@go-to-k/cdkd 0.50.4 → 0.50.6

package/dist/cli.js

@@ -10038,6 +10038,7 @@ import {
   ListUserTagsCommand,
   NoSuchEntityException as NoSuchEntityException4,
   TagUserCommand,
+  UntagUserCommand,
   PutUserPermissionsBoundaryCommand,
   DeleteUserPermissionsBoundaryCommand
 } from "@aws-sdk/client-iam";
@@ -10234,16 +10235,11 @@ var IAMUserGroupProvider = class {
   async updateUser(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating IAM user ${logicalId}: ${physicalId}`);
     try {
-      const tags = properties["Tags"];
-      if (tags && Array.isArray(tags)) {
-        await this.iamClient.send(
-          new TagUserCommand({
-            UserName: physicalId,
-            Tags: tags
-          })
-        );
-        this.logger.debug(`Tagged user ${physicalId}`);
-      }
+      await this.applyUserTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const newPermBoundary = properties["PermissionsBoundary"];
       const oldPermBoundary = previousProperties["PermissionsBoundary"];
       if (newPermBoundary !== oldPermBoundary) {
@@ -10492,6 +10488,42 @@ var IAMUserGroupProvider = class {
       throw error;
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via IAM's
+   * `TagUser` / `UntagUser` APIs.
+   */
+  async applyUserTagDiff(userName, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.iamClient.send(
+        new UntagUserCommand({ UserName: userName, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from IAM user ${userName}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.iamClient.send(new TagUserCommand({ UserName: userName, Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on IAM user ${userName}`);
+    }
+  }
   async updateUserManagedPolicies(userName, newPolicies, oldPolicies) {
     const newSet = new Set(newPolicies || []);
     const oldSet = new Set(oldPolicies || []);
@@ -11224,6 +11256,7 @@ import {
   ListBucketsCommand,
   PutBucketVersioningCommand as PutBucketVersioningCommand2,
   PutBucketTaggingCommand,
+  DeleteBucketTaggingCommand,
   PutBucketOwnershipControlsCommand,
   PutBucketNotificationConfigurationCommand,
   PutBucketCorsCommand,
@@ -11347,6 +11380,52 @@ var S3BucketProvider = class {
     );
     this.logger.debug(`Applied ${tags.length} tags to bucket ${bucketName}`);
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via S3's
+   * `PutBucketTagging` (full-replace) / `DeleteBucketTagging` APIs.
+   *
+   * S3's `PutBucketTagging` replaces the entire tag set in one call, so we
+   * don't need separate add/remove API operations. When the new set is
+   * empty, we issue `DeleteBucketTagging` to clear it. When old and new
+   * are equal, we skip the call entirely.
+   */
+  async applyTagDiff(bucketName, oldTagsRaw, newTagsRaw) {
+    const normalize = (tags) => {
+      const out = [];
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          out.push({ Key: t.Key, Value: t.Value });
+      }
+      return out;
+    };
+    const oldNorm = normalize(oldTagsRaw);
+    const newNorm = normalize(newTagsRaw);
+    if (JSON.stringify(oldNorm) === JSON.stringify(newNorm))
+      return;
+    if (newNorm.length === 0) {
+      try {
+        await this.s3Client.send(
+          new DeleteBucketTaggingCommand({
+            Bucket: bucketName
+          })
+        );
+        this.logger.debug(`Cleared tags from bucket ${bucketName}`);
+      } catch (err) {
+        const e = err;
+        if (e.name === "NoSuchTagSet")
+          return;
+        throw err;
+      }
+      return;
+    }
+    await this.s3Client.send(
+      new PutBucketTaggingCommand({
+        Bucket: bucketName,
+        Tagging: { TagSet: newNorm }
+      })
+    );
+    this.logger.debug(`Replaced tag set on bucket ${bucketName} (${newNorm.length} tags)`);
+  }
   /**
    * Apply CORS configuration
    *
@@ -11890,13 +11969,13 @@ var S3BucketProvider = class {
   /**
    * Apply additional bucket configuration after creation
    */
-  async applyConfiguration(bucketName, properties) {
+  async applyConfiguration(bucketName, properties, skipTags = false) {
     const versioningConfig = properties["VersioningConfiguration"];
     if (versioningConfig) {
       await this.applyVersioning(bucketName, versioningConfig);
     }
     const tags = properties["Tags"];
-    if (tags && Array.isArray(tags) && tags.length > 0) {
+    if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) {
       await this.applyTags(bucketName, tags);
     }
     const ownershipControls = properties["OwnershipControls"];
@@ -12035,7 +12114,7 @@ var S3BucketProvider = class {
   /**
    * Update an S3 bucket
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating S3 bucket ${logicalId}: ${physicalId}`);
     const newBucketName = properties["BucketName"];
     if (newBucketName && newBucketName !== physicalId) {
@@ -12048,7 +12127,17 @@ var S3BucketProvider = class {
       };
     }
     try {
-      await this.applyConfiguration(physicalId, properties);
+      await this.applyConfiguration(
+        physicalId,
+        properties,
+        /* skipTags */
+        true
+      );
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const attributes = await this.buildAttributes(physicalId);
       this.logger.debug(`Successfully updated S3 bucket ${logicalId}`);
       return {
@@ -12546,6 +12635,8 @@ import {
   ListQueuesCommand,
   ListQueueTagsCommand,
   SetQueueAttributesCommand,
+  TagQueueCommand,
+  UntagQueueCommand,
   QueueDoesNotExist
 } from "@aws-sdk/client-sqs";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand4 } from "@aws-sdk/client-sts";
@@ -12656,7 +12747,7 @@ var SQSQueueProvider = class {
   /**
    * Update an SQS queue
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating SQS queue ${logicalId}: ${physicalId}`);
     try {
       const attributes = {};
@@ -12681,6 +12772,11 @@ var SQSQueueProvider = class {
         );
         this.logger.debug(`Updated attributes for SQS queue ${physicalId}`);
       }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const getResponse = await this.sqsClient.send(
         new GetQueueAttributesCommand({
           QueueUrl: physicalId,
@@ -12739,6 +12835,46 @@ var SQSQueueProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via SQS's
+   * `TagQueue` / `UntagQueue` APIs. SQS's `TagQueue` takes a `Tags` map
+   * (`{ key: value }`); `UntagQueue` takes a `TagKeys` array. cdkd state
+   * holds Tags in CFn shape (`[{ Key, Value }]`).
+   */
+  async applyTagDiff(queueUrl, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.sqsClient.send(
+        new UntagQueueCommand({ QueueUrl: queueUrl, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from SQS queue ${queueUrl}`);
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.sqsClient.send(new TagQueueCommand({ QueueUrl: queueUrl, Tags: tagsToAdd }));
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on SQS queue ${queueUrl}`
+      );
+    }
+  }
   /**
    * Construct SQS queue ARN from account/region/queue name
    */
@@ -12857,13 +12993,11 @@ var SQSQueueProvider = class {
       if (v !== void 0)
         result[key] = v === "true";
     }
-    const str = [
-      "KmsMasterKeyId",
-      "DeduplicationScope",
-      "FifoThroughputLimit"
-    ];
-    for (const key of str) {
-      result[key] = attributes[key] ?? "";
+    result["KmsMasterKeyId"] = attributes["KmsMasterKeyId"] ?? "";
+    const isFifo = attributes["FifoQueue"] === "true";
+    if (isFifo) {
+      result["DeduplicationScope"] = attributes["DeduplicationScope"] ?? "";
+      result["FifoThroughputLimit"] = attributes["FifoThroughputLimit"] ?? "";
     }
     if (attributes["RedrivePolicy"]) {
       try {
@@ -13544,16 +13678,14 @@ var SNSTopicProvider = class {
       if (v !== void 0)
         result[key] = v === "true";
     }
-    const str = [
-      "DisplayName",
-      "KmsMasterKeyId",
-      "TracingConfig",
-      "SignatureVersion",
-      "FifoThroughputScope"
-    ];
+    const str = ["DisplayName", "KmsMasterKeyId", "TracingConfig", "SignatureVersion"];
     for (const key of str) {
       result[key] = attrs[key] ?? "";
     }
+    const isFifo = attrs["FifoTopic"] === "true";
+    if (isFifo) {
+      result["FifoThroughputScope"] = attrs["FifoThroughputScope"] ?? "";
+    }
     for (const key of ["ArchivePolicy", "DataProtectionPolicy"]) {
       const v = attrs[key];
       if (v) {
@@ -14084,6 +14216,8 @@ import {
   GetFunctionCommand,
   ListFunctionsCommand,
   ListTagsCommand,
+  TagResourceCommand as TagResourceCommand2,
+  UntagResourceCommand as UntagResourceCommand2,
   ResourceNotFoundException,
   waitUntilFunctionUpdatedV2 as waitUntilFunctionUpdatedV22
 } from "@aws-sdk/client-lambda";
@@ -14301,11 +14435,17 @@ var LambdaFunctionProvider = class {
       const getResponse = await this.lambdaClient.send(
         new GetFunctionCommand({ FunctionName: physicalId })
       );
+      const functionArn = getResponse.Configuration?.FunctionArn;
+      await this.applyTagDiff(
+        functionArn,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       return {
         physicalId,
         wasReplaced: false,
         attributes: {
-          Arn: getResponse.Configuration?.FunctionArn,
+          Arn: functionArn,
           FunctionName: getResponse.Configuration?.FunctionName
         }
       };
@@ -14497,6 +14637,53 @@ var LambdaFunctionProvider = class {
    * one resource type that actually needs it preserves the bug fix
    * without paying the whole-stack tax.
    */
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via Lambda's
+   * `TagResource` / `UntagResource` APIs. Without this, `cdkd deploy`
+   * and `cdkd drift --revert` silently no-op tag changes — the
+   * `UpdateFunctionConfiguration` command does NOT accept a Tags
+   * parameter (Lambda treats tags as a separate API surface).
+   */
+  async applyTagDiff(functionArn, oldTagsRaw, newTagsRaw) {
+    if (!functionArn)
+      return;
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.lambdaClient.send(
+        new UntagResourceCommand2({ Resource: functionArn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(
+        `Removed ${tagsToRemove.length} tag(s) from Lambda function ${functionArn}`
+      );
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.lambdaClient.send(
+        new TagResourceCommand2({ Resource: functionArn, Tags: tagsToAdd })
+      );
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Lambda function ${functionArn}`
+      );
+    }
+  }
   async waitForFunctionUpdated(logicalId, resourceType, functionName) {
     try {
       await waitUntilFunctionUpdatedV22(
@@ -14831,14 +15018,11 @@ var LambdaFunctionProvider = class {
       if (cfg.EphemeralStorage?.Size !== void 0) {
         result["EphemeralStorage"] = { Size: cfg.EphemeralStorage.Size };
       }
-      const vpc = {
+      result["VpcConfig"] = {
         SubnetIds: cfg.VpcConfig?.SubnetIds ? [...cfg.VpcConfig.SubnetIds] : [],
-        SecurityGroupIds: cfg.VpcConfig?.SecurityGroupIds ? [...cfg.VpcConfig.SecurityGroupIds] : []
+        SecurityGroupIds: cfg.VpcConfig?.SecurityGroupIds ? [...cfg.VpcConfig.SecurityGroupIds] : [],
+        Ipv6AllowedForDualStack: cfg.VpcConfig?.Ipv6AllowedForDualStack ?? false
       };
-      if (cfg.VpcConfig?.Ipv6AllowedForDualStack !== void 0) {
-        vpc["Ipv6AllowedForDualStack"] = cfg.VpcConfig.Ipv6AllowedForDualStack;
-      }
-      result["VpcConfig"] = vpc;
       const tags = normalizeAwsTagsToCfn(resp.Tags);
       result["Tags"] = tags;
       return result;
@@ -15472,6 +15656,8 @@ import {
   DeleteEventSourceMappingCommand,
   UpdateEventSourceMappingCommand,
   GetEventSourceMappingCommand,
+  TagResourceCommand as TagResourceCommand3,
+  UntagResourceCommand as UntagResourceCommand3,
   ResourceNotFoundException as ResourceNotFoundException4
 } from "@aws-sdk/client-lambda";
 init_aws_clients();
@@ -15595,7 +15781,7 @@ var LambdaEventSourceMappingProvider = class {
   /**
    * Update a Lambda Event Source Mapping
    */
-  async update(logicalId, physicalId, _resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, _resourceType, properties, previousProperties) {
     this.logger.debug(`Updating event source mapping ${logicalId}: ${physicalId}`);
     const updateParams = {
       UUID: physicalId,
@@ -15629,7 +15815,17 @@ var LambdaEventSourceMappingProvider = class {
       updateParams.ScalingConfig = properties["ScalingConfig"];
     if (properties["DocumentDBEventSourceConfig"])
       updateParams.DocumentDBEventSourceConfig = properties["DocumentDBEventSourceConfig"];
-    await this.lambdaClient.send(new UpdateEventSourceMappingCommand(updateParams));
+    const updateResp = await this.lambdaClient.send(
+      new UpdateEventSourceMappingCommand(updateParams)
+    );
+    const eventSourceMappingArn = updateResp.EventSourceMappingArn;
+    if (eventSourceMappingArn) {
+      await this.applyTagDiff(
+        eventSourceMappingArn,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
+    }
     this.logger.debug(`Successfully updated event source mapping ${logicalId}`);
     return {
       physicalId,
@@ -15639,6 +15835,46 @@ var LambdaEventSourceMappingProvider = class {
       }
     };
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via Lambda's
+   * `TagResource` / `UntagResource` APIs against the EventSourceMapping
+   * ARN. Lambda's `TagResource` takes `{ Resource, Tags: { key: value } }`;
+   * `UntagResource` takes `{ Resource, TagKeys: [...] }`.
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.lambdaClient.send(
+        new UntagResourceCommand3({ Resource: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from EventSourceMapping ${arn}`);
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.lambdaClient.send(new TagResourceCommand3({ Resource: arn, Tags: tagsToAdd }));
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on EventSourceMapping ${arn}`
+      );
+    }
+  }
   /**
    * Delete a Lambda Event Source Mapping
    */
@@ -16072,6 +16308,8 @@ import {
   DescribeTableCommand as DescribeTableCommand2,
   ListTablesCommand,
   ListTagsOfResourceCommand,
+  TagResourceCommand as TagResourceCommand4,
+  UntagResourceCommand as UntagResourceCommand4,
   ResourceNotFoundException as ResourceNotFoundException6
 } from "@aws-sdk/client-dynamodb";
 init_aws_clients();
@@ -16197,13 +16435,20 @@ var DynamoDBTableProvider = class {
    * For immutable property changes (KeySchema, etc.), the deployment layer
    * handles replacement via DELETE + CREATE.
    */
-  async update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DynamoDB table ${logicalId}: ${physicalId}`);
     try {
       const response = await this.dynamoDBClient.send(
         new DescribeTableCommand2({ TableName: physicalId })
       );
       const table = response.Table;
+      if (table?.TableArn) {
+        await this.applyTagDiff(
+          table.TableArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -16256,6 +16501,45 @@ var DynamoDBTableProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via DynamoDB's
+   * `TagResource` / `UntagResource` APIs. Both take the table ARN as
+   * `ResourceArn`.
+   */
+  async applyTagDiff(tableArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.dynamoDBClient.send(
+        new UntagResourceCommand4({ ResourceArn: tableArn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from DynamoDB table ${tableArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.dynamoDBClient.send(
+        new TagResourceCommand4({ ResourceArn: tableArn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB table ${tableArn}`);
+    }
+  }
   /**
    * Poll DescribeTable until the table reaches ACTIVE status
    *
@@ -16475,8 +16759,8 @@ import {
   ListTagsForResourceCommand as ListTagsForResourceCommand2,
   PutRetentionPolicyCommand,
   DeleteRetentionPolicyCommand,
-  TagResourceCommand as TagResourceCommand2,
-  UntagResourceCommand as UntagResourceCommand2,
+  TagResourceCommand as TagResourceCommand5,
+  UntagResourceCommand as UntagResourceCommand5,
   PutDataProtectionPolicyCommand,
   DeleteDataProtectionPolicyCommand,
   ResourceNotFoundException as ResourceNotFoundException7,
@@ -16626,7 +16910,7 @@ var LogsLogGroupProvider = class {
       if (oldTags && oldTags.length > 0) {
         const oldTagKeys = oldTags.map((t) => t.Key);
         await this.logsClient.send(
-          new UntagResourceCommand2({
+          new UntagResourceCommand5({
             resourceArn: arn2,
             tagKeys: oldTagKeys
           })
@@ -16635,7 +16919,7 @@ var LogsLogGroupProvider = class {
       if (newTags && newTags.length > 0) {
         const tagsMap = Object.fromEntries(newTags.map((t) => [t.Key, t.Value]));
         await this.logsClient.send(
-          new TagResourceCommand2({
+          new TagResourceCommand5({
             resourceArn: arn2,
             tags: tagsMap
           })
@@ -16835,7 +17119,9 @@ import {
   PutMetricAlarmCommand,
   DeleteAlarmsCommand,
   DescribeAlarmsCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand3
+  ListTagsForResourceCommand as ListTagsForResourceCommand3,
+  TagResourceCommand as TagResourceCommand6,
+  UntagResourceCommand as UntagResourceCommand6
 } from "@aws-sdk/client-cloudwatch";
 init_aws_clients();
 var CloudWatchAlarmProvider = class {
@@ -16904,7 +17190,7 @@ var CloudWatchAlarmProvider = class {
    *
    * PutMetricAlarm is idempotent - calling it with the same alarm name updates the alarm.
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating CloudWatch alarm ${logicalId}: ${physicalId}`);
     try {
       await this.cloudWatchClient.send(
@@ -16912,6 +17198,11 @@ var CloudWatchAlarmProvider = class {
       );
       this.logger.debug(`Successfully updated CloudWatch alarm ${logicalId}`);
       const alarmArn = await this.getAlarmArn(physicalId);
+      await this.applyTagDiff(
+        alarmArn,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       return {
         physicalId,
         wasReplaced: false,
@@ -16996,6 +17287,44 @@ var CloudWatchAlarmProvider = class {
       return `arn:aws:cloudwatch:*:*:alarm:${alarmName}`;
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via CloudWatch's
+   * `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
+   */
+  async applyTagDiff(resourceArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.cloudWatchClient.send(
+        new UntagResourceCommand6({ ResourceARN: resourceArn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from alarm ${resourceArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.cloudWatchClient.send(
+        new TagResourceCommand6({ ResourceARN: resourceArn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on alarm ${resourceArn}`);
+    }
+  }
   /**
    * Build PutMetricAlarm parameters from CDK properties
    */
@@ -17188,8 +17517,8 @@ import {
   DescribeSecretCommand,
   ListSecretsCommand,
   UpdateSecretCommand,
-  TagResourceCommand as TagResourceCommand3,
-  UntagResourceCommand as UntagResourceCommand3,
+  TagResourceCommand as TagResourceCommand7,
+  UntagResourceCommand as UntagResourceCommand7,
   ReplicateSecretToRegionsCommand,
   RemoveRegionsFromReplicationCommand,
   ResourceNotFoundException as ResourceNotFoundException8
@@ -17302,7 +17631,7 @@ var SecretsManagerSecretProvider = class {
           const oldTagKeys = oldTags.map((t) => t.Key).filter((k) => !!k);
           if (oldTagKeys.length > 0) {
             await this.smClient.send(
-              new UntagResourceCommand3({
+              new UntagResourceCommand7({
                 SecretId: physicalId,
                 TagKeys: oldTagKeys
               })
@@ -17311,7 +17640,7 @@ var SecretsManagerSecretProvider = class {
         }
         if (newTags && newTags.length > 0) {
           await this.smClient.send(
-            new TagResourceCommand3({
+            new TagResourceCommand7({
               SecretId: physicalId,
               Tags: newTags
             })
@@ -17915,8 +18244,8 @@ import {
   ListRulesCommand,
   ListTargetsByRuleCommand,
   ListTagsForResourceCommand as ListTagsForResourceCommand5,
-  TagResourceCommand as TagResourceCommand4,
-  UntagResourceCommand as UntagResourceCommand4,
+  TagResourceCommand as TagResourceCommand8,
+  UntagResourceCommand as UntagResourceCommand8,
   ResourceNotFoundException as ResourceNotFoundException9
 } from "@aws-sdk/client-eventbridge";
 init_aws_clients();
@@ -18069,7 +18398,7 @@ var EventBridgeRuleProvider = class {
           const oldTagKeys = oldTags.map((t) => t.Key).filter((k) => !!k);
           if (oldTagKeys.length > 0) {
             await this.eventBridgeClient.send(
-              new UntagResourceCommand4({
+              new UntagResourceCommand8({
                 ResourceARN: ruleArn,
                 TagKeys: oldTagKeys
               })
@@ -18078,7 +18407,7 @@ var EventBridgeRuleProvider = class {
         }
         if (newTags && newTags.length > 0) {
           await this.eventBridgeClient.send(
-            new TagResourceCommand4({
+            new TagResourceCommand8({
               ResourceARN: ruleArn,
               Tags: newTags
             })
@@ -18385,8 +18714,8 @@ import {
   RemoveTargetsCommand as RemoveTargetsCommand2,
   DeleteRuleCommand as DeleteRuleCommand2,
   ListTargetsByRuleCommand as ListTargetsByRuleCommand2,
-  TagResourceCommand as TagResourceCommand5,
-  UntagResourceCommand as UntagResourceCommand5,
+  TagResourceCommand as TagResourceCommand9,
+  UntagResourceCommand as UntagResourceCommand9,
   ResourceNotFoundException as ResourceNotFoundException10
 } from "@aws-sdk/client-eventbridge";
 init_aws_clients();
@@ -18499,7 +18828,7 @@ var EventBridgeBusProvider = class {
           const oldTagKeys = oldTags.map((t) => t.Key).filter((k) => !!k);
           if (oldTagKeys.length > 0) {
             await this.eventBridgeClient.send(
-              new UntagResourceCommand5({
+              new UntagResourceCommand9({
                 ResourceARN: busArn,
                 TagKeys: oldTagKeys
               })
@@ -18508,7 +18837,7 @@ var EventBridgeBusProvider = class {
         }
         if (newTags && newTags.length > 0) {
           await this.eventBridgeClient.send(
-            new TagResourceCommand5({
+            new TagResourceCommand9({
               ResourceARN: busArn,
               Tags: newTags
             })
@@ -18760,6 +19089,7 @@ import {
   AuthorizeSecurityGroupEgressCommand,
   RevokeSecurityGroupEgressCommand,
   CreateTagsCommand,
+  DeleteTagsCommand,
   DescribeSubnetsCommand as DescribeSubnetsCommand2,
   DescribeSecurityGroupsCommand as DescribeSecurityGroupsCommand2,
   RunInstancesCommand,
@@ -18924,7 +19254,7 @@ var EC2Provider = class {
   async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::EC2::VPC":
-        return this.updateVpc(logicalId, physicalId, resourceType, properties);
+        return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties);
       case "AWS::EC2::Subnet":
         return this.updateSubnet(logicalId, physicalId);
       case "AWS::EC2::InternetGateway":
@@ -18962,7 +19292,13 @@ var EC2Provider = class {
           previousProperties
         );
       case "AWS::EC2::Instance":
-        return this.updateInstance(logicalId, physicalId, resourceType, properties);
+        return this.updateInstance(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::EC2::NetworkAcl":
       case "AWS::EC2::NetworkAclEntry":
       case "AWS::EC2::SubnetNetworkAclAssociation":
@@ -19108,7 +19444,7 @@ var EC2Provider = class {
       );
     }
   }
-  async updateVpc(logicalId, physicalId, resourceType, properties) {
+  async updateVpc(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating VPC ${logicalId}: ${physicalId}`);
     try {
       if (properties["EnableDnsHostnames"] !== void 0) {
@@ -19129,7 +19465,11 @@ var EC2Provider = class {
           })
         );
       }
-      await this.applyTags(physicalId, properties, logicalId);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated VPC ${logicalId}`);
       return {
         physicalId,
@@ -19999,7 +20339,11 @@ var EC2Provider = class {
   async updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating SecurityGroup ${logicalId}: ${physicalId}`);
     try {
-      await this.applyTags(physicalId, properties, logicalId);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       await this.applySecurityGroupRuleDiff(
         physicalId,
         previousProperties["SecurityGroupIngress"] ?? [],
@@ -20327,10 +20671,14 @@ var EC2Provider = class {
       );
     }
   }
-  async updateInstance(logicalId, physicalId, resourceType, _properties) {
+  async updateInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating EC2 Instance ${logicalId}: ${physicalId}`);
     try {
-      await this.applyTags(physicalId, _properties, logicalId);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const describeResponse = await this.ec2Client.send(
         new DescribeInstancesCommand({ InstanceIds: [physicalId] })
       );
@@ -20805,7 +21153,10 @@ var EC2Provider = class {
     }
   }
   /**
-   * Apply tags to an EC2 resource
+   * Apply tags to an EC2 resource (create-time, no removal).
+   *
+   * Used by `create*` paths. Update paths should use `applyTagDiff` instead
+   * to handle tag removal too.
    */
   async applyTags(resourceId, properties, logicalId) {
     const tags = properties["Tags"];
@@ -20825,6 +21176,64 @@ var EC2Provider = class {
       }
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via EC2's
+   * `CreateTags` / `DeleteTags` APIs. Used by `update*` paths so that
+   * tag removals reach AWS too. EC2 keys both APIs by a list of resource
+   * ids.
+   */
+  async applyTagDiff(resourceId, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push({ Key: k });
+    }
+    if (tagsToRemove.length > 0) {
+      try {
+        await this.ec2Client.send(
+          new DeleteTagsCommand({
+            Resources: [resourceId],
+            Tags: tagsToRemove
+          })
+        );
+        this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ${resourceId}`);
+      } catch (error) {
+        this.logger.warn(
+          `Failed to remove tags from ${resourceId}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    if (tagsToAdd.length > 0) {
+      try {
+        await this.ec2Client.send(
+          new CreateTagsCommand({
+            Resources: [resourceId],
+            Tags: tagsToAdd
+          })
+        );
+        this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ${resourceId}`);
+      } catch (error) {
+        this.logger.warn(
+          `Failed to add tags on ${resourceId}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  }
   /**
    * Check if an error indicates the resource was not found
    */
@@ -21171,6 +21580,8 @@ import {
   CreateAuthorizerCommand,
   DeleteAuthorizerCommand,
   GetAuthorizerCommand,
+  TagResourceCommand as TagResourceCommand10,
+  UntagResourceCommand as UntagResourceCommand10,
   NotFoundException as NotFoundException3
 } from "@aws-sdk/client-api-gateway";
 init_aws_clients();
@@ -21894,24 +22305,24 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
         value: description ?? ""
       });
     }
-    if (patchOperations.length === 0) {
-      this.logger.debug(`No changes detected for API Gateway Stage ${logicalId}`);
-      return {
-        physicalId,
-        wasReplaced: false,
-        attributes: {
-          StageName: physicalId
-        }
-      };
-    }
     try {
-      await this.apiGatewayClient.send(
-        new UpdateStageCommand({
-          restApiId,
-          stageName: physicalId,
-          patchOperations
-        })
-      );
+      if (patchOperations.length > 0) {
+        await this.apiGatewayClient.send(
+          new UpdateStageCommand({
+            restApiId,
+            stageName: physicalId,
+            patchOperations
+          })
+        );
+      }
+      const stageArn = await this.buildStageArn(restApiId, physicalId);
+      if (stageArn) {
+        await this.applyTagDiff(
+          stageArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       this.logger.debug(`Successfully updated API Gateway Stage ${logicalId}`);
       return {
         physicalId,
@@ -22144,7 +22555,64 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       if (attributeName === "HttpMethod")
         return Promise.resolve(parts[2]);
     }
-    return Promise.resolve(void 0);
+    return Promise.resolve(void 0);
+  }
+  /**
+   * Build the ARN for an API Gateway Stage, used for tag mutations.
+   *
+   * Format: `arn:aws:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
+   * The double colon (`::`) is intentional: API Gateway tagging uses an
+   * account-id-less ARN.
+   */
+  async buildStageArn(restApiId, stageName) {
+    try {
+      const region = await this.apiGatewayClient.config.region();
+      return `arn:aws:apigateway:${region}::/restapis/${restApiId}/stages/${stageName}`;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via API Gateway's
+   * `TagResource` / `UntagResource` APIs. API Gateway's `TagResource` takes
+   * lowercase camelCase fields plus a tag-map (`{ resourceArn, tags: {key: value} }`);
+   * `UntagResource` takes `{ resourceArn, tagKeys: [...] }`.
+   */
+  async applyTagDiff(resourceArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.apiGatewayClient.send(
+        new UntagResourceCommand10({ resourceArn, tagKeys: tagsToRemove })
+      );
+      this.logger.debug(
+        `Removed ${tagsToRemove.length} tag(s) from API Gateway resource ${resourceArn}`
+      );
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.apiGatewayClient.send(new TagResourceCommand10({ resourceArn, tags: tagsToAdd }));
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on API Gateway resource ${resourceArn}`
+      );
+    }
   }
   /**
    * Sleep for specified milliseconds
@@ -24179,6 +24647,8 @@ import {
   DescribeStateMachineCommand,
   ListStateMachinesCommand,
   ListTagsForResourceCommand as ListTagsForResourceCommand8,
+  TagResourceCommand as TagResourceCommand11,
+  UntagResourceCommand as UntagResourceCommand11,
   StateMachineDoesNotExist
 } from "@aws-sdk/client-sfn";
 var StepFunctionsProvider = class {
@@ -24281,7 +24751,7 @@ var StepFunctionsProvider = class {
   /**
    * Update a Step Functions state machine
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
     try {
       const definitionString = this.buildDefinitionString(properties);
@@ -24305,6 +24775,11 @@ var StepFunctionsProvider = class {
         })
       );
       this.logger.debug(`Updated Step Functions state machine ${physicalId}`);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const describeResponse = await this.getClient().send(
         new DescribeStateMachineCommand({ stateMachineArn: physicalId })
       );
@@ -24506,6 +24981,49 @@ var StepFunctionsProvider = class {
     } while (nextToken);
     return null;
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via SFN's
+   * `TagResource` / `UntagResource` APIs. SFN uses lowercase camelCase
+   * (`{ key, value }`) for tags.
+   */
+  async applyTagDiff(stateMachineArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ key: k, value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new UntagResourceCommand11({ resourceArn: stateMachineArn, tagKeys: tagsToRemove })
+      );
+      this.logger.debug(
+        `Removed ${tagsToRemove.length} tag(s) from SFN state machine ${stateMachineArn}`
+      );
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new TagResourceCommand11({ resourceArn: stateMachineArn, tags: tagsToAdd })
+      );
+      this.logger.debug(
+        `Added/updated ${tagsToAdd.length} tag(s) on SFN state machine ${stateMachineArn}`
+      );
+    }
+  }
   /**
    * Match SFN's lowercase `key`/`value` tag shape against the CDK path.
    */
@@ -24557,7 +25075,9 @@ import {
   DescribeServicesCommand,
   ListClustersCommand,
   ListServicesCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand9
+  ListTagsForResourceCommand as ListTagsForResourceCommand9,
+  TagResourceCommand as TagResourceCommand12,
+  UntagResourceCommand as UntagResourceCommand12
 } from "@aws-sdk/client-ecs";
 function convertTags(tags) {
   if (!tags || tags.length === 0)
@@ -24652,7 +25172,13 @@ var ECSProvider = class {
   async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::ECS::Cluster":
-        return this.updateCluster(logicalId, physicalId, resourceType, properties);
+        return this.updateCluster(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::ECS::TaskDefinition":
         return this.updateTaskDefinition(logicalId, physicalId, resourceType, properties);
       case "AWS::ECS::Service":
@@ -24744,7 +25270,7 @@ var ECSProvider = class {
       );
     }
   }
-  async updateCluster(logicalId, physicalId, resourceType, properties) {
+  async updateCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating ECS cluster ${logicalId}: ${physicalId}`);
     const client = this.getClient();
     try {
@@ -24762,6 +25288,13 @@ var ECSProvider = class {
         new DescribeClustersCommand({ clusters: [physicalId] })
       );
       const cluster = describeResponse.clusters?.[0];
+      if (cluster?.clusterArn) {
+        await this.applyTagDiff(
+          cluster.clusterArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -25030,6 +25563,13 @@ var ECSProvider = class {
         })
       );
       const service = response.service;
+      if (service?.serviceArn) {
+        await this.applyTagDiff(
+          service.serviceArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -25131,6 +25671,42 @@ var ECSProvider = class {
     }
   }
   // ─── Helpers ────────────────────────────────────────────────────
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via ECS's
+   * `TagResource` / `UntagResource` APIs. ECS uses lowercase camelCase
+   * (`{ key, value }`) for tags. Resource ARN identifies the cluster /
+   * service / task definition.
+   */
+  async applyTagDiff(resourceArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ key: k, value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(new UntagResourceCommand12({ resourceArn, tagKeys: tagsToRemove }));
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ECS resource ${resourceArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new TagResourceCommand12({ resourceArn, tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ECS resource ${resourceArn}`);
+    }
+  }
   /**
    * Convert CFn ContainerDefinitions to ECS SDK format.
    * CFn uses PascalCase, ECS SDK uses camelCase.
@@ -25578,6 +26154,8 @@ import {
   ModifyTargetGroupCommand,
   DescribeTargetGroupsCommand,
   DescribeTagsCommand,
+  AddTagsCommand,
+  RemoveTagsCommand,
   CreateListenerCommand,
   DeleteListenerCommand,
   ModifyListenerCommand,
@@ -25660,14 +26238,26 @@ var ELBv2Provider = class {
         );
     }
   }
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::ElasticLoadBalancingV2::LoadBalancer":
         return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties);
       case "AWS::ElasticLoadBalancingV2::TargetGroup":
-        return this.updateTargetGroup(logicalId, physicalId, resourceType, properties);
+        return this.updateTargetGroup(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::ElasticLoadBalancingV2::Listener":
-        return this.updateListener(logicalId, physicalId, resourceType, properties);
+        return this.updateListener(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -25846,7 +26436,7 @@ var ELBv2Provider = class {
       );
     }
   }
-  async updateTargetGroup(logicalId, physicalId, resourceType, properties) {
+  async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating TargetGroup ${logicalId}: ${physicalId}`);
     try {
       const matcher = properties["Matcher"];
@@ -25868,6 +26458,11 @@ var ELBv2Provider = class {
         new DescribeTargetGroupsCommand({ TargetGroupArns: [physicalId] })
       );
       const tg = describeResponse.TargetGroups?.[0];
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated TargetGroup ${logicalId}`);
       return {
         physicalId,
@@ -25961,7 +26556,7 @@ var ELBv2Provider = class {
       );
     }
   }
-  async updateListener(logicalId, physicalId, resourceType, properties) {
+  async updateListener(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating Listener ${logicalId}: ${physicalId}`);
     try {
       const defaultActions = this.convertActions(
@@ -25980,6 +26575,11 @@ var ELBv2Provider = class {
           ...certificates && { Certificates: certificates }
         })
       );
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated Listener ${logicalId}`);
       return {
         physicalId,
@@ -26037,6 +26637,44 @@ var ELBv2Provider = class {
       return [];
     return properties["Tags"];
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via ELBv2's
+   * `AddTags` / `RemoveTags` APIs. Both accept `ResourceArns: [arn]`
+   * (single ARN), `Tags: [{Key, Value}]` for AddTags, and
+   * `TagKeys: [...]` for RemoveTags.
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsCommand({ ResourceArns: [arn], TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ELBv2 resource ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new AddTagsCommand({ ResourceArns: [arn], Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ELBv2 resource ${arn}`);
+    }
+  }
   /**
    * Convert CDK DefaultActions to ELBv2 API Action format
    * CDK uses PascalCase property names matching the ELBv2 API, so pass through.
@@ -26351,7 +26989,9 @@ import {
   DeleteDBSubnetGroupCommand,
   DescribeDBSubnetGroupsCommand,
   ModifyDBSubnetGroupCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand10
+  ListTagsForResourceCommand as ListTagsForResourceCommand10,
+  AddTagsToResourceCommand as AddTagsToResourceCommand2,
+  RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand2
 } from "@aws-sdk/client-rds";
 var RDSProvider = class {
   rdsClient;
@@ -26418,14 +27058,32 @@ var RDSProvider = class {
         );
     }
   }
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::RDS::DBSubnetGroup":
-        return this.updateDBSubnetGroup(logicalId, physicalId, resourceType, properties);
+        return this.updateDBSubnetGroup(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::RDS::DBCluster":
-        return this.updateDBCluster(logicalId, physicalId, resourceType, properties);
+        return this.updateDBCluster(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::RDS::DBInstance":
-        return this.updateDBInstance(logicalId, physicalId, resourceType, properties);
+        return this.updateDBInstance(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -26484,7 +27142,7 @@ var RDSProvider = class {
       );
     }
   }
-  async updateDBSubnetGroup(logicalId, physicalId, resourceType, properties) {
+  async updateDBSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DBSubnetGroup ${logicalId}: ${physicalId}`);
     try {
       await this.getClient().send(
@@ -26494,6 +27152,17 @@ var RDSProvider = class {
           SubnetIds: properties["SubnetIds"]
         })
       );
+      const desc = await this.getClient().send(
+        new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: physicalId })
+      );
+      const arn = desc.DBSubnetGroups?.[0]?.DBSubnetGroupArn;
+      if (arn) {
+        await this.applyTagDiff(
+          arn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       this.logger.debug(`Successfully updated DBSubnetGroup ${logicalId}`);
       return {
         physicalId,
@@ -26608,7 +27277,7 @@ var RDSProvider = class {
       );
     }
   }
-  async updateDBCluster(logicalId, physicalId, resourceType, properties) {
+  async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DBCluster ${logicalId}: ${physicalId}`);
     try {
       const serverlessV2Config = properties["ServerlessV2ScalingConfiguration"];
@@ -26632,6 +27301,13 @@ var RDSProvider = class {
       );
       this.logger.debug(`Successfully updated DBCluster ${logicalId}`);
       const described = await this.describeDBCluster(physicalId);
+      if (described?.DBClusterArn) {
+        await this.applyTagDiff(
+          described.DBClusterArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -26749,7 +27425,7 @@ var RDSProvider = class {
       );
     }
   }
-  async updateDBInstance(logicalId, physicalId, resourceType, properties) {
+  async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DBInstance ${logicalId}: ${physicalId}`);
     try {
       await this.getClient().send(
@@ -26762,6 +27438,13 @@ var RDSProvider = class {
       );
       this.logger.debug(`Successfully updated DBInstance ${logicalId}`);
       const described = await this.describeDBInstance(physicalId);
+      if (described?.DBInstanceArn) {
+        await this.applyTagDiff(
+          described.DBInstanceArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -26832,6 +27515,45 @@ var RDSProvider = class {
     }
   }
   // ─── Helpers ──────────────────────────────────────────────────────
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via RDS's
+   * `AddTagsToResource` / `RemoveTagsFromResource` APIs (keyed by
+   * `ResourceName=arn`).
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsFromResourceCommand2({ ResourceName: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from RDS resource ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new AddTagsToResourceCommand2({ ResourceName: arn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on RDS resource ${arn}`);
+    }
+  }
   buildTags(properties) {
     if (!properties["Tags"])
       return [];
@@ -28119,6 +28841,8 @@ import {
   GetWebACLCommand,
   ListWebACLsCommand,
   ListTagsForResourceCommand as ListTagsForResourceCommand12,
+  TagResourceCommand as TagResourceCommand13,
+  UntagResourceCommand as UntagResourceCommand13,
   WAFNonexistentItemException
 } from "@aws-sdk/client-wafv2";
 function parseWebACLArn(arn) {
@@ -28225,7 +28949,7 @@ var WAFv2WebACLProvider = class {
    * Name and Scope are immutable - changes to those require replacement.
    * UpdateWebACL requires LockToken obtained from GetWebACL.
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
     try {
       const { id, name, scope } = parseWebACLArn(physicalId);
@@ -28257,6 +28981,11 @@ var WAFv2WebACLProvider = class {
           AssociationConfig: properties["AssociationConfig"]
         })
       );
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated WAFv2 WebACL ${logicalId}`);
       return {
         physicalId,
@@ -28333,6 +29062,42 @@ var WAFv2WebACLProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via WAFv2's
+   * `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new UntagResourceCommand13({ ResourceARN: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new TagResourceCommand13({ ResourceARN: arn, Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on WAFv2 WebACL ${arn}`);
+    }
+  }
   /**
    * Read the AWS-current WAFv2 WebACL configuration in CFn-property shape.
    *
@@ -28947,7 +29712,9 @@ import {
   DeleteCacheSubnetGroupCommand,
   ModifyCacheSubnetGroupCommand,
   ModifyCacheClusterCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand14
+  ListTagsForResourceCommand as ListTagsForResourceCommand14,
+  AddTagsToResourceCommand as AddTagsToResourceCommand3,
+  RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand3
 } from "@aws-sdk/client-elasticache";
 import { STSClient as STSClient6, GetCallerIdentityCommand as GetCallerIdentityCommand6 } from "@aws-sdk/client-sts";
 var ElastiCacheProvider = class {
@@ -29013,12 +29780,18 @@ var ElastiCacheProvider = class {
         );
     }
   }
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::ElastiCache::SubnetGroup":
         return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties);
       case "AWS::ElastiCache::CacheCluster":
-        return this.updateCacheCluster(logicalId, physicalId, resourceType, properties);
+        return this.updateCacheCluster(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -29203,7 +29976,7 @@ var ElastiCacheProvider = class {
       );
     }
   }
-  async updateCacheCluster(logicalId, physicalId, resourceType, properties) {
+  async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating CacheCluster ${logicalId}: ${physicalId}`);
     try {
       await this.getClient().send(
@@ -29226,6 +29999,13 @@ var ElastiCacheProvider = class {
       this.logger.debug(`Successfully updated CacheCluster ${logicalId}`);
       await this.waitForClusterAvailable(physicalId);
       const described = await this.describeCacheCluster(physicalId);
+      if (described?.ARN) {
+        await this.applyTagDiff(
+          described.ARN,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       const attributes = {};
       if (described?.CacheNodes?.[0]?.Endpoint) {
         const endpoint = described.CacheNodes[0].Endpoint;
@@ -29290,6 +30070,45 @@ var ElastiCacheProvider = class {
     }
   }
   // ─── Helpers ──────────────────────────────────────────────────────
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via ElastiCache's
+   * `AddTagsToResource` / `RemoveTagsFromResource` APIs (keyed by
+   * `ResourceName=arn`).
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsFromResourceCommand3({ ResourceName: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ElastiCache resource ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new AddTagsToResourceCommand3({ ResourceName: arn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ElastiCache resource ${arn}`);
+    }
+  }
   buildTags(properties) {
     if (!properties["Tags"])
       return [];
@@ -31617,8 +32436,8 @@ import {
   PutKeyPolicyCommand,
   EnableKeyCommand,
   DisableKeyCommand,
-  TagResourceCommand as TagResourceCommand6,
-  UntagResourceCommand as UntagResourceCommand6,
+  TagResourceCommand as TagResourceCommand14,
+  UntagResourceCommand as UntagResourceCommand14,
   NotFoundException as NotFoundException5
 } from "@aws-sdk/client-kms";
 var KMSProvider = class {
@@ -31803,26 +32622,11 @@ var KMSProvider = class {
           await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
         }
       }
-      const newTags = properties["Tags"];
-      const oldTags = previousProperties["Tags"];
-      if (JSON.stringify(newTags) !== JSON.stringify(oldTags)) {
-        if (oldTags && oldTags.length > 0) {
-          await this.getClient().send(
-            new UntagResourceCommand6({
-              KeyId: physicalId,
-              TagKeys: oldTags.map((t) => t.Key)
-            })
-          );
-        }
-        if (newTags && newTags.length > 0) {
-          await this.getClient().send(
-            new TagResourceCommand6({
-              KeyId: physicalId,
-              Tags: newTags.map((t) => ({ TagKey: t.Key, TagValue: t.Value }))
-            })
-          );
-        }
-      }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const newKeyPolicy = properties["KeyPolicy"];
       const oldKeyPolicy = previousProperties["KeyPolicy"];
       const newPolicyStr = newKeyPolicy ? typeof newKeyPolicy === "string" ? newKeyPolicy : JSON.stringify(newKeyPolicy) : void 0;
@@ -31884,6 +32688,43 @@ var KMSProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via KMS's
+   * `TagResource` / `UntagResource` APIs. KMS uses `{TagKey, TagValue}`
+   * (NOT the standard `{Key, Value}` shape) keyed by `KeyId`.
+   */
+  async applyTagDiff(keyId, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ TagKey: k, TagValue: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new UntagResourceCommand14({ KeyId: keyId, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from KMS Key ${keyId}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new TagResourceCommand14({ KeyId: keyId, Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on KMS Key ${keyId}`);
+    }
+  }
   // ─── AWS::KMS::Alias ───────────────────────────────────────────────
   async createAlias(logicalId, resourceType, properties) {
     this.logger.debug(`Creating KMS Alias ${logicalId}`);
@@ -32168,6 +33009,7 @@ import {
   DescribeStreamCommand,
   UpdateShardCountCommand,
   AddTagsToStreamCommand,
+  RemoveTagsFromStreamCommand,
   IncreaseStreamRetentionPeriodCommand,
   DecreaseStreamRetentionPeriodCommand,
   StartStreamEncryptionCommand,
@@ -32345,6 +33187,11 @@ var KinesisStreamProvider = class {
         }
         await this.waitForStreamActive(physicalId);
       }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const newEncryption = properties["StreamEncryption"];
       const oldEncryption = previousProperties["StreamEncryption"];
       if (JSON.stringify(newEncryption) !== JSON.stringify(oldEncryption)) {
@@ -32426,6 +33273,47 @@ var KinesisStreamProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via Kinesis's
+   * `AddTagsToStream` (map shape) / `RemoveTagsFromStream` (TagKeys list)
+   * APIs.
+   */
+  async applyTagDiff(streamName, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsFromStreamCommand({ StreamName: streamName, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream ${streamName}`);
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.getClient().send(
+        new AddTagsToStreamCommand({ StreamName: streamName, Tags: tagsToAdd })
+      );
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Kinesis stream ${streamName}`
+      );
+    }
+  }
   /**
    * Adopt an existing Kinesis stream into cdkd state.
    *
@@ -33786,6 +34674,8 @@ import {
   GetEventSelectorsCommand,
   ListTrailsCommand,
   ListTagsCommand as ListTagsCommand3,
+  AddTagsCommand as AddTagsCommand2,
+  RemoveTagsCommand as RemoveTagsCommand2,
   TrailNotFoundException
 } from "@aws-sdk/client-cloudtrail";
 var CloudTrailProvider = class {
@@ -33969,6 +34859,11 @@ var CloudTrailProvider = class {
           await this.getClient().send(new StartLoggingCommand({ Name: physicalId }));
         }
       }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated CloudTrail Trail ${logicalId}`);
       return { physicalId, wasReplaced: false };
     } catch (error) {
@@ -34017,6 +34912,46 @@ var CloudTrailProvider = class {
   getAttribute(_physicalId, _resourceType, attributeName) {
     return Promise.resolve(attributeName);
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via CloudTrail's
+   * `AddTags` / `RemoveTags` APIs. Note: CloudTrail's `RemoveTags` takes
+   * full `{Key, Value}` objects in `TagsList` (NOT just keys), unlike most
+   * other AWS services.
+   */
+  async applyTagDiff(trailArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const [k, v] of oldMap) {
+      if (!newMap.has(k))
+        tagsToRemove.push({ Key: k, Value: v });
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsCommand2({ ResourceId: trailArn, TagsList: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from CloudTrail Trail ${trailArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new AddTagsCommand2({ ResourceId: trailArn, TagsList: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on CloudTrail Trail ${trailArn}`);
+    }
+  }
   /**
    * Adopt an existing CloudTrail trail into cdkd state.
    *
@@ -35840,7 +36775,7 @@ import {
   SetRepositoryPolicyCommand,
   PutImageScanningConfigurationCommand,
   PutImageTagMutabilityCommand,
-  TagResourceCommand as TagResourceCommand7,
+  TagResourceCommand as TagResourceCommand15,
   ListTagsForResourceCommand as ListTagsForResourceCommand18,
   LifecyclePolicyNotFoundException,
   RepositoryNotFoundException
@@ -36006,7 +36941,7 @@ var ECRProvider = class {
         const repoArn = describeResponse.repositories?.[0]?.repositoryArn;
         if (repoArn && newTags) {
           await this.getClient().send(
-            new TagResourceCommand7({
+            new TagResourceCommand15({
               resourceArn: repoArn,
               tags: newTags
             })
@@ -42570,7 +43505,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.4");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.6");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());