CDK and the tale of the removed secret

I have a CDK script that uses a secret as part of the script. Works pretty well:

const PARAM_PREFIX = '/autofrog-ha-skill';
const alexaVendorId = ssm.StringParameter.valueForStringParameter(this, `${PARAM_PREFIX}/alexa-developer-vendor-id`);
const lwaClientId = ssm.StringParameter.valueForStringParameter(this, `${PARAM_PREFIX}/lwa-client-id`);

const secret = Secret.fromSecretNameV2(this, 'secrets', `${PARAM_PREFIX}/secrets`);
const lwaClientSecret = SecretValue.secretsManager(secret.secretArn, {            jsonField: 'lwa_client_secret'        });
const lwaRefreshToken = SecretValue.secretsManager(secret.secretArn, {            jsonField: 'lwa_refresh_token'        });

but I wanted to rename the secret, which necessarily lives outside of CloudFormation. I cancelled the secret under the old name and created a new secret under the new name, then tried to do an update:

You can't perform this operation on the secret because it was marked for deletion.
(Service: AWSSecretsManager; Status Code: 400; Error Code: InvalidRequestException

Not good! I'm experienced with CDK so I know now to go manually touching things that are part of the stack. In this case, though, I didn't think there would be any reason why updating the stack would make it want to touch or see the old secret.

I was able to fix the problem by restoring the cancelled secrets then doing an update. Then I went back and deleted the old secrets and CDK was happy again. I still think the hardest part of CloudFormation and CDK is this kind of thing, where you get your stack into a situation where it can't be updated because it's out of sync.

In this case, it's the [cdk-alexa-skill[(https://github.com/aws-samples/cdk-alexa-skill) resource trying to access the old secret in order to update the skill. Does anybody have any idea why it would be trying to do that?