@go-to-k/cdkd 0.313.0 → 0.315.0

package/dist/{provider-classes-DefoNqY7.js → provider-classes-B8kkAZqJ.js}

@@ -1,16 +1,16 @@
 import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-Bu9EMILF.js";
-import { B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, D as getCurrentStackInstanceId, J as displayStackName, K as displayIdent, M as recordedGeneratedNameKept, Q as safeMsg, T as generatedNameFor, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify, i as isAwsAuthoredFailure, k as isBeforeStateRead, n as describeAwsFailure, q as displaySafe, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceNameWithFallback } from "./aws-failure-text-NSBdKPYK.js";
-import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-BT2Dfnpt.js";
+import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-agWtoyga.js";
+import { $ as logGroupProtectionSite, $n as plainOrDescribed, A as withoutServerErrorRetries, Ar as markNonRetryable, At as createMaskedLogSinks, B as quotedRemedyLogicalId, C as RecentIdSet, Ct as compositeIdSeparatorRefusal, D as replayFollowedAmbiguousAttempt, Dr as THROTTLING_ERROR_NAMES, E as isInsideWindow, Et as packCompositeId, F as VALUE_NOT_SHOWN, Ft as withDerivedNameMasks, G as ProtectionFlipRegistry, Gt as markCreatedBeforeFailure, H as remedyLogicalId, Ht as isAuxiliaryFailure, I as isPlainImportJson, J as deleteWithProtectionCompensation, Jn as commandHole, Kt as markSupersedesEarlierCreate, L as isPlainImportValue, Mn as ProvisioningError, Mr as wrapMaskedAwsError, Mt as isSecretDerivedValue, N as markNotGone, Nt as maskDeep, O as replayedSendWindow, Or as isMarkedNonRetryable, Ot as segmentAfterAnchor, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Pt as maskerOrIdentity, Q as isTerminalDeleteFailure, R as isQuotableImportValue, Rt as clearCreatedBeforeFailure, S as AmbiguousCreateLatch, Sr as isExplicitDenyError, St as compositeIdFormatMessage, T as createAttemptKey, Tr as isTransientServerError, Tt as logicalIdShown, U as resolveExplicitPhysicalId, V as refusalTypeShown, Wt as markAuxiliaryFailure, X as isProceedDbStatus, Xn as isInertUnquoted, Yn as hasClauseBreak, Z as isTerminalDbWaitStatus, Zn as pasteableCommand, _n as CdkdError, a as retractCreatedResource, an as injectiveKey, at as userPoolProtectionSite, bt as startInterruptWatch, c as SECRET_DERIVED_READ_LIVE, ct as WITHHELD_AWS_COMMAND, d as readPrincipalLists, dn as ambientClientDefaults, dt as protectedReplacementAdvice, et as observeThenDisableProtection, fn as ambientCredentialConfig, fr as markNameCollision, ft as renderDisableCommand, h as clearOnUpdateRemoval, hn as AccountIdUnavailableError, i as reportCreatedResource, j as RESOURCE_NOT_FOUND, jr as markRedactedCause, jt as createMaskedRetryLogger, k as setBounded, kr as isThrottlingError, kt as stateOrphanRecordRemedy, l as holdsSecretDerivedEntry, lt as isAwsCliLiteral, mn as credentialFingerprint, mr as relayedNameCollision, mt as ElapsedBudgetRegistry, nr as shellQuote, nt as rdsFamilyProtectionSite, on as injectiveKeyPrefix, p as recordedPrincipalsRepair, pn as clientDefaultsFor, pr as markReplayMayCollide, pt as ElapsedBudget, q as deleteAfterProtectionFlipWithFinalSnapshot, rr as withheldTargetClause, st as UNNAMEABLE_ID_CLAUSE, tt as protectionFlipKey, u as onlySecretDerived, un as withPasteableAwsProfile, ut as pasteableAwsCommand, v as removedTemplateKeys, vr as explicitDenyPolicyKind, w as ambiguousAttemptLead, wr as isRetryableTransientError, wt as compositeIdSkipResult, x as AMBIGUOUS_LATCH_TTL_MS, xr as isAmbiguousOutcomeError, xt as canonicalizeRoute53QueryName, y as withRemovalDefaults, yt as isInterruptedWaitError, z as normalizeAwsTagsToCfn } from "./created-resource-sink-QECX8C-Z.js";
 import { c as ambientRegion } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as getPriorAttempts, $s as isWarmThroughputDecrease, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ad as renderAssemblyPathEscape, Ai as acquireIdempotencyToken, Ao as accountArgs, B as deleteTableWithIndexBusyRetry, Bc as markSameGenerationBag, Bi as refuseMalformedDesiredTags, Bn as isRedactedRecordedValue, Bs as findSilentDropProperties, C as planContributorInsightsOp, Co as passedParameterClassesOf, D as reverseMapTableContributorInsights, E as reverseMapIndexContributorInsights, Ei as earliestDefined, F as resolveDynamoDbDeleteBudgetClock, Fa as s3BucketDomainName, Fi as markDeleteStarted, Fr as getStackRecords, G as isTtlRateLimited, H as relayedIndexBusyDelete, Hc as recordReferenceProvenanceEntry, Hi as tagPlanWarning, Hn as redactedDeleteAddressSkip, Hs as withoutSilentDropProperties, I as resolveDynamoDbDeleteBudgetMs, Ia as s3BucketDualStackDomainName, Ii as DBPROXY_TAGS_WHAT, It as getNestedRevertRun, J as sendTtlWaitingOutRateLimit, K as planTimeToLive, Kc as hasMaskableValues, L as DELETE_INDEX_WAIT_PROCEED_NOTE, La as s3BucketRegionalDomainName, Li as DBPROXY_TAG_OPTIONS, Ln as getCurrentProducerRegions, Lr as replacedDeleteFailureVerdict, Ls as withheldAccountClause, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Na as isSettledInstanceState, Nr as awaitInFlightSibling, O as stripIndexContributorInsights, Od as describeFileReadFailure, Oi as reserveStackCreateToken, P as deleteBudgetKey, Pa as s3BucketArn, Pc as passedNoEchoParametersOf, Pi as isRefusedByName, Q as isTruthyCfnBoolean, Qs as coerceWarmThroughput$1, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as s3BucketWebsiteUrl, Ri as planTagDiff, S as indexDeclaresContributorInsights, Sa as reEnableInstanceApiTermination, Sc as sameLambdaFunctionAddress, T as readContributorInsightsSpec, Ta as isUsableAttemptedName, Ts as refuseMalformedResourcesForDestroy, U as waitForIndexesSettled, Ua as outputReferenceProvenanceOf, Uc as snapshotPassProvenance, Ui as definedAttributes, Ut as getCurrentNestedStackContext, V as maskedLogger, Vc as redactForState, Vi as tagMapAsList, Vn as redactedDeleteAddressFields, W as isTtlAlreadyDisabled, Wi as stringifyIfAssigned, Wt as withNestedStackContext, X as S3_AUTO_DELETE_OBJECTS_TAG, Xi as waitForLambdaFunctionActive, Y as ECR_AUTO_DELETE_IMAGES_TAG, Z as hasCdkAutoDeleteTag, Zs as WARM_THROUGHPUT_MEMBERS, _ as streamMemberRefusals, _l as recordAttributeIdCopy, ac as configIntegerRefusal, as as refuseMalformedNestedChildOutputs, b as CONTRIBUTOR_INSIGHTS_KEY, ba as observeThenDisableInstanceApiTermination, bc as canonicalLambdaFunctionName, bl as carriesSecretMask, bo as parseWebACLArn, c as DynamoDBGlobalTableProvider, ca as unchangedBehindSecretReference, cc as replayWarn, cl as dynamicReferenceTokens, d as declaredStreamPolicyMember, dc as requireConfigString, dd as decodeListingKey, dt as listNestedTemplateRows, ea as getCurrentResourceSecrets, ec as toCfnInteger, en as chunks, et as markRefusedBeforeApplying, f as declaredStreamTagsMember, ft as renderNestedTemplateTreeDefect, fu as rewriteTemplateAssetReferences, g as streamDeclaresTags, ga as markWaitAbandoned, gc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, gl as physicalNameCopiesOf, h as streamDeclaresPolicy, ha as isWaitAbandonedError, hc as withRetry, hd as derivePartitionAndUrlSuffix, hl as recoverMaskedOutput, ic as configBooleanRefusal, iu as timePhase, j as DYNAMODB_DELETE_POLL_COST_MS, jd as resolveAssemblyPath, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, kd as displayAssemblyPath, l as STREAM_POLICY_KEY, lc as requireConfigArray, lo as getAccountInfo, lt as findNestedTemplateTreeDefect, m as reverseMapStreamPolicy, ma as withIndeterminateGuard, md as canonicalizeRegion, nc as coerceCfnBoolean, nn as lookupEachName, oa as slowCcOperationTimeoutMs, oc as configStringRefusal, ol as withoutPhysicalNameCopies, p as planStreamMemberOps, pa as deleteSkipReason, pi as secretNamedAttributeNamesOf, q as readTtlSpec, rc as coerceCfnInteger, rn as withApiLimit, sa as onlySecretReferencesDiffer, sc as readConfigString, su as stringifyValue, t as DeployEngine, tc as toFiniteNumber, tn as isAccessDeniedError, u as STREAM_TAGS_KEY, uc as requireConfigObject, ut as isAbsoluteAssetPath, v as streamPolicyMatchesDeclared, va as ec2InstanceProtectionSite, vc as ecsServiceLaunchTypeSetOrChanged, vt as enclosingDeadlineExpired, w as planIndexContributorInsightsOps, x as contributorInsightsRefusals, xa as reDisableInstanceApiTermination, xc as lambdaFunctionNameForMask, y as streamTagsMatchDeclared, ya as isTerminationProtectionPropagationError, yc as emrClusterInstancesReplaced, yt as enclosingDeadlineRemainingMs, z as TABLE_INDEX_NOUN, zi as readTagList, zn as REDACTED_DELETE_ADDRESS_SKIP_REASON, zt as revertNestedChildFromJournal } from "./deploy-engine-CwpnkMCZ.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ARR3C50J.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CMP_YVVn.js";
-import { t as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-D7wXWxVo.js";
-import { RDSProvider } from "./rds-provider-Dn-7U1CR.js";
-import { NeptuneProvider } from "./neptune-provider-DfPOAG0q.js";
-import { ASGProvider } from "./asg-provider-CqPtIngx.js";
+import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Aa as isUsableAttemptedName, As as refuseMalformedResourcesForDestroy, B as deleteTableWithIndexBusyRetry, Ba as s3BucketDomainName, Bi as markDeleteStarted, Br as getStackRecords, C as planContributorInsightsOp, Ca as ec2InstanceProtectionSite, Cc as ecsServiceLaunchTypeSetOrChanged, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reEnableInstanceApiTermination, Dc as sameLambdaFunctionAddress, E as reverseMapIndexContributorInsights, Ea as reDisableInstanceApiTermination, Ec as lambdaFunctionNameForMask, F as resolveDynamoDbDeleteBudgetClock, Fd as renderAssemblyPathEscape, Fi as acquireIdempotencyToken, Fo as accountArgs, G as readbackVectorIndexes, Gc as markSameGenerationBag, Gi as refuseMalformedDesiredTags, Gn as isRedactedRecordedValue, Gs as findSilentDropProperties, H as relayedIndexBusyDelete, Ha as s3BucketRegionalDomainName, Hi as DBPROXY_TAG_OPTIONS, Hn as getCurrentProducerRegions, Hr as replacedDeleteFailureVerdict, Hs as withheldAccountClause, I as resolveDynamoDbDeleteBudgetMs, Id as resolveAssemblyPath, J as vectorIndexesShapeDetail, Ja as outputReferenceProvenanceOf, Jc as snapshotPassProvenance, Ji as definedAttributes, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as redactForState, Ki as tagMapAsList, Kn as redactedDeleteAddressFields, L as DELETE_INDEX_WAIT_PROCEED_NOTE, M as beginDeleteWait, N as compensateRemovedDeletionProtection, Nd as describeFileReadFailure, Ni as reserveStackCreateToken, O as stripIndexContributorInsights, Oo as passedParameterClassesOf, P as deleteBudgetKey, Pd as displayAssemblyPath, Q as readTtlSpec, R as INDEX_SETTLE_POLL_INTERVAL_MS, Ra as isSettledInstanceState, Rr as awaitInFlightSibling, S as indexDeclaresContributorInsights, Sl as recordAttributeIdCopy, T as readContributorInsightsSpec, Ta as observeThenDisableInstanceApiTermination, Tc as canonicalLambdaFunctionName, Tl as carriesSecretMask, To as parseWebACLArn, U as waitForIndexesSettled, Ua as s3BucketWebsiteUrl, Ui as planTagDiff, V as maskedLogger, Va as s3BucketDualStackDomainName, Vi as DBPROXY_TAGS_WHAT, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wi as readTagList, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Y as isTtlAlreadyDisabled, Yi as stringifyIfAssigned, Yt as withNestedStackContext, Z as planTimeToLive, Zc as hasMaskableValues, _ as streamMemberRefusals, _t as renderNestedTemplateTreeDefect, _u as rewriteTemplateAssetReferences, aa as getCurrentResourceSecrets, ac as toCfnInteger, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as isWaitAbandonedError, bc as withRetry, bd as derivePartitionAndUrlSuffix, bl as recoverMaskedOutput, c as DynamoDBGlobalTableProvider, cc as coerceCfnInteger, cn as withApiLimit, d as declaredStreamPolicyMember, da as slowCcOperationTimeoutMs, dc as configStringRefusal, dl as withoutPhysicalNameCopies, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as onlySecretReferencesDiffer, fc as readConfigString, fu as stringifyValue, g as streamDeclaresTags, gc as requireConfigString, gd as decodeListingKey, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigObject, ht as isAbsoluteAssetPath, ic as isWarmThroughputDecrease, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ji as earliestDefined, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, l as STREAM_POLICY_KEY, lc as configBooleanRefusal, lu as timePhase, m as reverseMapStreamPolicy, mc as requireConfigArray, mo as getAccountInfo, mt as findNestedTemplateTreeDefect, nc as WARM_THROUGHPUT_MEMBERS, nt as hasCdkAutoDeleteTag, oc as toFiniteNumber, on as isAccessDeniedError, p as planStreamMemberOps, pa as unchangedBehindSecretReference, pc as replayWarn, pl as dynamicReferenceTokens, q as vectorIndexesSettled, qc as recordReferenceProvenanceEntry, qi as tagPlanWarning, qn as redactedDeleteAddressSkip, qs as withoutSilentDropProperties, rc as coerceWarmThroughput$1, rt as isTruthyCfnBoolean, sc as coerceCfnBoolean, sn as lookupEachName, t as DeployEngine, ta as waitForLambdaFunctionActive, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configIntegerRefusal, us as refuseMalformedNestedChildOutputs, v as streamPolicyMatchesDeclared, va as deleteSkipReason, vi as secretNamedAttributeNamesOf, w as planIndexContributorInsightsOps, wa as isTerminationProtectionPropagationError, wc as emrClusterInstancesReplaced, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as markWaitAbandoned, xc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, xl as physicalNameCopiesOf, y as streamTagsMatchDeclared, ya as withIndeterminateGuard, yd as canonicalizeRegion, z as TABLE_INDEX_NOUN, za as s3BucketArn, zc as passedNoEchoParametersOf, zi as isRefusedByName } from "./deploy-engine--bCIMkkk.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-s5--ZmBZ.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CMtAmRyw.js";
+import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-B1NRKBSQ.js";
+import { RDSProvider } from "./rds-provider-Cm3dsmFW.js";
+import { NeptuneProvider } from "./neptune-provider-BNxotnbp.js";
+import { ASGProvider } from "./asg-provider-DpNkEibf.js";
 import { createHash, randomUUID } from "node:crypto";
-import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetSubscriptionAttributesCommand, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -39,30 +39,30 @@ import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCo
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import { isDeepStrictEqual } from "node:util";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBProxyCommand, CreateDBProxyEndpointCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeregisterDBProxyTargetsCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
+import { ListTagsForResourceCommand as ListTagsForResourceCommand$11, S3ControlClient, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13 } from "@aws-sdk/client-s3-control";
 import * as zlib from "node:zlib";
-import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
-import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UntagResourceCommand as UntagResourceCommand$17, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$18, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$19, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
-import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$20, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$21, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$22, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
+import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UntagResourceCommand as UntagResourceCommand$18, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$19, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$20, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$21, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeNotificationsForBudgetCommand, DescribeSubscribersForNotificationCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$22, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$23, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand, UpdateStreamRecordDistributionStrategyCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$13, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
-import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$23, UpdatePipeCommand } from "@aws-sdk/client-pipes";
-import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteFileSystemPolicyCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
-import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
+import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$24, UpdatePipeCommand } from "@aws-sdk/client-pipes";
+import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteFileSystemPolicyCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$25, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
+import { AssociateFileSystemAliasesCommand, CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemAliasesCommand, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, DisassociateFileSystemAliasesCommand, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetUnhealthyNodeReplacementCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$14, StartDeliveryStreamEncryptionCommand, StopDeliveryStreamEncryptionCommand, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventConfigurationCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventConfigurationCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$15, UpdateProjectCommand, UpdateProjectVisibilityCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$25, UntagResourceCommand as UntagResourceCommand$26, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3VectorsClient, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28 } from "@aws-sdk/client-s3vectors";
-import { ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3ControlClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3-control";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, GetRepositoryTriggersCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$26, UntagResourceCommand as UntagResourceCommand$27, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$16, TagResourceCommand as TagResourceCommand$27, UntagResourceCommand as UntagResourceCommand$28, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, S3VectorsClient, TagResourceCommand as TagResourceCommand$28, UntagResourceCommand as UntagResourceCommand$29 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableBucketMetricsConfigurationCommand, DeleteTableBucketReplicationCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableBucketEncryptionCommand, GetTableBucketMaintenanceConfigurationCommand, GetTableBucketMetricsConfigurationCommand, GetTableBucketReplicationCommand, GetTableBucketStorageClassCommand, GetTableCommand as GetTableCommand$1, GetTableMaintenanceConfigurationCommand, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$7, PutTableBucketEncryptionCommand, PutTableBucketMaintenanceConfigurationCommand, PutTableBucketMetricsConfigurationCommand, PutTableBucketReplicationCommand, PutTableBucketStorageClassCommand, PutTableMaintenanceConfigurationCommand, RenameTableCommand, S3TablesClient, TagResourceCommand as TagResourceCommand$29, UntagResourceCommand as UntagResourceCommand$30 } from "@aws-sdk/client-s3tables";
 
 //#region src/provisioning/providers/iam-policy-provider.ts
@@ -3121,6 +3121,126 @@ function foldEventBridgeConfiguration(config) {
 		[EVENTBRIDGE_CONFIG_KEY]: { EventBridgeEnabled: enabled }
 	};
 }
+const ABAC_DISABLED = "Disabled";
+const ABAC_ENABLED = "Enabled";
+const METADATA_TABLE_DISABLED = "DISABLED";
+const METADATA_TABLE_ENABLED = "ENABLED";
+const METADATA_TABLE_POLL_MS = 2e3;
+const METADATA_TABLE_BUDGET_MS = 3e5;
+function abacStatusOf(properties) {
+	return properties["AbacStatus"] ?? ABAC_DISABLED;
+}
+function metadataBag(value) {
+	return isPlainObject$3(value) ? value : void 0;
+}
+function metadataConfigurationRefusal(value) {
+	if (value === void 0) return void 0;
+	const root = "MetadataConfiguration";
+	if (!isPlainObject$3(value)) return `${root} must be an object`;
+	const journal = value["JournalTableConfiguration"];
+	if (!isPlainObject$3(journal)) return `${root}.JournalTableConfiguration must be an object`;
+	const expiration = journal["RecordExpiration"];
+	if (!isPlainObject$3(expiration)) return `${root}.JournalTableConfiguration.RecordExpiration must be an object`;
+	if (typeof expiration["Expiration"] !== "string") return `${root}.JournalTableConfiguration.RecordExpiration.Expiration must be a string`;
+	const days = expiration["Days"];
+	if (days !== void 0 && (days === "" || days === null || !Number.isInteger(Number(days)))) return `${root}.JournalTableConfiguration.RecordExpiration.Days must be an integer`;
+	const tables = [
+		["JournalTableConfiguration", journal],
+		["InventoryTableConfiguration", value["InventoryTableConfiguration"]],
+		["AnnotationTableConfiguration", value["AnnotationTableConfiguration"]]
+	];
+	for (const [member, table] of tables) {
+		if (table === void 0) continue;
+		if (!isPlainObject$3(table)) return `${root}.${member} must be an object`;
+		if (member !== "JournalTableConfiguration" && typeof table["ConfigurationState"] !== "string") return `${root}.${member}.ConfigurationState must be a string`;
+		const encryption = table["EncryptionConfiguration"];
+		if (encryption === void 0) continue;
+		if (!isPlainObject$3(encryption) || typeof encryption["SseAlgorithm"] !== "string") return `${root}.${member}.EncryptionConfiguration must be an object with an SseAlgorithm`;
+	}
+}
+function metadataEncryptionToSdk(table) {
+	const encryption = metadataBag(table["EncryptionConfiguration"]);
+	if (encryption === void 0) return void 0;
+	return {
+		SseAlgorithm: encryption["SseAlgorithm"],
+		...encryption["KmsKeyArn"] !== void 0 ? { KmsKeyArn: encryption["KmsKeyArn"] } : {}
+	};
+}
+function metadataConfigurationToSdk(config) {
+	const journal = metadataBag(config["JournalTableConfiguration"]) ?? {};
+	const expiration = metadataBag(journal["RecordExpiration"]) ?? {};
+	const days = expiration["Days"];
+	const journalEncryption = metadataEncryptionToSdk(journal);
+	const inventory = metadataBag(config["InventoryTableConfiguration"]);
+	const inventoryEncryption = inventory && metadataEncryptionToSdk(inventory);
+	const annotation = metadataBag(config["AnnotationTableConfiguration"]);
+	const annotationEncryption = annotation && metadataEncryptionToSdk(annotation);
+	return {
+		JournalTableConfiguration: {
+			RecordExpiration: {
+				Expiration: expiration["Expiration"],
+				...days !== void 0 ? { Days: typeof days === "string" ? Number(days) : days } : {}
+			},
+			...journalEncryption ? { EncryptionConfiguration: journalEncryption } : {}
+		},
+		...inventory ? { InventoryTableConfiguration: {
+			ConfigurationState: inventory["ConfigurationState"],
+			...inventoryEncryption ? { EncryptionConfiguration: inventoryEncryption } : {}
+		} } : {},
+		...annotation ? { AnnotationTableConfiguration: {
+			ConfigurationState: annotation["ConfigurationState"],
+			...annotationEncryption ? { EncryptionConfiguration: annotationEncryption } : {},
+			...annotation["Role"] !== void 0 ? { Role: annotation["Role"] } : {}
+		} } : {}
+	};
+}
+function metadataConfigurationFromSdk(result) {
+	const journal = result.JournalTableConfigurationResult;
+	const inventory = result.InventoryTableConfigurationResult;
+	const annotation = result.AnnotationTableConfigurationResult;
+	return {
+		...journal ? { JournalTableConfiguration: { RecordExpiration: {
+			Expiration: journal.RecordExpiration?.Expiration,
+			...journal.RecordExpiration?.Days !== void 0 ? { Days: journal.RecordExpiration.Days } : {}
+		} } } : {},
+		...inventory ? { InventoryTableConfiguration: { ConfigurationState: inventory.ConfigurationState } } : {},
+		...annotation ? { AnnotationTableConfiguration: {
+			ConfigurationState: annotation.ConfigurationState,
+			...annotation.Role !== void 0 ? { Role: annotation.Role } : {}
+		} } : {}
+	};
+}
+function metadataAttributesFromSdk(result) {
+	const attributes = {};
+	const destination = result.DestinationResult;
+	if (destination) {
+		const path = "MetadataConfiguration.Destination";
+		attributes[path] = {
+			TableBucketArn: destination.TableBucketArn,
+			TableBucketType: destination.TableBucketType,
+			TableNamespace: destination.TableNamespace
+		};
+		attributes[`${path}.TableBucketArn`] = destination.TableBucketArn;
+		attributes[`${path}.TableBucketType`] = destination.TableBucketType;
+		attributes[`${path}.TableNamespace`] = destination.TableNamespace;
+	}
+	for (const [member, table] of [
+		["JournalTableConfiguration", result.JournalTableConfigurationResult],
+		["InventoryTableConfiguration", result.InventoryTableConfigurationResult],
+		["AnnotationTableConfiguration", result.AnnotationTableConfigurationResult]
+	]) {
+		if (table?.TableName !== void 0) attributes[`MetadataConfiguration.${member}.TableName`] = table.TableName;
+		if (table?.TableArn !== void 0) attributes[`MetadataConfiguration.${member}.TableArn`] = table.TableArn;
+	}
+	return attributes;
+}
+function bucketNameRefusal(properties) {
+	const prefix = properties["BucketNamePrefix"];
+	if (prefix === void 0) return void 0;
+	if (typeof prefix !== "string" || prefix === "") return "sets a BucketNamePrefix that is not a non-empty string";
+	if (properties["BucketName"] !== void 0) return "specifies both BucketName and BucketNamePrefix; only one of them is accepted";
+	if (properties["BucketNamespace"] !== "account-regional") return "sets BucketNamePrefix, which is only supported with BucketNamespace: account-regional";
+}
 const LIFECYCLE_RULE_PATH = "AWS::S3::Bucket LifecycleConfiguration.Rules[]";
 const LIFECYCLE_FILTER_PATH = `${LIFECYCLE_RULE_PATH}.Filter`;
 const LIFECYCLE_TAG_FILTERS_PATH = `${LIFECYCLE_RULE_PATH}.TagFilters`;
@@ -3490,9 +3610,13 @@ var S3BucketProvider = class S3BucketProvider {
 		"InventoryConfigurations",
 		"ReplicationConfiguration",
 		"ObjectLockConfiguration",
-		"ObjectLockEnabled"
+		"ObjectLockEnabled",
+		"AbacStatus",
+		"BucketNamePrefix",
+		"BucketNamespace",
+		"MetadataConfiguration"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"], ["MetadataTableConfiguration", "V1 S3 Metadata, which the schema says to replace with MetadataConfiguration; S3 answered V1APIsNotAllowed where it was probed, so an SDK path could not be verified. Stays on Cloud Control"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
@@ -3594,6 +3718,7 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName.startsWith("MetadataConfiguration.")) return (await this.readMetadataAttributes(physicalId))[attributeName];
 		return (await this.buildAttributes(physicalId))[attributeName];
 	}
 	async applyVersioning(bucketName, versioningConfig, onUnusable) {
@@ -3619,7 +3744,7 @@ var S3BucketProvider = class S3BucketProvider {
 		}));
 		this.logger.debug(`Applied ${tags.length} tags to bucket ${this.shown(bucketName)}`);
 	}
-	async applyTagDiff(bucketName, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+	async applyTagDiff(bucketName, resourceType, logicalId, oldTagsRaw, newTagsRaw, abacEnabled = false) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const desiredRead = readTagList(newTagsRaw, "desired");
 		const desired = desiredRead.kind === "tags" ? desiredRead.tags : [];
@@ -3640,6 +3765,10 @@ var S3BucketProvider = class S3BucketProvider {
 			if (plan.set.size === 0 && plan.remove.length === 0) return;
 			tagSet = desired;
 		}
+		if (abacEnabled) {
+			await this.replaceAbacBucketTags(bucketName, tagSet);
+			return;
+		}
 		if (tagSet.length === 0) {
 			try {
 				await this.s3Client.send(new DeleteBucketTaggingCommand({ Bucket: bucketName }));
@@ -3656,6 +3785,219 @@ var S3BucketProvider = class S3BucketProvider {
 		}));
 		this.logger.debug(`Replaced tag set on bucket ${this.shown(bucketName)} (${tagSet.length} tags)`);
 	}
+	async replaceAbacBucketTags(bucketName, tagSet) {
+		const keep = new Set(tagSet.map((t) => t.Key));
+		const stale = (await this.readTags(bucketName)).map((t) => t.Key).filter((key) => !keep.has(key));
+		const client = new S3ControlClient({
+			...clientDefaultsFor(this.credentialConfig),
+			region: await this.getRegion()
+		});
+		try {
+			const AccountId = (await getAccountInfo()).accountId;
+			const ResourceArn = s3BucketArn(bucketName, await this.getRegion());
+			if (stale.length > 0) await client.send(new UntagResourceCommand$13({
+				AccountId,
+				ResourceArn,
+				TagKeys: stale
+			}));
+			if (tagSet.length > 0) await client.send(new TagResourceCommand$13({
+				AccountId,
+				ResourceArn,
+				Tags: tagSet
+			}));
+		} finally {
+			client.destroy();
+		}
+		this.logger.debug(safeMsg`Replaced tag set on ABAC bucket ${this.shown(bucketName)}`);
+	}
+	async applyAbacStatus(bucketName, status) {
+		await this.s3Client.send(new PutBucketAbacCommand({
+			Bucket: bucketName,
+			AbacStatus: { Status: status }
+		}));
+		this.logger.debug(safeMsg`Applied AbacStatus to bucket ${this.shown(bucketName)}`);
+	}
+	async accountRegionalBucketName(prefix) {
+		return `${prefix}-${(await getAccountInfo()).accountId}-${canonicalizeRegion(await this.getRegion())}-an`;
+	}
+	async createMetadataConfiguration(bucketName, desired, stateBorne) {
+		const MetadataConfiguration = metadataConfigurationToSdk(desired);
+		try {
+			await this.s3Client.send(new CreateBucketMetadataConfigurationCommand({
+				Bucket: bucketName,
+				MetadataConfiguration
+			}));
+		} catch (err) {
+			if (err.name !== "MetadataConfigurationAlreadyExists") throw err;
+			const live = await this.readMetadataConfigurationResult(bucketName).catch(() => void 0);
+			if (live === void 0) throw err;
+			return this.convergeMetadataConfiguration(bucketName, desired, live, stateBorne);
+		}
+		await this.waitForMetadataTables(bucketName, MetadataConfiguration, stateBorne);
+		return true;
+	}
+	async convergeMetadataConfiguration(bucketName, desired, live, stateBorne) {
+		const sent = metadataConfigurationToSdk(desired);
+		if (sent.JournalTableConfiguration?.EncryptionConfiguration || sent.InventoryTableConfiguration?.EncryptionConfiguration || sent.AnnotationTableConfiguration?.EncryptionConfiguration) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)} already holds an S3 Metadata configuration, and S3 never returns a table's encryption, so the declared EncryptionConfiguration is unverified and may not be the one in effect`);
+		const enabledATable = await this.applyMetadataConfigurationDiff(bucketName, desired, metadataConfigurationFromSdk(live), true, true);
+		await this.waitForMetadataTables(bucketName, sent, stateBorne);
+		return enabledATable;
+	}
+	async applyMetadataConfigurationDiff(bucketName, desiredRaw, previousRaw, stateBorne, refuseOnly) {
+		const desired = metadataBag(desiredRaw);
+		const previous = metadataBag(previousRaw);
+		if (desired === void 0) {
+			if (previous === void 0) return false;
+			try {
+				await this.s3Client.send(new DeleteBucketMetadataConfigurationCommand({ Bucket: bucketName }));
+			} catch (err) {
+				if (err.name !== "MetadataConfigurationNotFound") throw err;
+			}
+			return false;
+		}
+		if (previous === void 0) {
+			if (refuseOnly) return false;
+			return this.createMetadataConfiguration(bucketName, desired, stateBorne);
+		}
+		const next = metadataConfigurationToSdk(desired);
+		const prev = metadataConfigurationToSdk(previous);
+		const differs = (a, b) => JSON.stringify(a) !== JSON.stringify(b);
+		const refuseEncryptionChange = (member, a, b) => {
+			if (!stateBorne && differs(a, b)) throw new Error(`Bucket ${this.shown(bucketName)}: changing MetadataConfiguration.${member}.EncryptionConfiguration is not supported once the table exists. Revert it, or re-create the table: remove MetadataConfiguration, deploy, delete the table with aws s3tables delete-table, then add it back with the new encryption`);
+		};
+		const nextJournal = next.JournalTableConfiguration;
+		const prevJournal = prev.JournalTableConfiguration;
+		refuseEncryptionChange("JournalTableConfiguration", prevJournal?.EncryptionConfiguration, nextJournal?.EncryptionConfiguration);
+		const nextInventory = next.InventoryTableConfiguration;
+		const prevInventory = prev.InventoryTableConfiguration;
+		const nextInventoryState = nextInventory?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		const prevInventoryState = prevInventory?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		if (nextInventoryState === METADATA_TABLE_ENABLED && prevInventoryState === METADATA_TABLE_ENABLED) refuseEncryptionChange("InventoryTableConfiguration", prevInventory?.EncryptionConfiguration, nextInventory?.EncryptionConfiguration);
+		const nextAnnotation = next.AnnotationTableConfiguration;
+		const prevAnnotation = prev.AnnotationTableConfiguration;
+		const nextAnnotationState = nextAnnotation?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		const prevAnnotationState = prevAnnotation?.ConfigurationState ?? METADATA_TABLE_DISABLED;
+		const annotationStaysOn = nextAnnotationState === METADATA_TABLE_ENABLED && prevAnnotationState === METADATA_TABLE_ENABLED;
+		if (annotationStaysOn) refuseEncryptionChange("AnnotationTableConfiguration", prevAnnotation?.EncryptionConfiguration, nextAnnotation?.EncryptionConfiguration);
+		let enabledATable = false;
+		if (differs(prevJournal?.RecordExpiration, nextJournal?.RecordExpiration)) await this.s3Client.send(new UpdateBucketMetadataJournalTableConfigurationCommand({
+			Bucket: bucketName,
+			JournalTableConfiguration: { RecordExpiration: nextJournal?.RecordExpiration }
+		}));
+		if (nextInventoryState !== prevInventoryState) {
+			const on = nextInventoryState === METADATA_TABLE_ENABLED;
+			await this.s3Client.send(new UpdateBucketMetadataInventoryTableConfigurationCommand({
+				Bucket: bucketName,
+				InventoryTableConfiguration: {
+					ConfigurationState: nextInventoryState,
+					...on && nextInventory?.EncryptionConfiguration ? { EncryptionConfiguration: nextInventory.EncryptionConfiguration } : {}
+				}
+			}));
+			enabledATable ||= on;
+		}
+		if (nextAnnotationState !== prevAnnotationState || annotationStaysOn && nextAnnotation?.Role !== prevAnnotation?.Role) {
+			const on = nextAnnotationState === METADATA_TABLE_ENABLED;
+			await this.s3Client.send(new UpdateBucketMetadataAnnotationTableConfigurationCommand({
+				Bucket: bucketName,
+				AnnotationTableConfiguration: {
+					ConfigurationState: nextAnnotationState,
+					...on && nextAnnotation?.EncryptionConfiguration ? { EncryptionConfiguration: nextAnnotation.EncryptionConfiguration } : {},
+					...on && nextAnnotation?.Role !== void 0 ? { Role: nextAnnotation.Role } : {}
+				}
+			}));
+			enabledATable ||= on;
+		}
+		if (enabledATable && !refuseOnly) await this.waitForMetadataTables(bucketName, next, stateBorne);
+		return enabledATable;
+	}
+	async waitForMetadataTables(bucketName, sent, stateBorne) {
+		const deadline = Date.now() + METADATA_TABLE_BUDGET_MS;
+		const warned = /* @__PURE__ */ new Set();
+		for (;;) {
+			let result;
+			try {
+				result = await this.readMetadataConfigurationResult(bucketName);
+			} catch (err) {
+				if (!stateBorne) throw err;
+				this.logger.warn(safeMsg`Could not read the S3 Metadata tables of ${this.shown(bucketName)} (${caughtErrorName(err)}); not waiting for them`);
+				return;
+			}
+			const tables = [
+				[
+					"journal",
+					true,
+					result?.JournalTableConfigurationResult
+				],
+				[
+					"inventory",
+					sent.InventoryTableConfiguration?.ConfigurationState === METADATA_TABLE_ENABLED,
+					result?.InventoryTableConfigurationResult
+				],
+				[
+					"annotation",
+					sent.AnnotationTableConfiguration?.ConfigurationState === METADATA_TABLE_ENABLED,
+					result?.AnnotationTableConfigurationResult
+				]
+			];
+			let pending;
+			for (const [name, wanted, table] of tables) {
+				if (!wanted) continue;
+				if (table?.TableStatus === "FAILED") {
+					if (!warned.has(name)) {
+						warned.add(name);
+						this.warnMetadataTableFailed(bucketName, name, table);
+					}
+					continue;
+				}
+				if (table?.TableArn === void 0) pending = `the ${name} table`;
+			}
+			if (pending === void 0) return;
+			if (Date.now() >= deadline) {
+				this.logger.warn(safeMsg`Gave up waiting for ${pending} of bucket ${this.shown(bucketName)}'s S3 Metadata configuration; it may still finish, and an Fn::GetAtt on its ARN fails until then. Read it with aws s3api get-bucket-metadata-configuration`);
+				return;
+			}
+			await new Promise((r) => setTimeout(r, METADATA_TABLE_POLL_MS));
+		}
+	}
+	warnMetadataTableFailed(bucketName, name, table) {
+		const reason = describeAwsStatusReason({
+			code: table.Error?.ErrorCode,
+			message: table.Error?.ErrorMessage
+		}, "S3 gave no reason.");
+		const noArn = table.TableArn === void 0 ? " It has no ARN, so an Fn::GetAtt on its TableArn fails." : "";
+		this.logger.debug(safeMsg`S3 Metadata ${name} table: ${this.maskRaw(reason.detail)}`);
+		this.logger.warn(safeMsg`The S3 Metadata ${name} table of bucket ${this.shown(bucketName)} FAILED: ${reason.summary} The deploy continues, but this table records nothing.${noArn} When a table left by an earlier bucket of this name is the cause, delete it with aws s3tables delete-table --table-bucket-arn <the account's aws-s3 table bucket> --namespace b_${this.shown(bucketName)} --name ${name}, then deploy without MetadataConfiguration and add it back`);
+	}
+	async readMetadataConfigurationResult(bucket) {
+		try {
+			return (await this.s3Client.send(new GetBucketMetadataConfigurationCommand({ Bucket: bucket }))).GetBucketMetadataConfigurationResult?.MetadataConfigurationResult;
+		} catch (err) {
+			if (err.name === "MetadataConfigurationNotFound") return void 0;
+			throw err;
+		}
+	}
+	async readMetadataForDrift(bucket) {
+		try {
+			return await this.readMetadataConfigurationResult(bucket);
+		} catch (err) {
+			this.logger.debug(safeMsg`Could not read S3 Metadata of ${this.shown(bucket)} (${caughtErrorName(err)})`);
+			return "unread";
+		}
+	}
+	async readMetadataAttributesAfterWrites(bucket, context) {
+		try {
+			return await this.readMetadataAttributes(bucket);
+		} catch (err) {
+			const readback = context !== void 0 && "desiredFromAwsReadback" in context ? context.desiredFromAwsReadback : void 0;
+			if (context?.replayingState !== true && readback !== true) throw err;
+			this.logger.warn(safeMsg`Could not read the S3 Metadata attributes of ${this.shown(bucket)} (${caughtErrorName(err)}); an Fn::GetAtt on them fails until the next deploy records them`);
+			return {};
+		}
+	}
+	async readMetadataAttributes(bucket) {
+		const result = await this.readMetadataConfigurationResult(bucket);
+		return result ? metadataAttributesFromSdk(result) : {};
+	}
 	async applyCorsConfiguration(bucketName, corsConfig) {
 		const corsRules = corsConfig.CorsRules.map((rule) => ({
 			ID: rule["Id"],
@@ -4620,6 +4962,17 @@ var S3BucketProvider = class S3BucketProvider {
 				retainPrevious("VersioningConfiguration");
 			} else await this.applyVersioning(bucketName, { Status: "Suspended" });
 		}
+		const desiredMetadata = properties["MetadataConfiguration"];
+		const previousMetadata = previousProperties["MetadataConfiguration"];
+		const metadataStateBorne = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+		const metadataRefusal = metadataConfigurationRefusal(desiredMetadata);
+		if (metadataRefusal !== void 0 && JSON.stringify(desiredMetadata) !== JSON.stringify(previousMetadata)) {
+			if (!metadataStateBorne) throw new Error(metadataRefusal);
+			this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)}: ${metadataRefusal}; its S3 Metadata configuration was left as it is`);
+			retainPrevious("MetadataConfiguration");
+		} else if (metadataRefusal === void 0) {
+			if (await this.applyMetadataConfigurationDiff(bucketName, desiredMetadata, previousMetadata, metadataStateBorne, refuseUnusable) && context?.desiredFromAwsReadback === true) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)}: S3 never returns a table's EncryptionConfiguration, so a table this revert turned on took S3's default encryption, whatever the template declares`);
+		}
 		return overrides;
 	}
 	async applyAllSubConfigsForCreate(bucketName, properties, context) {
@@ -4736,16 +5089,34 @@ var S3BucketProvider = class S3BucketProvider {
 		this.logger.debug(`${message} Proceeding.`);
 	}
 	async create(logicalId, resourceType, properties, context) {
-		if (this.opMask === void 0) return this.maskedView(createMaskedLogSinks(this.logger, context?.maskSecrets)).create(logicalId, resourceType, properties, context);
+		if (this.opMask === void 0) {
+			const sinks = createMaskedLogSinks(this.logger, context?.maskSecrets);
+			const prefix = properties["BucketNamePrefix"];
+			const derivedName = typeof prefix === "string" && prefix !== "" && bucketNameRefusal(properties) === void 0 ? await this.accountRegionalBucketName(prefix) : void 0;
+			const view = withDerivedNameMasks(this.logger, sinks, [[prefix, derivedName]]);
+			return this.maskedView(view).create(logicalId, resourceType, properties, context);
+		}
 		this.logger.debug(`Creating S3 bucket ${displaySafe(logicalId)}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
-		const explicitBucketName = Boolean(properties["BucketName"]);
-		const bucketName = properties["BucketName"] || this.generatedCreateName(resourceType, logicalId, properties);
+		const nameRefusal = bucketNameRefusal(properties);
+		if (nameRefusal !== void 0) {
+			if (context?.replayingState !== true) throw markNonRetryable(new ProvisioningError(`S3 bucket ${displaySafe(logicalId)} ${nameRefusal}; fix the template`, resourceType, logicalId));
+			this.logger.warn(safeMsg`S3 bucket ${displaySafe(logicalId)} ${nameRefusal}; restoring it anyway`);
+		}
+		const metadataRefusal = metadataConfigurationRefusal(properties["MetadataConfiguration"]);
+		if (metadataRefusal !== void 0 && context?.replayingState !== true) throw markNonRetryable(new ProvisioningError(`S3 bucket ${displaySafe(logicalId)}: ${metadataRefusal}; fix the template`, resourceType, logicalId));
+		const declaredPrefix = properties["BucketNamePrefix"];
+		const namePrefix = typeof declaredPrefix === "string" ? declaredPrefix : void 0;
+		const explicitBucketName = Boolean(properties["BucketName"] || namePrefix);
+		const bucketName = (namePrefix ? await this.accountRegionalBucketName(namePrefix) : void 0) || properties["BucketName"] || this.generatedCreateName(resourceType, logicalId, properties);
 		let bucketLeftBehind = false;
 		let ambiguousWindow;
 		let windowSpent = false;
 		try {
-			const createParams = { Bucket: bucketName };
+			const createParams = {
+				Bucket: bucketName,
+				...properties["BucketNamespace"] !== void 0 ? { BucketNamespace: properties["BucketNamespace"] } : {}
+			};
 			const region = await this.getRegion();
 			const canonicalRegion = canonicalizeRegion(region);
 			if (canonicalRegion !== "us-east-1") createParams.CreateBucketConfiguration = { LocationConstraint: canonicalRegion };
@@ -4837,12 +5208,28 @@ var S3BucketProvider = class S3BucketProvider {
 				} else throw createError;
 			}
 			let effectiveOverrides;
+			const bucketPredates = !createdNewBucket || adoptedOwnLeftover;
+			const desiredAbac = abacStatusOf(properties);
+			const liveAbacOn = bucketPredates && await this.readAbacStatus(bucketName) === ABAC_ENABLED;
 			try {
+				const turnAbacOff = liveAbacOn && properties["AbacStatus"] === ABAC_DISABLED;
+				if (turnAbacOff) await this.applyAbacStatus(bucketName, ABAC_DISABLED);
+				else if (liveAbacOn && properties["AbacStatus"] === void 0) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)} already existed with ABAC on, which the template does not declare; it stays on, and a later Tags change fails with BadRequest until the template declares AbacStatus`);
+				const tagsThroughControl = liveAbacOn && !turnAbacOff;
 				effectiveOverrides = await this.applyConfiguration(bucketName, properties, {
 					...context ? { context } : {},
-					...tagsAppliedOnCreate ? { skipTags: true } : { desiredTags }
+					...tagsAppliedOnCreate || tagsThroughControl ? { skipTags: true } : { desiredTags }
 				});
 				for (const [key, value] of await this.applyAllSubConfigsForCreate(bucketName, properties, context)) effectiveOverrides.set(key, value);
+				if (tagsThroughControl && desiredTags.length > 0) await this.replaceAbacBucketTags(bucketName, desiredTags);
+				if (desiredAbac !== ABAC_DISABLED) await this.applyAbacStatus(bucketName, desiredAbac);
+				const metadata = metadataBag(properties["MetadataConfiguration"]);
+				const replaying = context?.replayingState === true;
+				if (metadataRefusal !== void 0) this.logger.warn(safeMsg`Bucket ${this.shown(bucketName)}: ${metadataRefusal}; no S3 Metadata configuration was restored`);
+				else if (metadata !== void 0 && bucketPredates) {
+					const live = await this.readMetadataForDrift(bucketName);
+					await (live === "unread" || live === void 0 ? this.createMetadataConfiguration(bucketName, metadata, true) : this.convergeMetadataConfiguration(bucketName, metadata, live, replaying));
+				} else if (metadata !== void 0) await this.createMetadataConfiguration(bucketName, metadata, replaying);
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
@@ -4860,6 +5247,7 @@ var S3BucketProvider = class S3BucketProvider {
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
 			const attributes = await this.buildAttributes(bucketName);
+			if (metadataBag(properties["MetadataConfiguration"])) Object.assign(attributes, await this.readMetadataAttributesAfterWrites(bucketName, context));
 			this.logger.debug(`Successfully created S3 bucket ${displaySafe(logicalId)}: ${this.shown(bucketName)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
@@ -4879,7 +5267,7 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		if (this.opMask === void 0) {
-			const sinks = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["BucketName"], physicalId]]);
+			const sinks = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["BucketName"], physicalId], [previousProperties["BucketNamePrefix"], physicalId]]);
 			return this.maskedView(sinks).update(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		}
 		this.logger.debug(`Updating S3 bucket ${displaySafe(logicalId)}: ${this.shown(physicalId)}`);
@@ -4909,9 +5297,14 @@ var S3BucketProvider = class S3BucketProvider {
 				skipDiffManaged: true
 			});
 			for (const [key, value] of await this.applySubConfigDiffs(physicalId, properties, previousProperties, context)) effectiveOverrides.set(key, value);
-			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+			const previousAbac = abacStatusOf(previousProperties);
+			const desiredAbac = abacStatusOf(properties);
+			if (previousAbac !== desiredAbac && desiredAbac === ABAC_DISABLED) await this.applyAbacStatus(physicalId, desiredAbac);
+			await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], previousAbac === ABAC_ENABLED && desiredAbac === ABAC_ENABLED);
+			if (previousAbac !== desiredAbac && desiredAbac !== ABAC_DISABLED) await this.applyAbacStatus(physicalId, desiredAbac);
 			await this.warnUnappliedBucketObjectLock(logicalId, physicalId, properties, previousProperties, context);
 			const attributes = await this.buildAttributes(physicalId);
+			if (metadataBag(properties["MetadataConfiguration"])) Object.assign(attributes, await this.readMetadataAttributesAfterWrites(physicalId, context));
 			this.logger.debug(`Successfully updated S3 bucket ${displaySafe(logicalId)}`);
 			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
@@ -4996,7 +5389,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			throw err;
 		}
-		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
+		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory, abac, metadata] = await Promise.all([
 			this.readVersioning(physicalId),
 			this.readEncryption(physicalId),
 			this.readOwnershipControls(physicalId),
@@ -5013,7 +5406,9 @@ var S3BucketProvider = class S3BucketProvider {
 			this.readMetricsList(physicalId),
 			this.readAnalyticsList(physicalId),
 			this.readIntelligentTieringList(physicalId),
-			this.readInventoryList(physicalId)
+			this.readInventoryList(physicalId),
+			this.readAbacStatus(physicalId),
+			this.readMetadataForDrift(physicalId)
 		]);
 		return {
 			BucketName: physicalId,
@@ -5033,9 +5428,23 @@ var S3BucketProvider = class S3BucketProvider {
 			MetricsConfigurations: metrics,
 			AnalyticsConfigurations: analytics,
 			IntelligentTieringConfigurations: intelligentTier,
-			InventoryConfigurations: inventory
+			InventoryConfigurations: inventory,
+			...abac === ABAC_ENABLED || _properties?.["AbacStatus"] !== void 0 ? { AbacStatus: abac ?? _properties?.["AbacStatus"] } : {},
+			...metadata === "unread" ? _properties?.["MetadataConfiguration"] !== void 0 ? { MetadataConfiguration: _properties["MetadataConfiguration"] } : {} : metadata ? { MetadataConfiguration: metadataConfigurationFromSdk(metadata) } : {}
 		};
 	}
+	getDriftAbsentMeansDefaultKeys(_resourceType, properties) {
+		return [...abacStatusOf(properties) === ABAC_DISABLED ? ["AbacStatus"] : [], ...properties["MetadataConfiguration"] === void 0 ? ["MetadataConfiguration"] : []];
+	}
+	getDriftUnknownPaths() {
+		return [
+			"BucketNamePrefix",
+			"BucketNamespace",
+			"MetadataConfiguration.JournalTableConfiguration.EncryptionConfiguration",
+			"MetadataConfiguration.InventoryTableConfiguration.EncryptionConfiguration",
+			"MetadataConfiguration.AnnotationTableConfiguration.EncryptionConfiguration"
+		];
+	}
 	async readVersioning(bucket) {
 		return { Status: (await this.s3Client.send(new GetBucketVersioningCommand({ Bucket: bucket }))).Status ?? "Suspended" };
 	}
@@ -5383,6 +5792,14 @@ var S3BucketProvider = class S3BucketProvider {
 			throw err;
 		}
 	}
+	async readAbacStatus(bucket) {
+		try {
+			return (await this.s3Client.send(new GetBucketAbacCommand({ Bucket: bucket }))).AbacStatus?.Status ?? ABAC_DISABLED;
+		} catch (err) {
+			this.logger.debug(safeMsg`Could not read AbacStatus of ${this.shown(bucket)} (${caughtErrorName(err)})`);
+			return;
+		}
+	}
 	async readAccelerate(bucket) {
 		return { AccelerationStatus: (await this.s3Client.send(new GetBucketAccelerateConfigurationCommand({ Bucket: bucket }))).Status ?? "Suspended" };
 	}
@@ -5562,7 +5979,7 @@ var S3BucketProvider = class S3BucketProvider {
 		}
 	}
 	generatedCreateName(_resourceType, logicalId, properties) {
-		if (properties["BucketName"]) return void 0;
+		if (properties["BucketNamePrefix"] || properties["BucketName"]) return void 0;
 		return generatedNameFor("AWS::S3::Bucket", logicalId);
 	}
 	async import(input) {
@@ -11863,120 +12280,6 @@ async function waitForGoneAfterDelete(opts) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-vector-indexes.ts
-function vectorIndexesByName(value) {
-	const out = /* @__PURE__ */ new Map();
-	if (!Array.isArray(value)) return out;
-	for (const entry of value) {
-		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
-		const name = entry["IndexName"];
-		if (typeof name === "string") out.set(name, entry);
-	}
-	return out;
-}
-function vectorIndexForSend(entry) {
-	const out = {};
-	for (const key of [
-		"IndexName",
-		"VectorAttribute",
-		"Projection",
-		"DistanceFunction"
-	]) if (entry[key] !== void 0) out[key] = entry[key];
-	if (entry["Dimensions"] !== void 0) out["Dimensions"] = coerceCfnInteger(entry["Dimensions"]) ?? entry["Dimensions"];
-	if (entry["SearchSchema"] !== void 0) out["SearchSchema"] = entry["SearchSchema"];
-	return out;
-}
-function vectorIndexesForCreate(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (!Array.isArray(value)) return value;
-	return value.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? vectorIndexForSend(entry) : entry);
-}
-function sortedByJson(list) {
-	if (!Array.isArray(list)) return list;
-	return [...list].sort((a, b) => {
-		const x = JSON.stringify(a) ?? "";
-		const y = JSON.stringify(b) ?? "";
-		return x < y ? -1 : x > y ? 1 : 0;
-	});
-}
-function vectorIndexKey(entry) {
-	const e = entry;
-	const projection = e["Projection"];
-	const normalizedProjection = typeof projection === "object" && projection !== null && !Array.isArray(projection) ? {
-		ProjectionType: projection["ProjectionType"],
-		NonKeyAttributes: sortedByJson(nonEmpty(projection["NonKeyAttributes"]))
-	} : projection;
-	const attribute = e["VectorAttribute"];
-	return JSON.stringify([
-		e["IndexName"],
-		typeof attribute === "object" && attribute !== null ? attribute["AttributeName"] : attribute,
-		coerceCfnInteger(e["Dimensions"]) ?? e["Dimensions"],
-		e["DistanceFunction"],
-		normalizedProjection,
-		sortedByJson(Array.isArray(e["SearchSchema"]) && e["SearchSchema"].length > 0 ? e["SearchSchema"].map((s) => typeof s === "object" && s !== null ? {
-			AttributeName: s["AttributeName"],
-			SearchSchemaElementType: s["SearchSchemaElementType"]
-		} : s) : nonEmpty(e["SearchSchema"]))
-	]);
-}
-function nonEmpty(value) {
-	return Array.isArray(value) && value.length === 0 ? void 0 : value;
-}
-function planVectorIndexUpdates(previous, desired, live) {
-	const prevByName = vectorIndexesByName(previous);
-	const desiredByName = vectorIndexesByName(desired);
-	const liveByName = live === void 0 ? void 0 : new Map(live.filter((d) => typeof d.IndexName === "string").map((d) => [d.IndexName, d]));
-	const plan = {
-		ops: [],
-		changed: [],
-		adopted: [],
-		alreadyGone: []
-	};
-	const liveHolds = (name, entry) => {
-		const l = liveByName?.get(name);
-		return l !== void 0 && l.IndexStatus !== "DELETING" && vectorIndexKey(l) === vectorIndexKey(entry);
-	};
-	for (const name of prevByName.keys()) {
-		if (desiredByName.has(name)) continue;
-		const l = liveByName?.get(name);
-		if (liveByName !== void 0 && (l === void 0 || l.IndexStatus === "DELETING")) {
-			plan.alreadyGone.push(name);
-			continue;
-		}
-		plan.ops.push({ Delete: { IndexName: name } });
-	}
-	for (const [name, entry] of desiredByName) {
-		const before = prevByName.get(name);
-		if (before === void 0) {
-			const l = liveByName?.get(name);
-			if (l === void 0 || l.IndexStatus === "DELETING") plan.ops.push({ Create: vectorIndexForSend(entry) });
-			else if (liveHolds(name, entry)) plan.adopted.push(name);
-			else plan.changed.push(name);
-			continue;
-		}
-		if (vectorIndexKey(before) === vectorIndexKey(entry)) continue;
-		if (!liveHolds(name, entry)) plan.changed.push(name);
-	}
-	return plan;
-}
-function readbackVectorIndexes(live) {
-	if (live === void 0 || live.length === 0) return void 0;
-	return live.map((d) => {
-		const out = {};
-		if (d.IndexName !== void 0) out["IndexName"] = d.IndexName;
-		if (d.VectorAttribute !== void 0) out["VectorAttribute"] = d.VectorAttribute;
-		if (d.Dimensions !== void 0) out["Dimensions"] = d.Dimensions;
-		if (d.DistanceFunction !== void 0) out["DistanceFunction"] = d.DistanceFunction;
-		if (d.Projection !== void 0) out["Projection"] = d.Projection;
-		if (d.SearchSchema !== void 0 && d.SearchSchema.length > 0) out["SearchSchema"] = d.SearchSchema;
-		return out;
-	});
-}
-function vectorIndexesSettled(live) {
-	return (live ?? []).every((d) => d.IndexStatus === void 0 || d.IndexStatus === "ACTIVE");
-}
-
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
@@ -12225,12 +12528,15 @@ function sentWarmThroughputMembers(value) {
 function wasSentWarmThroughput(value) {
 	return sentWarmThroughputMembers(value).size > 0;
 }
-function readbackWarmThroughput(live, members) {
+function readbackWarmThroughput(live, members, declared) {
+	const moving = live.Status === "UPDATING" ? coerceWarmThroughput(declared)?.spec : void 0;
 	const out = {};
 	for (const member of WARM_THROUGHPUT_MEMBERS) {
-		if (live[member] === void 0) continue;
+		const value = live[member];
+		if (value === void 0) continue;
 		if (members !== void 0 && !members.has(member)) continue;
-		out[member] = live[member];
+		const target = moving?.[member];
+		out[member] = target === void 0 ? value : Math.max(value, target);
 	}
 	return Object.keys(out).length > 0 ? out : void 0;
 }
@@ -12292,7 +12598,7 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 		if (Object.keys(odt).length > 0) out["OnDemandThroughput"] = odt;
 	}
 	if ("WarmThroughput" in live && indexDeclares(desired, "WarmThroughput", bagInformative) && live.WarmThroughput) {
-		const wt = readbackWarmThroughput(live.WarmThroughput, bagInformative ? sentWarmThroughputMembers(desired?.["WarmThroughput"]) : void 0);
+		const wt = readbackWarmThroughput(live.WarmThroughput, bagInformative ? sentWarmThroughputMembers(desired?.["WarmThroughput"]) : void 0, bagInformative ? desired?.["WarmThroughput"] : void 0);
 		if (wt !== void 0) out["WarmThroughput"] = wt;
 	}
 	return out;
@@ -12650,7 +12956,14 @@ var DynamoDBTableProvider = class {
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${lsiMessage}. Nothing was applied to the table; revert the LocalSecondaryIndexes change, or create a new table under a new logical ID (a new table starts empty)`, resourceType, logicalId, physicalId);
 				warn(`${lsiMessage}; the LocalSecondaryIndexes change was not applied`);
 			}
-			const vectorIndexPlan = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]) ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
+			const vectorIndexesChanged = JSON.stringify(properties["VectorIndexes"]) !== JSON.stringify(previousProperties["VectorIndexes"]);
+			const vectorIndexShape = vectorIndexesChanged ? vectorIndexesShapeDetail(properties["VectorIndexes"]) : void 0;
+			if (vectorIndexShape !== void 0) {
+				const shapeMessage = `AWS::DynamoDB::Table ${logicalId}: ${vectorIndexShape}`;
+				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(shapeMessage)}. Nothing was applied to the table; fix the template value`, resourceType, logicalId, physicalId);
+				warn(`${shapeMessage}; the VectorIndexes change was not applied`);
+			}
+			const vectorIndexPlan = vectorIndexesChanged && vectorIndexShape === void 0 ? planVectorIndexUpdates(previousProperties["VectorIndexes"], properties["VectorIndexes"], table?.VectorIndexes ?? (table === void 0 ? void 0 : [])) : void 0;
 			if (vectorIndexPlan !== void 0 && vectorIndexPlan.changed.length > 0) {
 				const vectorMessage = `AWS::DynamoDB::Table ${logicalId}: VectorIndexes ${vectorIndexPlan.changed.map((n) => maskSecrets(n)).join(", ")} changed definition, which DynamoDB cannot modify in place`;
 				if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) throw new ProvisioningError(`${maskSecrets(vectorMessage)}. Nothing was applied to the table; rename the index (so it is dropped and re-created) or revert the change`, resourceType, logicalId, physicalId);
@@ -13971,7 +14284,8 @@ var DynamoDBTableProvider = class {
 				if (Object.keys(odt).length > 0) result["OnDemandThroughput"] = odt;
 			}
 			if (table.WarmThroughput && declaresWarmThroughput(properties)) {
-				const wt = readbackWarmThroughput(table.WarmThroughput, properties !== void 0 && desiredBagIsInformative(properties) ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0);
+				const informative = properties !== void 0 && desiredBagIsInformative(properties);
+				const wt = readbackWarmThroughput(table.WarmThroughput, informative ? sentWarmThroughputMembers(properties["WarmThroughput"]) : void 0, informative ? properties["WarmThroughput"] : void 0);
 				if (wt !== void 0) result["WarmThroughput"] = wt;
 			}
 			let streamMembersRead = Promise.resolve();
@@ -24502,11 +24816,11 @@ var ApiGatewayV2Provider = class ApiGatewayV2Provider {
 		const region = await this.getClient().config.region();
 		const { partition } = derivePartitionAndUrlSuffix(region);
 		const resourceArn = `arn:${partition}:apigateway:${canonicalizeRegion(region)}::${path}`;
-		if (change.remove.length > 0) await this.getClient().send(new UntagResourceCommand$13({
+		if (change.remove.length > 0) await this.getClient().send(new UntagResourceCommand$14({
 			ResourceArn: resourceArn,
 			TagKeys: change.remove
 		}));
-		if (Object.keys(change.set).length > 0) await this.getClient().send(new TagResourceCommand$13({
+		if (Object.keys(change.set).length > 0) await this.getClient().send(new TagResourceCommand$14({
 			ResourceArn: resourceArn,
 			Tags: change.set
 		}));
@@ -26426,7 +26740,7 @@ var StepFunctionsProvider = class {
 			result["EncryptionConfiguration"] = ec;
 		}
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (!(err instanceof StateMachineDoesNotExist)) throw err;
@@ -26469,14 +26783,14 @@ var StepFunctionsProvider = class {
 		}));
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$14({
+			await this.getClient().send(new UntagResourceCommand$15({
 				resourceArn: stateMachineArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from SFN state machine ${stateMachineArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$14({
+			await this.getClient().send(new TagResourceCommand$15({
 				resourceArn: stateMachineArn,
 				tags: tagsToAdd
 			}));
@@ -27468,14 +27782,14 @@ var ECSProvider = class {
 		}));
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$16({
 				resourceArn,
 				tagKeys: tagsToRemove
 			}));
 			log.debug(`Removed ${tagsToRemove.length} tag(s) from ECS resource ${resourceArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn,
 				tags: tagsToAdd
 			}));
@@ -30927,6 +31241,41 @@ function wrapDocDBFailure(logger, mask, error, build) {
 	const wrapped = build(`${m(failure.summary)}${relayedNameCollision(failure.detail)}`);
 	return error instanceof Error ? markRedactedCause(wrapped) : wrapped;
 }
+function docdbStringList(value) {
+	if (value == null) return [];
+	if (!Array.isArray(value)) return void 0;
+	return value.every((item) => typeof item === "string") ? value : void 0;
+}
+function docdbLogExportChange(desired, previous) {
+	const enable = [...new Set(desired)].filter((type) => !previous.includes(type));
+	const disable = [...new Set(previous)].filter((type) => !desired.includes(type));
+	if (enable.length === 0 && disable.length === 0) return void 0;
+	return {
+		...enable.length > 0 && { EnableLogTypes: enable },
+		...disable.length > 0 && { DisableLogTypes: disable }
+	};
+}
+function cfnCapacity(value) {
+	const capacity = typeof value === "number" || typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+	return Number.isFinite(capacity) ? capacity : void 0;
+}
+function docdbServerlessScaling(value) {
+	if (value == null) return void 0;
+	if (typeof value !== "object" || Array.isArray(value)) return null;
+	const { MinCapacity, MaxCapacity } = value;
+	const min = cfnCapacity(MinCapacity);
+	const max = cfnCapacity(MaxCapacity);
+	if (min === void 0 || max === void 0) return null;
+	return {
+		MinCapacity: min,
+		MaxCapacity: max
+	};
+}
+function holdsDocDBPendingValue(value) {
+	if (value === void 0 || value === null) return false;
+	if (typeof value === "object") return Object.values(value).some(holdsDocDBPendingValue);
+	return true;
+}
 function isDocDBNotFoundError(error, faultName) {
 	if (!(error instanceof Error)) return false;
 	const name = error.name ?? "";
@@ -30959,7 +31308,7 @@ async function applyDocDBTagDiff(client, logger, arn, resourceType, logicalId, o
 }
 async function attachDocDBTags(client, logger, result, arn) {
 	try {
-		const tagsResp = await client.send(new ListTagsForResourceCommand$12({ ResourceName: arn }));
+		const tagsResp = await client.send(new ListTagsForResourceCommand$13({ ResourceName: arn }));
 		result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 	} catch (err) {
 		logger.debug(safeMsg`DocDB ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
@@ -30977,6 +31326,20 @@ function masterUserPasswordToSend(properties, previousProperties, context) {
 	return typeof desired === "string" && typeof recorded === "string" && recorded === desired && dynamicReferenceTokens(recorded).length === 0 && recorded !== "***" ? void 0 : desired;
 }
 const DOCDB_DEFAULT_PORT = 27017;
+const DOCDB_DEFAULT_STORAGE_TYPE = "standard";
+function rotateMasterUserPassword(properties, previousProperties, context) {
+	if (context?.replayingState === true || context?.desiredFromAwsReadback === true) return false;
+	return coerceCfnBoolean(properties["RotateMasterUserPassword"]) === true && coerceCfnBoolean(previousProperties["RotateMasterUserPassword"]) !== true;
+}
+function kmsKeyText(key) {
+	return key.replace(/^arn:[^:]*:kms:[^:]*:[^:]*:/, "").replace(/^key\//, "");
+}
+function sameKmsKey(a, b) {
+	return b !== void 0 && kmsKeyText(a) === kmsKeyText(b);
+}
+function declaredChange(desired, recorded, live) {
+	return desired != null && String(desired) !== String(recorded ?? live);
+}
 const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
 	"DeletionProtection",
 	"BackupRetentionPeriod",
@@ -30984,17 +31347,38 @@ const DOCDB_CLUSTER_KEPT_ON_REMOVAL = [
 	"EngineVersion",
 	"PreferredBackupWindow",
 	"PreferredMaintenanceWindow",
-	"DBClusterParameterGroupName"
+	"DBClusterParameterGroupName",
+	"CopyTagsToSnapshot",
+	"EnableCloudwatchLogsExports",
+	"StorageType",
+	"ServerlessV2ScalingConfiguration",
+	"MasterUserSecretKmsKeyId"
+];
+const DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL = ["NetworkType", "ManageMasterUserPassword"];
+const DOCDB_INSTANCE_KEPT_ON_REMOVAL = [
+	"PreferredMaintenanceWindow",
+	"CACertificateIdentifier",
+	"EnablePerformanceInsights"
 ];
-const DOCDB_INSTANCE_KEPT_ON_REMOVAL = ["PreferredMaintenanceWindow"];
-function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType) {
+const CLUSTER_MODIFY_UNSETTLED_KEYS = [
+	"CopyTagsToSnapshot",
+	"EnableCloudwatchLogsExports",
+	"NetworkType",
+	"ServerlessV2ScalingConfiguration",
+	"StorageType"
+];
+const INSTANCE_MODIFY_UNSETTLED_KEYS = ["CACertificateIdentifier", "EnablePerformanceInsights"];
+const SETTLE_MAX_WAIT_MS = 3e5;
+const STORAGE_SETTLE_MAX_WAIT_MS = 18e5;
+const DEADLINE_MARGIN_MS = 3e4;
+function keptOnRemovalWarning$1(keys, properties, previousProperties, context, logicalId, resourceType, measured = true) {
 	const removedSet = context?.removedProperties ?? new Set(removedTemplateKeys(previousProperties, properties));
 	const removed = keys.filter((key) => removedSet.has(key));
 	if (removed.length === 0) return void 0;
 	const one = removed.length === 1;
 	const names = `${one ? "property" : "properties"} ${removed.join(", ")}`;
 	const modify = resourceType === "AWS::DocDB::DBInstance" ? "ModifyDBInstance" : "ModifyDBCluster";
-	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place, as CloudFormation does. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
+	return context?.replayingState ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; ${modify} keeps a setting it is not sent, so the rollback leaves any value the failed deploy applied in place.` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS ${one ? "value" : "values"} in place${measured ? ", as CloudFormation does" : ""}. Declare ${one ? "it" : "them"} to change ${one ? "it" : "them"}.`;
 }
 const SECURITY_GROUP_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying"]);
 const PORT_CHANGE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["modifying", "rebooting"]);
@@ -31038,6 +31422,7 @@ var DocDBProvider = class {
 	protectionFlips = new ProtectionFlipRegistry();
 	disableCcApiFallback = true;
 	removalHandledInUpdate = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
+		"AvailabilityZones",
 		"DBClusterIdentifier",
 		"DBSubnetGroupName",
 		"KmsKeyId",
@@ -31046,7 +31431,9 @@ var DocDBProvider = class {
 		"Port",
 		"Tags",
 		"MasterUserPassword",
-		...DOCDB_CLUSTER_KEPT_ON_REMOVAL
+		"RotateMasterUserPassword",
+		...DOCDB_CLUSTER_KEPT_ON_REMOVAL,
+		...DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBClusterIdentifier",
@@ -31054,6 +31441,7 @@ var DocDBProvider = class {
 		"DBInstanceClass",
 		"Tags",
 		"AutoMinorVersionUpgrade",
+		"CertificateRotationRestart",
 		...DOCDB_INSTANCE_KEPT_ON_REMOVAL
 	])]]);
 	handledProperties = /* @__PURE__ */ new Map([["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
@@ -31071,7 +31459,16 @@ var DocDBProvider = class {
 		"PreferredMaintenanceWindow",
 		"DBClusterParameterGroupName",
 		"DeletionProtection",
-		"Tags"
+		"Tags",
+		"AvailabilityZones",
+		"CopyTagsToSnapshot",
+		"EnableCloudwatchLogsExports",
+		"ManageMasterUserPassword",
+		"MasterUserSecretKmsKeyId",
+		"NetworkType",
+		"RotateMasterUserPassword",
+		"ServerlessV2ScalingConfiguration",
+		"StorageType"
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBInstanceClass",
@@ -31079,7 +31476,10 @@ var DocDBProvider = class {
 		"AvailabilityZone",
 		"PreferredMaintenanceWindow",
 		"AutoMinorVersionUpgrade",
-		"Tags"
+		"Tags",
+		"CACertificateIdentifier",
+		"CertificateRotationRestart",
+		"EnablePerformanceInsights"
 	])]]);
 	getClient() {
 		if (!this.docdbClient) {
@@ -31101,8 +31501,8 @@ var DocDBProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		const mask = context?.maskSecrets;
 		switch (resourceType) {
-			case "AWS::DocDB::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask);
-			case "AWS::DocDB::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask);
+			case "AWS::DocDB::DBCluster": return this.createDBCluster(logicalId, resourceType, properties, mask, context?.replayingState === true);
+			case "AWS::DocDB::DBInstance": return this.createDBInstance(logicalId, resourceType, properties, mask, context?.replayingState === true);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -31127,9 +31527,13 @@ var DocDBProvider = class {
 		const thrown = this.wrapCaughtError(mask, error, build);
 		return error instanceof Error && error.name.includes("NotFound") ? markNotGone(thrown) : thrown;
 	}
-	async createDBCluster(logicalId, resourceType, properties, mask) {
+	async createDBCluster(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating DocDB DBCluster ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const origin = { stateBorne: replayingState };
+		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, true);
+		const managedPassword = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
+		const password = this.passwordBesideManaged(managedPassword, false, properties["MasterUserPassword"], resourceType, logicalId, origin);
 		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
 		let clusterCreated = false;
 		let createdResourceId;
@@ -31139,7 +31543,7 @@ var DocDBProvider = class {
 				Engine: "docdb",
 				EngineVersion: properties["EngineVersion"],
 				MasterUsername: properties["MasterUsername"],
-				MasterUserPassword: properties["MasterUserPassword"],
+				MasterUserPassword: password,
 				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
 				DBSubnetGroupName: properties["DBSubnetGroupName"],
@@ -31150,6 +31554,14 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				DeletionProtection: properties["DeletionProtection"],
+				AvailabilityZones: properties["AvailabilityZones"],
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				ManageMasterUserPassword: managedPassword,
+				MasterUserSecretKmsKeyId: properties["MasterUserSecretKmsKeyId"],
+				NetworkType: properties["NetworkType"],
+				StorageType: properties["StorageType"],
+				...logTypes !== void 0 && logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
+				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
 				...tags.length > 0 && { Tags: tags }
 			}));
 			clusterCreated = true;
@@ -31171,10 +31583,26 @@ var DocDBProvider = class {
 	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating DocDB DBCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const origin = {
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		};
+		const { logTypes, scaling } = this.readClusterBlocks(properties, resourceType, logicalId, origin, false);
+		const logExportConfig = logTypes === void 0 ? void 0 : docdbLogExportChange(logTypes, docdbStringList(previousProperties["EnableCloudwatchLogsExports"]) ?? []);
 		try {
+			const credentials = await this.planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin);
 			const vpcSgIds = properties["VpcSecurityGroupIds"];
 			const sendVpcSgIds = vpcSgIds !== void 0 && vpcSgIds.length > 0;
 			const portToSend = clusterPortToSend(properties, previousProperties);
+			const unrecorded = (key) => properties[key] != null && previousProperties[key] == null;
+			const live = unrecorded("NetworkType") || unrecorded("StorageType") || logExportConfig?.EnableLogTypes !== void 0 ? await this.describeDBCluster(physicalId) : void 0;
+			const networkType = properties["NetworkType"];
+			const networkChange = declaredChange(networkType, previousProperties["NetworkType"], live?.NetworkType);
+			const storageType = properties["StorageType"];
+			const storageChange = declaredChange(storageType, previousProperties["StorageType"], live?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE);
+			const previousScaling = docdbServerlessScaling(previousProperties["ServerlessV2ScalingConfiguration"]);
+			const scalingChange = scaling != null && (scaling.MinCapacity !== previousScaling?.MinCapacity || scaling.MaxCapacity !== previousScaling?.MaxCapacity);
+			this.markChangedUnsettled(CLUSTER_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await this.getClient().send(new ModifyDBClusterCommand$1({
 				DBClusterIdentifier: physicalId,
 				EngineVersion: properties["EngineVersion"],
@@ -31184,15 +31612,40 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				...sendVpcSgIds && { VpcSecurityGroupIds: vpcSgIds },
-				MasterUserPassword: masterUserPasswordToSend(properties, previousProperties, context),
+				MasterUserPassword: credentials.password,
 				Port: portToSend,
+				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+				...rotateMasterUserPassword(properties, previousProperties, context) && { RotateMasterUserPassword: true },
+				...credentials.managed !== void 0 && { ManageMasterUserPassword: credentials.managed },
+				...credentials.secretKmsKey !== void 0 && { MasterUserSecretKmsKeyId: credentials.secretKmsKey },
+				...networkChange && { NetworkType: networkType },
+				...storageChange && { StorageType: storageType },
+				...scalingChange && { ServerlessV2ScalingConfiguration: scaling },
+				...logExportConfig !== void 0 && { CloudwatchLogsExportConfiguration: logExportConfig },
 				ApplyImmediately: true
 			}));
+			const addedLogTypes = (logExportConfig?.EnableLogTypes ?? []).filter((type) => !live?.EnabledCloudwatchLogsExports?.includes(type));
+			if (addedLogTypes.length > 0) context?.markAttempted?.("EnableCloudwatchLogsExports", addedLogTypes);
 			this.logger.debug(`Successfully updated DocDB DBCluster ${logicalId}`);
 			const noWait = process.env["CDKD_NO_WAIT"] === "true";
 			const portChanged = portToSend !== void 0 && portToSend !== numberOrUndefined(previousProperties["Port"]);
 			if (!noWait && portChanged) await this.waitForClusterPortApplied(physicalId, logicalId, portToSend);
 			const described = await this.describeDBCluster(physicalId);
+			if (!noWait) {
+				const { EnableLogTypes: enabled = [], DisableLogTypes: disabled = [] } = logExportConfig ?? {};
+				const applied = /* @__PURE__ */ new Map();
+				if (logExportConfig !== void 0) applied.set("EnableCloudwatchLogsExports", (cluster) => {
+					const logs = cluster?.EnabledCloudwatchLogsExports;
+					return enabled.every((type) => logs?.includes(type)) && !disabled.some((type) => logs?.includes(type));
+				});
+				if (networkChange) applied.set("NetworkType", (cluster) => cluster?.NetworkType === networkType);
+				if (storageChange) applied.set("StorageType", (cluster) => (cluster?.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE) === storageType);
+				if (scalingChange) applied.set("ServerlessV2ScalingConfiguration", (cluster) => {
+					const live = cluster?.ServerlessV2ScalingConfiguration;
+					return live?.MinCapacity === scaling?.MinCapacity && live?.MaxCapacity === scaling?.MaxCapacity;
+				});
+				await this.waitForApplied(logicalId, applied, () => this.describeDBCluster(physicalId), storageChange ? STORAGE_SETTLE_MAX_WAIT_MS : SETTLE_MAX_WAIT_MS);
+			}
 			if (!noWait && portChanged) {
 				for (const member of described?.DBClusterMembers ?? []) if (member.DBInstanceIdentifier) await this.waitForMemberAfterClusterChange(member.DBInstanceIdentifier, logicalId, PORT_CHANGE_MEMBER_STATUSES, "port");
 			}
@@ -31203,15 +31656,20 @@ var DocDBProvider = class {
 			if (described?.DBClusterArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBClusterArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const keptWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
 			if (keptWarning !== void 0) this.logger.warn(keptWarning);
+			const unmeasuredWarning = keptOnRemovalWarning$1(DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType, false);
+			if (unmeasuredWarning !== void 0) this.logger.warn(unmeasuredWarning);
+			if (credentials.heldWarning !== void 0) this.logger.warn(credentials.heldWarning);
 			return {
 				physicalId,
 				wasReplaced: false,
 				attributes: clusterAttributes(noWait && portChanged && described !== void 0 ? {
 					...described,
 					Port: portToSend
-				} : described)
+				} : described),
+				...credentials.effectiveProperties !== void 0 && { effectiveProperties: credentials.effectiveProperties }
 			};
 		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw this.wrapCaughtError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to update DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
@@ -31293,9 +31751,10 @@ var DocDBProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBCluster ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async createDBInstance(logicalId, resourceType, properties, mask) {
+	async createDBInstance(logicalId, resourceType, properties, mask, replayingState) {
 		this.logger.debug(`Creating DocDB DBInstance ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		const insights = this.readBooleanProperty("EnablePerformanceInsights", properties, resourceType, logicalId, { stateBorne: replayingState });
 		const dbInstanceIdentifier = properties["DBInstanceIdentifier"] || generatedNameFor("AWS::DocDB::DBInstance", logicalId);
 		let instanceCreated = false;
 		let createdResourceId;
@@ -31308,6 +31767,8 @@ var DocDBProvider = class {
 				AvailabilityZone: properties["AvailabilityZone"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+				CACertificateIdentifier: properties["CACertificateIdentifier"],
+				EnablePerformanceInsights: insights,
 				...tags.length > 0 && { Tags: tags }
 			}));
 			instanceCreated = true;
@@ -31330,13 +31791,25 @@ var DocDBProvider = class {
 		this.logger.debug(`Updating DocDB DBInstance ${logicalId}: ${physicalId}`);
 		const mask = context?.maskSecrets;
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const insights = this.readBooleanProperty("EnablePerformanceInsights", properties, resourceType, logicalId, {
+			stateBorne: context?.replayingState === true || context?.desiredFromAwsReadback === true,
+			physicalId
+		});
 		try {
+			const certificate = properties["CACertificateIdentifier"];
+			const live = certificate != null && previousProperties["CACertificateIdentifier"] == null || insights !== void 0 && previousProperties["EnablePerformanceInsights"] == null ? await this.describeDBInstance(physicalId) : void 0;
+			const certificateChange = declaredChange(certificate, previousProperties["CACertificateIdentifier"], live?.CACertificateIdentifier);
+			const insightsChange = declaredChange(insights, previousProperties["EnablePerformanceInsights"], live?.PerformanceInsightsEnabled ?? false);
+			this.markChangedUnsettled(INSTANCE_MODIFY_UNSETTLED_KEYS, properties, previousProperties, context);
 			await modifyDbInstanceWhenAvailable({
 				send: () => this.getClient().send(new ModifyDBInstanceCommand$1({
 					DBInstanceIdentifier: physicalId,
 					DBInstanceClass: properties["DBInstanceClass"],
 					PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 					AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
+					...certificateChange && { CACertificateIdentifier: certificate },
+					...certificateChange && properties["CertificateRotationRestart"] != null && { CertificateRotationRestart: properties["CertificateRotationRestart"] },
+					...insightsChange && { EnablePerformanceInsights: insights },
 					ApplyImmediately: true
 				})),
 				readStatus: async () => (await this.describeDBInstance(physicalId))?.DBInstanceStatus,
@@ -31347,6 +31820,12 @@ var DocDBProvider = class {
 				remainingMs: enclosingDeadlineRemainingMs()
 			});
 			this.logger.debug(`Successfully updated DocDB DBInstance ${logicalId}`);
+			if (process.env["CDKD_NO_WAIT"] !== "true") {
+				const applied = /* @__PURE__ */ new Map();
+				if (certificateChange) applied.set("CACertificateIdentifier", (instance) => instance?.CACertificateIdentifier === certificate);
+				if (insightsChange) applied.set("EnablePerformanceInsights", (instance) => instance?.PerformanceInsightsEnabled === insights);
+				await this.waitForApplied(logicalId, applied, () => this.describeDBInstance(physicalId));
+			}
 			const described = await this.describeDBInstance(physicalId);
 			if (described?.DBInstanceArn) await applyDocDBTagDiff(this.getClient(), this.logger, described.DBInstanceArn, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 			const keptWarning = keptOnRemovalWarning$1(DOCDB_INSTANCE_KEPT_ON_REMOVAL, properties, previousProperties, context, logicalId, resourceType);
@@ -31379,6 +31858,106 @@ var DocDBProvider = class {
 			throw this.wrapDeleteError(context?.maskSecrets, error, (text) => new ProvisioningError(`Failed to delete DocDB DBInstance ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
+	markChangedUnsettled(keys, properties, previousProperties, context) {
+		for (const key of keys) if (properties[key] != null && !isDeepStrictEqual(properties[key], previousProperties[key])) context?.markUnsettled?.(key);
+	}
+	refuseBlock(logicalId, resourceType, physicalId, text) {
+		throw markNonRetryable(new ProvisioningError(safeMsg`${resourceType === "AWS::DocDB::DBInstance" ? "DocDB DBInstance" : "DocDB DBCluster"} ${logicalId}: ${text}; nothing was changed.`, resourceType, logicalId, physicalId));
+	}
+	readClusterBlocks(properties, resourceType, logicalId, origin, creating) {
+		const leaveOut = (key) => {
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+		};
+		const rawLogs = properties["EnableCloudwatchLogsExports"];
+		let logTypes = rawLogs == null ? void 0 : docdbStringList(rawLogs);
+		if (rawLogs != null && logTypes === void 0) {
+			if (!(creating && origin.stateBorne)) this.refuseBlock(logicalId, resourceType, origin.physicalId, "EnableCloudwatchLogsExports must be a list of strings");
+			leaveOut("EnableCloudwatchLogsExports");
+			logTypes = void 0;
+		}
+		const scaling = docdbServerlessScaling(properties["ServerlessV2ScalingConfiguration"]);
+		if (scaling === null) {
+			if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, "ServerlessV2ScalingConfiguration must be an object with both a numeric MinCapacity and a numeric MaxCapacity");
+			leaveOut("ServerlessV2ScalingConfiguration");
+		}
+		return {
+			logTypes,
+			scaling
+		};
+	}
+	async planMasterCredentials(physicalId, properties, previousProperties, resourceType, logicalId, context, origin) {
+		const managed = this.readBooleanProperty("ManageMasterUserPassword", properties, resourceType, logicalId, origin);
+		const changedPassword = masterUserPasswordToSend(properties, previousProperties, context);
+		const recordedFlag = coerceCfnBoolean(previousProperties["ManageMasterUserPassword"]);
+		const key = properties["MasterUserSecretKmsKeyId"];
+		const recordedKey = previousProperties["MasterUserSecretKmsKeyId"];
+		let managedSide = recordedFlag ?? false;
+		let keyChange = key != null && !sameKmsKey(key, recordedKey);
+		if (recordedFlag === void 0 && (changedPassword !== void 0 || managed !== void 0 || keyChange)) {
+			const secret = (await this.describeDBCluster(physicalId))?.MasterUserSecret;
+			managedSide = secret !== void 0;
+			if (recordedKey === void 0 && secret?.KmsKeyId !== void 0 && key != null) keyChange = !sameKmsKey(key, secret.KmsKeyId) && !kmsKeyText(key).startsWith("alias/");
+		}
+		const leaving = managed === false && managedSide;
+		const declared = properties["MasterUserPassword"];
+		const declaredUsable = typeof declared === "string" && declared !== "***" && dynamicReferenceTokens(declared).length === 0;
+		const password = leaving ? declaredUsable ? declared : void 0 : changedPassword;
+		const modeChange = managed !== void 0 && managed !== managedSide;
+		if (context?.desiredFromAwsReadback === true && modeChange) return {
+			managed: void 0,
+			secretKmsKey: void 0,
+			password: void 0,
+			heldWarning: safeMsg`${logicalId} (${resourceType}): cdkd drift --revert does not change ManageMasterUserPassword, so it is left as it is. Declare it in the template and deploy to change it.`
+		};
+		if (origin.stateBorne && leaving && password === void 0) return {
+			managed: void 0,
+			secretKmsKey: void 0,
+			password: void 0,
+			heldWarning: safeMsg`${logicalId} (${resourceType}): ManageMasterUserPassword stays true: turning it off needs a MasterUserPassword, which the restored state does not hold. Declare both in the template and deploy.`,
+			effectiveProperties: {
+				...properties,
+				ManageMasterUserPassword: true
+			}
+		};
+		const sendKey = key != null && (modeChange && managed === true || keyChange && (managed ?? managedSide));
+		return {
+			managed: modeChange || sendKey ? managed : void 0,
+			secretKmsKey: sendKey ? key : void 0,
+			password: this.passwordBesideManaged(managed, managed === void 0 && managedSide, password, resourceType, logicalId, origin),
+			heldWarning: void 0
+		};
+	}
+	readBooleanProperty(key, properties, resourceType, logicalId, origin) {
+		const value = properties[key];
+		if (value == null) return void 0;
+		const flag = coerceCfnBoolean(value);
+		if (flag !== void 0) return flag;
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, `${key} must be a boolean`);
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded ${key} is unusable, so it is not sent.`);
+	}
+	passwordBesideManaged(managed, removedFromManaged, password, resourceType, logicalId, origin) {
+		if (managed !== true && !removedFromManaged || password == null) return password;
+		if (!origin.stateBorne) this.refuseBlock(logicalId, resourceType, origin.physicalId, removedFromManaged ? "MasterUserPassword cannot change while AWS manages the password; declare ManageMasterUserPassword: false beside it to leave managed mode" : "MasterUserPassword cannot be set while ManageMasterUserPassword is true, because AWS manages that password");
+		this.logger.warn(removedFromManaged ? safeMsg`${logicalId} (${resourceType}): the recorded MasterUserPassword is not sent: the cluster stays managed, because the recorded ManageMasterUserPassword is absent.` : safeMsg`${logicalId} (${resourceType}): the recorded MasterUserPassword is not sent, because ManageMasterUserPassword is true.`);
+	}
+	async waitForApplied(logicalId, applied, read, maxWaitMs = SETTLE_MAX_WAIT_MS) {
+		if (applied.size === 0) return;
+		const capMs = Math.min(maxWaitMs, enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS);
+		const startTime = Date.now();
+		let delay = 2e3;
+		for (;;) {
+			const live = await read();
+			const pending = [...applied].filter(([, isApplied]) => !isApplied(live));
+			if (pending.length === 0) return;
+			if (Date.now() - startTime + delay >= capMs) {
+				const keys = pending.map(([key]) => key).join(", ");
+				this.logger.warn(safeMsg`${logicalId}: the new ${keys} did not read back when cdkd stopped waiting; AWS accepted the change, so cdkd drift may report the old value as the baseline. Once it applies, run cdkd drift --accept.`);
+				return;
+			}
+			await this.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+		}
+	}
 	async describeDBCluster(dbClusterIdentifier) {
 		return (await this.getClient().send(new DescribeDBClustersCommand$1({ DBClusterIdentifier: dbClusterIdentifier }))).DBClusters?.[0];
 	}
@@ -31567,6 +32146,60 @@ var DocDBProvider = class {
 	sleep(ms) {
 		return new Promise((resolve) => setTimeout(resolve, ms));
 	}
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::DocDB::DBCluster") return [
+			"AvailabilityZones",
+			"MasterUserSecretKmsKeyId",
+			"RotateMasterUserPassword"
+		];
+		if (resourceType === "AWS::DocDB::DBInstance") return ["CertificateRotationRestart"];
+		return [];
+	}
+	getDriftUnorderedPaths(resourceType) {
+		return resourceType === "AWS::DocDB::DBCluster" ? ["EnableCloudwatchLogsExports"] : [];
+	}
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::DocDB::DBCluster") return properties;
+		const out = { ...properties };
+		const logs = out["EnableCloudwatchLogsExports"];
+		if (Array.isArray(logs) && docdbStringList(logs) !== void 0) out["EnableCloudwatchLogsExports"] = [...new Set(logs)];
+		const scaling = docdbServerlessScaling(out["ServerlessV2ScalingConfiguration"]);
+		if (scaling != null) out["ServerlessV2ScalingConfiguration"] = scaling;
+		return out;
+	}
+	canonicalizeUnsettledProperties(resourceType, properties) {
+		return this.canonicalizeDriftProperties(resourceType, properties);
+	}
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
+		const live = await this.readCurrentState(physicalId, logicalId, resourceType);
+		if (resourceType !== "AWS::DocDB::DBCluster") return live;
+		if (live === void 0 || live === RESOURCE_NOT_FOUND) return live;
+		if (!names.has("EnableCloudwatchLogsExports")) return live;
+		const key = "EnableCloudwatchLogsExports";
+		const named = /* @__PURE__ */ new Set([
+			...docdbStringList(recordedProperties?.[key]) ?? [],
+			...docdbStringList(desiredProperties?.[key]) ?? [],
+			...[...attemptedItems?.get(key) ?? []].filter(isUsableAttemptedName)
+		]);
+		return {
+			...live,
+			[key]: (live[key] ?? []).filter((type) => named.has(type))
+		};
+	}
+	async unsettledInTransition(physicalId, _logicalId, resourceType, names, _recordedProperties, desiredProperties) {
+		if (desiredProperties !== void 0) return /* @__PURE__ */ new Set();
+		const unmoving = (status) => isProceedDbStatus(status) || status === "backing-up";
+		try {
+			if (resourceType === "AWS::DocDB::DBCluster") return unmoving((await this.describeDBCluster(physicalId))?.Status) ? /* @__PURE__ */ new Set() : names;
+			if (resourceType === "AWS::DocDB::DBInstance") {
+				const instance = await this.describeDBInstance(physicalId);
+				return unmoving(instance?.DBInstanceStatus) && !holdsDocDBPendingValue(instance?.PendingModifiedValues) ? /* @__PURE__ */ new Set() : names;
+			}
+			return /* @__PURE__ */ new Set();
+		} catch {
+			return names;
+		}
+	}
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::DocDB::DBInstance": return this.importDBInstance(input);
@@ -31598,6 +32231,8 @@ var DocDBProvider = class {
 		if (inst.AvailabilityZone !== void 0) result["AvailabilityZone"] = inst.AvailabilityZone;
 		if (inst.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = inst.PreferredMaintenanceWindow;
 		if (inst.AutoMinorVersionUpgrade !== void 0) result["AutoMinorVersionUpgrade"] = inst.AutoMinorVersionUpgrade;
+		if (inst.CACertificateIdentifier !== void 0) result["CACertificateIdentifier"] = inst.CACertificateIdentifier;
+		result["EnablePerformanceInsights"] = inst.PerformanceInsightsEnabled ?? false;
 		if (inst.DBInstanceArn) await attachDocDBTags(this.getClient(), this.logger, result, inst.DBInstanceArn);
 		return result;
 	}
@@ -31625,6 +32260,16 @@ var DocDBProvider = class {
 		if (cluster.PreferredMaintenanceWindow !== void 0) result["PreferredMaintenanceWindow"] = cluster.PreferredMaintenanceWindow;
 		if (cluster.DBClusterParameterGroup !== void 0) result["DBClusterParameterGroupName"] = cluster.DBClusterParameterGroup;
 		if (cluster.DeletionProtection !== void 0) result["DeletionProtection"] = cluster.DeletionProtection;
+		result["CopyTagsToSnapshot"] = cluster.CopyTagsToSnapshot ?? false;
+		result["ManageMasterUserPassword"] = cluster.MasterUserSecret !== void 0;
+		result["StorageType"] = cluster.StorageType ?? DOCDB_DEFAULT_STORAGE_TYPE;
+		result["EnableCloudwatchLogsExports"] = cluster.EnabledCloudwatchLogsExports ?? [];
+		if (cluster.NetworkType !== void 0) result["NetworkType"] = cluster.NetworkType;
+		const { MinCapacity: min, MaxCapacity: max } = cluster.ServerlessV2ScalingConfiguration ?? {};
+		if (min !== void 0 && max !== void 0) result["ServerlessV2ScalingConfiguration"] = {
+			MinCapacity: min,
+			MaxCapacity: max
+		};
 		if (cluster.DBClusterArn) await attachDocDBTags(this.getClient(), this.logger, result, cluster.DBClusterArn);
 		return result;
 	}
@@ -33338,14 +33983,14 @@ var WAFv2WebACLProvider = class {
 		}));
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$17({
 				ResourceARN: arn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$17({
 				ResourceARN: arn,
 				Tags: tagsToAdd
 			}));
@@ -33384,7 +34029,7 @@ var WAFv2WebACLProvider = class {
 		if (webACL.ApplicationConfig) result["ApplicationConfig"] = webACL.ApplicationConfig;
 		if (webACL.MonetizationConfig) result["MonetizationConfig"] = webACL.MonetizationConfig;
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceARN: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
 		} catch (err) {
 			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
@@ -33446,6 +34091,7 @@ function userPoolDeletionProtectionUpdate(physicalId, pool, value, opts = {}) {
 	if (acr === void 0) delete input.AcrConfiguration;
 	else input.AcrConfiguration = acr;
 	if (echoesDeveloperEmail(pool) && opts.withoutDeveloperEmail !== true) input.EmailConfiguration = pool.EmailConfiguration;
+	if (echoesCustomerManagedKey(pool)) input.KeyConfiguration = pool.KeyConfiguration;
 	input.DeletionProtection = value;
 	return input;
 }
@@ -33471,6 +34117,19 @@ function reportKind(record) {
 function echoesDeveloperEmail(pool) {
 	return pool.EmailConfiguration?.EmailSendingAccount === "DEVELOPER";
 }
+function echoesCustomerManagedKey(pool) {
+	return pool.KeyConfiguration?.KeyType === "CUSTOMER_MANAGED_KEY";
+}
+function bareFlipResets(pool) {
+	const reset = [
+		"self sign-up",
+		"Lambda triggers",
+		"advanced security"
+	];
+	if (echoesDeveloperEmail(pool)) reset.push("SES email configuration");
+	if (echoesCustomerManagedKey(pool)) reset.push("customer-managed key");
+	return `${reset.slice(0, -1).join(", ")} and ${reset[reset.length - 1]}`;
+}
 const REFUSED_ECHO_ERRORS = /* @__PURE__ */ new Set([
 	"InvalidParameterException",
 	"InvalidSmsRoleAccessPolicyException",
@@ -33553,12 +34212,13 @@ const KEPT_ON_REMOVAL_MEMBERS = {
 	AccountRecoverySetting: void 0,
 	SmsConfiguration: void 0,
 	UserPoolTier: "ESSENTIALS",
-	DeletionProtection: "INACTIVE"
+	DeletionProtection: "INACTIVE",
+	IssuerConfiguration: { Type: "ORIGINAL" }
 };
 function declaresMember(value, unset) {
 	if (value === void 0 || value === null || value === "") return false;
 	if (isEmptyObjectPlaceholder(value)) return false;
-	return unset === void 0 || value !== unset;
+	return unset === void 0 || !isDeepStrictEqual(value, unset);
 }
 function sendsKeptMember(member, value) {
 	if (!value) return false;
@@ -33763,6 +34423,8 @@ var CognitoUserPoolProvider = class {
 		"SmsAuthenticationMessage",
 		"SmsVerificationMessage",
 		"UserPoolTier",
+		"KeyConfiguration",
+		"IssuerConfiguration",
 		"EnabledMfas",
 		"EmailAuthenticationMessage",
 		"EmailAuthenticationSubject",
@@ -33844,6 +34506,8 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsAuthenticationMessage"]) createParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
 			if (properties["SmsVerificationMessage"]) createParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) createParams.UserPoolTier = properties["UserPoolTier"];
+			if (properties["KeyConfiguration"]) createParams.KeyConfiguration = properties["KeyConfiguration"];
+			if (properties["IssuerConfiguration"]) createParams.IssuerConfiguration = properties["IssuerConfiguration"];
 			const orphanWindow = createUserPoolLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleOrphanPools(logicalId, poolName, orphanWindow, createMaskedLogSinks(this.logger, context?.maskSecrets));
 			let created;
@@ -34104,6 +34768,8 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsAuthenticationMessage"] !== void 0) updateParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
+			if (properties["KeyConfiguration"]) updateParams.KeyConfiguration = properties["KeyConfiguration"];
+			if (properties["IssuerConfiguration"]) updateParams.IssuerConfiguration = properties["IssuerConfiguration"];
 			const mfaOptions = {
 				...liveMfa?.value !== void 0 ? { liveMfaConfiguration: liveMfa.value } : {},
 				...liveMfa?.failed === true ? { liveReadFailed: true } : {},
@@ -34163,7 +34829,7 @@ var CognitoUserPoolProvider = class {
 			this.logger.warn(safeMsg`Cognito User Pool ${logicalId} (${physicalId}): the template no longer declares ` + safeMsg`${removed.length} UserPoolTags key(s), but DescribeUserPool returned no ARN to ` + safeMsg`untag them with, so they stay on the pool. Remove them with ` + safeMsg`aws cognito-idp untag-resource.`);
 			return;
 		}
-		await this.getClient().send(new UntagResourceCommand$17({
+		await this.getClient().send(new UntagResourceCommand$18({
 			ResourceArn: poolArn,
 			TagKeys: removed
 		}));
@@ -34211,7 +34877,7 @@ var CognitoUserPoolProvider = class {
 				before: "aws cognito-idp update-user-pool --user-pool-id",
 				identifier: physicalId,
 				after: "--deletion-protection INACTIVE",
-				caveat: "Note UpdateUserPool resets some members a call omits (self sign-up, Lambda triggers, advanced security and AutoVerifiedAttributes among them), so send your complete pool configuration alongside that flag rather than the flag alone."
+				caveat: "Note UpdateUserPool resets some members a call omits (self sign-up, Lambda triggers, advanced security, AutoVerifiedAttributes and a customer-managed KeyConfiguration among them), so send your complete pool configuration alongside that flag rather than the flag alone."
 			}
 		}) : `AWS::Cognito::UserPool is a stateful type, so re-run with ${replaceFlags} to recreate it (this deletes all users in the pool).`;
 	}
@@ -34236,16 +34902,16 @@ var CognitoUserPoolProvider = class {
 					try {
 						pool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
 					} catch (readError) {
-						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip), maskerOrIdentity(context?.maskSecrets));
 						throw readError;
 					}
 					if (!pool) {
-						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+						if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip), maskerOrIdentity(context?.maskSecrets));
 						throw new Error(`DescribeUserPool returned no pool for ${physicalId}`);
 					}
 					if (bareFlip && pool.DeletionProtection !== "ACTIVE") bareFlip.ambiguous = false;
 					const resetConfirmed = bareFlip !== void 0 && !bareFlip.ambiguous;
-					if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip));
+					if (bareFlip) this.reportSettingsResetByBareFlip(physicalId, bareFlip.pool, reportKind(bareFlip), maskerOrIdentity(context?.maskSecrets));
 					if (flipRecord && this.emailOmittedFlips.has(flipRecord) && !echoesDeveloperEmail(pool) && !(bareFlip && echoesDeveloperEmail(bareFlip.pool))) this.logger.error(safeMsg`Cognito User Pool ${physicalId} is LIVE with its SES email configuration reset: ` + safeMsg`--remove-protection turned DeletionProtection off with an UpdateUserPool that left ` + safeMsg`out its DEVELOPER EmailConfiguration (sending it was refused), and the delete then ` + safeMsg`failed. The pool's email configuration was ${EMAIL_RESET_CLAUSE}`);
 					const bareLicensed = resetConfirmed && bareFlip.echoedSince !== true;
 					const readOn = pool.DeletionProtection === "ACTIVE";
@@ -34278,7 +34944,7 @@ var CognitoUserPoolProvider = class {
 			}
 		});
 	}
-	reportSettingsResetByBareFlip(physicalId, before, kind) {
+	reportSettingsResetByBareFlip(physicalId, before, kind, mask) {
 		const held = [];
 		const adminOnly = before.AdminCreateUserConfig?.AllowAdminCreateUserOnly;
 		if (adminOnly !== void 0) held.push(`AllowAdminCreateUserOnly=${String(adminOnly)}`);
@@ -34292,10 +34958,11 @@ var CognitoUserPoolProvider = class {
 		const mode = before.UserPoolAddOns?.AdvancedSecurityMode;
 		if (mode) held.push(`AdvancedSecurityMode=${mode}`);
 		if (echoesDeveloperEmail(before)) held.push("EmailConfiguration.EmailSendingAccount=DEVELOPER (SES)");
-		const heldText = held.length > 0 ? held.join(", ") : "none of these settings";
-		const what = echoesDeveloperEmail(before) ? "self sign-up, Lambda triggers, advanced security and SES email configuration" : "self sign-up, Lambda triggers and advanced security";
+		if (echoesCustomerManagedKey(before)) held.push(`KeyConfiguration.KmsKeyArn=${String(before.KeyConfiguration?.KmsKeyArn)}`);
+		const heldText = held.length > 0 ? held.map((entry) => mask(entry)).join(", ") : "none of these settings";
+		const what = bareFlipResets(before);
 		const state = kind === "unclear" ? safeMsg`is LIVE and its ${what} MAY have been reset: ` + safeMsg`--remove-protection sent UpdateUserPool with DeletionProtection alone (the pool's own ` + safeMsg`configuration was refused) and got no clear answer, and the delete then failed. Check it ` + safeMsg`with aws cognito-idp describe-user-pool.` : kind === "earlier" ? safeMsg`is LIVE; its ${what} were reset by an ` + safeMsg`earlier UpdateUserPool that --remove-protection sent with DeletionProtection alone (the ` + safeMsg`pool's own configuration was refused); they may have been restored since. Check it with ` + safeMsg`aws cognito-idp describe-user-pool.` : safeMsg`is LIVE with its ${what} reset: ` + safeMsg`--remove-protection had to turn DeletionProtection off with UpdateUserPool alone (the ` + safeMsg`pool's own configuration was refused), and the delete then failed.`;
-		this.logger.error(safeMsg`Cognito User Pool ${physicalId} ` + state + safeMsg` Before that write the pool held: ${heldText}. Put them back with ` + safeMsg`aws cognito-idp update-user-pool, sending the pool's complete configuration -- a ` + safeMsg`cdkd deploy will NOT restore them, because its recorded properties still match the template.`);
+		this.logger.error(mask(safeMsg`Cognito User Pool ${physicalId} ` + state + safeMsg` Before that write the pool held: ${heldText}. Put them back with ` + safeMsg`aws cognito-idp update-user-pool, sending the pool's complete configuration -- a ` + safeMsg`cdkd deploy will NOT restore them, because its recorded properties still match the template.`));
 	}
 	async deleteOnce(logicalId, physicalId, resourceType, context, flip) {
 		this.logger.debug(`Deleting Cognito User Pool ${logicalId}: ${physicalId}`);
@@ -34397,7 +35064,7 @@ var CognitoUserPoolProvider = class {
 			if (observedOn && isAmbiguousWriteFailure(echoError)) flip.flippedOffByThisRun = true;
 			if (isTransientCognitoFailure(echoError)) throw echoError;
 			if (!isRefusedEcho(echoError)) {
-				this.warnGuardLeftOn(physicalId, mask, echoError);
+				this.warnGuardLeftOn(physicalId, pool, mask, echoError);
 				throw echoError;
 			}
 			try {
@@ -34415,10 +35082,10 @@ var CognitoUserPoolProvider = class {
 					});
 				}
 				if (isTransientCognitoFailure(bareError)) {
-					if (isAmbiguousWriteFailure(bareError)) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool with DeletionProtection alone ` + safeMsg`(the pool's own configuration was refused) answered ${mask(describeAwsFailure(bareError).summary)}; ` + safeMsg`if that write landed, the pool's self sign-up, Lambda triggers and advanced ` + safeMsg`security were reset. Retrying the delete.`);
+					if (isAmbiguousWriteFailure(bareError)) this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool with DeletionProtection alone ` + safeMsg`(the pool's own configuration was refused) answered ${mask(describeAwsFailure(bareError).summary)}; ` + safeMsg`if that write landed, the pool's ${bareFlipResets(pool)} were reset. Retrying the delete.`);
 					throw bareError;
 				}
-				this.warnGuardLeftOn(physicalId, mask, bareError, echoError);
+				this.warnGuardLeftOn(physicalId, pool, mask, bareError, echoError);
 				throw bareError;
 			}
 			const kept = this.preFlipPools.get(flip);
@@ -34431,16 +35098,16 @@ var CognitoUserPoolProvider = class {
 				kept.echoedSince = false;
 			}
 			this.logger.debug(mask(safeMsg`UpdateUserPool refused the echoed configuration of ${mask(physicalId)}: ${mask(describeAwsFailure(echoError).detail)}`));
-			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the pool's own configuration ` + safeMsg`echoed back (${mask(describeAwsFailure(echoError).summary)}), so DeletionProtection was ` + safeMsg`turned off alone. That write resets the settings it omits -- self sign-up, Lambda ` + safeMsg`triggers and advanced security among them -- which stays that way if the delete fails.`);
+			this.logger.warn(safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool refused the pool's own configuration ` + safeMsg`echoed back (${mask(describeAwsFailure(echoError).summary)}), so DeletionProtection was ` + safeMsg`turned off alone. That write resets the settings it omits -- ${bareFlipResets(pool)} ` + safeMsg`among them -- which stays that way if the delete fails.`);
 		}
 	}
-	warnGuardLeftOn(physicalId, mask, error, echoError) {
+	warnGuardLeftOn(physicalId, pool, mask, error, echoError) {
 		const name = typeof error === "object" && error !== null ? safeStringify(error.name) : "";
 		const accessHint = /AccessDenied|NotAuthorized|Unauthorized/.test(name) ? " The caller needs cognito-idp:UpdateUserPool." : "";
 		const echoClause = echoError === void 0 ? "" : safeMsg`; the pool's own settings sent back were refused first (${mask(describeAwsFailure(echoError).summary)})`;
 		this.logger.debug(mask(safeMsg`UpdateUserPool did not turn DeletionProtection off on ${mask(physicalId)}: ${mask(describeAwsFailure(error).detail)}`));
 		const refused = error instanceof Error && isAwsAuthoredFailure(error);
-		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${mask(describeAwsFailure(error).summary)})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${mask(describeAwsFailure(error).summary)})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's self sign-up, Lambda triggers and advanced security were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
+		this.logger.warn(refused ? safeMsg`Cognito User Pool ${physicalId}: DeletionProtection was left on, because UpdateUserPool ` + safeMsg`refused to turn it off (${mask(describeAwsFailure(error).summary)})` + echoClause + safeMsg`. The delete will be refused while it is on.${accessHint}` : safeMsg`Cognito User Pool ${physicalId}: UpdateUserPool failed without an answer from AWS ` + safeMsg`(${mask(describeAwsFailure(error).summary)})` + echoClause + (echoError === void 0 ? typeof error === "object" && error !== null && sentWithoutEmail.has(error) ? safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset, except the SES EmailConfiguration, which that write omitted: if it ` + safeMsg`landed, the pool's email configuration was ${EMAIL_RESET_BEFORE_DELETE_CLAUSE}` : safeMsg`, so whether DeletionProtection was turned off is unknown. Its other settings were ` + safeMsg`not reset.` : safeMsg`, so whether DeletionProtection was turned off ALONE is unknown; if it was, the ` + safeMsg`pool's ${bareFlipResets(pool)} were reset.`) + safeMsg` If the delete then fails, cdkd turns the guard back on. Check the pool with ` + safeMsg`aws cognito-idp describe-user-pool.`);
 	}
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::Cognito::UserPool") return void 0;
@@ -34482,6 +35149,8 @@ var CognitoUserPoolProvider = class {
 		}
 		result["UserPoolTags"] = userTags;
 		result["UserPoolTier"] = pool.UserPoolTier ?? "ESSENTIALS";
+		if (pool.KeyConfiguration) result["KeyConfiguration"] = pool.KeyConfiguration;
+		if (pool.IssuerConfiguration) result["IssuerConfiguration"] = pool.IssuerConfiguration;
 		try {
 			const mfa = await this.getClient().send(new GetUserPoolMfaConfigCommand({ UserPoolId: physicalId }));
 			const enabledMfas = [];
@@ -35753,11 +36422,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			if (hasTagChange) {
 				const arn = knownArn ?? (await client.send(new GetServiceCommand({ Id: physicalId }))).Service?.Arn;
 				if (!arn) throw new ProvisioningError(safeMsg`Could not resolve the ARN of service discovery service ${logicalId}; its Tags were not updated`, resourceType, logicalId, physicalId);
-				if (tagPlan.remove.length > 0) await client.send(new UntagResourceCommand$18({
+				if (tagPlan.remove.length > 0) await client.send(new UntagResourceCommand$19({
 					ResourceARN: arn,
 					TagKeys: tagPlan.remove
 				}));
-				if (tagPlan.set.size > 0) await client.send(new TagResourceCommand$17({
+				if (tagPlan.set.size > 0) await client.send(new TagResourceCommand$18({
 					ResourceARN: arn,
 					Tags: [...tagPlan.set].map(([Key, Value]) => ({
 						Key,
@@ -35873,11 +36542,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const hasAdds = tagsToAdd.length > 0;
 		if (removedKeys.length === 0 && !hasAdds) return;
 		const arn = await this.resolveNamespaceArn(physicalId);
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$19({
 			ResourceARN: arn,
 			TagKeys: removedKeys
 		}));
-		if (hasAdds) await this.getClient().send(new TagResourceCommand$17({
+		if (hasAdds) await this.getClient().send(new TagResourceCommand$18({
 			ResourceARN: arn,
 			Tags: tagsToAdd
 		}));
@@ -36050,7 +36719,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 	async attachTags(result, arn) {
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${describeAwsFailure(err).detail}`);
@@ -36642,7 +37311,7 @@ var AppSyncProvider = class {
 		const tagKeysToRemove = plan.remove;
 		const tagsToAdd = Object.fromEntries(plan.set);
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$19({
+			await this.getClient().send(new UntagResourceCommand$20({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -36650,7 +37319,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)", mask);
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$18({
+			await this.getClient().send(new TagResourceCommand$19({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -39345,11 +40014,11 @@ async function applyGlueTagDiff(client, resourceArn, recorded, desired, resource
 	if (toSet.size === 0 && plan.remove.length === 0) return;
 	unsettled.beforeWrite();
 	const arn = await resourceArn();
-	if (toSet.size > 0) await client.send(new TagResourceCommand$19({
+	if (toSet.size > 0) await client.send(new TagResourceCommand$20({
 		ResourceArn: arn,
 		TagsToAdd: Object.fromEntries(toSet)
 	}));
-	if (plan.remove.length > 0) await client.send(new UntagResourceCommand$20({
+	if (plan.remove.length > 0) await client.send(new UntagResourceCommand$21({
 		ResourceArn: arn,
 		TagsToRemove: plan.remove
 	}));
@@ -41131,7 +41800,7 @@ var BudgetsBudgetProvider = class {
 			const newTags = this.toSdkResourceTags(next.ResourceTags);
 			if (prevTags.kind === "list") await this.reconcileResourceTags(accountId, physicalId, this.toSdkResourceTags(removableRecorded("ResourceTags", prevTags.items)), newTags);
 			else {
-				if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$20({
+				if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$21({
 					ResourceARN: await this.budgetArn(accountId, physicalId),
 					ResourceTags: newTags
 				}));
@@ -41275,11 +41944,11 @@ var BudgetsBudgetProvider = class {
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
 		});
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$21({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$22({
 			ResourceARN: arn,
 			ResourceTagKeys: removedKeys
 		}));
-		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$20({
+		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$21({
 			ResourceARN: arn,
 			ResourceTags: newTags
 		}));
@@ -41359,7 +42028,7 @@ var BudgetsBudgetProvider = class {
 		}));
 		let tags;
 		try {
-			tags = await client.send(new ListTagsForResourceCommand$15({ ResourceARN: await this.budgetArn(accountId, physicalId) }));
+			tags = await client.send(new ListTagsForResourceCommand$16({ ResourceARN: await this.budgetArn(accountId, physicalId) }));
 		} catch (error) {
 			if (error instanceof NotFoundException$5 && await describe() === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
 			throw error;
@@ -42337,7 +43006,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: physicalId }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return RESOURCE_NOT_FOUND;
@@ -42354,14 +43023,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToAdd = Object.fromEntries(plan.set);
 		const tagsToRemove = plan.remove;
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$22({
+			await this.getClient().send(new UntagResourceCommand$23({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(mask(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`));
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$21({
+			await this.getClient().send(new TagResourceCommand$22({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -43168,11 +43837,11 @@ var PipesPipeProvider = class {
 				settled ??= await this.describe(physicalId);
 				const arn = settled.Arn;
 				if (!arn) throw new Error("DescribePipe returned no Arn, which tagging needs");
-				if (plan.remove.length > 0) await this.getClient().send(new UntagResourceCommand$23({
+				if (plan.remove.length > 0) await this.getClient().send(new UntagResourceCommand$24({
 					resourceArn: arn,
 					tagKeys: plan.remove
 				}));
-				if (plan.set.size > 0) await this.getClient().send(new TagResourceCommand$22({
+				if (plan.set.size > 0) await this.getClient().send(new TagResourceCommand$23({
 					resourceArn: arn,
 					tags: Object.fromEntries(plan.set)
 				}));
@@ -43599,11 +44268,11 @@ var EFSProvider = class {
 		const plan = planTagDiff(recorded, desired);
 		const warning = tagPlanWarning(plan, resourceType, logicalId);
 		if (warning !== void 0) log.warn(warning);
-		if (plan.remove.length > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new UntagResourceCommand$24({
+		if (plan.remove.length > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new UntagResourceCommand$25({
 			ResourceId: resourceId,
 			TagKeys: plan.remove
 		})), `UntagResource ${resourceId}`, log);
-		if (plan.set.size > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new TagResourceCommand$23({
+		if (plan.set.size > 0) await this.retryOnTransientControlPlane(() => this.getClient().send(new TagResourceCommand$24({
 			ResourceId: resourceId,
 			Tags: [...plan.set].map(([Key, Value]) => ({
 				Key,
@@ -45191,11 +45860,11 @@ var FSxFileSystemProvider = class {
 			Value
 		}));
 		const toRemove = plan.remove;
-		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$24({
+		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$25({
 			ResourceARN: arn,
 			Tags: toSet
 		}));
-		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$25({
+		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$26({
 			ResourceARN: arn,
 			TagKeys: toRemove
 		}));
@@ -47429,6 +48098,7 @@ var FirehoseProvider = class {
 		"S3DestinationConfiguration",
 		"ExtendedS3DestinationConfiguration",
 		"KinesisStreamSourceConfiguration",
+		"DirectPutSourceConfiguration",
 		"Tags",
 		"HttpEndpointDestinationConfiguration",
 		"RedshiftDestinationConfiguration",
@@ -47481,6 +48151,7 @@ var FirehoseProvider = class {
 					RoleARN: kinesisConfig["RoleArn"] || kinesisConfig["RoleARN"]
 				};
 			}
+			if (properties["DirectPutSourceConfiguration"] !== void 0) input.DirectPutSourceConfiguration = { ThroughputHintInMBs: properties["DirectPutSourceConfiguration"]["ThroughputHintInMBs"] };
 			if (properties["HttpEndpointDestinationConfiguration"]) {
 				const httpConfig = properties["HttpEndpointDestinationConfiguration"];
 				const endpointConfig = httpConfig["EndpointConfiguration"];
@@ -48267,6 +48938,8 @@ var FirehoseProvider = class {
 			if (src.RoleARN !== void 0) srcOut["RoleARN"] = src.RoleARN;
 			if (Object.keys(srcOut).length > 0) result["KinesisStreamSourceConfiguration"] = srcOut;
 		}
+		const directPut = desc.Source?.DirectPutSourceDescription;
+		if (directPut?.ThroughputHintInMBs !== void 0) result["DirectPutSourceConfiguration"] = { ThroughputHintInMBs: directPut.ThroughputHintInMBs };
 		const dest = desc.Destinations?.[0];
 		if (dest?.ExtendedS3DestinationDescription) result["ExtendedS3DestinationConfiguration"] = mapExtendedS3DescriptionToCfn(dest.ExtendedS3DestinationDescription);
 		else if (dest?.S3DestinationDescription) result["S3DestinationConfiguration"] = mapS3DescriptionToCfn(dest.S3DestinationDescription);
@@ -49786,11 +50459,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !Object.hasOwn(newTagMap, k));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$26({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$27({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$25({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$26({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -49987,7 +50660,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: metadata.Arn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }));
 			tags = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return RESOURCE_NOT_FOUND;
@@ -50262,7 +50935,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = plan.remove;
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$27({
+					await this.getClient().send(new UntagResourceCommand$28({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -50270,7 +50943,7 @@ var DLMLifecyclePolicyProvider = class {
 				}
 				const tagsToAdd = Object.fromEntries(plan.set);
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$26({
+					await this.getClient().send(new TagResourceCommand$27({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -50434,11 +51107,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${mask(physicalId)}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$27({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$28({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$28({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$29({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -50540,7 +51213,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }));
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${describeAwsFailure(err).detail}`);
@@ -51218,7 +51891,7 @@ var S3DirectoryBucketProvider = class {
 				const resourceArn = await this.buildBucketArn(physicalId, accountId);
 				if (removedKeys.length > 0) {
 					context?.markUnsettled?.("Tags");
-					await this.getS3ControlClient().send(new UntagResourceCommand$29({
+					await this.getS3ControlClient().send(new UntagResourceCommand$13({
 						AccountId: accountId,
 						ResourceArn: resourceArn,
 						TagKeys: removedKeys
@@ -51226,7 +51899,7 @@ var S3DirectoryBucketProvider = class {
 				}
 				if (tagsToApply.length > 0) {
 					context?.markUnsettled?.("Tags");
-					await this.getS3ControlClient().send(new TagResourceCommand$28({
+					await this.getS3ControlClient().send(new TagResourceCommand$13({
 						AccountId: accountId,
 						ResourceArn: resourceArn,
 						Tags: tagsToApply
@@ -51381,7 +52054,7 @@ var S3DirectoryBucketProvider = class {
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
-		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$19({
+		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$11({
 			AccountId: accountId,
 			ResourceArn: resourceArn
 		}));
@@ -53734,4 +54407,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DefoNqY7.js.map
+//# sourceMappingURL=provider-classes-B8kkAZqJ.js.map