@go-to-k/cdkd 0.312.0 → 0.314.0

package/dist/{provider-classes-Dz0pYmlJ.js → provider-classes-ZqxIefLl.js}

@@ -1,16 +1,16 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
-import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-BT2Dfnpt.js";
+import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-agWtoyga.js";
+import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as getPriorAttempts, $s as isWarmThroughputDecrease, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ad as renderAssemblyPathEscape, Ai as acquireIdempotencyToken, Ao as accountArgs, B as deleteTableWithIndexBusyRetry, Bc as markSameGenerationBag, Bi as refuseMalformedDesiredTags, Bn as isRedactedRecordedValue, Bs as findSilentDropProperties, C as planContributorInsightsOp, Co as passedParameterClassesOf, D as reverseMapTableContributorInsights, E as reverseMapIndexContributorInsights, Ei as earliestDefined, F as resolveDynamoDbDeleteBudgetClock, Fa as s3BucketDomainName, Fi as markDeleteStarted, Fr as getStackRecords, G as isTtlRateLimited, H as relayedIndexBusyDelete, Hc as recordReferenceProvenanceEntry, Hi as tagPlanWarning, Hn as redactedDeleteAddressSkip, Hs as withoutSilentDropProperties, I as resolveDynamoDbDeleteBudgetMs, Ia as s3BucketDualStackDomainName, Ii as DBPROXY_TAGS_WHAT, It as getNestedRevertRun, J as sendTtlWaitingOutRateLimit, K as planTimeToLive, Kc as hasMaskableValues, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as s3BucketRegionalDomainName, Li as DBPROXY_TAG_OPTIONS, Ln as getCurrentProducerRegions, Lr as replacedDeleteFailureVerdict, Ls as withheldAccountClause, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Na as isSettledInstanceState, Nr as awaitInFlightSibling, O as stripIndexContributorInsights, Od as describeFileReadFailure, Oi as reserveStackCreateToken, P as deleteBudgetKey, Pa as s3BucketArn, Pc as passedNoEchoParametersOf, Pi as isRefusedByName, Q as isTruthyCfnBoolean, Qs as coerceWarmThroughput$1, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketWebsiteUrl, Ri as planTagDiff, S as indexDeclaresContributorInsights, Sa as reEnableInstanceApiTermination, Sc as sameLambdaFunctionAddress, T as readContributorInsightsSpec, Ta as isUsableAttemptedName, Ts as refuseMalformedResourcesForDestroy, U as waitForIndexesSettled, Ua as outputReferenceProvenanceOf, Uc as snapshotPassProvenance, Ui as definedAttributes, Ut as getCurrentNestedStackContext, V as maskedLogger, Vc as redactForState, Vi as tagMapAsList, Vn as redactedDeleteAddressFields, W as isTtlAlreadyDisabled, Wi as stringifyIfAssigned, Wt as withNestedStackContext, X as S3_AUTO_DELETE_OBJECTS_TAG, Xi as waitForLambdaFunctionActive, Y as ECR_AUTO_DELETE_IMAGES_TAG, Z as hasCdkAutoDeleteTag, Zs as WARM_THROUGHPUT_MEMBERS, _ as streamMemberRefusals, _l as recordAttributeIdCopy, ac as configIntegerRefusal, as as refuseMalformedNestedChildOutputs, b as CONTRIBUTOR_INSIGHTS_KEY, ba as observeThenDisableInstanceApiTermination, bc as canonicalLambdaFunctionName, bl as carriesSecretMask, bo as parseWebACLArn, c as DynamoDBGlobalTableProvider, ca as unchangedBehindSecretReference, cc as replayWarn, cl as dynamicReferenceTokens, d as declaredStreamPolicyMember, dc as requireConfigString, dd as decodeListingKey, dt as listNestedTemplateRows, ea as getCurrentResourceSecrets, ec as toCfnInteger, en as chunks, et as markRefusedBeforeApplying, f as declaredStreamTagsMember, ft as renderNestedTemplateTreeDefect, fu as rewriteTemplateAssetReferences, g as streamDeclaresTags, ga as markWaitAbandoned, gc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, gl as physicalNameCopiesOf, h as streamDeclaresPolicy, ha as isWaitAbandonedError, hc as withRetry, hd as derivePartitionAndUrlSuffix, hl as recoverMaskedOutput, ic as configBooleanRefusal, iu as timePhase, j as DYNAMODB_DELETE_POLL_COST_MS, jd as resolveAssemblyPath, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, kd as displayAssemblyPath, l as STREAM_POLICY_KEY, lc as requireConfigArray, lo as getAccountInfo, lt as findNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as withIndeterminateGuard, md as canonicalizeRegion, nc as coerceCfnBoolean, nn as lookupEachName, oa as slowCcOperationTimeoutMs, oc as configStringRefusal, ol as withoutPhysicalNameCopies, p as planStreamMemberOps, pa as deleteSkipReason, pi as secretNamedAttributeNamesOf, q as readTtlSpec, rc as coerceCfnInteger, rn as withApiLimit, sa as onlySecretReferencesDiffer, sc as readConfigString, su as stringifyValue, t as DeployEngine, tc as toFiniteNumber, tn as isAccessDeniedError, u as STREAM_TAGS_KEY, uc as requireConfigObject, ut as isAbsoluteAssetPath, v as streamPolicyMatchesDeclared, va as ec2InstanceProtectionSite, vc as ecsServiceLaunchTypeSetOrChanged, vt as enclosingDeadlineExpired, w as planIndexContributorInsightsOps, x as contributorInsightsRefusals, xa as reDisableInstanceApiTermination, xc as lambdaFunctionNameForMask, y as streamTagsMatchDeclared, ya as isTerminationProtectionPropagationError, yc as emrClusterInstancesReplaced, yt as enclosingDeadlineRemainingMs, z as TABLE_INDEX_NOUN, zi as readTagList, zn as REDACTED_DELETE_ADDRESS_SKIP_REASON, zt as revertNestedChildFromJournal } from "./deploy-engine-CVNzK__j.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DM7bN9m1.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Nk_95KKk.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-D7wXWxVo.js";
-import { RDSProvider } from "./rds-provider-CXSZq1c8.js";
-import { NeptuneProvider } from "./neptune-provider-qdoLunCh.js";
-import { ASGProvider } from "./asg-provider-CVLTQtQr.js";
+import { $ as ECR_AUTO_DELETE_IMAGES_TAG, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ai as earliestDefined, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDualStackDomainName, Bi as DBPROXY_TAGS_WHAT, Bt as getNestedRevertRun, C as planContributorInsightsOp, Ca as isTerminationProtectionPropagationError, Cc as emrClusterInstancesReplaced, Ct as enclosingDeadlineRemainingMs, D as reverseMapTableContributorInsights, Do as passedParameterClassesOf, E as reverseMapIndexContributorInsights, Ea as reEnableInstanceApiTermination, Ec as sameLambdaFunctionAddress, F as resolveDynamoDbDeleteBudgetClock, Fd as resolveAssemblyPath, G as readbackVectorIndexes, Gc as redactForState, Gi as tagMapAsList, Gn as redactedDeleteAddressFields, H as relayedIndexBusyDelete, Ha as s3BucketWebsiteUrl, Hi as planTagDiff, I as resolveDynamoDbDeleteBudgetMs, J as isTtlAlreadyDisabled, Ji as stringifyIfAssigned, Jt as withNestedStackContext, K as vectorIndexesForCreate, Kc as recordReferenceProvenanceEntry, Ki as tagPlanWarning, Kn as redactedDeleteAddressSkip, Ks as withoutSilentDropProperties, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as isSettledInstanceState, Lr as awaitInFlightSibling, M as beginDeleteWait, Md as describeFileReadFailure, Mi as reserveStackCreateToken, N as compensateRemovedDeletionProtection, Nd as displayAssemblyPath, O as stripIndexContributorInsights, P as deleteBudgetKey, Pd as renderAssemblyPathEscape, Pi as acquireIdempotencyToken, Po as accountArgs, Q as sendTtlWaitingOutRateLimit, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketArn, Rc as passedNoEchoParametersOf, Ri as isRefusedByName, S as indexDeclaresContributorInsights, Sa as ec2InstanceProtectionSite, Sc as ecsServiceLaunchTypeSetOrChanged, St as enclosingDeadlineExpired, T as readContributorInsightsSpec, Ta as reDisableInstanceApiTermination, Tc as lambdaFunctionNameForMask, U as waitForIndexesSettled, Ui as readTagList, Un as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ut as revertNestedChildFromJournal, V as maskedLogger, Va as s3BucketRegionalDomainName, Vi as DBPROXY_TAG_OPTIONS, Vn as getCurrentProducerRegions, Vr as replacedDeleteFailureVerdict, Vs as withheldAccountClause, W as planVectorIndexUpdates, Wc as markSameGenerationBag, Wi as refuseMalformedDesiredTags, Wn as isRedactedRecordedValue, Ws as findSilentDropProperties, X as planTimeToLive, Xc as hasMaskableValues, Y as isTtlRateLimited, Z as readTtlSpec, _ as streamMemberRefusals, _a as deleteSkipReason, _i as secretNamedAttributeNamesOf, ac as toFiniteNumber, an as isAccessDeniedError, b as CONTRIBUTOR_INSIGHTS_KEY, ba as markWaitAbandoned, bc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, bl as physicalNameCopiesOf, c as DynamoDBGlobalTableProvider, cc as configBooleanRefusal, cu as timePhase, d as declaredStreamPolicyMember, da as onlySecretReferencesDiffer, dc as readConfigString, du as stringifyValue, ea as waitForLambdaFunctionActive, et as S3_AUTO_DELETE_OBJECTS_TAG, f as declaredStreamTagsMember, fa as unchangedBehindSecretReference, fc as replayWarn, fl as dynamicReferenceTokens, g as streamDeclaresTags, gt as renderNestedTemplateTreeDefect, gu as rewriteTemplateAssetReferences, h as streamDeclaresPolicy, hc as requireConfigString, hd as decodeListingKey, ht as listNestedTemplateRows, ia as getCurrentResourceSecrets, ic as toCfnInteger, in as chunks, it as markRefusedBeforeApplying, j as DYNAMODB_DELETE_POLL_COST_MS, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, ka as isUsableAttemptedName, ks as refuseMalformedResourcesForDestroy, l as STREAM_POLICY_KEY, lc as configIntegerRefusal, ls as refuseMalformedNestedChildOutputs, m as reverseMapStreamPolicy, mc as requireConfigObject, mt as isAbsoluteAssetPath, nc as coerceWarmThroughput$1, nt as isTruthyCfnBoolean, oc as coerceCfnBoolean, on as lookupEachName, p as planStreamMemberOps, pc as requireConfigArray, po as getAccountInfo, pt as findNestedTemplateTreeDefect, q as vectorIndexesSettled, qa as outputReferenceProvenanceOf, qc as snapshotPassProvenance, qi as definedAttributes, qt as getCurrentNestedStackContext, rc as isWarmThroughputDecrease, rt as getPriorAttempts, sc as coerceCfnInteger, sn as withApiLimit, t as DeployEngine, tc as WARM_THROUGHPUT_MEMBERS, tt as hasCdkAutoDeleteTag, u as STREAM_TAGS_KEY, ua as slowCcOperationTimeoutMs, uc as configStringRefusal, ul as withoutPhysicalNameCopies, v as streamPolicyMatchesDeclared, va as withIndeterminateGuard, vd as canonicalizeRegion, w as planIndexContributorInsightsOps, wa as observeThenDisableInstanceApiTermination, wc as canonicalLambdaFunctionName, wl as carriesSecretMask, wo as parseWebACLArn, x as contributorInsightsRefusals, xl as recordAttributeIdCopy, y as streamTagsMatchDeclared, ya as isWaitAbandonedError, yc as withRetry, yd as derivePartitionAndUrlSuffix, yl as recoverMaskedOutput, z as TABLE_INDEX_NOUN, za as s3BucketDomainName, zi as markDeleteStarted, zr as getStackRecords } from "./deploy-engine-ClIUqDQL.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DJep3uns.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Du6jOw1-.js";
+import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-By0_BFNO.js";
+import { RDSProvider } from "./rds-provider-C2fHUNSE.js";
+import { NeptuneProvider } from "./neptune-provider-CGZ_G4Vz.js";
+import { ASGProvider } from "./asg-provider-_nun2Jda.js";
 import { createHash, randomUUID } from "node:crypto";
-import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -39,30 +39,30 @@ import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCo
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import { isDeepStrictEqual } from "node:util";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCommand, CreateDBProxyEndpointCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeregisterDBProxyTargetsCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
+import { ListTagsForResourceCommand as ListTagsForResourceCommand$11, S3ControlClient, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13 } from "@aws-sdk/client-s3-control";
 import * as zlib from "node:zlib";
-import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
-import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UntagResourceCommand as UntagResourceCommand$17, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$18, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$19, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
-import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$20, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$21, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$22, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
+import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UntagResourceCommand as UntagResourceCommand$18, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$19, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$20, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$21, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$22, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$23, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
-import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$23, UpdatePipeCommand } from "@aws-sdk/client-pipes";
-import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteFileSystemPolicyCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
-import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
+import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdatePipeCommand } from "@aws-sdk/client-pipes";
+import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteFileSystemPolicyCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
+import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventConfigurationCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventConfigurationCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3vectors";
-import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3-control";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3VectorsClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableBucketMetricsConfigurationCommand, DeleteTableBucketReplicationCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableBucketEncryptionCommand, GetTableBucketMaintenanceConfigurationCommand, GetTableBucketMetricsConfigurationCommand, GetTableBucketReplicationCommand, GetTableBucketStorageClassCommand, GetTableCommand as GetTableCommand$1, GetTableMaintenanceConfigurationCommand, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, PutTableBucketEncryptionCommand, PutTableBucketMaintenanceConfigurationCommand, PutTableBucketMetricsConfigurationCommand, PutTableBucketReplicationCommand, PutTableBucketStorageClassCommand, PutTableMaintenanceConfigurationCommand, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
@@ -3121,6 +3121,126 @@ function foldEventBridgeConfiguration(config) {
 		[EVENTBRIDGE_CONFIG_KEY]: { EventBridgeEnabled: enabled }
 	};
 }
+const ABAC_DISABLED = "Disabled";
+const ABAC_ENABLED = "Enabled";
+const METADATA_TABLE_DISABLED = "DISABLED";
+const METADATA_TABLE_ENABLED = "ENABLED";
+const METADATA_TABLE_POLL_MS = 2e3;
+const METADATA_TABLE_BUDGET_MS = 3e5;
+function abacStatusOf(properties) {
+	return properties["AbacStatus"] ?? ABAC_DISABLED;
+}
+function metadataBag(value) {
+	return isPlainObject$3(value) ? value : void 0;
+}
+function metadataConfigurationRefusal(value) {
+	if (value === void 0) return void 0;
+	const root = "MetadataConfiguration";
+	if (!isPlainObject$3(value)) return `${root} must be an object`;
+	const journal = value["JournalTableConfiguration"];
+	if (!isPlainObject$3(journal)) return `${root}.JournalTableConfiguration must be an object`;
+	const expiration = journal["RecordExpiration"];
+	if (!isPlainObject$3(expiration)) return `${root}.JournalTableConfiguration.RecordExpiration must be an object`;
+	if (typeof expiration["Expiration"] !== "string") return `${root}.JournalTableConfiguration.RecordExpiration.Expiration must be a string`;
+	const days = expiration["Days"];
+	if (days !== void 0 && (days === "" || days === null || !Number.isInteger(Number(days)))) return `${root}.JournalTableConfiguration.RecordExpiration.Days must be an integer`;
+	const tables = [
+		["JournalTableConfiguration", journal],
+		["InventoryTableConfiguration", value["InventoryTableConfiguration"]],
+		["AnnotationTableConfiguration", value["AnnotationTableConfiguration"]]
+	];
+	for (const [member, table] of tables) {
+		if (table === void 0) continue;
+		if (!isPlainObject$3(table)) return `${root}.${member} must be an object`;
+		if (member !== "JournalTableConfiguration" && typeof table["ConfigurationState"] !== "string") return `${root}.${member}.ConfigurationState must be a string`;
+		const encryption = table["EncryptionConfiguration"];
+		if (encryption === void 0) continue;
+		if (!isPlainObject$3(encryption) || typeof encryption["SseAlgorithm"] !== "string") return `${root}.${member}.EncryptionConfiguration must be an object with an SseAlgorithm`;
+	}
+}
+function metadataEncryptionToSdk(table) {
+	const encryption = metadataBag(table["EncryptionConfiguration"]);
+	if (encryption === void 0) return void 0;
+	return {
+		SseAlgorithm: encryption["SseAlgorithm"],
+		...encryption["KmsKeyArn"] !== void 0 ? { KmsKeyArn: encryption["KmsKeyArn"] } : {}
+	};
+}
+function metadataConfigurationToSdk(config) {
+	const journal = metadataBag(config["JournalTableConfiguration"]) ?? {};
+	const expiration = metadataBag(journal["RecordExpiration"]) ?? {};
+	const days = expiration["Days"];
+	const journalEncryption = metadataEncryptionToSdk(journal);
+	const inventory = metadataBag(config["InventoryTableConfiguration"]);
+	const inventoryEncryption = inventory && metadataEncryptionToSdk(inventory);
+	const annotation = metadataBag(config["AnnotationTableConfiguration"]);
+	const annotationEncryption = annotation && metadataEncryptionToSdk(annotation);
+	return {
+		JournalTableConfiguration: {
+			RecordExpiration: {
+				Expiration: expiration["Expiration"],
+				...days !== void 0 ? { Days: typeof days === "string" ? Number(days) : days } : {}
+			},
+			...journalEncryption ? { EncryptionConfiguration: journalEncryption } : {}
+		},
+		...inventory ? { InventoryTableConfiguration: {
+			ConfigurationState: inventory["ConfigurationState"],
+			...inventoryEncryption ? { EncryptionConfiguration: inventoryEncryption } : {}
+		} } : {},
+		...annotation ? { AnnotationTableConfiguration: {
+			ConfigurationState: annotation["ConfigurationState"],
+			...annotationEncryption ? { EncryptionConfiguration: annotationEncryption } : {},
+			...annotation["Role"] !== void 0 ? { Role: annotation["Role"] } : {}
+		} } : {}
+	};
+}
+function metadataConfigurationFromSdk(result) {
+	const journal = result.JournalTableConfigurationResult;
+	const inventory = result.InventoryTableConfigurationResult;
+	const annotation = result.AnnotationTableConfigurationResult;
+	return {
+		...journal ? { JournalTableConfiguration: { RecordExpiration: {
+			Expiration: journal.RecordExpiration?.Expiration,
+			...journal.RecordExpiration?.Days !== void 0 ? { Days: journal.RecordExpiration.Days } : {}
+		} } } : {},
+		...inventory ? { InventoryTableConfiguration: { ConfigurationState: inventory.ConfigurationState } } : {},
+		...annotation ? { AnnotationTableConfiguration: {
+			ConfigurationState: annotation.ConfigurationState,
+			...annotation.Role !== void 0 ? { Role: annotation.Role } : {}
+		} } : {}
+	};
+}
+function metadataAttributesFromSdk(result) {
+	const attributes = {};
+	const destination = result.DestinationResult;
+	if (destination) {
+		const path = "MetadataConfiguration.Destination";
+		attributes[path] = {
+			TableBucketArn: destination.TableBucketArn,
+			TableBucketType: destination.TableBucketType,
+			TableNamespace: destination.TableNamespace
+		};
+		attributes[`${path}.TableBucketArn`] = destination.TableBucketArn;
+		attributes[`${path}.TableBucketType`] = destination.TableBucketType;
+		attributes[`${path}.TableNamespace`] = destination.TableNamespace;
+	}
+	for (const [member, table] of [
+		["JournalTableConfiguration", result.JournalTableConfigurationResult],
+		["InventoryTableConfiguration", result.InventoryTableConfigurationResult],
+		["AnnotationTableConfiguration", result.AnnotationTableConfigurationResult]
+	]) {
+		if (table?.TableName !== void 0) attributes[`MetadataConfiguration.${member}.TableName`] = table.TableName;
+		if (table?.TableArn !== void 0) attributes[`MetadataConfiguration.${member}.TableArn`] = table.TableArn;
+	}
+	return attributes;
+}
+function bucketNameRefusal(properties) {
+	const prefix = properties["BucketNamePrefix"];
+	if (prefix === void 0) return void 0;
+	if (typeof prefix !== "string" || prefix === "") return "sets a BucketNamePrefix that is not a non-empty string";
+	if (properties["BucketName"] !== void 0) return "specifies both BucketName and BucketNamePrefix; only one of them is accepted";
+	if (properties["BucketNamespace"] !== "account-regional") return "sets BucketNamePrefix, which is only supported with BucketNamespace: account-regional";
+}
 const LIFECYCLE_RULE_PATH = "AWS::S3::Bucket LifecycleConfiguration.Rules[]";
 const LIFECYCLE_FILTER_PATH = `${LIFECYCLE_RULE_PATH}.Filter`;
 const LIFECYCLE_TAG_FILTERS_PATH = `${LIFECYCLE_RULE_PATH}.TagFilters`;
@@ -3490,9 +3610,13 @@ var S3BucketProvider = class S3BucketProvider {
 		"InventoryConfigurations",
 		"ReplicationConfiguration",
 		"ObjectLockConfiguration",
-		"ObjectLockEnabled"
+		"ObjectLockEnabled",
+		"AbacStatus",
+		"BucketNamePrefix",
+		"BucketNamespace",
+		"MetadataConfiguration"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"], ["MetadataTableConfiguration", "V1 S3 Metadata, which the schema says to replace with MetadataConfiguration; S3 answered V1APIsNotAllowed where it was probed, so an SDK path could not be verified. Stays on Cloud Control"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
@@ -3594,6 +3718,7 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName.startsWith("MetadataConfiguration.")) return (await this.readMetadataAttributes(physicalId))[attributeName];
 		return (await this.buildAttributes(physicalId))[attributeName];
 	}
 	async applyVersioning(bucketName, versioningConfig, onUnusable) {
@@ -3619,7 +3744,7 @@ var S3BucketProvider = class S3BucketProvider {
 		}));
 		this.logger.debug(`Applied ${tags.length} tags to bucket ${this.shown(bucketName)}`);
 	}
-	async applyTagDiff(bucketName, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+	async applyTagDiff(bucketName, resourceType, logicalId, oldTagsRaw, newTagsRaw, abacEnabled = false) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const desiredRead = readTagList(newTagsRaw, "desired");
 		const desired = desiredRead.kind === "tags" ? desiredRead.tags : [];
@@ -3640,6 +3765,10 @@ var S3BucketProvider = class S3BucketProvider {
 			if (plan.set.size === 0 && plan.remove.length === 0) return;
 			tagSet = desired;
 		}
+		if (abacEnabled) {
+			await this.replaceAbacBucketTags(bucketName, tagSet);
+			return;
+		}
 		if (tagSet.length === 0) {
 			try {
 				await this.s3Client.send(new DeleteBucketTaggingCommand({ Bucket: bucketName }));
@@ -3656,6 +3785,219 @@ var S3BucketProvider = class S3BucketProvider {
 		}));
 		this.logger.debug(`Replaced tag set on bucket ${this.shown(bucketName)} (${tagSet.length} tags)`);
 	}
+	async replaceAbacBucketTags(bucketName, tagSet) {
+		const keep = new Set(tagSet.map((t) => t.Key));
+		const stale = (await this.readTags(bucketName)).map((t) => t.Key).filter((key) => !keep.has(key));
+		const client = new S3ControlClient({
+			...clientDefaultsFor(this.credentialConfig),
+			region: await this.getRegion()
+		});
+		try {
+			const AccountId = (await getAccountInfo()).accountId;
+			const ResourceArn = s3BucketArn(bucketName, await this.getRegion());
+			if (stale.length > 0) await client.send(new UntagResourceCommand$13({
+				AccountId,
+				ResourceArn,
+				TagKeys: stale
+			}));
+			if (tagSet.length > 0) await client.send(new TagResourceCommand$13({
+				AccountId,
+				ResourceArn,
+				Tags: tagSet
+			}));
+		} finally {
+			client.destroy();
+		}
+		this.logger.debug(safeMsg`Replaced tag set on ABAC bucket ${this.shown(bucketName)}`);
+	}
+	async applyAbacStatus(bucketName, status) {
+		await this.s3Client.send(new PutBucketAbacCommand({
+			Bucket: bucketName,
+			AbacStatus: { Status: status }
+		}));
+		this.logger.debug(safeMsg`Applied AbacStatus to bucket ${this.shown(bucketName)}`);
+	}
+	async accountRegionalBucketName(prefix) {
+		return `${prefix}-${(await getAccountInfo()).accountId}-${canonicalizeRegion(await this.getRegion())}-an`;
+	}
+	async createMetadataConfiguration(bucketName, desired, stateBorne) {
+		const MetadataConfiguration = metadataConfigurationToSdk(desired);
+		try {
+			await this.s3Client.send(new CreateBucketMetadataConfigurationCommand({
+				Bucket: bucketName,
+				MetadataConfiguration
+			}));
+		} catch (err) {
+			if (err.name !== "MetadataConfigurationAlreadyExists") throw err;
+			const live = await this.readMetadataConfigurationResult(bucketName).catch(() => void 0);
+			if (live === void 0) throw err;
+			return this.convergeMetadataConfiguration(bucketName, desired, live, stateBorne);
+		}
+		await this.waitForMetadataTables(bucketName, MetadataConfiguration, stateBorne);
+		return true;
+	}
+	async convergeMetadataConfiguration(bucketName, desired, live, stateBorne) {
+		const sent = metadataConfigurationToSdk(desired);
+		if (sent.JournalTableConfiguration?.EncryptionConfiguration || sent.InventoryTableConfiguration?.EncryptionConfiguration || sent.AnnotationTableConfiguration?.EncryptionConfiguration) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)} already holds an S3 Metadata configuration, and S3 never returns a table's encryption, so the declared EncryptionConfiguration is unverified and may not be the one in effect`);
+		const enabledATable = await this.applyMetadataConfigurationDiff(bucketName, desired, metadataConfigurationFromSdk(live), true, true);
+		await this.waitForMetadataTables(bucketName, sent, stateBorne);
+		return enabledATable;
+	}
+	async applyMetadataConfigurationDiff(bucketName, desiredRaw, previousRaw, stateBorne, refuseOnly) {
+		const desired = metadataBag(desiredRaw);
+		const previous = metadataBag(previousRaw);
+		if (desired === void 0) {
+			if (previous === void 0) return false;
+			try {
+				await this.s3Client.send(new DeleteBucketMetadataConfigurationCommand({ Bucket: bucketName }));
+			} catch (err) {
+				if (err.name !== "MetadataConfigurationNotFound") throw err;
+			}
+			return false;
+		}
+		if (previous === void 0) {
+			if (refuseOnly) return false;
+			return this.createMetadataConfiguration(bucketName, desired, stateBorne);
+		}
+		const next = metadataConfigurationToSdk(desired);
+		const prev = metadataConfigurationToSdk(previous);
+		const differs = (a, b) => JSON.stringify(a) !== JSON.stringify(b);
+		const refuseEncryptionChange = (member, a, b) => {
+			if (!stateBorne && differs(a, b)) throw new Error(`Bucket ${this.shown(bucketName)}: changing MetadataConfiguration.${member}.EncryptionConfiguration is not supported once the table exists. Revert it, or re-create the table: remove MetadataConfiguration, deploy, delete the table with aws s3tables delete-table, then add it back with the new encryption`);
+		};
+		const nextJournal = next.JournalTableConfiguration;
+		const prevJournal = prev.JournalTableConfiguration;
+		refuseEncryptionChange("JournalTableConfiguration", prevJournal?.EncryptionConfiguration, nextJournal?.EncryptionConfiguration);
+		const nextInventory = next.InventoryTableConfiguration;
+		const prevInventory = prev.InventoryTableConfiguration;
+		const nextInventoryState = nextInventory?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		const prevInventoryState = prevInventory?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		if (nextInventoryState === METADATA_TABLE_ENABLED && prevInventoryState === METADATA_TABLE_ENABLED) refuseEncryptionChange("InventoryTableConfiguration", prevInventory?.EncryptionConfiguration, nextInventory?.EncryptionConfiguration);
+		const nextAnnotation = next.AnnotationTableConfiguration;
+		const prevAnnotation = prev.AnnotationTableConfiguration;
+		const nextAnnotationState = nextAnnotation?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		const prevAnnotationState = prevAnnotation?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		const annotationStaysOn = nextAnnotationState === METADATA_TABLE_ENABLED && prevAnnotationState === METADATA_TABLE_ENABLED;
+		if (annotationStaysOn) refuseEncryptionChange("AnnotationTableConfiguration", prevAnnotation?.EncryptionConfiguration, nextAnnotation?.EncryptionConfiguration);
+		let enabledATable = false;
+		if (differs(prevJournal?.RecordExpiration, nextJournal?.RecordExpiration)) await this.s3Client.send(new UpdateBucketMetadataJournalTableConfigurationCommand({
+			Bucket: bucketName,
+			JournalTableConfiguration: { RecordExpiration: nextJournal?.RecordExpiration }
+		}));
+		if (nextInventoryState !== prevInventoryState) {
+			const on = nextInventoryState === METADATA_TABLE_ENABLED;
+			await this.s3Client.send(new UpdateBucketMetadataInventoryTableConfigurationCommand({
+				Bucket: bucketName,
+				InventoryTableConfiguration: {
+					ConfigurationState: nextInventoryState,
+					...on && nextInventory?.EncryptionConfiguration ? { EncryptionConfiguration: nextInventory.EncryptionConfiguration } : {}
+				}
+			}));
+			enabledATable ||= on;
+		}
+		if (nextAnnotationState !== prevAnnotationState || annotationStaysOn && nextAnnotation?.Role !== prevAnnotation?.Role) {
+			const on = nextAnnotationState === METADATA_TABLE_ENABLED;
+			await this.s3Client.send(new UpdateBucketMetadataAnnotationTableConfigurationCommand({
+				Bucket: bucketName,
+				AnnotationTableConfiguration: {
+					ConfigurationState: nextAnnotationState,
+					...on && nextAnnotation?.EncryptionConfiguration ? { EncryptionConfiguration: nextAnnotation.EncryptionConfiguration } : {},
+					...on && nextAnnotation?.Role !== void 0 ? { Role: nextAnnotation.Role } : {}
+				}
+			}));
+			enabledATable ||= on;
+		}
+		if (enabledATable && !refuseOnly) await this.waitForMetadataTables(bucketName, next, stateBorne);
+		return enabledATable;
+	}
+	async waitForMetadataTables(bucketName, sent, stateBorne) {
+		const deadline = Date.now() + METADATA_TABLE_BUDGET_MS;
+		const warned = /* @__PURE__ */ new Set();
+		for (;;) {
+			let result;
+			try {
+				result = await this.readMetadataConfigurationResult(bucketName);
+			} catch (err) {
+				if (!stateBorne) throw err;
+				this.logger.warn(safeMsg`Could not read the S3 Metadata tables of ${this.shown(bucketName)} (${caughtErrorName(err)}); not waiting for them`);
+				return;
+			}
+			const tables = [
+				[
+					"journal",
+					true,
+					result?.JournalTableConfigurationResult
+				],
+				[
+					"inventory",
+					sent.InventoryTableConfiguration?.ConfigurationState === METADATA_TABLE_ENABLED,
+					result?.InventoryTableConfigurationResult
+				],
+				[
+					"annotation",
+					sent.AnnotationTableConfiguration?.ConfigurationState === METADATA_TABLE_ENABLED,
+					result?.AnnotationTableConfigurationResult
+				]
+			];
+			let pending;
+			for (const [name, wanted, table] of tables) {
+				if (!wanted) continue;
+				if (table?.TableStatus === "FAILED") {
+					if (!warned.has(name)) {
+						warned.add(name);
+						this.warnMetadataTableFailed(bucketName, name, table);
+					}
+					continue;
+				}
+				if (table?.TableArn === void 0) pending = `the ${name} table`;
+			}
+			if (pending === void 0) return;
+			if (Date.now() >= deadline) {
+				this.logger.warn(safeMsg`Gave up waiting for ${pending} of bucket ${this.shown(bucketName)}'s S3 Metadata configuration; it may still finish, and an Fn::GetAtt on its ARN fails until then. Read it with aws s3api get-bucket-metadata-configuration`);
+				return;
+			}
+			await new Promise((r) => setTimeout(r, METADATA_TABLE_POLL_MS));
+		}
+	}
+	warnMetadataTableFailed(bucketName, name, table) {
+		const reason = describeAwsStatusReason({
+			code: table.Error?.ErrorCode,
+			message: table.Error?.ErrorMessage
+		}, "S3 gave no reason.");
+		const noArn = table.TableArn === void 0 ? " It has no ARN, so an Fn::GetAtt on its TableArn fails." : "";
+		this.logger.debug(safeMsg`S3 Metadata ${name} table: ${this.maskRaw(reason.detail)}`);
+		this.logger.warn(safeMsg`The S3 Metadata ${name} table of bucket ${this.shown(bucketName)} FAILED: ${reason.summary} The deploy continues, but this table records nothing.${noArn} When a table left by an earlier bucket of this name is the cause, delete it with aws s3tables delete-table --table-bucket-arn <the account's aws-s3 table bucket> --namespace b_${this.shown(bucketName)} --name ${name}, then deploy without MetadataConfiguration and add it back`);
+	}
+	async readMetadataConfigurationResult(bucket) {
+		try {
+			return (await this.s3Client.send(new GetBucketMetadataConfigurationCommand({ Bucket: bucket }))).GetBucketMetadataConfigurationResult?.MetadataConfigurationResult;
+		} catch (err) {
+			if (err.name === "MetadataConfigurationNotFound") return void 0;
+			throw err;
+		}
+	}
+	async readMetadataForDrift(bucket) {
+		try {
+			return await this.readMetadataConfigurationResult(bucket);
+		} catch (err) {
+			this.logger.debug(safeMsg`Could not read S3 Metadata of ${this.shown(bucket)} (${caughtErrorName(err)})`);
+			return "unread";
+		}
+	}
+	async readMetadataAttributesAfterWrites(bucket, context) {
+		try {
+			return await this.readMetadataAttributes(bucket);
+		} catch (err) {
+			const readback = context !== void 0 && "desiredFromAwsReadback" in context ? context.desiredFromAwsReadback : void 0;
+			if (context?.replayingState !== true && readback !== true) throw err;
+			this.logger.warn(safeMsg`Could not read the S3 Metadata attributes of ${this.shown(bucket)} (${caughtErrorName(err)}); an Fn::GetAtt on them fails until the next deploy records them`);
+			return {};
+		}
+	}
+	async readMetadataAttributes(bucket) {
+		const result = await this.readMetadataConfigurationResult(bucket);
+		return result ? metadataAttributesFromSdk(result) : {};
+	}
 	async applyCorsConfiguration(bucketName, corsConfig) {
 		const corsRules = corsConfig.CorsRules.map((rule) => ({
 			ID: rule["Id"],
@@ -4620,6 +4962,17 @@ var S3BucketProvider = class S3BucketProvider {
 				retainPrevious("VersioningConfiguration");
 			} else await this.applyVersioning(bucketName, { Status: "Suspended" });
 		}
+		const desiredMetadata = properties["MetadataConfiguration"];
+		const previousMetadata = previousProperties["MetadataConfiguration"];
+		const metadataStateBorne = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+		const metadataRefusal = metadataConfigurationRefusal(desiredMetadata);
+		if (metadataRefusal !== void 0 && JSON.stringify(desiredMetadata) !== JSON.stringify(previousMetadata)) {
+			if (!metadataStateBorne) throw new Error(metadataRefusal);
+			this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)}: ${metadataRefusal}; its S3 Metadata configuration was left as it is`);
+			retainPrevious("MetadataConfiguration");
+		} else if (metadataRefusal === void 0) {
+			if (await this.applyMetadataConfigurationDiff(bucketName, desiredMetadata, previousMetadata, metadataStateBorne, refuseUnusable) && context?.desiredFromAwsReadback === true) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)}: S3 never returns a table's EncryptionConfiguration, so a table this revert turned on took S3's default encryption, whatever the template declares`);
+		}
 		return overrides;
 	}
 	async applyAllSubConfigsForCreate(bucketName, properties, context) {
@@ -4736,16 +5089,34 @@ var S3BucketProvider = class S3BucketProvider {
 		this.logger.debug(`${message} Proceeding.`);
 	}
 	async create(logicalId, resourceType, properties, context) {
-		if (this.opMask === void 0) return this.maskedView(createMaskedLogSinks(this.logger, context?.maskSecrets)).create(logicalId, resourceType, properties, context);
+		if (this.opMask === void 0) {
+			const sinks = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			const prefix = properties["BucketNamePrefix"];
+			const derivedName = typeof prefix === "string" && prefix !== "" && bucketNameRefusal(properties) === void 0 ? await this.accountRegionalBucketName(prefix) : void 0;
+			const view = withDerivedNameMasks(this.logger, sinks, [[prefix, derivedName]]);
+			return this.maskedView(view).create(logicalId, resourceType, properties, context);
+		}
 		this.logger.debug(`Creating S3 bucket ${displaySafe(logicalId)}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const explicitBucketName = Boolean(properties["BucketName"]);
-		const bucketName = properties["BucketName"] || this.generatedCreateName(resourceType, logicalId, properties);
+		const nameRefusal = bucketNameRefusal(properties);
+		if (nameRefusal !== void 0) {
+			if (context?.replayingState !== true) throw markNonRetryable(new ProvisioningError(`S3 bucket ${displaySafe(logicalId)} ${nameRefusal}; fix the template`, resourceType, logicalId));
+			this.logger.warn(safeMsg`S3 bucket ${displaySafe(logicalId)} ${nameRefusal}; restoring it anyway`);
+		}
+		const metadataRefusal = metadataConfigurationRefusal(properties["MetadataConfiguration"]);
+		if (metadataRefusal !== void 0 && context?.replayingState !== true) throw markNonRetryable(new ProvisioningError(`S3 bucket ${displaySafe(logicalId)}: ${metadataRefusal}; fix the template`, resourceType, logicalId));
+		const declaredPrefix = properties["BucketNamePrefix"];
+		const namePrefix = typeof declaredPrefix === "string" ? declaredPrefix : void 0;
+		const explicitBucketName = Boolean(properties["BucketName"] || namePrefix);
+		const bucketName = (namePrefix ? await this.accountRegionalBucketName(namePrefix) : void 0) || properties["BucketName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		let bucketLeftBehind = false;
 		let ambiguousWindow;
 		let windowSpent = false;
 		try {
-			const createParams = { Bucket: bucketName };
+			const createParams = {
+				Bucket: bucketName,
+				...properties["BucketNamespace"] !== void 0 ? { BucketNamespace: properties["BucketNamespace"] } : {}
+			};
 			const region = await this.getRegion();
 			const canonicalRegion = canonicalizeRegion(region);
 			if (canonicalRegion !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: canonicalRegion };
@@ -4837,12 +5208,28 @@ var S3BucketProvider = class S3BucketProvider {
 				} else throw createError;
 			}
 			let effectiveOverrides;
+			const bucketPredates = !createdNewBucket || adoptedOwnLeftover;
+			const desiredAbac = abacStatusOf(properties);
+			const liveAbacOn = bucketPredates && await this.readAbacStatus(bucketName) === ABAC_ENABLED;
 			try {
+				const turnAbacOff = liveAbacOn && properties["AbacStatus"] === ABAC_DISABLED;
+				if (turnAbacOff) await this.applyAbacStatus(bucketName, ABAC_DISABLED);
+				else if (liveAbacOn && properties["AbacStatus"] === void 0) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)} already existed with ABAC on, which the template does not declare; it stays on, and a later Tags change fails with BadRequest until the template declares AbacStatus`);
+				const tagsThroughControl = liveAbacOn && !turnAbacOff;
 				effectiveOverrides = await this.applyConfiguration(bucketName, properties, {
 					...context ? { context } : {},
-					...tagsAppliedOnCreate ? { skipTags: true } : { desiredTags }
+					...tagsAppliedOnCreate || tagsThroughControl ? { skipTags: true } : { desiredTags }
 				});
 				for (const [key, value] of await this.applyAllSubConfigsForCreate(bucketName, properties, context)) effectiveOverrides.set(key, value);
+				if (tagsThroughControl && desiredTags.length > 0) await this.replaceAbacBucketTags(bucketName, desiredTags);
+				if (desiredAbac !== ABAC_DISABLED) await this.applyAbacStatus(bucketName, desiredAbac);
+				const metadata = metadataBag(properties["MetadataConfiguration"]);
+				const replaying = context?.replayingState === true;
+				if (metadataRefusal !== void 0) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)}: ${metadataRefusal}; no S3 Metadata configuration was restored`);
+				else if (metadata !== void 0 && bucketPredates) {
+					const live = await this.readMetadataForDrift(bucketName);
+					await (live === "unread" || live === void 0 ? this.createMetadataConfiguration(bucketName, metadata, true) : this.convergeMetadataConfiguration(bucketName, metadata, live, replaying));
+				} else if (metadata !== void 0) await this.createMetadataConfiguration(bucketName, metadata, replaying);
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
@@ -4860,6 +5247,7 @@ var S3BucketProvider = class S3BucketProvider {
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
 			const attributes = await this.buildAttributes(bucketName);
+			if (metadataBag(properties["MetadataConfiguration"])) Object.assign(attributes, await this.readMetadataAttributesAfterWrites(bucketName, context));
 			this.logger.debug(`Successfully created S3 bucket ${displaySafe(logicalId)}: ${this.shown(bucketName)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
@@ -4879,7 +5267,7 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		if (this.opMask === void 0) {
-			const sinks = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["BucketName"], physicalId]]);
+			const sinks = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["BucketName"], physicalId], [previousProperties["BucketNamePrefix"], physicalId]]);
 			return this.maskedView(sinks).update(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		}
 		this.logger.debug(`Updating S3 bucket ${displaySafe(logicalId)}: ${this.shown(physicalId)}`);
@@ -4909,9 +5297,14 @@ var S3BucketProvider = class S3BucketProvider {
 				skipDiffManaged: true
 			});
 			for (const [key, value] of await this.applySubConfigDiffs(physicalId, properties, previousProperties, context)) effectiveOverrides.set(key, value);
-			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			const previousAbac = abacStatusOf(previousProperties);
+			const desiredAbac = abacStatusOf(properties);
+			if (previousAbac !== desiredAbac && desiredAbac === ABAC_DISABLED) await this.applyAbacStatus(physicalId, desiredAbac);
+			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], previousAbac === ABAC_ENABLED && desiredAbac === ABAC_ENABLED);
+			if (previousAbac !== desiredAbac && desiredAbac !== ABAC_DISABLED) await this.applyAbacStatus(physicalId, desiredAbac);
 			await this.warnUnappliedBucketObjectLock(logicalId, physicalId, properties, previousProperties, context);
 			const attributes = await this.buildAttributes(physicalId);
+			if (metadataBag(properties["MetadataConfiguration"])) Object.assign(attributes, await this.readMetadataAttributesAfterWrites(physicalId, context));
 			this.logger.debug(`Successfully updated S3 bucket ${displaySafe(logicalId)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
@@ -4996,7 +5389,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			throw err;
 		}
-		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
+		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory, abac, metadata] = await Promise.all([
 			this.readVersioning(physicalId),
 			this.readEncryption(physicalId),
 			this.readOwnershipControls(physicalId),
@@ -5013,7 +5406,9 @@ var S3BucketProvider = class S3BucketProvider {
 			this.readMetricsList(physicalId),
 			this.readAnalyticsList(physicalId),
 			this.readIntelligentTieringList(physicalId),
-			this.readInventoryList(physicalId)
+			this.readInventoryList(physicalId),
+			this.readAbacStatus(physicalId),
+			this.readMetadataForDrift(physicalId)
 		]);
 		return {
 			BucketName: physicalId,
@@ -5033,9 +5428,23 @@ var S3BucketProvider = class S3BucketProvider {
 			MetricsConfigurations: metrics,
 			AnalyticsConfigurations: analytics,
 			IntelligentTieringConfigurations: intelligentTier,
-			InventoryConfigurations: inventory
+			InventoryConfigurations: inventory,
+			...abac === ABAC_ENABLED || _properties?.["AbacStatus"] !== void 0 ? { AbacStatus: abac ?? _properties?.["AbacStatus"] } : {},
+			...metadata === "unread" ? _properties?.["MetadataConfiguration"] !== void 0 ? { MetadataConfiguration: _properties["MetadataConfiguration"] } : {} : metadata ? { MetadataConfiguration: metadataConfigurationFromSdk(metadata) } : {}
 		};
 	}
+	getDriftAbsentMeansDefaultKeys(_resourceType, properties) {
+		return [...abacStatusOf(properties) === ABAC_DISABLED ? ["AbacStatus"] : [], ...properties["MetadataConfiguration"] === void 0 ? ["MetadataConfiguration"] : []];
+	}
+	getDriftUnknownPaths() {
+		return [
+			"BucketNamePrefix",
+			"BucketNamespace",
+			"MetadataConfiguration.JournalTableConfiguration.EncryptionConfiguration",
+			"MetadataConfiguration.InventoryTableConfiguration.EncryptionConfiguration",
+			"MetadataConfiguration.AnnotationTableConfiguration.EncryptionConfiguration"
+		];
+	}
 	async readVersioning(bucket) {
 		return { Status: (await this.s3Client.send(new GetBucketVersioningCommand({ Bucket: bucket }))).Status ?? "Suspended" };
 	}
@@ -5383,6 +5792,14 @@ var S3BucketProvider = class S3BucketProvider {
 			throw err;
 		}
 	}
+	async readAbacStatus(bucket) {
+		try {
+			return (await this.s3Client.send(new GetBucketAbacCommand({ Bucket: bucket }))).AbacStatus?.Status ?? ABAC_DISABLED;
+		} catch (err) {
+			this.logger.debug(safeMsg`Could not read AbacStatus of ${this.shown(bucket)} (${caughtErrorName(err)})`);
+			return;
+		}
+	}
 	async readAccelerate(bucket) {
 		return { AccelerationStatus: (await this.s3Client.send(new GetBucketAccelerateConfigurationCommand({ Bucket: bucket }))).Status ?? "Suspended" };
 	}
@@ -5562,7 +5979,7 @@ var S3BucketProvider = class S3BucketProvider {
 		}
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
-		if (properties["BucketName"]) return void 0;
+		if (properties["BucketNamePrefix"] || properties["BucketName"]) return void 0;
 		return generatedNameFor("AWS::S3::Bucket", logicalId);
 	}
 	async import(input) {
@@ -9379,13 +9796,17 @@ function toCfnSelfManagedEventSource(selfManagedEventSource) {
 	return renameEndpointsKey(selfManagedEventSource, SDK_KAFKA_ENDPOINTS_KEY, CFN_KAFKA_ENDPOINTS_KEY);
 }
 const KAFKA_CONSUMPTION_MODE_KEY = "ConsumptionMode";
-function declaredConsumptionMode(properties) {
+const KAFKA_DEFAULT_CONSUMPTION_MODE = "Stream";
+function consumptionModeOf(properties) {
 	const config = properties["SelfManagedKafkaEventSourceConfig"];
-	if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
-	return config[KAFKA_CONSUMPTION_MODE_KEY];
+	if (typeof config !== "object" || config === null || Array.isArray(config)) return KAFKA_DEFAULT_CONSUMPTION_MODE;
+	return config[KAFKA_CONSUMPTION_MODE_KEY] ?? KAFKA_DEFAULT_CONSUMPTION_MODE;
 }
-function consumptionModeRefusalMessage(logicalId, mode) {
-	return `AWS::Lambda::EventSourceMapping ${logicalId}: SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be sent by cdkd yet — the AWS SDK for JavaScript does not model the member, so it would be dropped from the ${mode === "create" ? "CreateEventSourceMapping" : "UpdateEventSourceMapping"} request without an error. Remove ${KAFKA_CONSUMPTION_MODE_KEY} from SelfManagedKafkaEventSourceConfig to deploy the mapping without it.`;
+function replayableKafkaConfig(properties) {
+	if (consumptionModeOf(properties) !== "Queue") return void 0;
+	if (properties["StartingPosition"] === void 0 && properties["StartingPositionTimestamp"] === void 0 && properties["MaximumBatchingWindowInSeconds"] === void 0) return;
+	const { [KAFKA_CONSUMPTION_MODE_KEY]: _dropped, ...rest } = properties["SelfManagedKafkaEventSourceConfig"];
+	return rest;
 }
 function kafkaConfigForUpdate(desired, previous, options) {
 	const asObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
@@ -9573,11 +9994,6 @@ var LambdaEventSourceMappingProvider = class {
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, void 0, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const functionName = properties["FunctionName"];
 		if (!functionName) throw new ProvisioningError(`FunctionName is required for event source mapping ${logicalId}`, resourceType, logicalId);
-		if (declaredConsumptionMode(properties) !== void 0) {
-			const message = consumptionModeRefusalMessage(logicalId, "create");
-			if (context?.replayingState !== true) throw new ProvisioningError(message, resourceType, logicalId);
-			log.warn(safeMsg`${message} Proceeding without it: this create replays a cdkd state record.`);
-		}
 		try {
 			const params = { FunctionName: functionName };
 			if (properties["EventSourceArn"]) params.EventSourceArn = properties["EventSourceArn"];
@@ -9596,6 +10012,11 @@ var LambdaEventSourceMappingProvider = class {
 			if (properties["SourceAccessConfigurations"]) params.SourceAccessConfigurations = properties["SourceAccessConfigurations"];
 			if (properties["SelfManagedEventSource"]) params.SelfManagedEventSource = toSdkSelfManagedEventSource(properties["SelfManagedEventSource"]);
 			if (properties["SelfManagedKafkaEventSourceConfig"]) params.SelfManagedKafkaEventSourceConfig = properties["SelfManagedKafkaEventSourceConfig"];
+			const replayableKafka = context?.replayingState === true ? replayableKafkaConfig(properties) : void 0;
+			if (replayableKafka !== void 0) {
+				log.warn(safeMsg`AWS::Lambda::EventSourceMapping ${logicalId}: the state record holds ConsumptionMode Queue beside a member Lambda refuses with it, so the mapping it records never ran in Queue mode. Proceeding without ConsumptionMode: this create replays a cdkd state record.`);
+				params.SelfManagedKafkaEventSourceConfig = replayableKafka;
+			}
 			if (properties["AmazonManagedKafkaEventSourceConfig"]) params.AmazonManagedKafkaEventSourceConfig = properties["AmazonManagedKafkaEventSourceConfig"];
 			if (properties["DocumentDBEventSourceConfig"]) params.DocumentDBEventSourceConfig = properties["DocumentDBEventSourceConfig"];
 			if (properties["ScalingConfig"]) params.ScalingConfig = properties["ScalingConfig"];
@@ -9632,7 +10053,11 @@ var LambdaEventSourceMappingProvider = class {
 				attributes: {
 					Id: uuid,
 					EventSourceMappingArn: response.EventSourceMappingArn
-				}
+				},
+				...replayableKafka !== void 0 && { effectiveProperties: {
+					...properties,
+					SelfManagedKafkaEventSourceConfig: replayableKafka
+				} }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -9666,18 +10091,15 @@ var LambdaEventSourceMappingProvider = class {
 		const log = this.operationSinks(context?.maskSecrets, properties, previousProperties);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		const restoring = context?.replayingState === true || context?.desiredFromAwsReadback === true;
-		for (const key of ["Queues", "Topics"]) {
-			if (JSON.stringify(properties[key]) === JSON.stringify(previousProperties[key])) continue;
-			const reason = `${key} cannot be changed on an existing event source mapping (UpdateEventSourceMapping does not take it, and CloudFormation refuses the change too)`;
+		const refuseChange = (reason) => {
 			if (!restoring) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${reason}; deploy with --replace to delete and recreate the mapping`);
 			log.warn(safeMsg`AWS::Lambda::EventSourceMapping ${logicalId}: ${reason}. Proceeding without it: this update restores a recorded or read-back configuration.`);
+		};
+		for (const key of ["Queues", "Topics"]) {
+			if (JSON.stringify(properties[key]) === JSON.stringify(previousProperties[key])) continue;
+			refuseChange(`${key} cannot be changed on an existing event source mapping (UpdateEventSourceMapping does not take it, and CloudFormation refuses the change too)`);
 		}
-		const desiredMode = declaredConsumptionMode(properties);
-		if (desiredMode !== void 0 && JSON.stringify(desiredMode) !== JSON.stringify(declaredConsumptionMode(previousProperties))) {
-			const message = consumptionModeRefusalMessage(logicalId, "update");
-			if (!restoring) throw new ProvisioningError(message, resourceType, logicalId, physicalId);
-			log.warn(safeMsg`${message} Proceeding without it: this update restores a recorded or read-back configuration.`);
-		}
+		if (JSON.stringify(consumptionModeOf(properties)) !== JSON.stringify(consumptionModeOf(previousProperties))) refuseChange(`SelfManagedKafkaEventSourceConfig.${KAFKA_CONSUMPTION_MODE_KEY} cannot be changed on an existing event source mapping (UpdateEventSourceMapping refuses it)`);
 		try {
 			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, log, restoring);
 		} catch (error) {
@@ -9905,6 +10327,24 @@ var LambdaEventSourceMappingProvider = class {
 		result["Tags"] = tags;
 		return result;
 	}
+	async canonicalizeDriftPair(_resourceType, baseline, aws, properties) {
+		const key = "SelfManagedKafkaEventSourceConfig";
+		const block = baseline[key];
+		if (typeof block !== "object" || block === null || Array.isArray(block) || KAFKA_CONSUMPTION_MODE_KEY in block || consumptionModeOf(aws) !== KAFKA_DEFAULT_CONSUMPTION_MODE || consumptionModeOf(properties ?? {}) !== KAFKA_DEFAULT_CONSUMPTION_MODE || aws[key]?.[KAFKA_CONSUMPTION_MODE_KEY] === void 0) return {
+			baseline,
+			aws
+		};
+		return {
+			baseline: {
+				...baseline,
+				[key]: {
+					...block,
+					[KAFKA_CONSUMPTION_MODE_KEY]: KAFKA_DEFAULT_CONSUMPTION_MODE
+				}
+			},
+			aws
+		};
+	}
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
 		let resp;
@@ -11840,120 +12280,6 @@ async function waitForGoneAfterDelete(opts) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-vector-indexes.ts
-function vectorIndexesByName(value) {
-	const out = /* @__PURE__ */ new Map();
-	if (!Array.isArray(value)) return out;
-	for (const entry of value) {
-		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
-		const name = entry["IndexName"];
-		if (typeof name === "string") out.set(name, entry);
-	}
-	return out;
-}
-function vectorIndexForSend(entry) {
-	const out = {};
-	for (const key of [
-		"IndexName",
-		"VectorAttribute",
-		"Projection",
-		"DistanceFunction"
-	]) if (entry[key] !== void 0) out[key] = entry[key];
-	if (entry["Dimensions"] !== void 0) out["Dimensions"] = coerceCfnInteger(entry["Dimensions"]) ?? entry["Dimensions"];
-	if (entry["SearchSchema"] !== void 0) out["SearchSchema"] = entry["SearchSchema"];
-	return out;
-}
-function vectorIndexesForCreate(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (!Array.isArray(value)) return value;
-	return value.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? vectorIndexForSend(entry) : entry);
-}
-function sortedByJson(list) {
-	if (!Array.isArray(list)) return list;
-	return [...list].sort((a, b) => {
-		const x = JSON.stringify(a) ?? "";
-		const y = JSON.stringify(b) ?? "";
-		return x < y ? -1 : x > y ? 1 : 0;
-	});
-}
-function vectorIndexKey(entry) {
-	const e = entry;
-	const projection = e["Projection"];
-	const normalizedProjection = typeof projection === "object" && projection !== null && !Array.isArray(projection) ? {
-		ProjectionType: projection["ProjectionType"],
-		NonKeyAttributes: sortedByJson(nonEmpty(projection["NonKeyAttributes"]))
-	} : projection;
-	const attribute = e["VectorAttribute"];
-	return JSON.stringify([
-		e["IndexName"],
-		typeof attribute === "object" && attribute !== null ? attribute["AttributeName"] : attribute,
-		coerceCfnInteger(e["Dimensions"]) ?? e["Dimensions"],
-		e["DistanceFunction"],
-		normalizedProjection,
-		sortedByJson(Array.isArray(e["SearchSchema"]) && e["SearchSchema"].length > 0 ? e["SearchSchema"].map((s) => typeof s === "object" && s !== null ? {
-			AttributeName: s["AttributeName"],
-			SearchSchemaElementType: s["SearchSchemaElementType"]
-		} : s) : nonEmpty(e["SearchSchema"]))
-	]);
-}
-function nonEmpty(value) {
-	return Array.isArray(value) && value.length === 0 ? void 0 : value;
-}
-function planVectorIndexUpdates(previous, desired, live) {
-	const prevByName = vectorIndexesByName(previous);
-	const desiredByName = vectorIndexesByName(desired);
-	const liveByName = live === void 0 ? void 0 : new Map(live.filter((d) => typeof d.IndexName === "string").map((d) => [d.IndexName, d]));
-	const plan = {
-		ops: [],
-		changed: [],
-		adopted: [],
-		alreadyGone: []
-	};
-	const liveHolds = (name, entry) => {
-		const l = liveByName?.get(name);
-		return l !== void 0 && l.IndexStatus !== "DELETING" && vectorIndexKey(l) === vectorIndexKey(entry);
-	};
-	for (const name of prevByName.keys()) {
-		if (desiredByName.has(name)) continue;
-		const l = liveByName?.get(name);
-		if (liveByName !== void 0 && (l === void 0 || l.IndexStatus === "DELETING")) {
-			plan.alreadyGone.push(name);
-			continue;
-		}
-		plan.ops.push({ Delete: { IndexName: name } });
-	}
-	for (const [name, entry] of desiredByName) {
-		const before = prevByName.get(name);
-		if (before === void 0) {
-			const l = liveByName?.get(name);
-			if (l === void 0 || l.IndexStatus === "DELETING") plan.ops.push({ Create: vectorIndexForSend(entry) });
-			else if (liveHolds(name, entry)) plan.adopted.push(name);
-			else plan.changed.push(name);
-			continue;
-		}
-		if (vectorIndexKey(before) === vectorIndexKey(entry)) continue;
-		if (!liveHolds(name, entry)) plan.changed.push(name);
-	}
-	return plan;
-}
-function readbackVectorIndexes(live) {
-	if (live === void 0 || live.length === 0) return void 0;
-	return live.map((d) => {
-		const out = {};
-		if (d.IndexName !== void 0) out["IndexName"] = d.IndexName;
-		if (d.VectorAttribute !== void 0) out["VectorAttribute"] = d.VectorAttribute;
-		if (d.Dimensions !== void 0) out["Dimensions"] = d.Dimensions;
-		if (d.DistanceFunction !== void 0) out["DistanceFunction"] = d.DistanceFunction;
-		if (d.Projection !== void 0) out["Projection"] = d.Projection;
-		if (d.SearchSchema !== void 0 && d.SearchSchema.length > 0) out["SearchSchema"] = d.SearchSchema;
-		return out;
-	});
-}
-function vectorIndexesSettled(live) {
-	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
-}
-
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
@@ -24479,11 +24805,11 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 		const region = await this.getClient().config.region();
 		const { partition } = derivePartitionAndUrlSuffix(region);
 		const resourceArn = `arn:${partition}:apigateway:${canonicalizeRegion(region)}::${path}`;
-		if (change.remove.length > 0) await this.getClient().send(new UntagResourceCommand$13({
+		if (change.remove.length > 0) await this.getClient().send(new UntagResourceCommand$14({
 			ResourceArn: resourceArn,
 			TagKeys: change.remove
 		}));
-		if (Object.keys(change.set).length > 0) await this.getClient().send(new TagResourceCommand$13({
+		if (Object.keys(change.set).length > 0) await this.getClient().send(new TagResourceCommand$14({
 			ResourceArn: resourceArn,
 			Tags: change.set
 		}));
@@ -26403,7 +26729,7 @@ var StepFunctionsProvider = class {
 			result["EncryptionConfiguration"] = ec;
 		}
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (!(err instanceof StateMachineDoesNotExist)) throw err;
@@ -26446,14 +26772,14 @@ var StepFunctionsProvider = class {
 		}));
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$14({
+			await this.getClient().send(new UntagResourceCommand$15({
 				resourceArn: stateMachineArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from SFN state machine ${stateMachineArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$14({
+			await this.getClient().send(new TagResourceCommand$15({
 				resourceArn: stateMachineArn,
 				tags: tagsToAdd
 			}));
@@ -27445,14 +27771,14 @@ var ECSProvider = class {
 		}));
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$16({
 				resourceArn,
 				tagKeys: tagsToRemove
 			}));
 			log.debug(`Removed ${tagsToRemove.length} tag(s) from ECS resource ${resourceArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn,
 				tags: tagsToAdd
 			}));
@@ -30936,7 +31262,7 @@ async function applyDocDBTagDiff(client, logger, arn, resourceType, logicalId, o
 }
 async function attachDocDBTags(client, logger, result, arn) {
 	try {
-		const tagsResp = await client.send(new ListTagsForResourceCommand$12({ ResourceName: arn }));
+		const tagsResp = await client.send(new ListTagsForResourceCommand$13({ ResourceName: arn }));
 		result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 	} catch (err) {
 		logger.debug(safeMsg`DocDB ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
@@ -33315,14 +33641,14 @@ var WAFv2WebACLProvider = class {
 		}));
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$17({
 				ResourceARN: arn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$17({
 				ResourceARN: arn,
 				Tags: tagsToAdd
 			}));
@@ -33361,7 +33687,7 @@ var WAFv2WebACLProvider = class {
 		if (webACL.ApplicationConfig) result["ApplicationConfig"] = webACL.ApplicationConfig;
 		if (webACL.MonetizationConfig) result["MonetizationConfig"] = webACL.MonetizationConfig;
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceARN: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
 		} catch (err) {
 			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
@@ -33423,6 +33749,7 @@ function userPoolDeletionProtectionUpdate(physicalId, pool, value, opts = {}) {
 	if (acr === void 0) delete input.AcrConfiguration;
 	else input.AcrConfiguration = acr;
 	if (echoesDeveloperEmail(pool) && opts.withoutDeveloperEmail !== true) input.EmailConfiguration = pool.EmailConfiguration;
+	if (echoesCustomerManagedKey(pool)) input.KeyConfiguration = pool.KeyConfiguration;
 	input.DeletionProtection = value;
 	return input;
 }
@@ -33448,6 +33775,19 @@ function reportKind(record) {
 function echoesDeveloperEmail(pool) {
 	return pool.EmailConfiguration?.EmailSendingAccount === "DEVELOPER";
 }
+function echoesCustomerManagedKey(pool) {
+	return pool.KeyConfiguration?.KeyType === "CUSTOMER_MANAGED_KEY";
+}
+function bareFlipResets(pool) {
+	const reset = [
+		"self sign-up",
+		"Lambda triggers",
+		"advanced security"
+	];
+	if (echoesDeveloperEmail(pool)) reset.push("SES email configuration");
+	if (echoesCustomerManagedKey(pool)) reset.push("customer-managed key");
+	return `${reset.slice(0, -1).join(", ")} and ${reset[reset.length - 1]}`;
+}
 const REFUSED_ECHO_ERRORS = /* @__PURE__ */ new Set([
 	"InvalidParameterException",
 	"InvalidSmsRoleAccessPolicyException",
@@ -33530,12 +33870,13 @@ const KEPT_ON_REMOVAL_MEMBERS = {
 	AccountRecoverySetting: void 0,
 	SmsConfiguration: void 0,
 	UserPoolTier: "ESSENTIALS",
-	DeletionProtection: "INACTIVE"
+	DeletionProtection: "INACTIVE",
+	IssuerConfiguration: { Type: "ORIGINAL" }
 };
 function declaresMember(value, unset) {
 	if (value === void 0 || value === null || value === "") return false;
 	if (isEmptyObjectPlaceholder(value)) return false;
-	return unset === void 0 || value !== unset;
+	return unset === void 0 || !isDeepStrictEqual(value, unset);
 }
 function sendsKeptMember(member, value) {
 	if (!value) return false;
@@ -33740,6 +34081,8 @@ var CognitoUserPoolProvider = class {
 		"SmsAuthenticationMessage",
 		"SmsVerificationMessage",
 		"UserPoolTier",
+		"KeyConfiguration",
+		"IssuerConfiguration",
 		"EnabledMfas",
 		"EmailAuthenticationMessage",
 		"EmailAuthenticationSubject",
@@ -33821,6 +34164,8 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsAuthenticationMessage"]) createParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
 			if (properties["SmsVerificationMessage"]) createParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) createParams.UserPoolTier = properties["UserPoolTier"];
+			if (properties["KeyConfiguration"]) createParams.KeyConfiguration = properties["KeyConfiguration"];
+			if (properties["IssuerConfiguration"]) createParams.IssuerConfiguration = properties["IssuerConfiguration"];
 			const orphanWindow = createUserPoolLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleOrphanPools(logicalId, poolName, orphanWindow, createMaskedLogSinks(this.logger, context?.maskSecrets));
 			let created;
@@ -34081,6 +34426,8 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsAuthenticationMessage"] !== void 0) updateParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
+			if (properties["KeyConfiguration"]) updateParams.KeyConfiguration = properties["KeyConfiguration"];
+			if (properties["IssuerConfiguration"]) updateParams.IssuerConfiguration = properties["IssuerConfiguration"];
 			const mfaOptions = {
 				...liveMfa?.value !== void 0 ? { liveMfaConfiguration: liveMfa.value } : {},
 				...liveMfa?.failed === true ? { liveReadFailed: true } : {},
@@ -34140,7 +34487,7 @@ var CognitoUserPoolProvider = class {
 			this.logger.warn(safeMsg`Cognito User Pool ${logicalId} (${physicalId}): the template no longer declares ` + safeMsg`${removed.length} UserPoolTags key(s), but DescribeUserPool returned no ARN to ` + safeMsg`untag them with, so they stay on the pool. Remove them with ` + safeMsg`aws cognito-idp untag-resource.`);
 			return;
 		}
-		await this.getClient().send(new UntagResourceCommand$17({
+		await this.getClient().send(new UntagResourceCommand$18({
 			ResourceArn: poolArn,
 			TagKeys: removed
 		}));
@@ -34188,7 +34535,7 @@ var CognitoUserPoolProvider = class {
 				before: "aws cognito-idp update-user-pool --user-pool-id",
 				identifier: physicalId,
 				after: "--deletion-protection INACTIVE",
-				caveat: "Note UpdateUserPool resets some members a call omits (self sign-up, Lambda triggers, advanced security and AutoVerifiedAttributes among them), so send your complete pool configuration alongside that flag rather than the flag alone."
+				caveat: "Note UpdateUserPool resets some members a call omits (self sign-up, Lambda triggers, advanced security, AutoVerifiedAttributes and a customer-managed KeyConfiguration among them), so send your complete pool configuration alongside that flag rather than the flag alone."
 			}
 		}) : `AWS::Cognito::UserPool is a stateful type, so re-run with ${replaceFlags} to recreate it (this deletes all users in the pool).`;
 	}
@@ -34213,16 +34560,16 @@ var CognitoUserPoolProvider = class {
 					try {
 						pool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
 					} catch (readError) {
-						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip), maskerOrIdentity(context?.maskSecrets));
 						throw readError;
 					}
 					if (!pool) {
-						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip), maskerOrIdentity(context?.maskSecrets));
 						throw new Error(`DescribeUserPool returned no pool for ${physicalId}`);
 					}
 					if (bareFlip && pool.DeletionProtection !== "ACTIVE") bareFlip.ambiguous = false;
 					const resetConfirmed = bareFlip !== void 0 && !bareFlip.ambiguous;
-					if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+					if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip), maskerOrIdentity(context?.maskSecrets));
 					if (flipRecord && this.emailOmittedFlips.has(flipRecord) && !echoesDeveloperEmail(pool) && !(bareFlip && echoesDeveloperEmail(bareFlip.pool))) this.logger.error(safeMsg`Cognito User Pool ${physicalId} is LIVE with its SES email configuration reset: ` + safeMsg`--remove-protection turned DeletionProtection off with an UpdateUserPool that left ` + safeMsg`out its DEVELOPER EmailConfiguration (sending it was refused), and the delete then ` + safeMsg`failed. The pool's email configuration was ${EMAIL_RESET_CLAUSE}`);
 					const bareLicensed = resetConfirmed && bareFlip.echoedSince !== true;
 					const readOn = pool.DeletionProtection === "ACTIVE";
@@ -34255,7 +34602,7 @@ var CognitoUserPoolProvider = class {
 			}
 		});
 	}
-	reportSettingsResetByBareFlip(physicalId, before, kind) {
+	reportSettingsResetByBareFlip(physicalId, before, kind, mask) {
 		const held = [];
 		const adminOnly = before.AdminCreateUserConfig?.AllowAdminCreateUserOnly;
 		if (adminOnly !== void 0) held.push(`AllowAdminCreateUserOnly=${String(adminOnly)}`);
@@ -34269,10 +34616,11 @@ var CognitoUserPoolProvider = class {
 		const mode = before.UserPoolAddOns?.AdvancedSecurityMode;
 		if (mode) held.push(`AdvancedSecurityMode=${mode}`);
 		if (echoesDeveloperEmail(before)) held.push("EmailConfiguration.EmailSendingAccount=DEVELOPER (SES)");
-		const heldText = held.length > 0 ? held.join(", ") : "none of these settings";
-		const what = echoesDeveloperEmail(before) ? "self sign-up, Lambda triggers, advanced security and SES email configuration" : "self sign-up, Lambda triggers and advanced security";
+		if (echoesCustomerManagedKey(before)) held.push(`KeyConfiguration.KmsKeyArn=${String(before.KeyConfiguration?.KmsKeyArn)}`);
+		const heldText = held.length > 0 ? held.map((entry) => mask(entry)).join(", ") : "none of these settings";
+		const what = bareFlipResets(before);
 		const state = kind === "unclear" ? safeMsg`is LIVE and its ${what} MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its ${what} were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its ${what} reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
-		this.logger.error(safeMsg`Cognito User Pool ${physicalId} ` + state + safeMsg` Before that write the pool held: ${heldText}. Put them back with ` + safeMsg`aws cognito-idp update-user-pool, sending the pool's complete configuration -- a ` + safeMsg`cdkd deploy will NOT restore them, because its recorded properties still match the template.`);
+		this.logger.error(mask(safeMsg`Cognito User Pool ${physicalId} ` + state + safeMsg` Before that write the pool held: ${heldText}. Put them back with ` + safeMsg`aws cognito-idp update-user-pool, sending the pool's complete configuration -- a ` + safeMsg`cdkd deploy will NOT restore them, because its recorded properties still match the template.`));
 	}
 	async deleteOnce(logicalId, physicalId, resourceType, context, flip) {
 		this.logger.debug(`Deleting Cognito User Pool ${logicalId}: ${physicalId}`);
@@ -34374,7 +34722,7 @@ var CognitoUserPoolProvider = class {
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
-				this.warnGuardLeftOn(physicalId, mask, echoError);
+				this.warnGuardLeftOn(physicalId, pool, mask, echoError);
 				throw echoError;
 			}
 			try {
@@ -34392,10 +34740,10 @@ var CognitoUserPoolProvider = class {
 					});
 				}
 				if (isTransientCognitoFailure(bareError)) {
-					if (isAmbiguousWriteFailure(bareError)) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool with DeletionProtection alone ` + safeMsg`(the pool's own configuration was refused) answered ${mask(describeAwsFailure(bareError).summary)}; ` + safeMsg`if that write landed, the pool's self sign-up, Lambda triggers and advanced ` + safeMsg`security were reset. Retrying the delete.`);
+					if (isAmbiguousWriteFailure(bareError)) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool with DeletionProtection alone ` + safeMsg`(the pool's own configuration was refused) answered ${mask(describeAwsFailure(bareError).summary)}; ` + safeMsg`if that write landed, the pool's ${bareFlipResets(pool)} were reset. Retrying the delete.`);
 					throw bareError;
 				}
-				this.warnGuardLeftOn(physicalId, mask, bareError, echoError);
+				this.warnGuardLeftOn(physicalId, pool, mask, bareError, echoError);
 				throw bareError;
 			}
 			const kept = this.preFlipPools.get(flip);
@@ -34408,16 +34756,16 @@ var CognitoUserPoolProvider = class {
 				kept.echoedSince = false;
 			}
 			this.logger.debug(mask(safeMsg`UpdateUserPool refused the echoed configuration of ${mask(physicalId)}: ${mask(describeAwsFailure(echoError).detail)}`));
-			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the pool's own configuration ` + safeMsg`echoed back (${mask(describeAwsFailure(echoError).summary)}), so DeletionProtection was ` + safeMsg`turned off alone. That write resets the settings it omits -- self sign-up, Lambda ` + safeMsg`triggers and advanced security among them -- which stays that way if the delete fails.`);
+			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the pool's own configuration ` + safeMsg`echoed back (${mask(describeAwsFailure(echoError).summary)}), so DeletionProtection was ` + safeMsg`turned off alone. That write resets the settings it omits -- ${bareFlipResets(pool)} ` + safeMsg`among them -- which stays that way if the delete fails.`);
 		}
 	}
-	warnGuardLeftOn(physicalId, mask, error, echoError) {
+	warnGuardLeftOn(physicalId, pool, mask, error, echoError) {
 		const name = typeof error === "object" && error !== null ? safeStringify(error.name) : "";
 		const accessHint = /AccessDenied|NotAuthorized|Unauthorized/.test(name) ? " The caller needs cognito-idp:UpdateUserPool." : "";
 		const echoClause = echoError === void 0 ? "" : safeMsg`; the pool's own settings sent back were refused first (${mask(describeAwsFailure(echoError).summary)})`;
 		this.logger.debug(mask(safeMsg`UpdateUserPool did not turn DeletionProtection off on ${mask(physicalId)}: ${mask(describeAwsFailure(error).detail)}`));
 		const refused = error instanceof Error && isAwsAuthoredFailure(error);
-		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${mask(describeAwsFailure(error).summary)})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${mask(describeAwsFailure(error).summary)})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
+		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${mask(describeAwsFailure(error).summary)})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${mask(describeAwsFailure(error).summary)})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's ${bareFlipResets(pool)} were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::Cognito::UserPool") return void 0;
@@ -34459,6 +34807,8 @@ var CognitoUserPoolProvider = class {
 		}
 		result["UserPoolTags"] = userTags;
 		result["UserPoolTier"] = pool.UserPoolTier ?? "ESSENTIALS";
+		if (pool.KeyConfiguration) result["KeyConfiguration"] = pool.KeyConfiguration;
+		if (pool.IssuerConfiguration) result["IssuerConfiguration"] = pool.IssuerConfiguration;
 		try {
 			const mfa = await this.getClient().send(new GetUserPoolMfaConfigCommand({ UserPoolId: physicalId }));
 			const enabledMfas = [];
@@ -35730,11 +36080,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			if (hasTagChange) {
 				const arn = knownArn ?? (await client.send(new GetServiceCommand({ Id: physicalId }))).Service?.Arn;
 				if (!arn) throw new ProvisioningError(safeMsg`Could not resolve the ARN of service discovery service ${logicalId}; its Tags were not updated`, resourceType, logicalId, physicalId);
-				if (tagPlan.remove.length > 0) await client.send(new UntagResourceCommand$18({
+				if (tagPlan.remove.length > 0) await client.send(new UntagResourceCommand$19({
 					ResourceARN: arn,
 					TagKeys: tagPlan.remove
 				}));
-				if (tagPlan.set.size > 0) await client.send(new TagResourceCommand$17({
+				if (tagPlan.set.size > 0) await client.send(new TagResourceCommand$18({
 					ResourceARN: arn,
 					Tags: [...tagPlan.set].map(([Key, Value]) => ({
 						Key,
@@ -35850,11 +36200,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const hasAdds = tagsToAdd.length > 0;
 		if (removedKeys.length === 0 && !hasAdds) return;
 		const arn = await this.resolveNamespaceArn(physicalId);
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$19({
 			ResourceARN: arn,
 			TagKeys: removedKeys
 		}));
-		if (hasAdds) await this.getClient().send(new TagResourceCommand$17({
+		if (hasAdds) await this.getClient().send(new TagResourceCommand$18({
 			ResourceARN: arn,
 			Tags: tagsToAdd
 		}));
@@ -36027,7 +36377,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 	async attachTags(result, arn) {
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
@@ -36619,7 +36969,7 @@ var AppSyncProvider = class {
 		const tagKeysToRemove = plan.remove;
 		const tagsToAdd = Object.fromEntries(plan.set);
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$19({
+			await this.getClient().send(new UntagResourceCommand$20({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -36627,7 +36977,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)", mask);
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$18({
+			await this.getClient().send(new TagResourceCommand$19({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -39322,11 +39672,11 @@ async function applyGlueTagDiff(client, resourceArn, recorded, desired, resource
 	if (toSet.size === 0 && plan.remove.length === 0) return;
 	unsettled.beforeWrite();
 	const arn = await resourceArn();
-	if (toSet.size > 0) await client.send(new TagResourceCommand$19({
+	if (toSet.size > 0) await client.send(new TagResourceCommand$20({
 		ResourceArn: arn,
 		TagsToAdd: Object.fromEntries(toSet)
 	}));
-	if (plan.remove.length > 0) await client.send(new UntagResourceCommand$20({
+	if (plan.remove.length > 0) await client.send(new UntagResourceCommand$21({
 		ResourceArn: arn,
 		TagsToRemove: plan.remove
 	}));
@@ -41108,7 +41458,7 @@ var BudgetsBudgetProvider = class {
 			const newTags = this.toSdkResourceTags(next.ResourceTags);
 			if (prevTags.kind === "list") await this.reconcileResourceTags(accountId, physicalId, this.toSdkResourceTags(removableRecorded("ResourceTags", prevTags.items)), newTags);
 			else {
-				if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$20({
+				if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$21({
 					ResourceARN: await this.budgetArn(accountId, physicalId),
 					ResourceTags: newTags
 				}));
@@ -41252,11 +41602,11 @@ var BudgetsBudgetProvider = class {
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
 		});
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$21({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$22({
 			ResourceARN: arn,
 			ResourceTagKeys: removedKeys
 		}));
-		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$20({
+		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$21({
 			ResourceARN: arn,
 			ResourceTags: newTags
 		}));
@@ -41336,7 +41686,7 @@ var BudgetsBudgetProvider = class {
 		}));
 		let tags;
 		try {
-			tags = await client.send(new ListTagsForResourceCommand$15({ ResourceARN: await this.budgetArn(accountId, physicalId) }));
+			tags = await client.send(new ListTagsForResourceCommand$16({ ResourceARN: await this.budgetArn(accountId, physicalId) }));
 		} catch (error) {
 			if (error instanceof NotFoundException$5 && await describe() === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
 			throw error;
@@ -42314,7 +42664,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
@@ -42331,14 +42681,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToAdd = Object.fromEntries(plan.set);
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$22({
+			await this.getClient().send(new UntagResourceCommand$23({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(mask(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`));
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$21({
+			await this.getClient().send(new TagResourceCommand$22({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -43145,11 +43495,11 @@ var PipesPipeProvider = class {
 				settled ??= await this.describe(physicalId);
 				const arn = settled.Arn;
 				if (!arn) throw new Error("DescribePipe returned no Arn, which tagging needs");
-				if (plan.remove.length > 0) await this.getClient().send(new UntagResourceCommand$23({
+				if (plan.remove.length > 0) await this.getClient().send(new UntagResourceCommand$24({
 					resourceArn: arn,
 					tagKeys: plan.remove
 				}));
-				if (plan.set.size > 0) await this.getClient().send(new TagResourceCommand$22({
+				if (plan.set.size > 0) await this.getClient().send(new TagResourceCommand$23({
 					resourceArn: arn,
 					tags: Object.fromEntries(plan.set)
 				}));
@@ -43576,11 +43926,11 @@ var EFSProvider = class {
 		const plan = planTagDiff(recorded, desired);
 		const warning = tagPlanWarning(plan, resourceType, logicalId);
 		if (warning !== void 0) log.warn(warning);
-		if (plan.remove.length > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new UntagResourceCommand$24({
+		if (plan.remove.length > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new UntagResourceCommand$25({
 			ResourceId: resourceId,
 			TagKeys: plan.remove
 		})), `UntagResource ${resourceId}`, log);
-		if (plan.set.size > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new TagResourceCommand$23({
+		if (plan.set.size > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new TagResourceCommand$24({
 			ResourceId: resourceId,
 			Tags: [...plan.set].map(([Key, Value]) => ({
 				Key,
@@ -44461,7 +44811,7 @@ const cfnKeepsOnRemoval = (name, shape, removed) => {
 	if (narrow) return narrow(shape, removed);
 	return !cfnRefusesRemoval(name, shape) && !shape.storageTypes.includes("INTELLIGENT_TIERING") && (CFN_KEEPS_ON_REMOVAL.has(name) || typeof shape.fileSystemType === "string" && CFN_KEEPS_TOP_LEVEL_ON_REMOVAL.get(shape.fileSystemType)?.has(name) === true);
 };
-const leftInPlaceWarning$2 = (logicalId, names, caller, shape) => {
+const leftInPlaceWarning$3 = (logicalId, names, caller, shape) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -44825,7 +45175,7 @@ var FSxFileSystemProvider = class {
 		const leftInPlaceNames = [...TOP_LEVEL_LEFT_IN_PLACE_PROPS.filter((key) => properties[key] === void 0 && previousProperties[key] !== void 0), ...leftInPlace.map((key) => `${variantConfigKey}.${key}`)];
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning$2(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy", {
+			this.logger.warn(leftInPlaceWarning$3(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy", {
 				fileSystemType: properties["FileSystemType"] ?? previousProperties["FileSystemType"],
 				storageTypes: [previousProperties["StorageType"], properties["StorageType"]],
 				deploymentTypes: [previousProperties, properties].map((side) => variantConfigKey ? side[variantConfigKey]?.["DeploymentType"] : void 0),
@@ -45168,11 +45518,11 @@ var FSxFileSystemProvider = class {
 			Value
 		}));
 		const toRemove = plan.remove;
-		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$24({
+		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$25({
 			ResourceARN: arn,
 			Tags: toSet
 		}));
-		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$25({
+		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$26({
 			ResourceARN: arn,
 			TagKeys: toRemove
 		}));
@@ -45981,7 +46331,7 @@ const toNumber$1 = (v) => {
 };
 const jsonEqual$1 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const LEFT_IN_PLACE_ON_REMOVAL$1 = ["ResizeSpecifications", "InstanceTypeConfigs"];
-const leftInPlaceWarning$1 = (logicalId, names, caller) => {
+const leftInPlaceWarning$2 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -46170,7 +46520,7 @@ var EMRInstanceFleetConfigProvider = class {
 		const leftInPlaceNames = LEFT_IN_PLACE_ON_REMOVAL$1.filter((key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0);
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning$1(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
+			this.logger.warn(leftInPlaceWarning$2(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 		};
 		const leftInPlace = new Set(LEFT_IN_PLACE_ON_REMOVAL$1);
 		if (![...MUTABLE].some((k) => changed(k) && !(leftInPlace.has(k) && properties[k] === void 0))) {
@@ -46331,7 +46681,7 @@ const MUTABLE_TOP_LEVEL_PROPS = /* @__PURE__ */ new Set([
 	"AutoTerminationPolicy"
 ]);
 const LEFT_IN_PLACE_ON_REMOVAL = ["StepConcurrencyLevel"];
-const leftInPlaceWarning = (logicalId, names, caller) => {
+const leftInPlaceWarning$1 = (logicalId, names, caller) => {
 	const one = names.length === 1;
 	const subject = one ? "property" : "properties";
 	const verb = one ? "is" : "are";
@@ -46892,7 +47242,7 @@ var EMRClusterProvider = class {
 		const leftInPlaceNames = LEFT_IN_PLACE_ON_REMOVAL.filter((key) => removed !== void 0 ? removed.has(key) : properties[key] === void 0 && previousProperties[key] !== void 0);
 		const warnLeftInPlace = () => {
 			if (leftInPlaceNames.length === 0 || context?.desiredFromAwsReadback) return;
-			this.logger.warn(leftInPlaceWarning(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
+			this.logger.warn(leftInPlaceWarning$1(logicalId, leftInPlaceNames, context?.replayingState ? "rollback" : "deploy"));
 		};
 		const visibleChanged = changed("VisibleToAllUsers");
 		const stepConcurrencyChanged = changed("StepConcurrencyLevel") && properties["StepConcurrencyLevel"] !== void 0;
@@ -48551,6 +48901,19 @@ function withoutTrailIdentifiers(text, physicalId) {
 	}
 	return out;
 }
+function removalsLeftInPlace(properties, previousProperties, context, globalEventsResetSkipped) {
+	if (context?.desiredFromAwsReadback) return [];
+	const removed = context?.removedProperties;
+	const wasRemoved = (key) => previousProperties[key] != null && properties[key] == null && (removed === void 0 || removed.has(key));
+	const org = previousProperties["IsOrganizationTrail"];
+	const globalEvents = previousProperties["IncludeGlobalServiceEvents"];
+	return [...wasRemoved("IsOrganizationTrail") && org !== false && org !== "false" ? ["IsOrganizationTrail"] : [], ...globalEventsResetSkipped && wasRemoved("IncludeGlobalServiceEvents") && globalEvents !== false && globalEvents !== "false" ? ["IncludeGlobalServiceEvents"] : []];
+}
+function leftInPlaceWarning(logicalId, names, caller) {
+	const one = names.length === 1;
+	const subject = one ? "property" : "properties";
+	return caller === "rollback" ? safeMsg`${logicalId} (AWS::CloudTrail::Trail): ${subject} ${names.join(", ")} ${one ? "is" : "are"} absent from the state being restored; UpdateTrail keeps a field it is not sent, so the rollback leaves the value the failed deploy applied in place.` : safeMsg`${logicalId} (AWS::CloudTrail::Trail): ${subject} ${names.join(", ")} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS value in place (whether CloudFormation resets it is unmeasured). Declare the intended value explicitly to change it.`;
+}
 var CloudTrailProvider = class {
 	client;
 	createClient;
@@ -48566,6 +48929,23 @@ var CloudTrailProvider = class {
 		return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 	}
 	removalDefaults = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Map([["IsMultiRegionTrail", false], ["EnableLogFileValidation", false]])]]);
+	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
+		"S3BucketName",
+		"IsLogging",
+		"TrailName",
+		"S3KeyPrefix",
+		"SnsTopicName",
+		"KMSKeyId",
+		"CloudWatchLogsLogGroupArn",
+		"CloudWatchLogsRoleArn",
+		"EventSelectors",
+		"AdvancedEventSelectors",
+		"InsightSelectors",
+		"AggregationConfigurations",
+		"Tags",
+		"IncludeGlobalServiceEvents",
+		"IsOrganizationTrail"
+	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
 		"S3BucketName",
 		"TrailName",
@@ -48695,7 +49075,8 @@ var CloudTrailProvider = class {
 		const s3BucketName = properties["S3BucketName"];
 		const s3KeyPrefix = clearOnUpdateRemoval(emptyToUndefined(properties["S3KeyPrefix"]), emptyToUndefined(previousProperties["S3KeyPrefix"]), "");
 		const isMultiRegionTrail = properties["IsMultiRegionTrail"];
-		const includeGlobalServiceEvents = isMultiRegionTrail === false ? clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false) : properties["IncludeGlobalServiceEvents"];
+		const globalEventsResetSkipped = isMultiRegionTrail !== false;
+		const includeGlobalServiceEvents = globalEventsResetSkipped ? properties["IncludeGlobalServiceEvents"] : clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false);
 		const enableLogFileValidation = properties["EnableLogFileValidation"];
 		const isLogging = properties["IsLogging"];
 		const cwPair = resolveCloudWatchLogsPair(properties);
@@ -48720,6 +49101,8 @@ var CloudTrailProvider = class {
 				SnsTopicName: snsTopicName,
 				IsOrganizationTrail: isOrganizationTrail
 			}));
+			const keptNames = removalsLeftInPlace(properties, previousProperties, context, globalEventsResetSkipped);
+			if (keptNames.length > 0) this.logger.warn(leftInPlaceWarning(logicalId, keptNames, context?.replayingState ? "rollback" : "deploy"));
 			const basicRead = readListBlock(properties["EventSelectors"], "AWS::CloudTrail::Trail EventSelectors");
 			const advancedRead = readListBlock(properties["AdvancedEventSelectors"], "AWS::CloudTrail::Trail AdvancedEventSelectors");
 			for (const read of [basicRead, advancedRead]) if (read.kind === "unusable") this.logger.warn(safeMsg`${read.detail} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
@@ -49730,11 +50113,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !Object.hasOwn(newTagMap, k));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$26({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$27({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$25({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$26({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -49931,7 +50314,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: metadata.Arn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }));
 			tags = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return RESOURCE_NOT_FOUND;
@@ -50206,7 +50589,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = plan.remove;
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$27({
+					await this.getClient().send(new UntagResourceCommand$28({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -50214,7 +50597,7 @@ var DLMLifecyclePolicyProvider = class {
 				}
 				const tagsToAdd = Object.fromEntries(plan.set);
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$26({
+					await this.getClient().send(new TagResourceCommand$27({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -50378,11 +50761,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${mask(physicalId)}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$27({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$28({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$28({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$29({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -50484,7 +50867,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${describeAwsFailure(err).detail}`);
@@ -51162,7 +51545,7 @@ var S3DirectoryBucketProvider = class {
 				const resourceArn = await this.buildBucketArn(physicalId, accountId);
 				if (removedKeys.length > 0) {
 					context?.markUnsettled?.("Tags");
-					await this.getS3ControlClient().send(new UntagResourceCommand$29({
+					await this.getS3ControlClient().send(new UntagResourceCommand$13({
 						AccountId: accountId,
 						ResourceArn: resourceArn,
 						TagKeys: removedKeys
@@ -51170,7 +51553,7 @@ var S3DirectoryBucketProvider = class {
 				}
 				if (tagsToApply.length > 0) {
 					context?.markUnsettled?.("Tags");
-					await this.getS3ControlClient().send(new TagResourceCommand$28({
+					await this.getS3ControlClient().send(new TagResourceCommand$13({
 						AccountId: accountId,
 						ResourceArn: resourceArn,
 						Tags: tagsToApply
@@ -51325,7 +51708,7 @@ var S3DirectoryBucketProvider = class {
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
-		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$19({
+		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$11({
 			AccountId: accountId,
 			ResourceArn: resourceArn
 		}));
@@ -53678,4 +54061,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Dz0pYmlJ.js.map
+//# sourceMappingURL=provider-classes-ZqxIefLl.js.map