@gugananuvem/aws-local-simulator 1.0.34 → 1.0.39

package/src/services/s3/simulator.js

@@ -8,6 +8,7 @@ const path = require("path");
 const LocalStore = require("../../utils/local-store");
 const logger = require("../../utils/logger");
 const { CloudTrailAudit } = require("../../utils/cloudtrail-audit");
+const PresignedUrlGenerator = require("./presigned-url-generator");
 
 class S3Simulator {
   constructor(config) {
@@ -16,8 +17,20 @@ class S3Simulator {
     this.store = new LocalStore(this.dataDir);
     this.buckets = new Map();
     this.audit = new CloudTrailAudit("s3.amazonaws.com");
+    this.lambdaService = null;
+    this.snsService = null;
+    this.sqsService = null;
+    this.eventbridgeService = null;
+    this.region = "us-east-1";
+    this.accountId = "000000000000";
+    this.presignedUrlGenerator = new PresignedUrlGenerator(config);
   }
 
+  setLambdaService(service) { this.lambdaService = service; }
+  setSnsService(service) { this.snsService = service; }
+  setSqsService(service) { this.sqsService = service; }
+  setEventbridgeService(service) { this.eventbridgeService = service; }
+
   async initialize() {
     logger.debug("Inicializando S3 Simulator...");
     this.loadBuckets();
@@ -49,6 +62,7 @@ class S3Simulator {
             objects,
             objectCount: data.objectCount || 0,
             totalSize: data.totalSize || 0,
+            notificationConfiguration: data.notificationConfiguration || null,
           });
         }
       }
@@ -57,13 +71,14 @@ class S3Simulator {
     // Cria buckets definidos na config que ainda não existem
     if (this.config.s3?.buckets) {
       for (const bucketDef of this.config.s3.buckets) {
-        // suporta string simples ou objeto { name, region, websiteConfiguration }
+        // suporta string simples ou objeto { name, region, websiteConfiguration, notificationConfiguration }
         const bucketName     = typeof bucketDef === "string" ? bucketDef : bucketDef.name;
         const region         = typeof bucketDef === "object" ? (bucketDef.region || "us-east-1") : "us-east-1";
         const websiteConfig  = typeof bucketDef === "object" ? (bucketDef.websiteConfiguration || null) : null;
+        const notificationConfig = typeof bucketDef === "object" ? (bucketDef.notificationConfiguration || null) : null;
 
         if (!this.buckets.has(bucketName)) {
-          this.createBucket(bucketName, { region, websiteConfiguration: websiteConfig });
+          this.createBucket(bucketName, { region, websiteConfiguration: websiteConfig, notificationConfiguration: notificationConfig });
         }
       }
     }
@@ -111,7 +126,7 @@ class S3Simulator {
       return { error: { code: "BucketAlreadyExists", message: "Bucket already exists" }, status: 409 };
     }
 
-    const { region = "us-east-1", websiteConfiguration = null } = options;
+    const { region = "us-east-1", websiteConfiguration = null, notificationConfiguration = null } = options;
 
     const bucket = {
       name: bucketName,
@@ -127,11 +142,13 @@ class S3Simulator {
       objects: new Map(),
       objectCount: 0,
       totalSize: 0,
+      notificationConfiguration: this._normalizeNotificationConfig(notificationConfiguration),
+      policy: null, // Bucket policy para controle de acesso
     };
 
     this.buckets.set(bucketName, bucket);
     this.persistBuckets();
-    logger.debug(`✅ Bucket S3 criado: ${bucketName} (region: ${region}${websiteConfiguration ? ", website: enabled" : ""})`);
+    logger.debug(`✅ Bucket S3 criado: ${bucketName} (region: ${region}${websiteConfiguration ? ", website: enabled" : ""}${bucket.notificationConfiguration ? ", notifications: enabled" : ""})`);
     this.audit.record({ eventName: "CreateBucket", readOnly: false, resources: [{ ARN: `arn:aws:s3:::${bucketName}`, type: "AWS::S3::Bucket" }], requestParameters: { bucketName } });
     return { bucket };
   }
@@ -152,6 +169,82 @@ class S3Simulator {
     return { success: true };
   }
 
+  /**
+   * Definir política do bucket (bucket policy)
+   * Controla quem pode acessar o bucket e seus objetos
+   */
+  putBucketPolicy(bucketName, policy) {
+    const bucket = this.buckets.get(bucketName);
+    if (!bucket) {
+      return { error: { code: "NoSuchBucket", message: "Bucket does not exist" }, status: 404 };
+    }
+
+    try {
+      // Validar que é um JSON válido
+      const policyObject = typeof policy === 'string' ? JSON.parse(policy) : policy;
+      
+      if (!policyObject.Statement || !Array.isArray(policyObject.Statement)) {
+        return { error: { code: "InvalidPolicyDocument", message: "Invalid bucket policy" }, status: 400 };
+      }
+
+      bucket.policy = policyObject;
+      this.persistBuckets();
+      
+      logger.debug(`📋 Política de bucket definida: ${bucketName}`);
+      this.audit.record({ 
+        eventName: "PutBucketPolicy", 
+        readOnly: false, 
+        resources: [{ ARN: `arn:aws:s3:::${bucketName}`, type: "AWS::S3::Bucket" }],
+        requestParameters: { bucketName, policy: policyObject }
+      });
+      
+      return { success: true };
+    } catch (error) {
+      return { error: { code: "InvalidPolicyDocument", message: error.message }, status: 400 };
+    }
+  }
+
+  /**
+   * Obter política do bucket
+   */
+  getBucketPolicy(bucketName) {
+    const bucket = this.buckets.get(bucketName);
+    if (!bucket) {
+      return { error: { code: "NoSuchBucket", message: "Bucket does not exist" }, status: 404 };
+    }
+
+    if (!bucket.policy) {
+      return { error: { code: "NoSuchBucketPolicy", message: "The bucket policy does not exist" }, status: 404 };
+    }
+
+    return {
+      policy: bucket.policy,
+      status: 200
+    };
+  }
+
+  /**
+   * Deletar política do bucket
+   */
+  deleteBucketPolicy(bucketName) {
+    const bucket = this.buckets.get(bucketName);
+    if (!bucket) {
+      return { error: { code: "NoSuchBucket", message: "Bucket does not exist" }, status: 404 };
+    }
+
+    bucket.policy = null;
+    this.persistBuckets();
+    
+    logger.debug(`🗑️ Política de bucket deletada: ${bucketName}`);
+    this.audit.record({ 
+      eventName: "DeleteBucketPolicy", 
+      readOnly: false, 
+      resources: [{ ARN: `arn:aws:s3:::${bucketName}`, type: "AWS::S3::Bucket" }]
+    });
+    
+    return { success: true };
+  }
+
   listBuckets() {
     return Array.from(this.buckets.values()).map((bucket) => ({
       Name: bucket.name,
@@ -180,6 +273,7 @@ class S3Simulator {
       region: bucket.region,
       website: bucket.website,
       websiteConfiguration: bucket.websiteConfiguration,
+      notificationConfiguration: bucket.notificationConfiguration,
       creationDate: bucket.creationDate,
       objectCount: bucket.objectCount,
       totalSize: bucket.totalSize,
@@ -267,6 +361,20 @@ class S3Simulator {
 
     logger.verboso(`📤 Upload S3: ${bucketName}/${key} (${body.length} bytes)`);
     this.audit.record({ eventName: "PutObject", readOnly: false, isDataEvent: true, resources: [{ ARN: `arn:aws:s3:::${bucketName}/${key}`, type: "AWS::S3::Object" }], requestParameters: { bucketName, key, contentType }, responseElements: { etag } });
+
+    this._triggerS3Event(bucketName, key, {
+      eventName: oldObject ? "ObjectCreated:Put" : "ObjectCreated:Put",
+      eventType: "ObjectCreated",
+      objectInfo: {
+        key,
+        size: body.length,
+        etag,
+        contentType,
+        metadata,
+        sequencer: crypto.randomBytes(8).toString("hex").toUpperCase(),
+      },
+    });
+
     return { etag };
   }
 
@@ -338,6 +446,19 @@ class S3Simulator {
       this.persistBucket(bucketName);
       logger.verboso(`🗑️ Delete S3: ${bucketName}/${key}`);
       this.audit.record({ eventName: "DeleteObject", readOnly: false, isDataEvent: true, resources: [{ ARN: `arn:aws:s3:::${bucketName}/${key}`, type: "AWS::S3::Object" }], requestParameters: { bucketName, key } });
+
+      this._triggerS3Event(bucketName, key, {
+        eventName: "ObjectRemoved:Delete",
+        eventType: "ObjectRemoved",
+        objectInfo: {
+          key,
+          size: object.size,
+          etag: object.etag,
+          contentType: object.contentType,
+          metadata: object.metadata,
+          sequencer: crypto.randomBytes(8).toString("hex").toUpperCase(),
+        },
+      });
     }
     return { success: true };
   }
@@ -397,6 +518,302 @@ class S3Simulator {
     }));
   }
 
+  // ─── Notification Configuration ───────────────────────────────────────────
+
+  _normalizeNotificationConfig(config) {
+    if (!config) return null;
+    const normalized = {
+      LambdaFunctionConfigurations: [],
+      QueueConfigurations: [],
+      TopicConfigurations: [],
+    };
+    const validEvents = [
+      "s3:ObjectCreated:*",
+      "s3:ObjectCreated:Put",
+      "s3:ObjectCreated:Post",
+      "s3:ObjectCreated:Copy",
+      "s3:ObjectCreated:CompleteMultipartUpload",
+      "s3:ObjectRemoved:*",
+      "s3:ObjectRemoved:Delete",
+      "s3:ObjectRemoved:DeleteMarkerCreated",
+      "s3:ObjectRestore:*",
+      "s3:ObjectRestore:Post",
+      "s3:ObjectRestore:Completed",
+      "s3:ReducedRedundancyLostObject",
+      "s3:Replication:*",
+      "s3:Replication:OperationFailedReplication",
+      "s3:Replication:OperationNotTracked",
+      "s3:Replication:OperationMissedThreshold",
+      "s3:Replication:OperationReplicatedAfterThreshold",
+      "s3:LifecycleExpiration:*",
+      "s3:LifecycleExpiration:Delete",
+      "s3:LifecycleExpiration:DeleteMarkerCreated",
+      "s3:LifecycleTransition",
+      "s3:IntelligentTiering",
+      "s3:ObjectTagging:*",
+      "s3:ObjectTagging:Put",
+      "s3:ObjectTagging:Delete",
+      "s3:ObjectAcl:Put",
+    ];
+
+    if (Array.isArray(config.LambdaFunctionConfigurations)) {
+      for (const cfg of config.LambdaFunctionConfigurations) {
+        if (!cfg.LambdaFunctionArn) continue;
+        normalized.LambdaFunctionConfigurations.push({
+          Id: cfg.Id || crypto.randomUUID(),
+          LambdaFunctionArn: cfg.LambdaFunctionArn,
+          Events: cfg.Events?.filter((e) => validEvents.includes(e)) || ["s3:ObjectCreated:*"],
+          Filter: this._normalizeFilter(cfg.Filter),
+        });
+      }
+    }
+    if (Array.isArray(config.QueueConfigurations)) {
+      for (const cfg of config.QueueConfigurations) {
+        if (!cfg.QueueArn) continue;
+        normalized.QueueConfigurations.push({
+          Id: cfg.Id || crypto.randomUUID(),
+          QueueArn: cfg.QueueArn,
+          Events: cfg.Events?.filter((e) => validEvents.includes(e)) || ["s3:ObjectCreated:*"],
+          Filter: this._normalizeFilter(cfg.Filter),
+        });
+      }
+    }
+    if (Array.isArray(config.TopicConfigurations)) {
+      for (const cfg of config.TopicConfigurations) {
+        if (!cfg.TopicArn) continue;
+        normalized.TopicConfigurations.push({
+          Id: cfg.Id || crypto.randomUUID(),
+          TopicArn: cfg.TopicArn,
+          Events: cfg.Events?.filter((e) => validEvents.includes(e)) || ["s3:ObjectCreated:*"],
+          Filter: this._normalizeFilter(cfg.Filter),
+        });
+      }
+    }
+
+    const hasAny =
+      normalized.LambdaFunctionConfigurations.length > 0 ||
+      normalized.QueueConfigurations.length > 0 ||
+      normalized.TopicConfigurations.length > 0;
+    return hasAny ? normalized : null;
+  }
+
+  _normalizeFilter(filter) {
+    if (!filter || !filter.Key) return null;
+    const rules = [];
+    if (Array.isArray(filter.Key.FilterRules)) {
+      for (const r of filter.Key.FilterRules) {
+        if (r.Name === "prefix" || r.Name === "suffix") {
+          rules.push({ Name: r.Name, Value: r.Value });
+        }
+      }
+    }
+    return rules.length > 0 ? { Key: { FilterRules: rules } } : null;
+  }
+
+  _matchesFilter(filter, key) {
+    if (!filter || !filter.Key || !Array.isArray(filter.Key.FilterRules)) return true;
+    for (const rule of filter.Key.FilterRules) {
+      const val = rule.Value || "";
+      if (rule.Name === "prefix" && !key.startsWith(val)) return false;
+      if (rule.Name === "suffix" && !key.endsWith(val)) return false;
+    }
+    return true;
+  }
+
+  _matchesEvent(configuredEvents, eventName, eventType) {
+    if (!Array.isArray(configuredEvents) || configuredEvents.length === 0) return true;
+    const s3EventName = `s3:${eventName}`;
+    const s3EventType = `s3:${eventType}:*`;
+    for (const ev of configuredEvents) {
+      if (ev === s3EventName) return true;
+      if (ev === s3EventType) return true;
+      if (ev === "s3:ObjectCreated:*" && eventType === "ObjectCreated") return true;
+      if (ev === "s3:ObjectRemoved:*" && eventType === "ObjectRemoved") return true;
+    }
+    return false;
+  }
+
+  _buildS3EventRecord(bucketName, key, ctx) {
+    const bucket = this.buckets.get(bucketName);
+    const region = bucket?.region || this.region;
+    const info = ctx.objectInfo || {};
+    return {
+      eventVersion: "2.1",
+      eventSource: "aws:s3",
+      awsRegion: region,
+      eventTime: new Date().toISOString(),
+      eventName: ctx.eventName,
+      userIdentity: { principalId: "AWSLocalSimulator" },
+      requestParameters: { sourceIPAddress: "127.0.0.1" },
+      responseElements: {
+        "x-amz-request-id": crypto.randomUUID(),
+        "x-amz-id-2": crypto.randomBytes(24).toString("base64"),
+      },
+      s3: {
+        s3SchemaVersion: "1.0",
+        configurationId: ctx.configId || "bucket-notification-config",
+        bucket: {
+          name: bucketName,
+          ownerIdentity: { principalId: "AIDAJDPLRKLG7UEXAMPLE" },
+          arn: `arn:aws:s3:::${bucketName}`,
+        },
+        object: {
+          key: encodeURIComponent(key),
+          size: info.size || 0,
+          eTag: info.etag ? `"${info.etag}"` : undefined,
+          versionId: undefined,
+          sequencer: info.sequencer || crypto.randomBytes(8).toString("hex").toUpperCase(),
+        },
+      },
+    };
+  }
+
+  async _triggerS3Event(bucketName, key, ctx) {
+    try {
+      const bucket = this.buckets.get(bucketName);
+      if (!bucket) return;
+
+      const record = this._buildS3EventRecord(bucketName, key, ctx);
+      const s3EventPayload = { Records: [record] };
+
+      if (bucket.notificationConfiguration) {
+        for (const cfg of bucket.notificationConfiguration.LambdaFunctionConfigurations || []) {
+          if (!this._matchesEvent(cfg.Events, ctx.eventName, ctx.eventType)) continue;
+          if (!this._matchesFilter(cfg.Filter, key)) continue;
+          record.s3.configurationId = cfg.Id;
+          this._deliverToLambda(cfg.LambdaFunctionArn, { Records: [this._buildS3EventRecord(bucketName, key, { ...ctx, configId: cfg.Id })] });
+        }
+        for (const cfg of bucket.notificationConfiguration.QueueConfigurations || []) {
+          if (!this._matchesEvent(cfg.Events, ctx.eventName, ctx.eventType)) continue;
+          if (!this._matchesFilter(cfg.Filter, key)) continue;
+          this._deliverToSQS(cfg.QueueArn, { Records: [this._buildS3EventRecord(bucketName, key, { ...ctx, configId: cfg.Id })] });
+        }
+        for (const cfg of bucket.notificationConfiguration.TopicConfigurations || []) {
+          if (!this._matchesEvent(cfg.Events, ctx.eventName, ctx.eventType)) continue;
+          if (!this._matchesFilter(cfg.Filter, key)) continue;
+          this._deliverToSNS(cfg.TopicArn, { Records: [this._buildS3EventRecord(bucketName, key, { ...ctx, configId: cfg.Id })] });
+        }
+      }
+
+      this._deliverToEventBridge(bucketName, ctx, s3EventPayload);
+    } catch (err) {
+      logger.warn(`S3 Event trigger error (${bucketName}/${key}): ${err.message}`);
+    }
+  }
+
+  _deliverToLambda(functionArn, event) {
+    if (!this.lambdaService?.simulator) return;
+    try {
+      const match = functionArn.match(/function:([^:]+)/);
+      const functionName = match ? match[1] : functionArn;
+      this.lambdaService.simulator.invokeFunction(functionName, event);
+      logger.verboso(`📡 S3 → Lambda: ${functionArn}`);
+    } catch (err) {
+      logger.error(`❌ S3 → Lambda delivery failed: ${err.message}`);
+    }
+  }
+
+  _deliverToSQS(queueArn, event) {
+    if (!this.sqsService?.simulator) return;
+    try {
+      const match = queueArn.match(/:([^:]+)$/);
+      const queueName = match ? match[1] : queueArn;
+      const queue = this.sqsService.simulator.queues?.get(queueName);
+      const queueUrl = queue?.url || queueArn;
+      this.sqsService.simulator.sendMessage({
+        QueueUrl: queueUrl,
+        MessageBody: JSON.stringify(event),
+      });
+      logger.verboso(`📡 S3 → SQS: ${queueArn}`);
+    } catch (err) {
+      logger.error(`❌ S3 → SQS delivery failed: ${err.message}`);
+    }
+  }
+
+  _deliverToSNS(topicArn, event) {
+    if (!this.snsService?.simulator) return;
+    try {
+      this.snsService.simulator.publish({
+        TopicArn: topicArn,
+        Message: JSON.stringify(event),
+      });
+      logger.verboso(`📡 S3 → SNS: ${topicArn}`);
+    } catch (err) {
+      logger.error(`❌ S3 → SNS delivery failed: ${err.message}`);
+    }
+  }
+
+  _deliverToEventBridge(bucketName, ctx, s3EventPayload) {
+    if (!this.eventbridgeService?.simulator) return;
+    try {
+      const bucket = this.buckets.get(bucketName);
+      const region = bucket?.region || this.region;
+      const objectKey = ctx.objectInfo?.key;
+      const detailType = ctx.eventType === "ObjectCreated"
+        ? "Object Created"
+        : ctx.eventType === "ObjectRemoved"
+          ? "Object Deleted"
+          : ctx.eventName;
+      const resources = [
+        `arn:aws:s3:::${bucketName}`,
+      ];
+      if (objectKey) {
+        resources.push(`arn:aws:s3:::${bucketName}/${objectKey}`);
+      }
+      this.eventbridgeService.simulator.putEvents({
+        Entries: [{
+          Time: new Date().toISOString(),
+          Source: "aws.s3",
+          Resources: resources,
+          DetailType: detailType,
+          Detail: JSON.stringify({
+            version: "0",
+            bucket: { name: bucketName },
+            object: {
+              key: objectKey,
+              size: ctx.objectInfo?.size,
+              etag: ctx.objectInfo?.etag,
+              "version-id": ctx.objectInfo?.versionId,
+              sequencer: ctx.objectInfo?.sequencer,
+            },
+            "request-id": crypto.randomUUID(),
+            requester: this.accountId,
+            "source-ip-address": "127.0.0.1",
+            reason: ctx.eventName,
+          }),
+          EventBusName: "default",
+        }],
+      });
+      logger.verboso(`📡 S3 → EventBridge (${detailType})`);
+    } catch (err) {
+      logger.error(`❌ S3 → EventBridge delivery failed: ${err.message}`);
+    }
+  }
+
+  getBucketNotificationConfiguration(bucketName) {
+    const bucket = this.buckets.get(bucketName);
+    if (!bucket) {
+      return { error: { code: "NoSuchBucket", message: "Bucket does not exist" }, status: 404 };
+    }
+    const nc = bucket.notificationConfiguration || {
+      LambdaFunctionConfigurations: [],
+      QueueConfigurations: [],
+      TopicConfigurations: [],
+    };
+    return { notificationConfiguration: nc };
+  }
+
+  putBucketNotificationConfiguration(bucketName, config) {
+    const bucket = this.buckets.get(bucketName);
+    if (!bucket) {
+      return { error: { code: "NoSuchBucket", message: "Bucket does not exist" }, status: 404 };
+    }
+    bucket.notificationConfiguration = this._normalizeNotificationConfig(config);
+    this.persistBuckets();
+    logger.debug(`📢 Notification config atualizada: ${bucketName}`);
+    return { success: true };
+  }
+
   // ─── Website Config ───────────────────────────────────────────────────────
 
   getWebsiteConfig(bucketName) {
@@ -464,6 +881,7 @@ class S3Simulator {
         region: bucket.region || "us-east-1",
         website: bucket.website || false,
         websiteConfiguration: bucket.websiteConfiguration || null,
+        notificationConfiguration: bucket.notificationConfiguration || null,
         objects: objectsObj,
         objectCount: bucket.objectCount,
         totalSize: bucket.totalSize,
@@ -563,6 +981,135 @@ class S3Simulator {
   <HostId>local-simulator</HostId>
 </Error>`;
   }
+
+  // ─── Presigned URLs ──────────────────────────────────────────────────────
+
+  /**
+   * Generate a presigned GET URL for downloading an object
+   * @param {string} bucketName - Bucket name
+   * @param {string} key - Object key
+   * @param {object} options - Options { expiresIn, credentials }
+   * @returns {object} { url, presignedUrl, expiration }
+   */
+  generatePresignedGetUrl(bucketName, key, options = {}) {
+    const bucket = this.getBucket(bucketName);
+    if (!bucket) {
+      return { error: { code: 'NoSuchBucket', message: `The specified bucket does not exist: ${bucketName}` }, status: 404 };
+    }
+
+    try {
+      const result = this.presignedUrlGenerator.generateGetUrl(bucketName, key, options);
+      return { presignedUrl: result };
+    } catch (err) {
+      logger.error('S3: Error generating presigned GET URL:', err);
+      return { error: { code: 'InternalError', message: err.message }, status: 500 };
+    }
+  }
+
+  /**
+   * Generate a presigned PUT URL for uploading an object
+   * @param {string} bucketName - Bucket name
+   * @param {string} key - Object key
+   * @param {object} options - Options { expiresIn, credentials, contentType }
+   * @returns {object} { presignedUrl, expiration }
+   */
+  generatePresignedPutUrl(bucketName, key, options = {}) {
+    const bucket = this.getBucket(bucketName);
+    if (!bucket) {
+      return { error: { code: 'NoSuchBucket', message: `The specified bucket does not exist: ${bucketName}` }, status: 404 };
+    }
+
+    try {
+      const result = this.presignedUrlGenerator.generatePutUrl(bucketName, key, options);
+      return { presignedUrl: result };
+    } catch (err) {
+      logger.error('S3: Error generating presigned PUT URL:', err);
+      return { error: { code: 'InternalError', message: err.message }, status: 500 };
+    }
+  }
+
+  /**
+   * Generate a presigned DELETE URL for deleting an object
+   * @param {string} bucketName - Bucket name
+   * @param {string} key - Object key
+   * @param {object} options - Options { expiresIn, credentials }
+   * @returns {object} { presignedUrl, expiration }
+   */
+  generatePresignedDeleteUrl(bucketName, key, options = {}) {
+    const bucket = this.getBucket(bucketName);
+    if (!bucket) {
+      return { error: { code: 'NoSuchBucket', message: `The specified bucket does not exist: ${bucketName}` }, status: 404 };
+    }
+
+    try {
+      const result = this.presignedUrlGenerator.generateDeleteUrl(bucketName, key, options);
+      return { presignedUrl: result };
+    } catch (err) {
+      logger.error('S3: Error generating presigned DELETE URL:', err);
+      return { error: { code: 'InternalError', message: err.message }, status: 500 };
+    }
+  }
+
+  /**
+   * Generate a presigned HEAD URL for checking object metadata
+   * @param {string} bucketName - Bucket name
+   * @param {string} key - Object key
+   * @param {object} options - Options { expiresIn, credentials }
+   * @returns {object} { presignedUrl, expiration }
+   */
+  generatePresignedHeadUrl(bucketName, key, options = {}) {
+    const bucket = this.getBucket(bucketName);
+    if (!bucket) {
+      return { error: { code: 'NoSuchBucket', message: `The specified bucket does not exist: ${bucketName}` }, status: 404 };
+    }
+
+    try {
+      const result = this.presignedUrlGenerator.generateHeadUrl(bucketName, key, options);
+      return { presignedUrl: result };
+    } catch (err) {
+      logger.error('S3: Error generating presigned HEAD URL:', err);
+      return { error: { code: 'InternalError', message: err.message }, status: 500 };
+    }
+  }
+
+  /**
+   * Generate a presigned POST policy for form uploads
+   * @param {string} bucketName - Bucket name
+   * @param {string} key - Object key
+   * @param {object} options - Options { expiresIn, conditions, contentType }
+   * @returns {object} { policy, signature, amzAlgorithm, amzDate, amzCredential }
+   */
+  generatePresignedPostPolicy(bucketName, key, options = {}) {
+    const bucket = this.getBucket(bucketName);
+    if (!bucket) {
+      return { error: { code: 'NoSuchBucket', message: `The specified bucket does not exist: ${bucketName}` }, status: 404 };
+    }
+
+    try {
+      const result = this.presignedUrlGenerator.generatePostPolicy(bucketName, key, options);
+      return result;
+    } catch (err) {
+      logger.error('S3: Error generating presigned POST policy:', err);
+      return { error: { code: 'InternalError', message: err.message }, status: 500 };
+    }
+  }
+
+  /**
+   * Validate a presigned URL
+   * @param {string} url - Presigned URL to validate
+   * @param {string} method - HTTP method (GET, PUT, DELETE, HEAD)
+   * @param {object} credentials - Optional credentials for validation
+   * @returns {object} { valid: boolean, message: string, expiresAt: Date }
+   */
+  validatePresignedUrl(url, method = 'GET', credentials = null) {
+    try {
+      const result = this.presignedUrlGenerator.validatePresignedUrl(url, method, credentials);
+      return result;
+    } catch (err) {
+      logger.error('S3: Error validating presigned URL:', err);
+      return { valid: false, message: err.message };
+    }
+  }
 }
 
 module.exports = S3Simulator;

package/src/services/sns/index.js

@@ -41,6 +41,37 @@ class SNSService {
     if (sqs) this.simulator.setSqsService(sqs);
     const ct = server.getService('cloudtrail');
     if (ct?.simulator) this.simulator.audit.setTrail(ct.simulator);
+
+    // IAM enforcement middleware integration
+    const iamService = server.getService('iam');
+    if (iamService && iamService.getSimulator()) {
+      const { createIAMEnforcementMiddleware } = require('../iam/middleware');
+      const iamSimulator = iamService.getSimulator();
+
+      const middleware = createIAMEnforcementMiddleware({
+        iamSimulator,
+        servicePrefix: 'sns',
+        extractAction: (req) => req.body?.Action || req.query?.Action || 'Unknown',
+        extractResource: (req) => {
+          const topicArn = req.body?.TopicArn || req.query?.TopicArn || '';
+          if (topicArn) {
+            return topicArn; // Already an ARN
+          }
+          const topicName = req.body?.Name || req.body?.TopicName || 'unknown';
+          return `arn:aws:sns:us-east-1:123456789012:${topicName}`;
+        },
+        formatError: (res, code, message) => {
+          res.status(403).set('Content-Type', 'text/xml').send(
+            `<ErrorResponse xmlns="http://sns.amazonaws.com/doc/2010-03-31/"><Error><Type>Sender</Type><Code>${code}</Code><Message>${message}</Message></Error></ErrorResponse>`
+          );
+        }
+      });
+
+      // Set middleware on the app so it's applied before routes
+      if (this.app) {
+        this.app.iamMiddleware = middleware;
+      }
+    }
   }
 
   async start() {