retainPreviousLists(desired, previous, keys, live) {
47641
+ const out = Object.fromEntries(Object.entries(desired).filter(([key]) => !keys.includes(key)));
47642
+ for (const key of keys) {
47643
+ const prev = previous[key];
47644
+ if (Array.isArray(prev)) out[key] = structuredClone(prev);
47645
+ else if (prev != null && Array.isArray(live?.[key])) out[key] = structuredClone(live[key]);
47646
+ }
47647
+ return out;
47648
+ }
47649
+ const UNORDERED_LIST_BLOCKS = ["AdvancedEventSelectors", "AggregationConfigurations"];
47650
+ function setKey(value) {
47651
+ if (value === void 0) return "undefined";
47652
+ if (Array.isArray(value)) return [
47653
+ "[",
47654
+ value.map(setKey).sort().join(","),
47655
+ "]"
47656
+ ].join("");
47657
+ if (value !== null && typeof value === "object") {
47658
+ const bag = value;
47659
+ return [
47660
+ "{",
47661
+ Object.keys(bag).filter((k) => bag[k] !== void 0).sort().map((k) => [JSON.stringify(k), setKey(bag[k])].join(":")).join(","),
47662
+ "}"
47663
+ ].join("");
47664
+ }
47665
+ return JSON.stringify(value) ?? "null";
47666
+ }
47667
+ function nonEmptyListOf(read) {
47668
+ return read.kind === "list" && read.value.length > 0 ? read.value : void 0;
47669
+ }
47670
+ function eventSelectorRequest(basic, advanced) {
47671
+ const hasBasic = basic !== void 0 && basic.length > 0;
47672
+ if (advanced !== void 0 && advanced.length > 0) return {
47673
+ members: {
47674
+ AdvancedEventSelectors: advanced,
47675
+ ...hasBasic ? { EventSelectors: basic } : {}
47676
+ },
47677
+ isReset: false
47678
+ };
47679
+ if (hasBasic) return {
47680
+ members: { EventSelectors: basic },
47681
+ isReset: false
47682
+ };
47683
+ return {
47684
+ members: { EventSelectors: [...DEFAULT_EVENT_SELECTORS] },
47685
+ isReset: true
47686
+ };
47687
+ }
47688
+ function advancedSelectorsToCfn(selectors) {
47689
+ return selectors.map((s) => ({
47690
+ ...s.Name !== void 0 && { Name: s.Name },
47691
+ FieldSelectors: (s.FieldSelectors ?? []).map((f) => Object.fromEntries(Object.entries(f).filter(([, v]) => v !== void 0)))
47692
+ }));
47693
+ }
47579
47694
  function describeValue(value) {
47580
47695
  if (value === null) return "null";
47581
47696
  if (value === void 0) return "nothing";
@@ -47625,7 +47740,9 @@ var CloudTrailProvider = class {
47625
47740
  "SnsTopicName",
47626
47741
  "EventSelectors",
47627
47742
  "InsightSelectors",
47628
- "IsOrganizationTrail"
47743
+ "IsOrganizationTrail",
47744
+ "AdvancedEventSelectors",
47745
+ "AggregationConfigurations"
47629
47746
  ])]]);
47630
47747
  getClient() {
47631
47748
  if (!this.client) {
@@ -47662,6 +47779,9 @@ var CloudTrailProvider = class {
47662
47779
  const isOrganizationTrail = properties["IsOrganizationTrail"];
47663
47780
  const eventSelectors = properties["EventSelectors"];
47664
47781
  const insightSelectors = properties["InsightSelectors"];
47782
+ const advancedEventSelectors = properties["AdvancedEventSelectors"] == null ? void 0 : requireConfigArray(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors", replayWarn(this.logger, context));
47783
+ const aggregationConfigurations = properties["AggregationConfigurations"] == null ? void 0 : requireConfigArray(properties["AggregationConfigurations"], "AWS::CloudTrail::Trail AggregationConfigurations", replayWarn(this.logger, context));
47784
+ const skippedOnReplay = [...properties["AdvancedEventSelectors"] != null && advancedEventSelectors === void 0 ? ["AdvancedEventSelectors"] : [], ...properties["AggregationConfigurations"] != null && aggregationConfigurations === void 0 ? ["AggregationConfigurations"] : []];
47665
47785
  let trailCreated = false;
47666
47786
  let createdTrailArn;
47667
47787
  try {
@@ -47685,11 +47805,19 @@ var CloudTrailProvider = class {
47685
47805
  trailCreated = true;
47686
47806
  const trailArn = result.TrailARN;
47687
47807
  createdTrailArn = result.TrailARN;
47688
- if (eventSelectors && eventSelectors.length > 0) {
47808
+ const basicForCreate = eventSelectors && eventSelectors.length > 0 ? eventSelectors : void 0;
47809
+ if (basicForCreate || advancedEventSelectors && advancedEventSelectors.length > 0) {
47689
47810
  this.logger.debug(`Setting event selectors for CloudTrail Trail ${logicalId}`);
47690
47811
  await this.getClient().send(new PutEventSelectorsCommand({
47691
47812
  TrailName: trailArn,
47692
- EventSelectors: eventSelectors
47813
+ ...eventSelectorRequest(basicForCreate, advancedEventSelectors).members
47814
+ }));
47815
+ }
47816
+ if (aggregationConfigurations && aggregationConfigurations.length > 0) {
47817
+ this.logger.debug(safeMsg`Setting aggregation configurations for CloudTrail Trail ${logicalId}`);
47818
+ await this.getClient().send(new PutEventConfigurationCommand({
47819
+ TrailName: trailArn,
47820
+ AggregationConfigurations: aggregationConfigurations
47693
47821
  }));
47694
47822
  }
47695
47823
  if (insightSelectors && insightSelectors.length > 0) {
@@ -47706,7 +47834,8 @@ var CloudTrailProvider = class {
47706
47834
  this.logger.debug(`Successfully created CloudTrail Trail ${logicalId}: ${trailArn}`);
47707
47835
  return {
47708
47836
  physicalId: trailArn,
47709
- attributes: { Arn: trailArn }
47837
+ attributes: { Arn: trailArn },
47838
+ ...skippedOnReplay.length > 0 && { effectiveProperties: retainPreviousLists(properties, {}, skippedOnReplay) }
47710
47839
  };
47711
47840
  } catch (error) {
47712
47841
  if (trailCreated) markAuxiliaryFailure(error, logicalId);
@@ -47717,6 +47846,7 @@ var CloudTrailProvider = class {
47717
47846
  }
47718
47847
  }
47719
47848
  async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
47849
+ const desiredProperties = properties;
47720
47850
  properties = withRemovalDefaults(this.removalDefaults, resourceType, properties, previousProperties, context);
47721
47851
  this.logger.debug(`Updating CloudTrail Trail ${logicalId}: ${physicalId}`);
47722
47852
  refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
@@ -47733,6 +47863,7 @@ var CloudTrailProvider = class {
47733
47863
  const kmsKeyId = clearOnUpdateRemoval(emptyToUndefined(properties["KMSKeyId"]), emptyToUndefined(previousProperties["KMSKeyId"]), "");
47734
47864
  const snsTopicName = clearOnUpdateRemoval(emptyToUndefined(properties["SnsTopicName"]), emptyToUndefined(previousProperties["SnsTopicName"]), "");
47735
47865
  const isOrganizationTrail = properties["IsOrganizationTrail"];
47866
+ const appliedBeforeFailure = [];
47736
47867
  try {
47737
47868
  await this.getClient().send(new UpdateTrailCommand({
47738
47869
  Name: physicalId,
@@ -47747,36 +47878,61 @@ var CloudTrailProvider = class {
47747
47878
  SnsTopicName: snsTopicName,
47748
47879
  IsOrganizationTrail: isOrganizationTrail
47749
47880
  }));
47750
- const rawEventSelectors = properties["EventSelectors"];
47751
- let eventSelectorsUnusable = false;
47752
- let newEventSelectors;
47753
- if (rawEventSelectors != null) try {
47754
- newEventSelectors = requireConfigArray(rawEventSelectors, "AWS::CloudTrail::Trail EventSelectors");
47755
- } catch (error) {
47756
- eventSelectorsUnusable = true;
47757
- this.logger.warn(`${describeAwsFailure(error).detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
47758
- }
47881
+ const basicRead = readListBlock(properties["EventSelectors"], "AWS::CloudTrail::Trail EventSelectors");
47882
+ const advancedRead = readListBlock(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors");
47883
+ for (const read of [basicRead, advancedRead]) if (read.kind === "unusable") this.logger.warn(safeMsg`${read.detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
47884
+ const selectorsUnusable = basicRead.kind === "unusable" || advancedRead.kind === "unusable";
47885
+ const newEventSelectors = listOf(basicRead);
47886
+ const newAdvancedSelectors = listOf(advancedRead);
47759
47887
  const oldEventSelectors = previousProperties["EventSelectors"];
47760
- if (!eventSelectorsUnusable && JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors)) {
47761
- const isRemoval = newEventSelectors === void 0 || newEventSelectors.length === 0;
47762
- const eventSelectorsToSend = newEventSelectors === void 0 || newEventSelectors.length === 0 ? DEFAULT_EVENT_SELECTORS : newEventSelectors;
47888
+ const oldAdvancedSelectors = previousProperties["AdvancedEventSelectors"];
47889
+ const hadAdvancedSelectors = Array.isArray(oldAdvancedSelectors) && oldAdvancedSelectors.length > 0;
47890
+ const aggregationRead = readListBlock(properties["AggregationConfigurations"], "AWS::CloudTrail::Trail AggregationConfigurations");
47891
+ if (aggregationRead.kind === "unusable") this.logger.warn(safeMsg`${aggregationRead.detail} The trail's existing aggregation configurations are left untouched for this update rather than cleared.`);
47892
+ const newAggregation = listOf(aggregationRead);
47893
+ const aggregationChanged = aggregationRead.kind !== "unusable" && setKey(newAggregation) !== setKey(previousProperties["AggregationConfigurations"]);
47894
+ const aggregationCleared = aggregationChanged && nonEmptyListOf(aggregationRead) === void 0;
47895
+ const putAggregation = async () => {
47896
+ this.logger.debug(safeMsg`Updating aggregation configurations for CloudTrail Trail ${logicalId}`);
47897
+ await this.getClient().send(new PutEventConfigurationCommand({
47898
+ TrailName: physicalId,
47899
+ AggregationConfigurations: newAggregation ?? []
47900
+ }));
47901
+ };
47902
+ if (aggregationCleared) {
47903
+ await putAggregation();
47904
+ appliedBeforeFailure.push("AggregationConfigurations was cleared");
47905
+ }
47906
+ if (!selectorsUnusable && (JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors) || setKey(newAdvancedSelectors) !== setKey(oldAdvancedSelectors))) {
47907
+ let basicToSend = newEventSelectors;
47908
+ let advancedToSend = newAdvancedSelectors;
47909
+ if (context?.desiredFromAwsReadback === true && nonEmptyListOf(basicRead) !== void 0 && nonEmptyListOf(advancedRead) !== void 0) {
47910
+ if (JSON.stringify(newEventSelectors) === JSON.stringify(oldEventSelectors)) basicToSend = void 0;
47911
+ else if (setKey(newAdvancedSelectors) === setKey(oldAdvancedSelectors)) advancedToSend = void 0;
47912
+ }
47913
+ const { members, isReset: isRemoval } = eventSelectorRequest(basicToSend, advancedToSend);
47763
47914
  this.logger.debug(isRemoval ? `Resetting event selectors to the AWS default for CloudTrail Trail ${logicalId}` : `Updating event selectors for CloudTrail Trail ${logicalId}`);
47764
47915
  try {
47765
47916
  await this.getClient().send(new PutEventSelectorsCommand({
47766
47917
  TrailName: physicalId,
47767
- EventSelectors: [...eventSelectorsToSend]
47918
+ ...members
47768
47919
  }));
47920
+ appliedBeforeFailure.push("the event selectors were updated");
47769
47921
  } catch (error) {
47770
47922
  const failure = describeAwsFailure(error);
47771
47923
  const message = withoutTrailIdentifiers(failure.detail, physicalId);
47772
47924
  const errorClass = error instanceof Error ? error.name : "";
47773
- if (!isRemoval || ACCESS_DENIAL_CLASS.test(errorClass) || !ADVANCED_SELECTOR_PHRASE.test(message)) throw error;
47925
+ if (!isRemoval || hadAdvancedSelectors || ACCESS_DENIAL_CLASS.test(errorClass) || !ADVANCED_SELECTOR_PHRASE.test(message)) throw error;
47774
47926
  const m = maskerOrIdentity(context?.maskSecrets);
47775
47927
  const head = `CloudTrail Trail ${logicalId}: skipping the EventSelectors reset — the trail is using AdvancedEventSelectors, which AWS manages through a separate API, so there are no basic event selectors to clear (`;
47776
47928
  if (failure.redacted) this.logger.debug(m(`${head}${m(failure.detail)})`));
47777
47929
  this.logger.warn(m(`${head}${failure.redacted ? failure.summary : failure.detail})`));
47778
47930
  }
47779
47931
  }
47932
+ if (aggregationChanged && !aggregationCleared) {
47933
+ await putAggregation();
47934
+ appliedBeforeFailure.push("AggregationConfigurations was updated");
47935
+ }
47780
47936
  const newInsightSelectors = properties["InsightSelectors"];
47781
47937
  const oldInsightSelectors = previousProperties["InsightSelectors"];
47782
47938
  if (JSON.stringify(newInsightSelectors) !== JSON.stringify(oldInsightSelectors)) {
@@ -47798,13 +47954,19 @@ var CloudTrailProvider = class {
47798
47954
  }
47799
47955
  await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
47800
47956
  this.logger.debug(`Successfully updated CloudTrail Trail ${logicalId}`);
47801
- return {
47957
+ const skipped = [...selectorsUnusable ? ["EventSelectors", "AdvancedEventSelectors"] : [], ...aggregationRead.kind === "unusable" ? ["AggregationConfigurations"] : []];
47958
+ if (skipped.length === 0) return {
47802
47959
  physicalId,
47803
47960
  wasReplaced: false
47804
47961
  };
47962
+ return {
47963
+ physicalId,
47964
+ wasReplaced: false,
47965
+ effectiveProperties: retainPreviousLists(desiredProperties, previousProperties, skipped, skipped.some((key) => previousProperties[key] != null && !Array.isArray(previousProperties[key])) ? await this.readLiveForRecord(physicalId, resourceType) : void 0)
47966
+ };
47805
47967
  } catch (error) {
47806
47968
  const cause = error instanceof Error ? error : void 0;
47807
- throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
47969
+ throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update CloudTrail Trail ${logicalId}: ${text}` + (appliedBeforeFailure.length > 0 ? ` (selector/aggregation writes already applied before this failure: ${appliedBeforeFailure.join("; ")})` : ""), resourceType, logicalId, physicalId, cause));
47808
47970
  }
47809
47971
  }
47810
47972
  async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -47834,6 +47996,19 @@ var CloudTrailProvider = class {
47834
47996
  throw stripped ? markDeleteStarted(notGone) : notGone;
47835
47997
  }
47836
47998
  }
47999
+ async readLiveForRecord(physicalId, resourceType) {
48000
+ try {
48001
+ const live = await this.readCurrentState(physicalId, "", resourceType);
48002
+ return live !== void 0 && live !== RESOURCE_NOT_FOUND ? live : void 0;
48003
+ } catch (error) {
48004
+ this.logger.debug(safeMsg`CloudTrail read-back for the record failed: ${describeAwsFailure(error).detail}`);
48005
+ return;
48006
+ }
48007
+ }
48008
+ getDriftUnorderedPaths(resourceType) {
48009
+ if (resourceType !== "AWS::CloudTrail::Trail") return [];
48010
+ return [...UNORDERED_LIST_BLOCKS];
48011
+ }
47837
48012
  getAttribute(_physicalId, _resourceType, attributeName) {
47838
48013
  return Promise.resolve(attributeName);
47839
48014
  }
@@ -47892,7 +48067,9 @@ var CloudTrailProvider = class {
47892
48067
  } catch {}
47893
48068
  try {
47894
48069
  const sel = await this.getClient().send(new GetEventSelectorsCommand({ TrailName: physicalId }));
47895
- if (!(Array.isArray(sel.AdvancedEventSelectors) && sel.AdvancedEventSelectors.length > 0)) result["EventSelectors"] = (sel.EventSelectors ?? []).map((es) => es);
48070
+ const hasAdvanced = Array.isArray(sel.AdvancedEventSelectors) && sel.AdvancedEventSelectors.length > 0;
48071
+ if (!hasAdvanced) result["EventSelectors"] = (sel.EventSelectors ?? []).map((es) => es);
48072
+ result["AdvancedEventSelectors"] = hasAdvanced ? advancedSelectorsToCfn(sel.AdvancedEventSelectors ?? []) : [];
47896
48073
  } catch {}
47897
48074
  let insightSelectors = [];
47898
48075
  try {
@@ -47907,6 +48084,14 @@ var CloudTrailProvider = class {
47907
48084
  this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${describeAwsFailure(err).detail}`);
47908
48085
  }
47909
48086
  result["Tags"] = tags;
48087
+ try {
48088
+ result["AggregationConfigurations"] = ((await this.getClient().send(new GetEventConfigurationCommand({ TrailName: physicalId }))).AggregationConfigurations ?? []).map((a) => ({
48089
+ ...a.EventCategory !== void 0 && { EventCategory: a.EventCategory },
48090
+ ...a.Templates !== void 0 && { Templates: a.Templates }
48091
+ }));
48092
+ } catch (err) {
48093
+ this.logger.debug(safeMsg`CloudTrail GetEventConfiguration(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
48094
+ }
47910
48095
  return result;
47911
48096
  }
47912
48097
  async import(input) {
@@ -51611,4 +51796,4 @@ var ACMCertificateProvider = class {
51611
51796
 
51612
51797
  //#endregion
51613
51798
  export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
51614
- //# sourceMappingURL=provider-classes-DYke4HKr.js.map
51799
+ //# sourceMappingURL=provider-classes-KsrvwO_r.js.map