@actsecurity/iam-lens 0.1.163 → 0.1.165

package/dist/esm/simulate/simulate.js

@@ -1,32 +1,95 @@
 import { iamActionDetails, iamActionExists, iamServiceExists } from '@actsecurity/iam-data';
 import {} from '@actsecurity/iam-policy';
-import { runSimulation } from '@actsecurity/iam-simulate';
+import { anonymousPrincipal, runSimulation } from '@actsecurity/iam-simulate';
 import { convertAssumedRoleArnToRoleArn, isAssumedRoleArn, isIamRoleArn, isS3BucketOrObjectArn, splitArnParts } from '@actsecurity/iam-utils';
 import { IamCollectClient } from '../collect/client.js';
 import { getAllPoliciesForPrincipal, isServiceLinkedRole, isServicePrincipal, principalExists } from '../principals.js';
 import { getAccountIdForResource, getRcpsForResource, getResourcePolicyForResource } from '../resources.js';
 import {} from '../utils/s3Abac.js';
 import { AssumeRoleActions } from '../utils/sts.js';
-import { CONTEXT_KEYS, contextValue, createContextKeys, knownContextKeys } from './contextKeys.js';
+import { CONTEXT_KEYS, contextValue, createContextKeys, isAnonymousPrincipalContextKey, knownContextKeys } from './contextKeys.js';
+import { externalResourcePolicy, syntheticIdentityPolicy } from './generatedPolicies.js';
 const kmsRetireGrantAction = 'kms:retiregrant';
 /**
- * Simulate an IAM request against the collected IAM data.
+ * Simulate an IAM request using the collected policies for both the principal and resource.
  *
- * @param simulationRequest the simulation request details.
- * @param collectClient the IAM collect client to use for data access.
- * @returns the simulation result, including the request and the evaluation result.
+ * @param simulationRequest the simulation request details
+ * @param collectClient the IAM collect client to use for data access
+ * @returns the normalized request and simulation result
  */
 export async function simulateRequest(simulationRequest, collectClient) {
-    const actionParts = simulationRequest.action.split(':');
-    const service = actionParts[0];
-    const serviceAction = actionParts[1];
+    return simulateRequestInternal({ ...simulationRequest }, 'normal', collectClient);
+}
+/**
+ * Simulate an unsigned request against a concrete resource ARN.
+ *
+ * @param simulationRequest the anonymous request details
+ * @param collectClient the IAM collect client to use for data access
+ * @returns the normalized anonymous request and simulation result
+ */
+export async function simulateAnonymousRequest(simulationRequest, collectClient) {
+    return simulateRequestInternal({ ...simulationRequest, principal: undefined }, 'anonymous', collectClient);
+}
+/**
+ * Simulate a request from an uncollected principal that has a synthetic administrator identity policy.
+ * SCPs and permission boundaries do not apply, while resource-side controls still apply.
+ * Wildcard-only actions are unsupported.
+ *
+ * @param simulationRequest the external principal request details
+ * @param collectClient the IAM collect client to use for resource-side data access
+ * @returns the normalized request and simulation result
+ */
+export async function simulateExternalPrincipalRequest(simulationRequest, collectClient) {
+    return simulateRequestInternal({ ...simulationRequest }, 'externalPrincipal', collectClient);
+}
+/**
+ * Simulate a collected principal accessing a resource outside the collected dataset.
+ * Wildcard-only actions are unsupported.
+ *
+ * @param simulationRequest the external resource request and optional resource/trust policy
+ * @param collectClient the IAM collect client to use for principal-side data access
+ * @returns the normalized request and simulation result
+ */
+export async function simulateExternalResourceRequest(simulationRequest, collectClient) {
+    return simulateRequestInternal({ ...simulationRequest }, 'externalResource', collectClient);
+}
+/**
+ * Assemble and run every simulation variant through one policy and context processing path.
+ *
+ * @param input the normalized caller input
+ * @param variant the policy-source behavior selected by the public entry point
+ * @param collectClient the IAM collect client used for applicable data lookups
+ * @returns the normalized request and simulation result
+ */
+async function simulateRequestInternal(input, variant, collectClient) {
+    const simulationRequest = { ...input };
+    if (variant === 'anonymous') {
+        const invalidContextKey = Object.keys(simulationRequest.customContextKeys).find(isAnonymousPrincipalContextKey);
+        if (invalidContextKey) {
+            throw new Error(`Anonymous simulations cannot specify principal-derived context key ${invalidContextKey}.`);
+        }
+    }
+    const [service, serviceAction] = simulationRequest.action.split(':');
     const serviceExists = await iamServiceExists(service);
     const actionExists = serviceExists && (await iamActionExists(service, serviceAction));
     if (!serviceExists || !actionExists) {
         throw new Error(`Unable to find action details for ${simulationRequest.action}`);
     }
     const actionDetails = await iamActionDetails(service, serviceAction);
-    // If it is a wildcard action, the resource account is always the principal account
+    if (actionDetails.isWildcardOnly && variant !== 'normal') {
+        const variantName = variant === 'anonymous'
+            ? 'Anonymous'
+            : variant === 'externalPrincipal'
+                ? 'External principal'
+                : 'External resource';
+        throw new Error(`${variantName} simulations do not support wildcard-only actions.`);
+    }
+    if (variant === 'anonymous' && !simulationRequest.resourceArn) {
+        throw new Error('Anonymous simulations require a concrete resource ARN.');
+    }
+    if (variant === 'externalResource' && !simulationRequest.resourceArn) {
+        throw new Error('External resource simulations require a concrete resource ARN.');
+    }
     if (actionDetails.isWildcardOnly) {
         simulationRequest.resourceAccount = splitArnParts(simulationRequest.principal).accountId;
     }
@@ -39,165 +102,255 @@ export async function simulateRequest(simulationRequest, collectClient) {
     if (!simulationRequest.resourceAccount) {
         throw new Error(`Unable to find account ID for resource ${simulationRequest.resourceArn}`);
     }
-    const principalFound = await principalExists(simulationRequest.principal, collectClient);
-    if (!principalFound && !simulationRequest.ignoreMissingPrincipal) {
-        throw new Error(`Principal ${simulationRequest.principal} does not exist. Use --ignore-missing-principal to ignore this.`);
+    const requiresCollectedPrincipal = variant === 'normal' || variant === 'externalResource';
+    if (requiresCollectedPrincipal) {
+        const principalFound = await principalExists(simulationRequest.principal, collectClient);
+        if (!principalFound) {
+            throw new Error(`Principal ${simulationRequest.principal} does not exist. Use --external-principal to test principals outside your dataset.`);
+        }
     }
+    const principalPolicyInputs = await principalPoliciesForVariant(variant, simulationRequest, collectClient);
+    const resourcePolicyInputs = await resourcePoliciesForVariant(variant, simulationRequest, service, actionDetails.isWildcardOnly, principalPolicyInputs.principalAccountRcps, collectClient);
     const request = {
         action: simulationRequest.action,
         resource: {
             resource: simulationRequest.resourceArn || '*',
             accountId: simulationRequest.resourceAccount
         },
-        principal: simulationRequest.principal,
+        principal: variant === 'anonymous' ? anonymousPrincipal : simulationRequest.principal,
         contextVariables: {}
     };
-    //Lookup the principal policies
-    const principalPolicies = await getAllPoliciesForPrincipal(collectClient, simulationRequest.principal);
-    const { resourcePolicy, resourceRcps } = await getResourcePolicies(collectClient, simulationRequest.action, simulationRequest.resourceArn, simulationRequest.resourceAccount);
-    const useResourcePolicy = simulationRequest.resourceArn &&
-        !(isIamRoleArn(simulationRequest.resourceArn) && service.toLowerCase() === 'iam');
-    if (AssumeRoleActions.has(simulationRequest.action.toLowerCase()) && !resourcePolicy) {
-        throw new Error(`Trust policy not found for resource ${simulationRequest.resourceArn}. sts assume role actions require a trust policy.`);
-    }
-    const principalArnForContext = await resolvePrincipalArnForContext(collectClient, simulationRequest.principal);
-    const { contextKeys, resourceTagsAreKnown } = await createContextKeys(collectClient, simulationRequest, service, simulationRequest.customContextKeys, principalArnForContext);
-    const vpcEndpointId = contextValue(contextKeys, CONTEXT_KEYS.vpcEndpointId);
-    let vpcEndpointPolicy = undefined;
-    if (vpcEndpointId && typeof vpcEndpointId === 'string') {
-        const vpcEndpointArn = await collectClient.getVpcEndpointArnForVpcEndpointId(vpcEndpointId);
-        if (vpcEndpointArn) {
-            const vpcPolicy = await collectClient.getVpcEndpointPolicyForArn(vpcEndpointArn);
-            if (vpcPolicy) {
-                vpcEndpointPolicy = { name: vpcEndpointArn, policy: vpcPolicy };
-            }
-        }
-    }
-    const applicableScps = isServiceLinkedRole(simulationRequest.principal)
-        ? []
-        : principalPolicies.scps;
+    const principalArnForContext = simulationRequest.principal
+        ? await resolvePrincipalArnForContext(collectClient, simulationRequest.principal)
+        : undefined;
+    const includeResourceMetadata = variant !== 'externalResource';
+    const { contextKeys, resourceTagsAreKnown } = await createContextKeys(collectClient, simulationRequest, service, simulationRequest.customContextKeys, principalArnForContext, { includeResourceMetadata });
+    const vpcEndpointPolicy = await getVpcEndpointPolicy(collectClient, contextKeys);
     request.contextVariables = contextKeys;
     const simulation = {
         request,
-        sessionPolicy: simulationRequest.sessionPolicy,
-        identityPolicies: prepareIdentityPolicies(simulationRequest.principal, principalPolicies),
-        serviceControlPolicies: applicableScps,
-        resourceControlPolicies: rcpsForRequest(simulationRequest.principal, actionDetails.isWildcardOnly, resourceRcps, principalPolicies.rcps),
-        resourcePolicy: useResourcePolicy ? resourcePolicy : undefined,
-        permissionBoundaryPolicies: preparePermissionBoundary(principalPolicies),
+        sessionPolicy: variant === 'anonymous' ? undefined : simulationRequest.sessionPolicy,
+        identityPolicies: principalPolicyInputs.identityPolicies,
+        serviceControlPolicies: principalPolicyInputs.serviceControlPolicies,
+        resourceControlPolicies: resourcePolicyInputs.resourceControlPolicies,
+        resourcePolicy: resourcePolicyInputs.resourcePolicy,
+        permissionBoundaryPolicies: principalPolicyInputs.permissionBoundaryPolicies,
         vpcEndpointPolicies: vpcEndpointPolicy ? [vpcEndpointPolicy] : undefined
     };
-    const s3BucketOrObjectRequest = simulationRequest.resourceArn && isS3BucketOrObjectArn(simulationRequest.resourceArn);
-    if (s3BucketOrObjectRequest) {
-        const [bucketAbacEnabled, blockPublicAccess] = await Promise.all([
-            evaluateAbacForBucket(simulationRequest.s3AbacOverride, collectClient, simulationRequest.resourceAccount, simulationRequest.resourceArn),
-            collectClient.getBlockPublicAccessEnabledForBucket(simulationRequest.resourceAccount, simulationRequest.resourceArn)
-        ]);
+    await applyS3Settings(simulation, simulationRequest, variant, collectClient);
+    const strictContextKeys = makeStrictContextKeys(simulationRequest, contextKeys, resourceTagsAreKnown, isS3BucketOrObjectArn(simulationRequest.resourceArn || ''));
+    const discoveryContextKeyConstraints = strictContextKeys.map((keyName) => discoveryConstraintForStrictKey(keyName, simulationRequest));
+    const result = await runSimulation(simulation, {
+        simulationMode: simulationRequest.simulationMode,
+        discoveryContextKeyConstraints
+    });
+    return { request, result };
+}
+/**
+ * Build all principal-side policy inputs for the selected simulation variant.
+ *
+ * Collected-principal variants prepare collected identity policies, SCPs, and permission
+ * boundaries. External principals receive only a synthetic administrator identity policy, while
+ * anonymous requests receive no principal-side policies.
+ *
+ * @param variant the simulation policy-source variant
+ * @param request the normalized request
+ * @param collectClient the data client
+ * @returns fully prepared principal-side simulation inputs
+ */
+async function principalPoliciesForVariant(variant, request, collectClient) {
+    if (variant === 'anonymous') {
+        return emptyPrincipalPolicyInputs();
+    }
+    if (variant === 'externalPrincipal') {
+        return {
+            ...emptyPrincipalPolicyInputs(),
+            identityPolicies: [syntheticIdentityPolicy]
+        };
+    }
+    const principalArn = request.principal;
+    const collectedPolicies = await getAllPoliciesForPrincipal(collectClient, principalArn);
+    return {
+        identityPolicies: prepareIdentityPolicies(principalArn, collectedPolicies),
+        serviceControlPolicies: collectedPolicies.scps,
+        permissionBoundaryPolicies: preparePermissionBoundary(collectedPolicies),
+        principalAccountRcps: collectedPolicies.rcps
+    };
+}
+/**
+ * Return principal-side policy inputs with no applicable policies.
+ *
+ * @returns empty principal-side simulation inputs
+ */
+function emptyPrincipalPolicyInputs() {
+    return {
+        identityPolicies: [],
+        serviceControlPolicies: [],
+        permissionBoundaryPolicies: undefined,
+        principalAccountRcps: []
+    };
+}
+/**
+ * Build all resource-side policy inputs for the selected simulation variant.
+ *
+ * This selects external versus collected resource policy behavior. All collected resource-policy
+ * and RCP applicability is delegated to `getResourcePolicies`.
+ *
+ * @param variant the simulation policy-source variant
+ * @param request the normalized request
+ * @param service the requested IAM service prefix
+ * @param actionIsWildcard whether the action uses the account-wide wildcard resource
+ * @param principalAccountRcps RCP hierarchy used by collected wildcard-only requests
+ * @param collectClient the data client
+ * @returns fully prepared resource-side simulation inputs
+ */
+async function resourcePoliciesForVariant(variant, request, service, actionIsWildcard, principalAccountRcps, collectClient) {
+    if (variant === 'externalResource') {
+        return {
+            resourcePolicy: externalResourcePolicy(request),
+            resourceControlPolicies: []
+        };
+    }
+    return getResourcePolicies(collectClient, request.action, service, request.resourceArn, request.resourceAccount, request.principal, actionIsWildcard, principalAccountRcps);
+}
+/**
+ * Look up the VPC endpoint policy selected by generated or caller-provided context.
+ *
+ * @param collectClient the data client
+ * @param contextKeys the normalized request context
+ * @returns the named endpoint policy when one is available
+ */
+async function getVpcEndpointPolicy(collectClient, contextKeys) {
+    const vpcEndpointId = contextValue(contextKeys, CONTEXT_KEYS.vpcEndpointId);
+    if (!vpcEndpointId || typeof vpcEndpointId !== 'string') {
+        return undefined;
+    }
+    const vpcEndpointArn = await collectClient.getVpcEndpointArnForVpcEndpointId(vpcEndpointId);
+    if (!vpcEndpointArn) {
+        return undefined;
+    }
+    const policy = await collectClient.getVpcEndpointPolicyForArn(vpcEndpointArn);
+    return policy ? { name: vpcEndpointArn, policy } : undefined;
+}
+/**
+ * Apply S3 ABAC and Block Public Access settings appropriate to the simulation variant.
+ *
+ * @param simulation the iam-simulate input to update
+ * @param request the normalized request
+ * @param variant the simulation policy-source variant
+ * @param collectClient the data client
+ */
+async function applyS3Settings(simulation, request, variant, collectClient) {
+    if (!request.resourceArn || !isS3BucketOrObjectArn(request.resourceArn)) {
+        return;
+    }
+    if (variant === 'externalResource') {
         simulation.additionalSettings = {
             s3: {
-                bucketAbacEnabled,
-                blockPublicAccess
+                bucketAbacEnabled: request.s3AbacOverride === 'enabled',
+                blockPublicAccess: false
             }
         };
+        return;
     }
-    // Assemble the strict context keys for the simulation
-    // Start with the default known context keys
-    const strictContextKeys = [
-        ...knownContextKeys,
-        ...(simulationRequest.additionalStrictContextKeys ?? [])
-    ];
-    if (!isIamRoleArn(simulationRequest.principal)) {
-        strictContextKeys.push(CONTEXT_KEYS.userId);
-    }
-    if (!simulationRequest.principal.endsWith(':root')) {
-        // Treat this as strict unless it is a root principal
-        strictContextKeys.push(CONTEXT_KEYS.assumedRoot);
+    const [bucketAbacEnabled, blockPublicAccess] = await Promise.all([
+        evaluateAbacForBucket(request.s3AbacOverride, collectClient, request.resourceAccount, request.resourceArn),
+        collectClient.getBlockPublicAccessEnabledForBucket(request.resourceAccount, request.resourceArn)
+    ]);
+    simulation.additionalSettings = { s3: { bucketAbacEnabled, blockPublicAccess } };
+}
+/**
+ * Assemble strict Discovery context-key constraints for a normalized request.
+ *
+ * @param request the normalized request
+ * @param contextKeys generated and caller-provided context values
+ * @param resourceTagsAreKnown whether all resource tags are known
+ * @param s3BucketOrObjectRequest whether S3 bucket tag keys apply
+ * @returns strict literal keys and key patterns
+ */
+function makeStrictContextKeys(request, contextKeys, resourceTagsAreKnown, s3BucketOrObjectRequest) {
+    const strictContextKeys = [...knownContextKeys, ...(request.additionalStrictContextKeys ?? [])];
+    if (!request.principal) {
+        strictContextKeys.push(CONTEXT_KEYS.userId, CONTEXT_KEYS.assumedRoot, '/^aws:PrincipalTag\/.*/');
     }
-    // S3 Access Points are Not Supported Right Now, Don't Add Noise
-    if (simulationRequest.action.startsWith('s3:')) {
-        strictContextKeys.push('s3:DataAccessPointAccount');
-        strictContextKeys.push('s3:DataAccessPointArn');
+    else {
+        if (!isIamRoleArn(request.principal)) {
+            strictContextKeys.push(CONTEXT_KEYS.userId);
+        }
+        if (!request.principal.endsWith(':root')) {
+            strictContextKeys.push(CONTEXT_KEYS.assumedRoot);
+        }
     }
-    // Add the custom context keys from the simulation request
-    for (const key of Object.keys(simulationRequest.customContextKeys)) {
-        strictContextKeys.push(key);
+    if (request.action.startsWith('s3:')) {
+        strictContextKeys.push('s3:DataAccessPointAccount', 's3:DataAccessPointArn');
     }
-    //If we know the tag keys, just make all tag keys strict
+    strictContextKeys.push(...Object.keys(request.customContextKeys));
     if (resourceTagsAreKnown) {
         strictContextKeys.push('/^aws:ResourceTag\/.*/');
         if (s3BucketOrObjectRequest) {
             strictContextKeys.push('/^s3:BucketTag\/.*/');
         }
     }
-    // There also may be other tag context keys, so add those too
     for (const key of Object.keys(contextKeys)) {
         if (key.toLowerCase().includes('tag/')) {
             strictContextKeys.push(key);
         }
     }
-    const discoveryContextKeyConstraints = strictContextKeys.map((keyName) => discoveryConstraintForStrictKey(keyName, simulationRequest));
-    const result = await runSimulation(simulation, {
-        simulationMode: simulationRequest.simulationMode,
-        discoveryContextKeyConstraints
-    });
-    return { request, result };
+    return strictContextKeys;
 }
 const awsSourceKeyPrefix = 'aws:source';
+const anonymousAbsentContextKeys = new Set([
+    'aws:principalarn',
+    'aws:principalaccount',
+    'aws:principalorgid',
+    'aws:principalorgpaths',
+    'aws:username',
+    'aws:userid',
+    'aws:principalisawsservice',
+    'aws:principalservicename',
+    'aws:sourceaccount',
+    'aws:sourceorgid',
+    'aws:sourceorgpaths',
+    'aws:sourceowner',
+    'aws:sourcearn',
+    'aws:assumedroot',
+    'kms:calleraccount',
+    '/^aws:principaltag\/.*/'
+]);
 /**
- * Converts an iam-lens strict context key into an iam-simulate Discovery constraint.
- *
- * Caller-provided keys are always authoritative. Other strict keys preserve the
- * existing behavior where both presence and value are authoritative. Service
- * source context keys are different during who-can discovery: iam-lens supplies
- * resource-derived placeholder values, but the actual source account/org for a
- * service principal request may differ. Treating those values as unknown lets
- * who-can return conditional access instead of incorrectly denying service-principal
- * statements.
+ * Convert an iam-lens strict context key into an iam-simulate Discovery constraint.
  *
  * @param keyName the literal context key or slash-delimited key pattern
- * @param simulationRequest the request whose context-key certainty is being modeled
+ * @param simulationRequest the normalized request whose context certainty is modeled
  * @returns the Discovery constraint to pass to iam-simulate
  * @internal
  */
 export function discoveryConstraintForStrictKey(keyName, simulationRequest) {
     if (hasCustomContextKey(simulationRequest.customContextKeys, keyName)) {
-        return {
-            keyName,
-            presenceIsKnown: true,
-            valueIsKnown: true
-        };
+        return { keyName, presenceIsKnown: true, valueIsKnown: true };
+    }
+    if (simulationRequest.principal === undefined &&
+        anonymousAbsentContextKeys.has(keyName.toLowerCase())) {
+        return { keyName, presenceIsKnown: true, valueIsKnown: true };
     }
     const isServiceCallerAccountInDiscovery = keyName.localeCompare('kms:CallerAccount', undefined, { sensitivity: 'base' }) === 0 &&
         simulationRequest.simulationMode === 'Discovery' &&
+        simulationRequest.principal !== undefined &&
         isServicePrincipal(simulationRequest.principal);
     if (isServiceCallerAccountInDiscovery) {
-        // AWS supplies this key for service-mediated KMS calls, but iam-lens does not know
-        // its value. Keep its presence authoritative while reporting conditional access.
-        return {
-            keyName,
-            presenceIsKnown: true,
-            valueIsKnown: false
-        };
+        return { keyName, presenceIsKnown: true, valueIsKnown: false };
     }
     if (keyName.slice(0, 10).localeCompare(awsSourceKeyPrefix, undefined, { sensitivity: 'base' }) === 0) {
-        return {
-            keyName,
-            presenceIsKnown: true,
-            valueIsKnown: false
-        };
+        return { keyName, presenceIsKnown: true, valueIsKnown: false };
     }
-    return {
-        keyName,
-        presenceIsKnown: true,
-        valueIsKnown: true
-    };
+    return { keyName, presenceIsKnown: true, valueIsKnown: true };
 }
 /**
- * Checks whether a caller supplied a context key using IAM's case-insensitive key matching.
+ * Check whether a caller supplied a context key using IAM's case-insensitive matching.
  *
- * @param customContextKeys the caller-provided context values
- * @param keyName the context key to look up
- * @returns whether the caller supplied a value for the key
+ * @param customContextKeys caller-provided context values
+ * @param keyName context key to look up
+ * @returns whether the caller supplied the key
  */
 function hasCustomContextKey(customContextKeys, keyName) {
     if (Object.hasOwn(customContextKeys, keyName)) {
@@ -206,65 +359,67 @@ function hasCustomContextKey(customContextKeys, keyName) {
     return Object.keys(customContextKeys).some((customKey) => customKey.toLowerCase() === keyName.toLowerCase());
 }
 /**
- * Retrieves resource policies and the RCP hierarchy applicable to a simulation request.
+ * Retrieve a collected resource policy and all applicable RCPs for a request.
  *
- * AWS does not apply RCPs to `kms:RetireGrant` or AWS-managed KMS keys, so those
- * requests retain their resource policy while omitting the RCP hierarchy.
+ * This applies non-variant resource-policy and RCP rules, including trust-policy requirements,
+ * IAM role identity-policy resources, wildcard-only actions, service-linked roles,
+ * `kms:RetireGrant`, AWS-managed KMS keys, and the implicit full-access RCP.
  *
- * @param collectClient the IAM collect client to use for data access
+ * @param collectClient the data client
  * @param action the action being simulated
- * @param resourceArn the ARN of the resource being accessed
- * @param resourceAccount the account ID of the resource, if known
- * @returns the resource policy and applicable RCP hierarchy for the request
+ * @param service the requested IAM service prefix
+ * @param resourceArn the resource ARN
+ * @param resourceAccount the resource account
+ * @param principalArn the authenticated principal ARN, when present
+ * @param actionIsWildcard whether the action uses the account-wide wildcard resource
+ * @param principalAccountRcps RCP hierarchy for the principal account
+ * @returns the resource policy and filtered RCP hierarchies applicable to the request
  */
-async function getResourcePolicies(collectClient, action, resourceArn, resourceAccount) {
-    if (!resourceArn) {
-        return { resourcePolicy: undefined, resourceRcps: [] };
-    }
-    const resourcePolicy = await getResourcePolicyForResource(collectClient, resourceArn, resourceAccount);
-    if (action.localeCompare(kmsRetireGrantAction, undefined, { sensitivity: 'base' }) === 0) {
-        return { resourcePolicy, resourceRcps: [] };
-    }
-    const resourceArnParts = splitArnParts(resourceArn);
-    const isAwsManagedKmsKey = resourceArnParts.service === 'kms' &&
-        resourceArnParts.resourceType === 'key' &&
-        resourceAccount !== undefined &&
-        (await collectClient.isAwsManagedKmsKey(resourceArn, resourceAccount));
-    const resourceRcps = isAwsManagedKmsKey
-        ? []
-        : await getRcpsForResource(collectClient, resourceArn, resourceAccount);
-    return { resourcePolicy, resourceRcps };
-}
-function rcpsForRequest(principalArn, actionIsWildcard, resourceRcps, principalRcps) {
-    if (isServiceLinkedRole(principalArn)) {
-        return [];
+async function getResourcePolicies(collectClient, action, service, resourceArn, resourceAccount, principalArn, actionIsWildcard, principalAccountRcps) {
+    const resourcePolicy = resourceArn
+        ? await getResourcePolicyForResource(collectClient, resourceArn, resourceAccount)
+        : undefined;
+    // AWS does not apply RCPs when a service principal assumes a service-linked role.
+    const servicePrincipalAssumesServiceLinkedRole = principalArn !== undefined &&
+        resourceArn !== undefined &&
+        isServicePrincipal(principalArn) &&
+        isServiceLinkedRole(resourceArn);
+    let resourceRcps = [];
+    if (resourceArn &&
+        !servicePrincipalAssumesServiceLinkedRole &&
+        action.localeCompare(kmsRetireGrantAction, undefined, { sensitivity: 'base' }) !== 0) {
+        const resourceArnParts = splitArnParts(resourceArn);
+        const isAwsManagedKmsKey = resourceArnParts.service === 'kms' &&
+            resourceArnParts.resourceType === 'key' &&
+            resourceAccount !== undefined &&
+            (await collectClient.isAwsManagedKmsKey(resourceArn, resourceAccount));
+        if (!isAwsManagedKmsKey) {
+            resourceRcps = await getRcpsForResource(collectClient, resourceArn, resourceAccount);
+        }
     }
-    let theRcps = resourceRcps;
-    if (actionIsWildcard) {
-        theRcps = principalRcps;
+    const applicableRcps = principalArn && isServiceLinkedRole(principalArn)
+        ? []
+        : actionIsWildcard
+            ? principalAccountRcps
+            : resourceRcps;
+    if (AssumeRoleActions.has(action.toLowerCase()) && !resourcePolicy) {
+        throw new Error(`Trust policy not found for resource ${resourceArn}. sts assume role actions require a trust policy.`);
     }
-    return theRcps.map((rcp) => {
-        rcp.orgIdentifier;
-        return {
+    const useResourcePolicy = resourceArn !== undefined && !(isIamRoleArn(resourceArn) && service.toLowerCase() === 'iam');
+    return {
+        resourcePolicy: useResourcePolicy ? resourcePolicy : undefined,
+        resourceControlPolicies: applicableRcps.map((rcp) => ({
             orgIdentifier: rcp.orgIdentifier,
-            policies: rcp.policies.filter((policy) => {
-                return !policy.name.toLowerCase().endsWith('rcpfullawsaccess');
-            })
-        };
-    });
+            policies: rcp.policies.filter((policy) => !policy.name.toLowerCase().endsWith('rcpfullawsaccess'))
+        }))
+    };
 }
 /**
- * Resolves the principal ARN to use for role-backed context keys.
+ * Resolve the canonical role ARN used for role-backed context keys.
  *
- * Direct simulations can use STS assumed-role session ARNs, but collected tags
- * and the canonical `aws:PrincipalArn` value belong to the underlying IAM role.
- * This function performs the collected-data lookup only after the principal ARN
- * passes the cheap assumed-role ARN check, avoiding unnecessary storage lookups
- * for users, role ARNs, root principals, and service principals.
- *
- * @param collectClient the IAM collect client to use for resolving role ARNs
- * @param principalArn the simulation principal ARN or service principal
- * @returns the canonical role ARN for assumed-role sessions, otherwise undefined
+ * @param collectClient the data client
+ * @param principalArn the request principal ARN
+ * @returns the canonical role ARN for an assumed-role session, otherwise undefined
  */
 async function resolvePrincipalArnForContext(collectClient, principalArn) {
     if (!isAssumedRoleArn(principalArn)) {
@@ -273,33 +428,30 @@ async function resolvePrincipalArnForContext(collectClient, principalArn) {
     return ((await collectClient.resolvePrincipalArn(principalArn)) ??
         convertAssumedRoleArnToRoleArn(principalArn));
 }
+/**
+ * Flatten collected managed, inline, and group policies into iam-simulate identity inputs.
+ *
+ * @param principalArn the principal whose inline policy names are qualified
+ * @param principalPolicies collected policies for the principal
+ * @returns named identity policy inputs
+ */
 function prepareIdentityPolicies(principalArn, principalPolicies) {
-    //Collect unique managed policies
     const uniqueIdentityPolicies = {};
     principalPolicies.managedPolicies.forEach((policy) => {
         if (!uniqueIdentityPolicies[policy.arn]) {
-            uniqueIdentityPolicies[policy.arn] = {
-                name: policy.arn,
-                policy: policy.policy
-            };
+            uniqueIdentityPolicies[policy.arn] = { name: policy.arn, policy: policy.policy };
         }
     });
     principalPolicies.groupPolicies?.forEach((groupPolicy) => {
         groupPolicy.managedPolicies.forEach((policy) => {
             if (!uniqueIdentityPolicies[policy.arn]) {
-                uniqueIdentityPolicies[policy.arn] = {
-                    name: policy.arn,
-                    policy: policy.policy
-                };
+                uniqueIdentityPolicies[policy.arn] = { name: policy.arn, policy: policy.policy };
             }
         });
     });
     const identityPolicies = Object.values(uniqueIdentityPolicies);
     principalPolicies.inlinePolicies.forEach((policy) => {
-        identityPolicies.push({
-            name: `${principalArn}#${policy.name}`,
-            policy: policy.policy
-        });
+        identityPolicies.push({ name: `${principalArn}#${policy.name}`, policy: policy.policy });
     });
     principalPolicies.groupPolicies?.forEach((groupPolicy) => {
         groupPolicy.inlinePolicies.forEach((policy) => {
@@ -311,17 +463,30 @@ function prepareIdentityPolicies(principalArn, principalPolicies) {
     });
     return identityPolicies;
 }
+/**
+ * Convert a collected permission boundary into iam-simulate inputs.
+ *
+ * @param principalPolicies collected policies for the principal
+ * @returns the named boundary policy or undefined
+ */
 function preparePermissionBoundary(principalPolicies) {
-    if (principalPolicies.permissionBoundary) {
-        return [
-            {
-                name: principalPolicies.permissionBoundary.arn,
-                policy: principalPolicies.permissionBoundary.policy
-            }
-        ];
+    if (!principalPolicies.permissionBoundary) {
+        return undefined;
     }
-    return undefined;
+    return [
+        {
+            name: principalPolicies.permissionBoundary.arn,
+            policy: principalPolicies.permissionBoundary.policy
+        }
+    ];
 }
+/**
+ * Compare an actual simulation decision with an optional expected result.
+ *
+ * @param expected expected result or AnyDeny
+ * @param result actual evaluation result
+ * @returns whether the result satisfies the expectation
+ */
 export function resultMatchesExpectation(expected, result) {
     if (!expected) {
         return true;
@@ -332,14 +497,13 @@ export function resultMatchesExpectation(expected, result) {
     return expected === result;
 }
 /**
- * Evaluates whether ABAC (Attribute-Based Access Control) is enabled for a given S3 bucket or object.
- * The evaluation can be overridden by the `s3AbacOverride` parameter.
+ * Evaluate whether S3 ABAC is enabled for a bucket or object.
  *
- * @param s3AbacOverride the override setting for S3 ABAC or undefined to auto-detect
- * @param collectClient the IAM collect client to use for data access
- * @param bucketAccountId the account ID the bucket belongs to
- * @param bucketOrObjectArn the ARN of the bucket or bucket object
- * @returns whether ABAC should be used to evaluate access for the bucket or object
+ * @param s3AbacOverride caller override or undefined for collected detection
+ * @param collectClient the data client
+ * @param bucketAccountId the bucket account
+ * @param bucketOrObjectArn the bucket or object ARN
+ * @returns whether S3 ABAC is enabled
  */
 async function evaluateAbacForBucket(s3AbacOverride, collectClient, bucketAccountId, bucketOrObjectArn) {
     if (s3AbacOverride === 'enabled') {