@go-to-k/cdkd 0.49.0 → 0.50.1

package/dist/cli.js

@@ -9130,9 +9130,7 @@ var IAMRoleProvider = class {
     const result = {};
     if (role.RoleName !== void 0)
       result["RoleName"] = role.RoleName;
-    if (role.Description !== void 0 && role.Description !== "") {
-      result["Description"] = role.Description;
-    }
+    result["Description"] = role.Description ?? "";
     if (role.MaxSessionDuration !== void 0) {
       result["MaxSessionDuration"] = role.MaxSessionDuration;
     }
@@ -9155,8 +9153,7 @@ var IAMRoleProvider = class {
         new ListAttachedRolePoliciesCommand({ RoleName: physicalId })
       );
       const arns = (attached.AttachedPolicies ?? []).map((p) => p.PolicyArn).filter((arn) => !!arn);
-      if (arns.length > 0)
-        result["ManagedPolicyArns"] = arns;
+      result["ManagedPolicyArns"] = arns;
     } catch (err) {
       if (!(err instanceof NoSuchEntityException))
         throw err;
@@ -9962,8 +9959,7 @@ var IAMInstanceProfileProvider = class {
     if (profile.Path !== void 0)
       result["Path"] = profile.Path;
     const roleNames = (profile.Roles ?? []).map((r) => r.RoleName).filter((n) => !!n);
-    if (roleNames.length > 0)
-      result["Roles"] = roleNames;
+    result["Roles"] = roleNames;
     return result;
   }
   /**
@@ -11086,8 +11082,7 @@ var IAMUserGroupProvider = class {
         new ListAttachedUserPoliciesCommand({ UserName: physicalId })
       );
       const arns = (attached.AttachedPolicies ?? []).map((p) => p.PolicyArn).filter((arn) => !!arn);
-      if (arns.length > 0)
-        result["ManagedPolicyArns"] = arns;
+      result["ManagedPolicyArns"] = arns;
     } catch (err) {
       if (!(err instanceof NoSuchEntityException4))
         throw err;
@@ -11097,8 +11092,7 @@ var IAMUserGroupProvider = class {
         new ListGroupsForUserCommand({ UserName: physicalId })
       );
       const names = (groups.Groups ?? []).map((g) => g.GroupName).filter((n) => !!n);
-      if (names.length > 0)
-        result["Groups"] = names;
+      result["Groups"] = names;
     } catch (err) {
       if (!(err instanceof NoSuchEntityException4))
         throw err;
@@ -11127,8 +11121,7 @@ var IAMUserGroupProvider = class {
         new ListAttachedGroupPoliciesCommand({ GroupName: physicalId })
       );
       const arns = (attached.AttachedPolicies ?? []).map((p) => p.PolicyArn).filter((arn) => !!arn);
-      if (arns.length > 0)
-        result["ManagedPolicyArns"] = arns;
+      result["ManagedPolicyArns"] = arns;
     } catch (err) {
       if (!(err instanceof NoSuchEntityException4))
         throw err;
@@ -12143,35 +12136,33 @@ var S3BucketProvider = class {
     };
     {
       const resp = await this.s3Client.send(new GetBucketVersioningCommand({ Bucket: physicalId }));
-      if (resp.Status) {
-        result["VersioningConfiguration"] = { Status: resp.Status };
-      }
+      result["VersioningConfiguration"] = { Status: resp.Status ?? "Suspended" };
     }
     try {
       const resp = await this.s3Client.send(new GetBucketEncryptionCommand({ Bucket: physicalId }));
-      const rules = resp.ServerSideEncryptionConfiguration?.Rules;
-      if (rules && rules.length > 0) {
-        result["BucketEncryption"] = {
-          ServerSideEncryptionConfiguration: rules.map((rule) => {
-            const out = {};
-            const sse = rule.ApplyServerSideEncryptionByDefault;
-            if (sse) {
-              const sseOut = {};
-              if (sse.SSEAlgorithm !== void 0)
-                sseOut["SSEAlgorithm"] = sse.SSEAlgorithm;
-              if (sse.KMSMasterKeyID !== void 0)
-                sseOut["KMSMasterKeyID"] = sse.KMSMasterKeyID;
-              out["ServerSideEncryptionByDefault"] = sseOut;
-            }
-            if (rule.BucketKeyEnabled !== void 0)
-              out["BucketKeyEnabled"] = rule.BucketKeyEnabled;
-            return out;
-          })
-        };
-      }
+      const rules = resp.ServerSideEncryptionConfiguration?.Rules ?? [];
+      result["BucketEncryption"] = {
+        ServerSideEncryptionConfiguration: rules.map((rule) => {
+          const out = {};
+          const sse = rule.ApplyServerSideEncryptionByDefault;
+          if (sse) {
+            const sseOut = {};
+            if (sse.SSEAlgorithm !== void 0)
+              sseOut["SSEAlgorithm"] = sse.SSEAlgorithm;
+            if (sse.KMSMasterKeyID !== void 0)
+              sseOut["KMSMasterKeyID"] = sse.KMSMasterKeyID;
+            out["ServerSideEncryptionByDefault"] = sseOut;
+          }
+          if (rule.BucketKeyEnabled !== void 0)
+            out["BucketKeyEnabled"] = rule.BucketKeyEnabled;
+          return out;
+        })
+      };
     } catch (err) {
       const e = err;
-      if (e.name !== "ServerSideEncryptionConfigurationNotFoundError") {
+      if (e.name === "ServerSideEncryptionConfigurationNotFoundError") {
+        result["BucketEncryption"] = { ServerSideEncryptionConfiguration: [] };
+      } else {
         throw err;
       }
     }
@@ -12180,24 +12171,22 @@ var S3BucketProvider = class {
         new GetPublicAccessBlockCommand({ Bucket: physicalId })
       );
       const cfg = resp.PublicAccessBlockConfiguration;
-      if (cfg) {
-        const out = {};
-        if (cfg.BlockPublicAcls !== void 0)
-          out["BlockPublicAcls"] = cfg.BlockPublicAcls;
-        if (cfg.BlockPublicPolicy !== void 0)
-          out["BlockPublicPolicy"] = cfg.BlockPublicPolicy;
-        if (cfg.IgnorePublicAcls !== void 0)
-          out["IgnorePublicAcls"] = cfg.IgnorePublicAcls;
-        if (cfg.RestrictPublicBuckets !== void 0) {
-          out["RestrictPublicBuckets"] = cfg.RestrictPublicBuckets;
-        }
-        if (Object.keys(out).length > 0) {
-          result["PublicAccessBlockConfiguration"] = out;
-        }
-      }
+      result["PublicAccessBlockConfiguration"] = {
+        BlockPublicAcls: cfg?.BlockPublicAcls ?? false,
+        BlockPublicPolicy: cfg?.BlockPublicPolicy ?? false,
+        IgnorePublicAcls: cfg?.IgnorePublicAcls ?? false,
+        RestrictPublicBuckets: cfg?.RestrictPublicBuckets ?? false
+      };
     } catch (err) {
       const e = err;
-      if (e.name !== "NoSuchPublicAccessBlockConfiguration") {
+      if (e.name === "NoSuchPublicAccessBlockConfiguration") {
+        result["PublicAccessBlockConfiguration"] = {
+          BlockPublicAcls: false,
+          BlockPublicPolicy: false,
+          IgnorePublicAcls: false,
+          RestrictPublicBuckets: false
+        };
+      } else {
         throw err;
       }
     }
@@ -12874,9 +12863,7 @@ var SQSQueueProvider = class {
       "FifoThroughputLimit"
     ];
     for (const key of str) {
-      const v = attributes[key];
-      if (v !== void 0)
-        result[key] = v;
+      result[key] = attributes[key] ?? "";
     }
     if (attributes["RedrivePolicy"]) {
       try {
@@ -12884,6 +12871,8 @@ var SQSQueueProvider = class {
       } catch {
         result["RedrivePolicy"] = attributes["RedrivePolicy"];
       }
+    } else {
+      result["RedrivePolicy"] = {};
     }
     try {
       const tagsResp = await this.sqsClient.send(
@@ -13563,9 +13552,7 @@ var SNSTopicProvider = class {
       "FifoThroughputScope"
     ];
     for (const key of str) {
-      const v = attrs[key];
-      if (v !== void 0 && v !== "")
-        result[key] = v;
+      result[key] = attrs[key] ?? "";
     }
     for (const key of ["ArchivePolicy", "DataProtectionPolicy"]) {
       const v = attrs[key];
@@ -14834,39 +14821,24 @@ var LambdaFunctionProvider = class {
         result["Timeout"] = cfg.Timeout;
       if (cfg.MemorySize !== void 0)
         result["MemorySize"] = cfg.MemorySize;
-      if (cfg.Description !== void 0 && cfg.Description !== "") {
-        result["Description"] = cfg.Description;
-      }
-      if (cfg.Environment?.Variables) {
-        result["Environment"] = { Variables: cfg.Environment.Variables };
-      }
-      if (cfg.Layers && cfg.Layers.length > 0) {
-        result["Layers"] = cfg.Layers.map((l) => l.Arn).filter((arn) => !!arn);
-      }
-      if (cfg.Architectures && cfg.Architectures.length > 0) {
-        result["Architectures"] = [...cfg.Architectures];
-      }
+      result["Description"] = cfg.Description ?? "";
+      result["Environment"] = { Variables: cfg.Environment?.Variables ?? {} };
+      result["Layers"] = (cfg.Layers ?? []).map((l) => l.Arn).filter((arn) => !!arn);
+      result["Architectures"] = cfg.Architectures ? [...cfg.Architectures] : [];
       if (cfg.PackageType !== void 0)
         result["PackageType"] = cfg.PackageType;
-      if (cfg.TracingConfig?.Mode !== void 0) {
-        result["TracingConfig"] = { Mode: cfg.TracingConfig.Mode };
-      }
+      result["TracingConfig"] = { Mode: cfg.TracingConfig?.Mode ?? "PassThrough" };
       if (cfg.EphemeralStorage?.Size !== void 0) {
         result["EphemeralStorage"] = { Size: cfg.EphemeralStorage.Size };
       }
-      if (cfg.VpcConfig) {
-        const vpc = {};
-        if (cfg.VpcConfig.SubnetIds)
-          vpc["SubnetIds"] = [...cfg.VpcConfig.SubnetIds];
-        if (cfg.VpcConfig.SecurityGroupIds) {
-          vpc["SecurityGroupIds"] = [...cfg.VpcConfig.SecurityGroupIds];
-        }
-        if (cfg.VpcConfig.Ipv6AllowedForDualStack !== void 0) {
-          vpc["Ipv6AllowedForDualStack"] = cfg.VpcConfig.Ipv6AllowedForDualStack;
-        }
-        if (Object.keys(vpc).length > 0)
-          result["VpcConfig"] = vpc;
+      const vpc = {
+        SubnetIds: cfg.VpcConfig?.SubnetIds ? [...cfg.VpcConfig.SubnetIds] : [],
+        SecurityGroupIds: cfg.VpcConfig?.SecurityGroupIds ? [...cfg.VpcConfig.SecurityGroupIds] : []
+      };
+      if (cfg.VpcConfig?.Ipv6AllowedForDualStack !== void 0) {
+        vpc["Ipv6AllowedForDualStack"] = cfg.VpcConfig.Ipv6AllowedForDualStack;
       }
+      result["VpcConfig"] = vpc;
       const tags = normalizeAwsTagsToCfn(resp.Tags);
       result["Tags"] = tags;
       return result;
@@ -15439,24 +15411,18 @@ var LambdaUrlProvider = class {
       result["AuthType"] = resp.AuthType;
     if (resp.InvokeMode !== void 0)
       result["InvokeMode"] = resp.InvokeMode;
-    if (resp.Cors !== void 0) {
-      const cors = {};
-      if (resp.Cors.AllowOrigins)
-        cors["AllowOrigins"] = [...resp.Cors.AllowOrigins];
-      if (resp.Cors.AllowMethods)
-        cors["AllowMethods"] = [...resp.Cors.AllowMethods];
-      if (resp.Cors.AllowHeaders)
-        cors["AllowHeaders"] = [...resp.Cors.AllowHeaders];
-      if (resp.Cors.ExposeHeaders)
-        cors["ExposeHeaders"] = [...resp.Cors.ExposeHeaders];
-      if (resp.Cors.MaxAge !== void 0)
-        cors["MaxAge"] = resp.Cors.MaxAge;
-      if (resp.Cors.AllowCredentials !== void 0) {
-        cors["AllowCredentials"] = resp.Cors.AllowCredentials;
-      }
-      if (Object.keys(cors).length > 0)
-        result["Cors"] = cors;
+    const cors = {
+      AllowOrigins: resp.Cors?.AllowOrigins ? [...resp.Cors.AllowOrigins] : [],
+      AllowMethods: resp.Cors?.AllowMethods ? [...resp.Cors.AllowMethods] : [],
+      AllowHeaders: resp.Cors?.AllowHeaders ? [...resp.Cors.AllowHeaders] : [],
+      ExposeHeaders: resp.Cors?.ExposeHeaders ? [...resp.Cors.ExposeHeaders] : []
+    };
+    if (resp.Cors?.MaxAge !== void 0)
+      cors["MaxAge"] = resp.Cors.MaxAge;
+    if (resp.Cors?.AllowCredentials !== void 0) {
+      cors["AllowCredentials"] = resp.Cors.AllowCredentials;
     }
+    result["Cors"] = cors;
     return result;
   }
   /**
@@ -15785,12 +15751,8 @@ var LambdaEventSourceMappingProvider = class {
     if (resp.TumblingWindowInSeconds !== void 0) {
       result["TumblingWindowInSeconds"] = resp.TumblingWindowInSeconds;
     }
-    if (resp.FunctionResponseTypes !== void 0 && resp.FunctionResponseTypes.length > 0) {
-      result["FunctionResponseTypes"] = [...resp.FunctionResponseTypes];
-    }
-    if (resp.SourceAccessConfigurations !== void 0 && resp.SourceAccessConfigurations.length > 0) {
-      result["SourceAccessConfigurations"] = resp.SourceAccessConfigurations;
-    }
+    result["FunctionResponseTypes"] = resp.FunctionResponseTypes ? [...resp.FunctionResponseTypes] : [];
+    result["SourceAccessConfigurations"] = resp.SourceAccessConfigurations ?? [];
     if (resp.SelfManagedEventSource !== void 0) {
       result["SelfManagedEventSource"] = resp.SelfManagedEventSource;
     }
@@ -16410,24 +16372,17 @@ var DynamoDBTableProvider = class {
           StreamViewType: table.StreamSpecification.StreamViewType
         };
       }
-      if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
-        result["GlobalSecondaryIndexes"] = table.GlobalSecondaryIndexes;
-      }
-      if (table.LocalSecondaryIndexes && table.LocalSecondaryIndexes.length > 0) {
-        result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes;
-      }
-      if (table.SSEDescription) {
-        const sse = {};
-        if (table.SSEDescription.Status === "ENABLED")
-          sse["SSEEnabled"] = true;
-        if (table.SSEDescription.KMSMasterKeyArn !== void 0) {
-          sse["KMSMasterKeyId"] = table.SSEDescription.KMSMasterKeyArn;
-        }
-        if (table.SSEDescription.SSEType !== void 0)
-          sse["SSEType"] = table.SSEDescription.SSEType;
-        if (Object.keys(sse).length > 0)
-          result["SSESpecification"] = sse;
+      result["GlobalSecondaryIndexes"] = table.GlobalSecondaryIndexes ?? [];
+      result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes ?? [];
+      const sse = {
+        SSEEnabled: table.SSEDescription?.Status === "ENABLED"
+      };
+      if (table.SSEDescription?.KMSMasterKeyArn !== void 0) {
+        sse["KMSMasterKeyId"] = table.SSEDescription.KMSMasterKeyArn;
       }
+      if (table.SSEDescription?.SSEType !== void 0)
+        sse["SSEType"] = table.SSEDescription.SSEType;
+      result["SSESpecification"] = sse;
       if (table.DeletionProtectionEnabled !== void 0) {
         result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
       }
@@ -16791,8 +16746,7 @@ var LogsLogGroupProvider = class {
       const result = {};
       if (found.logGroupName !== void 0)
         result["LogGroupName"] = found.logGroupName;
-      if (found.kmsKeyId !== void 0)
-        result["KmsKeyId"] = found.kmsKeyId;
+      result["KmsKeyId"] = found.kmsKeyId ?? "";
       if (found.retentionInDays !== void 0) {
         result["RetentionInDays"] = found.retentionInDays;
       }
@@ -17545,21 +17499,16 @@ var SecretsManagerSecretProvider = class {
       const result = {};
       if (resp.Name !== void 0)
         result["Name"] = resp.Name;
-      if (resp.Description !== void 0 && resp.Description !== "") {
-        result["Description"] = resp.Description;
-      }
-      if (resp.KmsKeyId !== void 0)
-        result["KmsKeyId"] = resp.KmsKeyId;
-      if (resp.ReplicationStatus && resp.ReplicationStatus.length > 0) {
-        result["ReplicaRegions"] = resp.ReplicationStatus.map((r) => {
-          const out = {};
-          if (r.Region)
-            out["Region"] = r.Region;
-          if (r.KmsKeyId)
-            out["KmsKeyId"] = r.KmsKeyId;
-          return out;
-        });
-      }
+      result["Description"] = resp.Description ?? "";
+      result["KmsKeyId"] = resp.KmsKeyId ?? "";
+      result["ReplicaRegions"] = (resp.ReplicationStatus ?? []).map((r) => {
+        const out = {};
+        if (r.Region)
+          out["Region"] = r.Region;
+        if (r.KmsKeyId)
+          out["KmsKeyId"] = r.KmsKeyId;
+        return out;
+      });
       const tags = normalizeAwsTagsToCfn(resp.Tags);
       result["Tags"] = tags;
       return result;
@@ -17902,16 +17851,10 @@ var SSMParameterProvider = class {
         })
       );
       const meta = desc.Parameters?.[0];
-      if (meta) {
-        if (meta.Description !== void 0 && meta.Description !== "") {
-          result["Description"] = meta.Description;
-        }
-        if (meta.AllowedPattern !== void 0 && meta.AllowedPattern !== "") {
-          result["AllowedPattern"] = meta.AllowedPattern;
-        }
-        if (meta.Tier !== void 0) {
-          result["Tier"] = meta.Tier;
-        }
+      result["Description"] = meta?.Description ?? "";
+      result["AllowedPattern"] = meta?.AllowedPattern ?? "";
+      if (meta?.Tier !== void 0) {
+        result["Tier"] = meta.Tier;
       }
     } catch {
     }
@@ -18295,9 +18238,7 @@ var EventBridgeRuleProvider = class {
     const result = {};
     if (resp.Name !== void 0)
       result["Name"] = resp.Name;
-    if (resp.Description !== void 0 && resp.Description !== "") {
-      result["Description"] = resp.Description;
-    }
+    result["Description"] = resp.Description ?? "";
     if (resp.EventBusName !== void 0 && resp.EventBusName !== "default") {
       result["EventBusName"] = resp.EventBusName;
     }
@@ -18322,9 +18263,7 @@ var EventBridgeRuleProvider = class {
           ...eventBusName && eventBusName !== "default" ? { EventBusName: eventBusName } : {}
         })
       );
-      if (targetsResp.Targets && targetsResp.Targets.length > 0) {
-        result["Targets"] = targetsResp.Targets;
-      }
+      result["Targets"] = targetsResp.Targets ?? [];
     } catch (err) {
       if (!(err instanceof ResourceNotFoundException9)) {
         throw err;
@@ -18729,15 +18668,9 @@ var EventBridgeBusProvider = class {
       const result = {};
       if (resp.Name !== void 0)
         result["Name"] = resp.Name;
-      if (resp.Description !== void 0 && resp.Description !== "") {
-        result["Description"] = resp.Description;
-      }
-      if (resp.KmsKeyIdentifier !== void 0) {
-        result["KmsKeyIdentifier"] = resp.KmsKeyIdentifier;
-      }
-      if (resp.DeadLetterConfig?.Arn) {
-        result["DeadLetterConfig"] = { Arn: resp.DeadLetterConfig.Arn };
-      }
+      result["Description"] = resp.Description ?? "";
+      result["KmsKeyIdentifier"] = resp.KmsKeyIdentifier ?? "";
+      result["DeadLetterConfig"] = { Arn: resp.DeadLetterConfig?.Arn ?? "" };
       if (resp.Policy) {
         try {
           result["Policy"] = JSON.parse(resp.Policy);
@@ -24259,9 +24192,7 @@ var AgentCoreRuntimeProvider = class {
     if (resp.networkConfiguration !== void 0) {
       result["NetworkConfiguration"] = camelToPascalCaseKeys(resp.networkConfiguration);
     }
-    if (resp.description !== void 0 && resp.description !== "") {
-      result["Description"] = resp.description;
-    }
+    result["Description"] = resp.description ?? "";
     if (resp.authorizerConfiguration !== void 0) {
       result["AuthorizerConfiguration"] = camelToPascalCaseKeys(resp.authorizerConfiguration);
     }
@@ -24539,15 +24470,15 @@ var StepFunctionsProvider = class {
         result["Definition"] = resp.definition;
       }
     }
-    if (resp.loggingConfiguration) {
+    {
       const lc = {};
-      if (resp.loggingConfiguration.level !== void 0) {
+      if (resp.loggingConfiguration?.level !== void 0) {
         lc["Level"] = resp.loggingConfiguration.level;
       }
-      if (resp.loggingConfiguration.includeExecutionData !== void 0) {
+      if (resp.loggingConfiguration?.includeExecutionData !== void 0) {
         lc["IncludeExecutionData"] = resp.loggingConfiguration.includeExecutionData;
       }
-      if (resp.loggingConfiguration.destinations) {
+      if (resp.loggingConfiguration?.destinations) {
         lc["Destinations"] = resp.loggingConfiguration.destinations.map((d) => {
           const inner = {};
           if (d.cloudWatchLogsLogGroup?.logGroupArn) {
@@ -24558,25 +24489,21 @@ var StepFunctionsProvider = class {
           return inner;
         });
       }
-      if (Object.keys(lc).length > 0)
-        result["LoggingConfiguration"] = lc;
-    }
-    if (resp.tracingConfiguration?.enabled !== void 0) {
-      result["TracingConfiguration"] = { Enabled: resp.tracingConfiguration.enabled };
+      result["LoggingConfiguration"] = lc;
     }
-    if (resp.encryptionConfiguration) {
+    result["TracingConfiguration"] = { Enabled: resp.tracingConfiguration?.enabled ?? false };
+    {
       const ec = {};
-      if (resp.encryptionConfiguration.type !== void 0) {
+      if (resp.encryptionConfiguration?.type !== void 0) {
         ec["Type"] = resp.encryptionConfiguration.type;
       }
-      if (resp.encryptionConfiguration.kmsKeyId !== void 0) {
+      if (resp.encryptionConfiguration?.kmsKeyId !== void 0) {
         ec["KmsKeyId"] = resp.encryptionConfiguration.kmsKeyId;
       }
-      if (resp.encryptionConfiguration.kmsDataKeyReusePeriodSeconds !== void 0) {
+      if (resp.encryptionConfiguration?.kmsDataKeyReusePeriodSeconds !== void 0) {
         ec["KmsDataKeyReusePeriodSeconds"] = resp.encryptionConfiguration.kmsDataKeyReusePeriodSeconds;
       }
-      if (Object.keys(ec).length > 0)
-        result["EncryptionConfiguration"] = ec;
+      result["EncryptionConfiguration"] = ec;
     }
     try {
       const tagsResp = await this.getClient().send(
@@ -25460,20 +25387,14 @@ var ECSProvider = class {
     if (!c || !c.clusterName)
       return void 0;
     const result = { ClusterName: c.clusterName };
-    if (c.capacityProviders && c.capacityProviders.length > 0) {
-      result["CapacityProviders"] = [...c.capacityProviders];
-    }
-    if (c.defaultCapacityProviderStrategy && c.defaultCapacityProviderStrategy.length > 0) {
-      result["DefaultCapacityProviderStrategy"] = c.defaultCapacityProviderStrategy;
-    }
+    result["CapacityProviders"] = c.capacityProviders ? [...c.capacityProviders] : [];
+    result["DefaultCapacityProviderStrategy"] = c.defaultCapacityProviderStrategy ?? [];
     if (c.configuration)
       result["Configuration"] = c.configuration;
-    if (c.settings && c.settings.length > 0) {
-      result["ClusterSettings"] = c.settings.map((s) => ({
-        Name: s.name,
-        Value: s.value
-      }));
-    }
+    result["ClusterSettings"] = (c.settings ?? []).map((s) => ({
+      Name: s.name,
+      Value: s.value
+    }));
     const tags = normalizeAwsTagsToCfn(c.tags);
     result["Tags"] = tags;
     return result;
@@ -25527,23 +25448,13 @@ var ECSProvider = class {
     }
     if (s.networkConfiguration)
       result["NetworkConfiguration"] = s.networkConfiguration;
-    if (s.loadBalancers && s.loadBalancers.length > 0) {
-      result["LoadBalancers"] = s.loadBalancers;
-    }
-    if (s.capacityProviderStrategy && s.capacityProviderStrategy.length > 0) {
-      result["CapacityProviderStrategy"] = s.capacityProviderStrategy;
-    }
+    result["LoadBalancers"] = s.loadBalancers ?? [];
+    result["CapacityProviderStrategy"] = s.capacityProviderStrategy ?? [];
     if (s.deploymentConfiguration)
       result["DeploymentConfiguration"] = s.deploymentConfiguration;
-    if (s.placementConstraints && s.placementConstraints.length > 0) {
-      result["PlacementConstraints"] = s.placementConstraints;
-    }
-    if (s.placementStrategy && s.placementStrategy.length > 0) {
-      result["PlacementStrategy"] = s.placementStrategy;
-    }
-    if (s.serviceRegistries && s.serviceRegistries.length > 0) {
-      result["ServiceRegistries"] = s.serviceRegistries;
-    }
+    result["PlacementConstraints"] = s.placementConstraints ?? [];
+    result["PlacementStrategy"] = s.placementStrategy ?? [];
+    result["ServiceRegistries"] = s.serviceRegistries ?? [];
     const tags = normalizeAwsTagsToCfn(s.tags);
     result["Tags"] = tags;
     return result;
@@ -25569,18 +25480,13 @@ var ECSProvider = class {
       result["Memory"] = td.memory;
     if (td.networkMode !== void 0)
       result["NetworkMode"] = td.networkMode;
-    if (td.requiresCompatibilities && td.requiresCompatibilities.length > 0) {
-      result["RequiresCompatibilities"] = [...td.requiresCompatibilities];
-    }
+    result["RequiresCompatibilities"] = td.requiresCompatibilities ? [...td.requiresCompatibilities] : [];
     if (td.executionRoleArn !== void 0)
       result["ExecutionRoleArn"] = td.executionRoleArn;
     if (td.taskRoleArn !== void 0)
       result["TaskRoleArn"] = td.taskRoleArn;
-    if (td.volumes && td.volumes.length > 0)
-      result["Volumes"] = td.volumes;
-    if (td.placementConstraints && td.placementConstraints.length > 0) {
-      result["PlacementConstraints"] = td.placementConstraints;
-    }
+    result["Volumes"] = td.volumes ?? [];
+    result["PlacementConstraints"] = td.placementConstraints ?? [];
     if (td.runtimePlatform)
       result["RuntimePlatform"] = td.runtimePlatform;
     if (td.proxyConfiguration)
@@ -25592,9 +25498,7 @@ var ECSProvider = class {
     if (td.ephemeralStorage?.sizeInGiB !== void 0) {
       result["EphemeralStorage"] = { SizeInGiB: td.ephemeralStorage.sizeInGiB };
     }
-    if (td.containerDefinitions && td.containerDefinitions.length > 0) {
-      result["ContainerDefinitions"] = td.containerDefinitions;
-    }
+    result["ContainerDefinitions"] = td.containerDefinitions ?? [];
     const tags = normalizeAwsTagsToCfn(resp.tags);
     result["Tags"] = tags;
     return result;
@@ -26260,16 +26164,9 @@ var ELBv2Provider = class {
     const result = {};
     if (lb.LoadBalancerName !== void 0)
       result["Name"] = lb.LoadBalancerName;
-    if (lb.AvailabilityZones && lb.AvailabilityZones.length > 0) {
-      const subnets = lb.AvailabilityZones.map((az) => az.SubnetId).filter(
-        (id) => !!id
-      );
-      if (subnets.length > 0)
-        result["Subnets"] = subnets;
-    }
-    if (lb.SecurityGroups && lb.SecurityGroups.length > 0) {
-      result["SecurityGroups"] = [...lb.SecurityGroups];
-    }
+    const subnets = (lb.AvailabilityZones ?? []).map((az) => az.SubnetId).filter((id) => !!id);
+    result["Subnets"] = subnets;
+    result["SecurityGroups"] = lb.SecurityGroups ? [...lb.SecurityGroups] : [];
     if (lb.Scheme !== void 0)
       result["Scheme"] = lb.Scheme;
     if (lb.Type !== void 0)
@@ -26326,15 +26223,12 @@ var ELBv2Provider = class {
     if (tg.UnhealthyThresholdCount !== void 0) {
       result["UnhealthyThresholdCount"] = tg.UnhealthyThresholdCount;
     }
-    if (tg.Matcher) {
-      const matcher = {};
-      if (tg.Matcher.HttpCode !== void 0)
-        matcher["HttpCode"] = tg.Matcher.HttpCode;
-      if (tg.Matcher.GrpcCode !== void 0)
-        matcher["GrpcCode"] = tg.Matcher.GrpcCode;
-      if (Object.keys(matcher).length > 0)
-        result["Matcher"] = matcher;
-    }
+    const matcher = {};
+    if (tg.Matcher?.HttpCode !== void 0)
+      matcher["HttpCode"] = tg.Matcher.HttpCode;
+    if (tg.Matcher?.GrpcCode !== void 0)
+      matcher["GrpcCode"] = tg.Matcher.GrpcCode;
+    result["Matcher"] = matcher;
     await this.attachTags(result, physicalId);
     return result;
   }
@@ -26362,21 +26256,17 @@ var ELBv2Provider = class {
       result["Protocol"] = listener.Protocol;
     if (listener.SslPolicy !== void 0)
       result["SslPolicy"] = listener.SslPolicy;
-    if (listener.Certificates && listener.Certificates.length > 0) {
-      result["Certificates"] = listener.Certificates.map((c) => {
-        const out = {};
-        if (c.CertificateArn !== void 0)
-          out["CertificateArn"] = c.CertificateArn;
-        if (c.IsDefault !== void 0)
-          out["IsDefault"] = c.IsDefault;
-        return out;
-      });
-    }
-    if (listener.DefaultActions && listener.DefaultActions.length > 0) {
-      result["DefaultActions"] = listener.DefaultActions.map(
-        (a) => a
-      );
-    }
+    result["Certificates"] = (listener.Certificates ?? []).map((c) => {
+      const out = {};
+      if (c.CertificateArn !== void 0)
+        out["CertificateArn"] = c.CertificateArn;
+      if (c.IsDefault !== void 0)
+        out["IsDefault"] = c.IsDefault;
+      return out;
+    });
+    result["DefaultActions"] = (listener.DefaultActions ?? []).map(
+      (a) => a
+    );
     await this.attachTags(result, physicalId);
     return result;
   }
@@ -27223,11 +27113,7 @@ var RDSProvider = class {
       result["DatabaseName"] = cluster.DatabaseName;
     if (cluster.Port !== void 0)
       result["Port"] = cluster.Port;
-    if (cluster.VpcSecurityGroups && cluster.VpcSecurityGroups.length > 0) {
-      result["VpcSecurityGroupIds"] = cluster.VpcSecurityGroups.map(
-        (sg) => sg.VpcSecurityGroupId
-      ).filter((id) => !!id);
-    }
+    result["VpcSecurityGroupIds"] = (cluster.VpcSecurityGroups ?? []).map((sg) => sg.VpcSecurityGroupId).filter((id) => !!id);
     if (cluster.DBSubnetGroup !== void 0)
       result["DBSubnetGroupName"] = cluster.DBSubnetGroup;
     if (cluster.StorageEncrypted !== void 0) {
@@ -27241,16 +27127,15 @@ var RDSProvider = class {
     if (cluster.DeletionProtection !== void 0) {
       result["DeletionProtection"] = cluster.DeletionProtection;
     }
-    if (cluster.ServerlessV2ScalingConfiguration) {
+    {
       const sc = {};
-      if (cluster.ServerlessV2ScalingConfiguration.MinCapacity !== void 0) {
+      if (cluster.ServerlessV2ScalingConfiguration?.MinCapacity !== void 0) {
         sc["MinCapacity"] = cluster.ServerlessV2ScalingConfiguration.MinCapacity;
       }
-      if (cluster.ServerlessV2ScalingConfiguration.MaxCapacity !== void 0) {
+      if (cluster.ServerlessV2ScalingConfiguration?.MaxCapacity !== void 0) {
         sc["MaxCapacity"] = cluster.ServerlessV2ScalingConfiguration.MaxCapacity;
       }
-      if (Object.keys(sc).length > 0)
-        result["ServerlessV2ScalingConfiguration"] = sc;
+      result["ServerlessV2ScalingConfiguration"] = sc;
     }
     if (cluster.DBClusterArn)
       await this.attachTags(result, cluster.DBClusterArn);
@@ -27276,11 +27161,7 @@ var RDSProvider = class {
     if (sg.DBSubnetGroupDescription !== void 0) {
       result["DBSubnetGroupDescription"] = sg.DBSubnetGroupDescription;
     }
-    if (sg.Subnets && sg.Subnets.length > 0) {
-      result["SubnetIds"] = sg.Subnets.map((s) => s.SubnetIdentifier).filter(
-        (id) => !!id
-      );
-    }
+    result["SubnetIds"] = (sg.Subnets ?? []).map((s) => s.SubnetIdentifier).filter((id) => !!id);
     if (sg.DBSubnetGroupArn)
       await this.attachTags(result, sg.DBSubnetGroupArn);
     return result;
@@ -28119,35 +28000,30 @@ var Route53Provider = class {
     const result = {};
     if (resp.HostedZone.Name !== void 0)
       result["Name"] = resp.HostedZone.Name;
-    if (resp.HostedZone.Config) {
-      const cfg = {};
-      if (resp.HostedZone.Config.Comment !== void 0) {
-        cfg["Comment"] = resp.HostedZone.Config.Comment;
-      }
-      if (resp.HostedZone.Config.PrivateZone !== void 0) {
+    {
+      const cfg = {
+        Comment: resp.HostedZone.Config?.Comment ?? ""
+      };
+      if (resp.HostedZone.Config?.PrivateZone !== void 0) {
         cfg["PrivateZone"] = resp.HostedZone.Config.PrivateZone;
       }
-      if (Object.keys(cfg).length > 0)
-        result["HostedZoneConfig"] = cfg;
-    }
-    if (resp.VPCs && resp.VPCs.length > 0) {
-      result["VPCs"] = resp.VPCs.map((v) => {
-        const out = {};
-        if (v.VPCId !== void 0)
-          out["VPCId"] = v.VPCId;
-        if (v.VPCRegion !== void 0)
-          out["VPCRegion"] = v.VPCRegion;
-        return out;
-      });
+      result["HostedZoneConfig"] = cfg;
     }
+    result["VPCs"] = (resp.VPCs ?? []).map((v) => {
+      const out = {};
+      if (v.VPCId !== void 0)
+        out["VPCId"] = v.VPCId;
+      if (v.VPCRegion !== void 0)
+        out["VPCRegion"] = v.VPCRegion;
+      return out;
+    });
     const idTail = physicalId.replace(/^\/hostedzone\//, "");
     try {
       const tagsResp = await this.getClient().send(
         new ListTagsForResourceCommand11({ ResourceType: "hostedzone", ResourceId: idTail })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.ResourceTagSet?.Tags);
-      if (tags.length > 0)
-        result["HostedZoneTags"] = tags;
+      result["HostedZoneTags"] = tags;
     } catch (err) {
       this.logger.debug(
         `Route53 ListTagsForResource(${idTail}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -28187,11 +28063,7 @@ var Route53Provider = class {
     };
     if (recordSet.TTL !== void 0)
       result["TTL"] = recordSet.TTL;
-    if (recordSet.ResourceRecords && recordSet.ResourceRecords.length > 0) {
-      result["ResourceRecords"] = recordSet.ResourceRecords.map((r) => r.Value).filter(
-        (v) => typeof v === "string"
-      );
-    }
+    result["ResourceRecords"] = (recordSet.ResourceRecords ?? []).map((r) => r.Value).filter((v) => typeof v === "string");
     if (recordSet.AliasTarget) {
       const at = {};
       if (recordSet.AliasTarget.HostedZoneId !== void 0) {
@@ -28229,8 +28101,7 @@ var Route53Provider = class {
       if (recordSet.GeoLocation.SubdivisionCode !== void 0) {
         geo["SubdivisionCode"] = recordSet.GeoLocation.SubdivisionCode;
       }
-      if (Object.keys(geo).length > 0)
-        result["GeoLocation"] = geo;
+      result["GeoLocation"] = geo;
     }
     return result;
   }
@@ -28564,30 +28435,22 @@ var WAFv2WebACLProvider = class {
     if (webACL.Name !== void 0)
       result["Name"] = webACL.Name;
     result["Scope"] = scope;
-    if (webACL.Description !== void 0 && webACL.Description !== "") {
-      result["Description"] = webACL.Description;
-    }
+    result["Description"] = webACL.Description ?? "";
     if (webACL.DefaultAction) {
       result["DefaultAction"] = webACL.DefaultAction;
     }
-    if (webACL.Rules && webACL.Rules.length > 0) {
-      result["Rules"] = webACL.Rules.map((r) => r);
-    }
+    result["Rules"] = (webACL.Rules ?? []).map((r) => r);
     if (webACL.VisibilityConfig) {
       result["VisibilityConfig"] = webACL.VisibilityConfig;
     }
-    if (webACL.CustomResponseBodies && Object.keys(webACL.CustomResponseBodies).length > 0) {
-      result["CustomResponseBodies"] = webACL.CustomResponseBodies;
-    }
+    result["CustomResponseBodies"] = webACL.CustomResponseBodies ?? {};
     if (webACL.CaptchaConfig) {
       result["CaptchaConfig"] = webACL.CaptchaConfig;
     }
     if (webACL.ChallengeConfig) {
       result["ChallengeConfig"] = webACL.ChallengeConfig;
     }
-    if (webACL.TokenDomains && webACL.TokenDomains.length > 0) {
-      result["TokenDomains"] = [...webACL.TokenDomains];
-    }
+    result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
     if (webACL.AssociationConfig) {
       result["AssociationConfig"] = webACL.AssociationConfig;
     }
@@ -29679,13 +29542,8 @@ var ElastiCacheProvider = class {
     if (cluster.CacheNodes?.[0]?.Endpoint?.Port !== void 0) {
       result["Port"] = cluster.CacheNodes[0].Endpoint.Port;
     }
-    if (cluster.SecurityGroups && cluster.SecurityGroups.length > 0) {
-      const ids = cluster.SecurityGroups.map((sg) => sg.SecurityGroupId).filter(
-        (id) => !!id
-      );
-      if (ids.length > 0)
-        result["VpcSecurityGroupIds"] = ids;
-    }
+    const sgIds = (cluster.SecurityGroups ?? []).map((sg) => sg.SecurityGroupId).filter((id) => !!id);
+    result["VpcSecurityGroupIds"] = sgIds;
     if (cluster.ARN)
       await this.attachTags(result, cluster.ARN);
     return result;
@@ -29711,11 +29569,8 @@ var ElastiCacheProvider = class {
     if (group.CacheSubnetGroupDescription !== void 0) {
       result["CacheSubnetGroupDescription"] = group.CacheSubnetGroupDescription;
     }
-    if (group.Subnets && group.Subnets.length > 0) {
-      const ids = group.Subnets.map((s) => s.SubnetIdentifier).filter((id) => !!id);
-      if (ids.length > 0)
-        result["SubnetIds"] = ids;
-    }
+    const subnetIds = (group.Subnets ?? []).map((s) => s.SubnetIdentifier).filter((id) => !!id);
+    result["SubnetIds"] = subnetIds;
     if (group.ARN)
       await this.attachTags(result, group.ARN);
     return result;
@@ -30251,9 +30106,7 @@ var ServiceDiscoveryProvider = class {
     const result = {};
     if (ns.Name !== void 0)
       result["Name"] = ns.Name;
-    if (ns.Description !== void 0 && ns.Description !== "") {
-      result["Description"] = ns.Description;
-    }
+    result["Description"] = ns.Description ?? "";
     if (ns.Arn)
       await this.attachTags(result, ns.Arn);
     return result;
@@ -30275,9 +30128,7 @@ var ServiceDiscoveryProvider = class {
       result["Name"] = svc.Name;
     if (svc.NamespaceId !== void 0)
       result["NamespaceId"] = svc.NamespaceId;
-    if (svc.Description !== void 0 && svc.Description !== "") {
-      result["Description"] = svc.Description;
-    }
+    result["Description"] = svc.Description ?? "";
     if (svc.Type !== void 0)
       result["Type"] = svc.Type;
     if (svc.DnsConfig) {
@@ -31656,14 +31507,10 @@ var GlueProvider = class {
     const dbInput = {};
     if (db.Name !== void 0)
       dbInput["Name"] = db.Name;
-    if (db.Description !== void 0 && db.Description !== "") {
-      dbInput["Description"] = db.Description;
-    }
+    dbInput["Description"] = db.Description ?? "";
     if (db.LocationUri !== void 0)
       dbInput["LocationUri"] = db.LocationUri;
-    if (db.Parameters && Object.keys(db.Parameters).length > 0) {
-      dbInput["Parameters"] = db.Parameters;
-    }
+    dbInput["Parameters"] = db.Parameters ?? {};
     return { DatabaseInput: dbInput };
   }
   async readTable(physicalId) {
@@ -31686,23 +31533,17 @@ var GlueProvider = class {
     const tableInput = {};
     if (table.Name !== void 0)
       tableInput["Name"] = table.Name;
-    if (table.Description !== void 0 && table.Description !== "") {
-      tableInput["Description"] = table.Description;
-    }
+    tableInput["Description"] = table.Description ?? "";
     if (table.Owner !== void 0)
       tableInput["Owner"] = table.Owner;
     if (table.Retention !== void 0)
       tableInput["Retention"] = table.Retention;
     if (table.TableType !== void 0)
       tableInput["TableType"] = table.TableType;
-    if (table.PartitionKeys && table.PartitionKeys.length > 0) {
-      tableInput["PartitionKeys"] = table.PartitionKeys.map(
-        (k) => k
-      );
-    }
-    if (table.Parameters && Object.keys(table.Parameters).length > 0) {
-      tableInput["Parameters"] = table.Parameters;
-    }
+    tableInput["PartitionKeys"] = (table.PartitionKeys ?? []).map(
+      (k) => k
+    );
+    tableInput["Parameters"] = table.Parameters ?? {};
     if (table.StorageDescriptor) {
       tableInput["StorageDescriptor"] = table.StorageDescriptor;
     }
@@ -32304,9 +32145,7 @@ var KMSProvider = class {
     if (!md)
       return void 0;
     const result = {};
-    if (md.Description !== void 0 && md.Description !== "") {
-      result["Description"] = md.Description;
-    }
+    result["Description"] = md.Description ?? "";
     if (md.KeySpec !== void 0)
       result["KeySpec"] = md.KeySpec;
     if (md.KeyUsage !== void 0)
@@ -32756,8 +32595,10 @@ var KinesisStreamProvider = class {
     if (stream.RetentionPeriodHours !== void 0) {
       result["RetentionPeriodHours"] = stream.RetentionPeriodHours;
     }
-    if (stream.EncryptionType !== void 0 && stream.EncryptionType !== "NONE") {
-      const encryption = { EncryptionType: stream.EncryptionType };
+    {
+      const encryption = {
+        EncryptionType: stream.EncryptionType ?? "NONE"
+      };
       if (stream.KeyId !== void 0)
         encryption["KeyId"] = stream.KeyId;
       result["StreamEncryption"] = encryption;
@@ -33337,20 +33178,18 @@ var EFSProvider = class {
       const resp = await this.getClient().send(
         new DescribeLifecycleConfigurationCommand({ FileSystemId: physicalId })
       );
-      const policies = resp.LifecyclePolicies;
-      if (policies && policies.length > 0) {
-        result["LifecyclePolicies"] = policies.map((p) => {
-          const out = {};
-          if (p.TransitionToIA !== void 0)
-            out["TransitionToIA"] = p.TransitionToIA;
-          if (p.TransitionToPrimaryStorageClass !== void 0) {
-            out["TransitionToPrimaryStorageClass"] = p.TransitionToPrimaryStorageClass;
-          }
-          if (p.TransitionToArchive !== void 0)
-            out["TransitionToArchive"] = p.TransitionToArchive;
-          return out;
-        });
-      }
+      const policies = resp.LifecyclePolicies ?? [];
+      result["LifecyclePolicies"] = policies.map((p) => {
+        const out = {};
+        if (p.TransitionToIA !== void 0)
+          out["TransitionToIA"] = p.TransitionToIA;
+        if (p.TransitionToPrimaryStorageClass !== void 0) {
+          out["TransitionToPrimaryStorageClass"] = p.TransitionToPrimaryStorageClass;
+        }
+        if (p.TransitionToArchive !== void 0)
+          out["TransitionToArchive"] = p.TransitionToArchive;
+        return out;
+      });
     } catch (err) {
       if (err instanceof FileSystemNotFound)
         return void 0;
@@ -33370,8 +33209,7 @@ var EFSProvider = class {
         return void 0;
     }
     const tags = normalizeAwsTagsToCfn(fs.Tags);
-    if (tags.length > 0)
-      result["FileSystemTags"] = tags;
+    result["FileSystemTags"] = tags;
     return result;
   }
   async readAccessPoint(physicalId) {
@@ -34371,11 +34209,9 @@ var CloudTrailProvider = class {
       const sel = await this.getClient().send(
         new GetEventSelectorsCommand({ TrailName: physicalId })
       );
-      if (sel.EventSelectors && sel.EventSelectors.length > 0) {
-        result["EventSelectors"] = sel.EventSelectors.map(
-          (es) => es
-        );
-      }
+      result["EventSelectors"] = (sel.EventSelectors ?? []).map(
+        (es) => es
+      );
     } catch {
     }
     if (trail.TrailARN) {
@@ -36406,24 +36242,17 @@ var ECRProvider = class {
       result["RepositoryName"] = r.repositoryName;
     if (r.imageTagMutability !== void 0)
       result["ImageTagMutability"] = r.imageTagMutability;
-    if (r.imageScanningConfiguration) {
-      const inner = {};
-      if (r.imageScanningConfiguration.scanOnPush !== void 0) {
-        inner["ScanOnPush"] = r.imageScanningConfiguration.scanOnPush;
-      }
-      if (Object.keys(inner).length > 0)
-        result["ImageScanningConfiguration"] = inner;
-    }
-    if (r.encryptionConfiguration) {
-      const inner = {};
-      if (r.encryptionConfiguration.encryptionType !== void 0) {
-        inner["EncryptionType"] = r.encryptionConfiguration.encryptionType;
-      }
-      if (r.encryptionConfiguration.kmsKey !== void 0) {
-        inner["KmsKey"] = r.encryptionConfiguration.kmsKey;
+    result["ImageScanningConfiguration"] = {
+      ScanOnPush: r.imageScanningConfiguration?.scanOnPush ?? false
+    };
+    {
+      const enc = {
+        EncryptionType: r.encryptionConfiguration?.encryptionType ?? "AES256"
+      };
+      if (r.encryptionConfiguration?.kmsKey !== void 0) {
+        enc["KmsKey"] = r.encryptionConfiguration.kmsKey;
       }
-      if (Object.keys(inner).length > 0)
-        result["EncryptionConfiguration"] = inner;
+      result["EncryptionConfiguration"] = enc;
     }
     try {
       const lp = await this.getClient().send(
@@ -38666,10 +38495,11 @@ init_aws_clients();
 function calculateResourceDrift(stateProperties, awsProperties, options) {
   const drifts = [];
   const ignore = options?.ignorePaths ?? [];
+  const union = options?.unionWalkObjects ?? false;
   for (const key of Object.keys(stateProperties)) {
     if (isIgnoredPath(key, ignore))
       continue;
-    diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore);
+    diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
   }
   return drifts;
 }
@@ -38682,15 +38512,16 @@ function isIgnoredPath(path, ignorePaths) {
   }
   return false;
 }
-function diffAt(path, stateValue, awsValue, out, ignorePaths) {
+function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
   if (deepEqual(stateValue, awsValue))
     return;
   if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
-    for (const key of Object.keys(stateValue)) {
+    const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
+    for (const key of keys) {
       const childPath = `${path}.${key}`;
       if (isIgnoredPath(childPath, ignorePaths))
         continue;
-      diffAt(childPath, stateValue[key], awsValue[key], out, ignorePaths);
+      diffAt(childPath, stateValue[key], awsValue[key], out, ignorePaths, unionWalkObjects);
     }
     return;
   }
@@ -39069,8 +38900,12 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
         continue;
       }
       const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
-      const baseline = resource.observedProperties ?? resource.properties ?? {};
-      const changes = calculateResourceDrift(baseline, aws, { ignorePaths });
+      const useObserved = resource.observedProperties !== void 0;
+      const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
+      const changes = calculateResourceDrift(baseline, aws, {
+        ignorePaths,
+        unionWalkObjects: useObserved
+      });
       if (changes.length === 0) {
         outcomes.push({ kind: "clean", logicalId, resourceType: resource.resourceType });
       } else {
@@ -42855,7 +42690,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.49.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.1");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());