@kensio/yulin 0.32.0 → 0.34.0

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimArn } from "../../aws/arn.js";
+import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
+import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
+import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
+import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
+interface SimIamAccountAuthZProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly policies: Map<SimArn, SimIamManagedPolicy>;
+    readonly roles: Map<SimIamRoleName, SimIamRole>;
+    readonly users: Map<SimIamUsername, SimIamUser>;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+}
+/**
+ * Evaluates IAM authorization attempts against one simulated Account's IAM
+ * state.
+ *
+ * If the caller is omitted, authorization defaults to the root principal of
+ * the owning sim Account. An explicit anonymous caller suppresses that
+ * fallback and is evaluated without identity policies.
+ */
+export declare class SimIamAccountAuthZ {
+    private readonly properties;
+    constructor(properties: SimIamAccountAuthZProperties);
+    /**
+     * Evaluate an IAM authorization attempt against policies relevant to the
+     * request caller.
+     */
+    authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+}
+export {};
+//# sourceMappingURL=sim-iam-account-auth-z.d.ts.map

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAW/D;CACF"}

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -0,0 +1,31 @@
+import { makeSimAwsAccountRootPrincipal } from "../../aws/caller/sim-aws-account-root-principal.js";
+import { SimIamAuthorizer } from "./sim-iam-authorizer.js";
+/**
+ * Evaluates IAM authorization attempts against one simulated Account's IAM
+ * state.
+ *
+ * If the caller is omitted, authorization defaults to the root principal of
+ * the owning sim Account. An explicit anonymous caller suppresses that
+ * fallback and is evaluated without identity policies.
+ */
+export class SimIamAccountAuthZ {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * Evaluate an IAM authorization attempt against policies relevant to the
+     * request caller.
+     */
+    authorize(input) {
+        const simIamAuthorizer = new SimIamAuthorizer({
+            policies: this.properties.policies,
+            roles: this.properties.roles,
+            users: this.properties.users,
+            defaultCallerPrincipal: makeSimAwsAccountRootPrincipal(this.properties.accountId),
+            credentialIdentityResolver: this.properties.credentialIdentityResolver,
+        });
+        return simIamAuthorizer.authorize(input);
+    }
+}
+//# sourceMappingURL=sim-iam-account-auth-z.js.map

package/dist/service/iam/authorize/sim-iam-account-auth-z.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-auth-z.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AAOpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAY3D;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,UAAU,CAA+B;IAE1D,YAAY,UAAwC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,sBAAsB,EAAE,8BAA8B,CACpD,IAAI,CAAC,UAAU,CAAC,SAAS,CAC1B;YACD,0BAA0B,EAAE,IAAI,CAAC,UAAU,CAAC,0BAA0B;SACvE,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-action-authorizer.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "./sim-iam-inter-service-auth-z.js";
+interface SimIamActionAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to a simulated service command for one action and
+ * resource.
+ *
+ * This shared authorizer suits services whose commands map one-to-one onto an
+ * IAM action and resource ARN, such as the IAM and CloudFormation control
+ * planes. Commands needing richer context, such as condition values, use
+ * their own per-command authorizers instead.
+ */
+export declare class SimIamActionAuthorizer {
+    private readonly iam;
+    constructor(properties: SimIamActionAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a resource.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit
+     * anonymous caller, which has no identity policy permissions.
+     */
+    authorize(action: string, resource: string, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=sim-iam-action-authorizer.d.ts.map

package/dist/service/iam/authorize/sim-iam-action-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-action-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-action-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAUvE;CACF"}

package/dist/service/iam/authorize/sim-iam-action-authorizer.js

@@ -0,0 +1,34 @@
+import { SimIamAccessDenied } from "../error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to a simulated service command for one action and
+ * resource.
+ *
+ * This shared authorizer suits services whose commands map one-to-one onto an
+ * IAM action and resource ARN, such as the IAM and CloudFormation control
+ * planes. Commands needing richer context, such as condition values, use
+ * their own per-command authorizers instead.
+ */
+export class SimIamActionAuthorizer {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may perform an action on a resource.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit
+     * anonymous caller, which has no identity policy permissions.
+     */
+    authorize(action, resource, caller) {
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-iam-action-authorizer.js.map

package/dist/service/iam/authorize/sim-iam-action-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-action-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-action-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAA0B;IAE9C,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAqB;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -4,10 +4,14 @@ import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
-interface SimIamAuthorizerProps {
+import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
+import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+interface SimIamAuthorizerProperties {
     readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
-    readonly defaultCallerPrincipal?: SimAwsPrincipal | undefined;
+    readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
+    readonly defaultCallerPrincipal: SimAwsPrincipal;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
 }
 /**
  * Facade for simulated IAM authorization decisions.
@@ -19,7 +23,7 @@ interface SimIamAuthorizerProps {
  */
 export declare class SimIamAuthorizer {
     private readonly contextBuilder;
-    constructor(props: SimIamAuthorizerProps);
+    constructor(properties: SimIamAuthorizerProperties);
     /**
      * Evaluate an IAM authorization request.
      */

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CAC/D;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,KAAK,EAAE,qBAAqB,EAMvC;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}
+{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAEpG,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,eAAe,CAAC;IACjD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,UAAU,EAAE,0BAA0B,EAQjD;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -10,8 +10,8 @@ import { SimIamPolicyDecision } from "./sim-iam-decision.js";
  */
 export class SimIamAuthorizer {
     contextBuilder;
-    constructor(props) {
-        this.contextBuilder = new SimIamAuthZContextBuilder(props.policies, props.roles, props.defaultCallerPrincipal);
+    constructor(properties) {
+        this.contextBuilder = new SimIamAuthZContextBuilder(properties.policies, properties.roles, properties.users, properties.defaultCallerPrincipal, properties.credentialIdentityResolver);
     }
     /**
      * Evaluate an IAM authorization request.

package/dist/service/iam/authorize/sim-iam-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAS7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,KAA4B;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAa7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,UAAsC;QAChD,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,sBAAsB,EACjC,UAAU,CAAC,0BAA0B,CACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts

@@ -0,0 +1,24 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIam } from "../../sim-iam.js";
+import type { SimIamManagedPolicy } from "../../policy/sim-iam-policy.js";
+interface SimCfnIamManagedPolicyCreatorProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Creates simulated IAM Managed Policies from CloudFormation Resources.
+ */
+export declare class SimCfnIamManagedPolicyCreator {
+    private readonly iam;
+    constructor(properties: SimCfnIamManagedPolicyCreatorProperties);
+    /**
+     * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamManagedPolicy>;
+    private managedPolicyName;
+    private path;
+    private description;
+    private policyDocument;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-managed-policy-creator.d.ts.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,uCAAuC,EAE9D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -0,0 +1,71 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/**
+ * Creates simulated IAM Managed Policies from CloudFormation Resources.
+ */
+export class SimCfnIamManagedPolicyCreator {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
+     */
+    async create(resource, properties) {
+        const policyName = this.managedPolicyName(resource, properties);
+        const path = this.path(resource, properties);
+        const description = this.description(resource, properties);
+        const policyDocument = this.policyDocument(resource, properties);
+        const createOutput = await this.iam.createPolicy({
+            input: {
+                PolicyName: policyName,
+                Path: path,
+                Description: description,
+                PolicyDocument: policyDocument,
+            },
+        });
+        const policy = this.iam.policies.get(createOutput.Policy.Arn);
+        assertDefined(policy, `Sim IAM Managed Policy ${createOutput.Policy.Arn} after CloudFormation creation`);
+        return policy;
+    }
+    managedPolicyName(resource, properties) {
+        const managedPolicyName = properties["ManagedPolicyName"];
+        if (managedPolicyName === undefined) {
+            return resource.logicalId;
+        }
+        if (typeof managedPolicyName !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: ManagedPolicyName must be a string`);
+        }
+        return managedPolicyName;
+    }
+    path(resource, properties) {
+        const path = properties["Path"];
+        if (path === undefined) {
+            return undefined;
+        }
+        if (typeof path !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Path must be a string`);
+        }
+        return path;
+    }
+    description(resource, properties) {
+        const description = properties["Description"];
+        if (description === undefined) {
+            return undefined;
+        }
+        if (typeof description !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Description must be a string`);
+        }
+        return description;
+    }
+    policyDocument(resource, properties) {
+        const policyDocument = properties["PolicyDocument"];
+        if (policyDocument === undefined ||
+            typeof policyDocument !== "object" ||
+            policyDocument === null ||
+            Array.isArray(policyDocument)) {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: PolicyDocument must be an object`);
+        }
+        return JSON.stringify(policyDocument);
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-managed-policy-creator.js.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAAS;IAE7B,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YAC/C,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,aAAa,CACX,MAAM,EACN,0BAA0B,YAAY,CAAC,MAAM,CAAC,GAAG,gCAAgC,CAClF,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,sCAAsC,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,IAAI,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,yBAAyB,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,gCAAgC,CACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts

@@ -0,0 +1,39 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIam } from "../../sim-iam.js";
+interface SimCfnIamPolicyCreatorProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Creates simulated IAM inline role policies from AWS::IAM::Policy
+ * CloudFormation Resources.
+ *
+ * AWS::IAM::Policy is an inline policy put onto the referenced principals,
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
+ * a function's execution role (the "DefaultPolicy" resource). Only Roles are
+ * simulated; the policy has no standalone stored resource, so creation
+ * returns undefined and Ref resolution uses the default adapter.
+ */
+export declare class SimCfnIamPolicyCreator {
+    private readonly iam;
+    constructor(properties: SimCfnIamPolicyCreatorProperties);
+    /**
+     * Put the inline policy onto each referenced Role.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<undefined>;
+    private policyName;
+    private policyDocument;
+    /**
+     * The Role names the policy attaches to. Role Refs are resolved to Role
+     * names before creation, so entries arrive as plain strings.
+     */
+    private roleNames;
+    /**
+     * IAM Users and Groups are not simulated as CloudFormation policy
+     * principals, and silently dropping a grant would be misleading, so their
+     * presence fails creation.
+     */
+    private rejectUnsimulatedPrincipals;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-policy-creator.d.ts.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,cAAc;IAoBtB;;;OAGG;IACH,OAAO,CAAC,SAAS;IAsBjB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;CAcpC"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js

@@ -0,0 +1,81 @@
+/**
+ * Creates simulated IAM inline role policies from AWS::IAM::Policy
+ * CloudFormation Resources.
+ *
+ * AWS::IAM::Policy is an inline policy put onto the referenced principals,
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
+ * a function's execution role (the "DefaultPolicy" resource). Only Roles are
+ * simulated; the policy has no standalone stored resource, so creation
+ * returns undefined and Ref resolution uses the default adapter.
+ */
+export class SimCfnIamPolicyCreator {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Put the inline policy onto each referenced Role.
+     */
+    async create(resource, properties) {
+        this.rejectUnsimulatedPrincipals(resource, properties);
+        const policyName = this.policyName(resource, properties);
+        const policyDocument = this.policyDocument(resource, properties);
+        const roleNames = this.roleNames(resource, properties);
+        await Promise.all(roleNames.map(async (roleName) => this.iam.putRolePolicy({
+            input: {
+                RoleName: roleName,
+                PolicyName: policyName,
+                PolicyDocument: policyDocument,
+            },
+        })));
+        return undefined;
+    }
+    policyName(resource, properties) {
+        const policyName = properties["PolicyName"];
+        if (typeof policyName !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyName must be a string`);
+        }
+        return policyName;
+    }
+    policyDocument(resource, properties) {
+        const policyDocument = properties["PolicyDocument"];
+        if (policyDocument === undefined ||
+            typeof policyDocument !== "object" ||
+            policyDocument === null ||
+            Array.isArray(policyDocument)) {
+            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyDocument must be an object`);
+        }
+        return JSON.stringify(policyDocument);
+    }
+    /**
+     * The Role names the policy attaches to. Role Refs are resolved to Role
+     * names before creation, so entries arrive as plain strings.
+     */
+    roleNames(resource, properties) {
+        const roles = properties["Roles"];
+        if (!Array.isArray(roles) || roles.length === 0) {
+            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles must be a non-empty array`);
+        }
+        return roles.map((roleName) => {
+            if (typeof roleName !== "string") {
+                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles entries must be strings`);
+            }
+            return roleName;
+        });
+    }
+    /**
+     * IAM Users and Groups are not simulated as CloudFormation policy
+     * principals, and silently dropping a grant would be misleading, so their
+     * presence fails creation.
+     */
+    rejectUnsimulatedPrincipals(resource, properties) {
+        for (const principalProperty of ["Users", "Groups"]) {
+            // eslint-disable-next-line security/detect-object-injection -- fixed property names.
+            if (properties[principalProperty] !== undefined) {
+                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: ` +
+                    `${principalProperty} are not simulated`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-policy-creator.js.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IAE7B,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,UAAU;gBACtB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CACH,CACF,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,+BAA+B,CAC9E,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,oCAAoC,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,QAAwB,EACxB,UAAqC;QAErC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,mCAAmC,CAClF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,iCAAiC,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,2BAA2B,CACjC,QAAwB,EACxB,UAAqC;QAErC,KAAK,MAAM,iBAAiB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,qFAAqF;YACrF,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,IAAI;oBAChD,GAAG,iBAAiB,oBAAoB,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIam } from "../../sim-iam.js";
+import type { SimIamRole } from "../../role/sim-iam-role.js";
+interface SimCfnIamRoleCreatorProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Creates simulated IAM Roles from CloudFormation Resources.
+ */
+export declare class SimCfnIamRoleCreator {
+    private readonly iam;
+    private readonly propsParser;
+    constructor(properties: SimCfnIamRoleCreatorProperties);
+    /**
+     * Create a simulated Role from an AWS::IAM::Role Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimIamRole>;
+    private putInlinePolicies;
+    private attachManagedPolicies;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-role-creator.d.ts.map

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-role-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,4BAA4B,CAAC;AAO7E,UAAU,8BAA8B;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IAEnE,YAAY,UAAU,EAAE,8BAA8B,EAErD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,UAAU,CAAC,CAwBrB;YAEa,iBAAiB;YAgBjB,qBAAqB;CAcpC"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.js

@@ -0,0 +1,51 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnIamRolePropsParser as SimCfnIamRolePropertiesParser, } from "./sim-cfn-iam-role-props-parser.js";
+/**
+ * Creates simulated IAM Roles from CloudFormation Resources.
+ */
+export class SimCfnIamRoleCreator {
+    iam;
+    propsParser = new SimCfnIamRolePropertiesParser();
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Create a simulated Role from an AWS::IAM::Role Resource.
+     */
+    async create(resource, properties) {
+        const roleProperties = this.propsParser.parse(resource, properties);
+        await this.iam.createRole({
+            input: {
+                RoleName: roleProperties.roleName,
+                Path: roleProperties.path,
+                Description: roleProperties.description,
+                AssumeRolePolicyDocument: roleProperties.assumeRolePolicyDocument,
+            },
+        });
+        await Promise.all([
+            this.putInlinePolicies(roleProperties),
+            this.attachManagedPolicies(roleProperties),
+        ]);
+        const role = this.iam.roles.get(roleProperties.roleName);
+        assertDefined(role, `Sim IAM Role ${roleProperties.roleName} after CloudFormation creation`);
+        return role;
+    }
+    async putInlinePolicies(roleProperties) {
+        await Promise.all(roleProperties.inlinePolicies.map(async (inlinePolicy) => this.iam.putRolePolicy({
+            input: {
+                RoleName: roleProperties.roleName,
+                PolicyName: inlinePolicy.policyName,
+                PolicyDocument: inlinePolicy.policyDocument,
+            },
+        })));
+    }
+    async attachManagedPolicies(roleProperties) {
+        await Promise.all(roleProperties.managedPolicyArns.map(async (policyArn) => this.iam.attachRolePolicy({
+            input: {
+                RoleName: roleProperties.roleName,
+                PolicyArn: policyArn,
+            },
+        })));
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-role-creator.js.map

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-role-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EACL,wBAAwB,IAAI,6BAA6B,GAE1D,MAAM,oCAAoC,CAAC;AAM5C;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACd,GAAG,CAAS;IACZ,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAEnE,YAAY,UAA0C;QACpD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEpE,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACxB,KAAK,EAAE;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,wBAAwB,EAAE,cAAc,CAAC,wBAAwB;aAClE;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC;SAC3C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,QAA0B,CAAC,CAAC;QAC3E,aAAa,CACX,IAAI,EACJ,gBAAgB,cAAc,CAAC,QAAQ,gCAAgC,CACxE,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,cAAuC;QAEvC,MAAM,OAAO,CAAC,GAAG,CACf,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,cAAc,EAAE,YAAY,CAAC,cAAc;aAC5C;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,cAAuC;QAEvC,MAAM,OAAO,CAAC,GAAG,CACf,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,SAAS,EAAE,SAAS;aACrB;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-policies-parser.d.ts

@@ -0,0 +1,25 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+export interface SimCfnIamRoleInlinePolicy {
+    readonly policyName: string;
+    readonly policyDocument: string;
+}
+/**
+ * Parses the AWS::IAM::Role policy collection properties: the inline `Policies`
+ * list and the attached `ManagedPolicyArns` list.
+ *
+ * These list-shaped properties carry the bulk of the Role property validation,
+ * so grouping them here keeps the main Role props parser small.
+ */
+export declare class SimCfnIamRolePoliciesParser {
+    /**
+     * Parse the inline `Policies` property into normalised inline policies.
+     */
+    inlinePolicies(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): readonly SimCfnIamRoleInlinePolicy[];
+    /**
+     * Parse the attached `ManagedPolicyArns` property into policy ARN strings.
+     */
+    managedPolicyArns(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): readonly string[];
+    private inlinePolicy;
+}
+//# sourceMappingURL=sim-cfn-iam-role-policies-parser.d.ts.map

package/dist/service/iam/cfn/role/sim-cfn-iam-role-policies-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-role-policies-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-policies-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,qBAAa,2BAA2B;IACtC;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,SAAS,yBAAyB,EAAE,CActC;IAED;;OAEG;IACH,iBAAiB,CACf,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,SAAS,MAAM,EAAE,CAsBnB;IAED,OAAO,CAAC,YAAY;CAuCrB"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-policies-parser.js

@@ -0,0 +1,62 @@
+/**
+ * Parses the AWS::IAM::Role policy collection properties: the inline `Policies`
+ * list and the attached `ManagedPolicyArns` list.
+ *
+ * These list-shaped properties carry the bulk of the Role property validation,
+ * so grouping them here keeps the main Role props parser small.
+ */
+export class SimCfnIamRolePoliciesParser {
+    /**
+     * Parse the inline `Policies` property into normalised inline policies.
+     */
+    inlinePolicies(resource, properties) {
+        const policies = properties["Policies"];
+        if (policies === undefined) {
+            return [];
+        }
+        if (!Array.isArray(policies)) {
+            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: Policies must be an array`);
+        }
+        return policies.map((policy) => this.inlinePolicy(resource, policy));
+    }
+    /**
+     * Parse the attached `ManagedPolicyArns` property into policy ARN strings.
+     */
+    managedPolicyArns(resource, properties) {
+        const managedPolicyArns = properties["ManagedPolicyArns"];
+        if (managedPolicyArns === undefined) {
+            return [];
+        }
+        if (!Array.isArray(managedPolicyArns)) {
+            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: ManagedPolicyArns must be an array`);
+        }
+        return managedPolicyArns.map((arn) => {
+            if (typeof arn !== "string") {
+                throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: each ManagedPolicyArns entry must be a string`);
+            }
+            return arn;
+        });
+    }
+    inlinePolicy(resource, policy) {
+        if (typeof policy !== "object" ||
+            policy === null ||
+            Array.isArray(policy)) {
+            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: each Policies entry must be an object`);
+        }
+        const policyName = policy["PolicyName"];
+        if (typeof policyName !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: Policies entry PolicyName must be a string`);
+        }
+        const policyDocument = policy["PolicyDocument"];
+        if (typeof policyDocument !== "object" ||
+            policyDocument === null ||
+            Array.isArray(policyDocument)) {
+            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: Policies entry PolicyDocument must be an object`);
+        }
+        return {
+            policyName,
+            policyDocument: JSON.stringify(policyDocument),
+        };
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-role-policies-parser.js.map

package/dist/service/iam/cfn/role/sim-cfn-iam-role-policies-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-role-policies-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-policies-parser.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,UAAqC;QAErC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,6BAA6B,CAC1E,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,sCAAsC,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,iDAAiD,CAC9F,CAAC;YACJ,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAClB,QAAwB,EACxB,MAAqD;QAErD,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,yCAAyC,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAExC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,8CAA8C,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEhD,IACE,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,mDAAmD,CAChG,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU;YACV,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}