@kensio/yulin 0.33.0 → 0.34.2

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.d.ts

@@ -3,10 +3,16 @@ import { type BackgroundScheduler } from "../../../../util/background/background
 import type { SimRoute53HostedZone } from "../../hosted-zone/sim-route53-hosted-zone.js";
 import { type SimRoute53HostedZoneId } from "../create-hosted-zone/sim-route53-zone-id.js";
 import type { SimChangeResourceRecordSetsCommand, SimChangeResourceRecordSetsCommandOutput } from "./change-resource-record-sets.cmd.js";
-interface ChangeResourceRecordSetsCommandHandlerProps {
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+interface ChangeResourceRecordSetsCommandHandlerProperties {
     readonly hostedZones: Map<SimRoute53HostedZoneId, SimRoute53HostedZone>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface ChangeResourceRecordSetsCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Route53 ChangeResourceRecordSetsCommand handler.
  *
@@ -14,12 +20,18 @@ interface ChangeResourceRecordSetsCommandHandlerProps {
  */
 export declare class ChangeResourceRecordSetsCommandHandler implements CommandHandler<SimChangeResourceRecordSetsCommand, SimChangeResourceRecordSetsCommandOutput> {
     private readonly hostedZones;
+    private readonly authorizer;
     private readonly background;
-    constructor(props: ChangeResourceRecordSetsCommandHandlerProps);
+    constructor(properties: ChangeResourceRecordSetsCommandHandlerProperties);
     /**
      * Handle changing Route53 records in a Hosted Zone.
+     *
+     * The hosted zone ID is normalized before authorization because it is the
+     * resource identifier used in the IAM decision. Authorization happens before
+     * the hosted zone store is read so unauthorized callers cannot learn whether
+     * the requested ID exists.
      */
-    handle(cmd: SimChangeResourceRecordSetsCommand): Promise<SimChangeResourceRecordSetsCommandOutput>;
+    handle(command: SimChangeResourceRecordSetsCommand, options?: ChangeResourceRecordSetsCommandHandlerOptions): Promise<SimChangeResourceRecordSetsCommandOutput>;
 }
 export {};
 //# sourceMappingURL=change-resource-record-sets.handler.d.ts.map

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-resource-record-sets.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAE7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EACV,kCAAkC,EAClC,wCAAwC,EACzC,MAAM,sCAAsC,CAAC;AAI9C,UAAU,2CAA2C;IACnD,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,sCAAuC,YAAW,cAAc,CAC3E,kCAAkC,EAClC,wCAAwC,CACzC;IACC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG1B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,KAAK,EAAE,2CAA2C,EAI7D;IAED;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,kCAAkC,GACtC,OAAO,CAAC,wCAAwC,CAAC,CAmCnD;CACF"}
+{"version":3,"file":"change-resource-record-sets.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAE7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EACV,kCAAkC,EAClC,wCAAwC,EACzC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,UAAU,gDAAgD;IACxD,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,6CAA6C;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,sCAAuC,YAAW,cAAc,CAC3E,kCAAkC,EAClC,wCAAwC,CACzC;IACC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG1B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,gDAAgD,EASvE;IAED;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,kCAAkC,EAC3C,OAAO,CAAC,EAAE,6CAA6C,GACtD,OAAO,CAAC,wCAAwC,CAAC,CAsCnD;CACF"}

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.js

@@ -3,6 +3,8 @@ import { BackgroundTasks, } from "../../../../util/background/background.js";
 import { normalizeSimRoute53HostedZoneId, } from "../create-hosted-zone/sim-route53-zone-id.js";
 import { getChangeResourceRecordSetsHostedZone } from "./change-res-rec-sets-zone.js";
 import { scheduleChangeResourceRecordSets } from "./schedule/schedule-change-res-rec-sets.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { ChangeResourceRecordSetsAuthorizer } from "./change-resource-record-sets-authorizer.js";
 /**
  * Route53 ChangeResourceRecordSetsCommand handler.
  *
@@ -10,21 +12,30 @@ import { scheduleChangeResourceRecordSets } from "./schedule/schedule-change-res
  */
 export class ChangeResourceRecordSetsCommandHandler {
     hostedZones;
+    authorizer;
     background;
-    constructor(props) {
-        const { hostedZones, background = new BackgroundTasks() } = props;
+    constructor(properties) {
+        const { hostedZones, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
         this.hostedZones = hostedZones;
+        this.authorizer = new ChangeResourceRecordSetsAuthorizer({ iam });
         this.background = background;
     }
     /**
      * Handle changing Route53 records in a Hosted Zone.
+     *
+     * The hosted zone ID is normalized before authorization because it is the
+     * resource identifier used in the IAM decision. Authorization happens before
+     * the hosted zone store is read so unauthorized callers cannot learn whether
+     * the requested ID exists.
      */
-    async handle(cmd) {
-        const hostedZoneId = normalizeSimRoute53HostedZoneId(cmd.input.HostedZoneId);
-        const changes = cmd.input.ChangeBatch?.Changes;
+    async handle(command, options) {
+        const hostedZoneId = normalizeSimRoute53HostedZoneId(command.input.HostedZoneId);
+        const hostedZoneArn = `arn:aws:route53:::hostedzone/${hostedZoneId}`;
+        const changes = command.input.ChangeBatch?.Changes;
         assertDefined(changes, "ChangeResourceRecordSetsCommand.ChangeBatch.Changes");
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
+        this.authorizer.authorize(hostedZoneArn, options?.caller);
         const hostedZone = getChangeResourceRecordSetsHostedZone(this.hostedZones, hostedZoneId);
         const submittedAt = new Date();
         await scheduleChangeResourceRecordSets(this.background, hostedZone, changes);

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-resource-record-sets.handler.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AAKtD,OAAO,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAO9F;;;;GAIG;AACH,MAAM,OAAO,sCAAsC;IAIhC,WAAW,CAG1B;IACe,UAAU,CAAsB;IAEjD,YAAY,KAAkD;QAC5D,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,KAAK,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAAuC;QAEvC,MAAM,YAAY,GAAG,+BAA+B,CAClD,GAAG,CAAC,KAAK,CAAC,YAAY,CACvB,CAAC;QAEF,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;QAC/C,aAAa,CACX,OAAO,EACP,qDAAqD,CACtD,CAAC;QAEF,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,UAAU,GAAG,qCAAqC,CACtD,IAAI,CAAC,WAAW,EAChB,YAAY,CACb,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAE/B,MAAM,gCAAgC,CACpC,IAAI,CAAC,UAAU,EACf,UAAU,EACV,OAAO,CACR,CAAC;QAEF,OAAO;YACL,UAAU,EAAE;gBACV,EAAE,EAAE,WAAW,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE;gBAC9D,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,WAAW;aACzB;YACD,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"change-resource-record-sets.handler.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/change-resource-record-sets.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AAKtD,OAAO,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AAYjG;;;;GAIG;AACH,MAAM,OAAO,sCAAsC;IAIhC,WAAW,CAG1B;IACe,UAAU,CAAqC;IAC/C,UAAU,CAAsB;IAEjD,YAAY,UAA4D;QACtE,MAAM,EACJ,WAAW,EACX,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,kCAAkC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,OAA2C,EAC3C,OAAuD;QAEvD,MAAM,YAAY,GAAG,+BAA+B,CAClD,OAAO,CAAC,KAAK,CAAC,YAAY,CAC3B,CAAC;QACF,MAAM,aAAa,GAAG,gCAAgC,YAAY,EAAE,CAAC;QAErE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;QACnD,aAAa,CACX,OAAO,EACP,qDAAqD,CACtD,CAAC;QAEF,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,UAAU,GAAG,qCAAqC,CACtD,IAAI,CAAC,WAAW,EAChB,YAAY,CACb,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAE/B,MAAM,gCAAgC,CACpC,IAAI,CAAC,UAAU,EACf,UAAU,EACV,OAAO,CACR,CAAC;QAEF,OAAO;YACL,UAAU,EAAE;gBACV,EAAE,EAAE,WAAW,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE;gBAC9D,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,WAAW;aACzB;YACD,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets.js

@@ -53,7 +53,7 @@ function toSimRoute53Record(resourceRecordSet) {
     if (!isSimRoute53RecordType(type)) {
         throw new Error(`Unsupported ChangeResourceRecordSetsCommand.ResourceRecordSet.Type ${type}`);
     }
-    const alias = resourceRecordSet.AliasTarget !== undefined;
+    const isAlias = resourceRecordSet.AliasTarget !== undefined;
     const values = resourceRecordSet.AliasTarget === undefined
         ? resourceRecordSet.ResourceRecords?.map((record) => {
             assertDefined(record.Value, "ChangeResourceRecordSetsCommand.ResourceRecordSet.ResourceRecords.Value");
@@ -70,7 +70,7 @@ function toSimRoute53Record(resourceRecordSet) {
         type,
         values,
         ttl: resourceRecordSet.TTL,
-        alias,
+        alias: isAlias,
     };
 }
 //# sourceMappingURL=change-resource-record-sets.js.map

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-resource-record-sets.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/change-resource-record-sets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAOvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,aAAa,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;IAEvE,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnD,aAAa,CACX,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IAEF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM;QACR,CAAC;QAED,SAAS,CAAC;YACR,oBAAoB;YACpB,MAAM,IAAI,KAAK,CACb,6DAA6D,MAAM,CAAC,MAAM,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAAgC,EAChC,MAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,aAAa,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;IAEvE,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnD,aAAa,CACX,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IAErD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,iBAA8C;IAE9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IAE9E,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,sEAAsE,IAAI,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,KAAK,SAAS,CAAC;IAC1D,MAAM,MAAM,GACV,iBAAiB,CAAC,WAAW,KAAK,SAAS;QACzC,CAAC,CAAC,iBAAiB,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAChD,aAAa,CACX,MAAM,CAAC,KAAK,EACZ,yEAAyE,CAC1E,CAAC;YACF,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC,GAAa,EAAE;YACd,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,OAAO,CAAC;YACtD,aAAa,CACX,OAAO,EACP,uEAAuE,CACxE,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CAAC,EAAE,CAAC;IAEX,aAAa,CACX,MAAM,EACN,mEAAmE,CACpE,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,GAAG,EAAE,iBAAiB,CAAC,GAAG;QAC1B,KAAK;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"change-resource-record-sets.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/change-resource-record-sets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAOvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,aAAa,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;IAEvE,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnD,aAAa,CACX,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IAEF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM;QACR,CAAC;QAED,SAAS,CAAC;YACR,oBAAoB;YACpB,MAAM,IAAI,KAAK,CACb,6DAA6D,MAAM,CAAC,MAAM,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAAgC,EAChC,MAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,aAAa,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;IAEvE,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnD,aAAa,CACX,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IAErD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,iBAA8C;IAE9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IAE9E,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,sEAAsE,IAAI,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,KAAK,SAAS,CAAC;IAC5D,MAAM,MAAM,GACV,iBAAiB,CAAC,WAAW,KAAK,SAAS;QACzC,CAAC,CAAC,iBAAiB,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAChD,aAAa,CACX,MAAM,CAAC,KAAK,EACZ,yEAAyE,CAC1E,CAAC;YACF,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC,GAAa,EAAE;YACd,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,OAAO,CAAC;YACtD,aAAa,CACX,OAAO,EACP,uEAAuE,CACxE,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CAAC,EAAE,CAAC;IAEX,aAAa,CACX,MAAM,EACN,mEAAmE,CACpE,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,GAAG,EAAE,iBAAiB,CAAC,GAAG;QAC1B,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC"}

package/dist/service/route53/command/change-resource-record-sets/list-zones-marker.d.ts

@@ -1,6 +1,6 @@
 import { type SimRoute53HostedZoneId } from "../create-hosted-zone/sim-route53-zone-id.js";
 import type { HostedZoneListEntry } from "../list-hosted-zones-by-name/list-hosted-zones-by-name.js";
-interface HostedZoneListMarkerProps {
+interface HostedZoneListMarkerProperties {
     readonly markerNameInput?: string | undefined;
     readonly markerHostedZoneId?: string | undefined;
 }
@@ -11,7 +11,7 @@ interface HostedZoneListMarker {
 /**
  * Normalise ListHostedZonesByName marker inputs before pagination comparison.
  */
-export declare function normaliseHostedZoneListMarker(props: HostedZoneListMarkerProps): HostedZoneListMarker;
+export declare function normaliseHostedZoneListMarker(properties: HostedZoneListMarkerProperties): HostedZoneListMarker;
 /**
  * Whether a hosted zone entry is positioned after the requested marker.
  */

package/dist/service/route53/command/change-resource-record-sets/list-zones-marker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-zones-marker.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/list-zones-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,8CAA8C,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AAErG,UAAU,yBAAyB;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAClE;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAKtB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAoBT"}
+{"version":3,"file":"list-zones-marker.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/list-zones-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,8CAA8C,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AAErG,UAAU,8BAA8B;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAClE;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,8BAA8B,GACzC,oBAAoB,CAOtB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAoBT"}

package/dist/service/route53/command/change-resource-record-sets/list-zones-marker.js

@@ -3,10 +3,10 @@ import { normaliseSimRoute53Name } from "../../local-name/sim-route53-local-name
 /**
  * Normalise ListHostedZonesByName marker inputs before pagination comparison.
  */
-export function normaliseHostedZoneListMarker(props) {
+export function normaliseHostedZoneListMarker(properties) {
     return {
-        markerName: normaliseMarkerName(props.markerNameInput),
-        markerHostedZoneId: normaliseMarkerHostedZoneId(props.markerHostedZoneId),
+        markerName: normaliseMarkerName(properties.markerNameInput),
+        markerHostedZoneId: normaliseMarkerHostedZoneId(properties.markerHostedZoneId),
     };
 }
 /**

package/dist/service/route53/command/change-resource-record-sets/list-zones-marker.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-zones-marker.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/list-zones-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAarF;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAgC;IAEhC,OAAO;QACL,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC;QACtD,kBAAkB,EAAE,2BAA2B,CAAC,KAAK,CAAC,kBAAkB,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA0B,EAC1B,MAA4B;IAE5B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE9E,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,2BAA2B,CAClC,YAAgC;IAEhC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,+BAA+B,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"list-zones-marker.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/change-resource-record-sets/list-zones-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAarF;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,UAA0C;IAE1C,OAAO;QACL,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC3D,kBAAkB,EAAE,2BAA2B,CAC7C,UAAU,CAAC,kBAAkB,CAC9B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA0B,EAC1B,MAA4B;IAE5B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE9E,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,2BAA2B,CAClC,YAAgC;IAEhC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,+BAA+B,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC"}

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface CreateHostedZoneAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to a Route53 CreateHostedZone request.
+ *
+ * Route53 authorizes this operation against the wildcard hosted zone resource
+ * because the hosted zone does not exist until the request succeeds. A policy
+ * must therefore grant access to "arn:aws:route53:::hostedzone/*" or "*" to
+ * permit hosted zone creation.
+ */
+export declare class CreateHostedZoneAuthorizer {
+    private static readonly action;
+    private static readonly resource;
+    private readonly iam;
+    constructor(properties: CreateHostedZoneAuthorizerProperties);
+    /**
+     * Ensure the caller may create a hosted zone.
+     *
+     * The caller is passed through unchanged so IAM can distinguish an omitted
+     * caller, which defaults to Account root, from an explicit anonymous caller.
+     */
+    authorize(caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=create-hosted-zone-authorizer.d.ts.map

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-hosted-zone-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAEpE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcrC;CACF"}

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.js

@@ -0,0 +1,38 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to a Route53 CreateHostedZone request.
+ *
+ * Route53 authorizes this operation against the wildcard hosted zone resource
+ * because the hosted zone does not exist until the request succeeds. A policy
+ * must therefore grant access to "arn:aws:route53:::hostedzone/*" or "*" to
+ * permit hosted zone creation.
+ */
+export class CreateHostedZoneAuthorizer {
+    static action = "route53:CreateHostedZone";
+    static resource = "arn:aws:route53:::hostedzone/*";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may create a hosted zone.
+     *
+     * The caller is passed through unchanged so IAM can distinguish an omitted
+     * caller, which defaults to Account root, from an explicit anonymous caller.
+     */
+    authorize(caller) {
+        const decision = this.iam.authorize({
+            action: CreateHostedZoneAuthorizer.action,
+            resource: CreateHostedZoneAuthorizer.resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: CreateHostedZoneAuthorizer.action,
+                resource: CreateHostedZoneAuthorizer.resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=create-hosted-zone-authorizer.js.map

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-hosted-zone-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAMzE;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IAC7B,MAAM,CAAU,MAAM,GAAG,0BAA0B,CAAC;IACpD,MAAM,CAAU,QAAQ,GAAG,gCAAgC,CAAC;IAEnD,GAAG,CAA0B;IAE9C,YAAY,UAAgD;QAC1D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAqB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,0BAA0B,CAAC,MAAM;YACzC,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;YAC7C,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,0BAA0B,CAAC,MAAM;gBACzC,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone.handler.d.ts

@@ -4,11 +4,17 @@ import { type BackgroundScheduler } from "../../../../util/background/background
 import { SimRoute53HostedZone } from "../../hosted-zone/sim-route53-hosted-zone.js";
 import { type SimRoute53HostedZoneId } from "./sim-route53-zone-id.js";
 import { SimRoute53Registry } from "../../registry/sim-route53-registry.js";
-interface CreateHostedZoneCommandHandlerProps {
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+interface CreateHostedZoneCommandHandlerProperties {
     readonly hostedZones: Map<SimRoute53HostedZoneId, SimRoute53HostedZone>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
     readonly route53Registry?: SimRoute53Registry;
 }
+interface CreateHostedZoneCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Route53 CreateHostedZoneCommand handler.
  *
@@ -16,13 +22,17 @@ interface CreateHostedZoneCommandHandlerProps {
  */
 export declare class CreateHostedZoneCommandHandler implements CommandHandler<SimCreateHostedZoneCommand, SimCreateHostedZoneCommandOutput> {
     private readonly hostedZones;
+    private readonly authorizer;
     private readonly background;
     private readonly route53Registry;
-    constructor(props: CreateHostedZoneCommandHandlerProps);
+    constructor(properties: CreateHostedZoneCommandHandlerProperties);
     /**
      * Handle creation of a new Route53 Hosted Zone.
+     *
+     * Authorization precedes hosted zone creation so an unauthorized caller
+     * cannot allocate hosted zone state or schedule synchronization tasks.
      */
-    handle(cmd: SimCreateHostedZoneCommand): Promise<SimCreateHostedZoneCommandOutput>;
+    handle(command: SimCreateHostedZoneCommand, options?: CreateHostedZoneCommandHandlerOptions): Promise<SimCreateHostedZoneCommandOutput>;
 }
 export {};
 //# sourceMappingURL=create-hosted-zone.handler.d.ts.map

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-hosted-zone.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/create-hosted-zone/create-hosted-zone.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAE7E,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAE5E,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;CAC/C;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG1B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD,YAAY,KAAK,EAAE,mCAAmC,EASrD;IAED;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,0BAA0B,GAC9B,OAAO,CAAC,gCAAgC,CAAC,CA6D3C;CACF"}
+{"version":3,"file":"create-hosted-zone.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/create-hosted-zone/create-hosted-zone.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAE7E,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,UAAU,wCAAwC;IAChD,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;CAC/C;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG1B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD,YAAY,UAAU,EAAE,wCAAwC,EAW/D;IAED;;;;;OAKG;IACG,MAAM,CACV,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,qCAAqC,GAC9C,OAAO,CAAC,gCAAgC,CAAC,CA+D3C;CACF"}

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone.handler.js

@@ -4,6 +4,8 @@ import { SimRoute53HostedZone } from "../../hosted-zone/sim-route53-hosted-zone.
 import { makeSimRoute53HostedZoneId, } from "./sim-route53-zone-id.js";
 import { SimRoute53HostedZoneAlreadyExists } from "../../error/sim-route53.error.js";
 import { SimRoute53Registry } from "../../registry/sim-route53-registry.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { CreateHostedZoneAuthorizer } from "./create-hosted-zone-authorizer.js";
 /**
  * Route53 CreateHostedZoneCommand handler.
  *
@@ -11,26 +13,32 @@ import { SimRoute53Registry } from "../../registry/sim-route53-registry.js";
  */
 export class CreateHostedZoneCommandHandler {
     hostedZones;
+    authorizer;
     background;
     route53Registry;
-    constructor(props) {
-        const { hostedZones, background = new BackgroundTasks(), route53Registry = new SimRoute53Registry(), } = props;
+    constructor(properties) {
+        const { hostedZones, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), route53Registry = new SimRoute53Registry(), } = properties;
         this.hostedZones = hostedZones;
+        this.authorizer = new CreateHostedZoneAuthorizer({ iam });
         this.background = background;
         this.route53Registry = route53Registry;
     }
     /**
      * Handle creation of a new Route53 Hosted Zone.
+     *
+     * Authorization precedes hosted zone creation so an unauthorized caller
+     * cannot allocate hosted zone state or schedule synchronization tasks.
      */
-    async handle(cmd) {
-        const nameInput = cmd.input.Name;
+    async handle(command, options) {
+        const nameInput = command.input.Name;
         assertDefined(nameInput, "CreateHostedZoneCommand.Name");
-        const callerReference = cmd.input.CallerReference;
+        const callerReference = command.input.CallerReference;
         assertDefined(callerReference, "CreateHostedZoneCommand.CallerReference");
         const hostedZoneId = makeSimRoute53HostedZoneId(new Set(this.hostedZones.keys()));
         const submittedAt = new Date();
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
+        this.authorizer.authorize(options?.caller);
         const existingHostedZone = this.hostedZones
             .values()
             .find((hostedZone) => hostedZone.callerReference === callerReference);
@@ -41,7 +49,7 @@ export class CreateHostedZoneCommandHandler {
             id: hostedZoneId,
             name: nameInput,
             callerReference,
-            config: cmd.input.HostedZoneConfig,
+            config: command.input.HostedZoneConfig,
         });
         this.hostedZones.set(hostedZoneId, hostedZone);
         this.route53Registry.registerHostedZone(hostedZoneId, hostedZone);

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-hosted-zone.handler.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/create-hosted-zone/create-hosted-zone.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,0BAA0B,GAE3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAQ5E;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,WAAW,CAG1B;IACe,UAAU,CAAsB;IAChC,eAAe,CAAqB;IAErD,YAAY,KAA0C;QACpD,MAAM,EACJ,WAAW,EACX,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,eAAe,GAAG,IAAI,kBAAkB,EAAE,GAC3C,GAAG,KAAK,CAAC;QACV,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA+B;QAE/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,aAAa,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QAEzD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;QAClD,aAAa,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;QAE1E,MAAM,YAAY,GAAG,0BAA0B,CAC7C,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CACjC,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAE/B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW;aACxC,MAAM,EAAE;aACR,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,eAAe,CAAC,CAAC;QACxE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,iCAAiC,CACzC,mDAAmD,eAAe,iBAAiB,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAC;YAC1C,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,SAAS;YACf,eAAe;YACf,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAElE,wEAAwE;QACxE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAErE,OAAO;YACL,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;aACjD;YACD,UAAU,EAAE;gBACV,EAAE,EAAE,WAAW,YAAY,EAAE;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,WAAW;aACzB;YACD,aAAa,EAAE;gBACb,WAAW,EAAE;oBACX,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;iBACzB;aACF;YACD,QAAQ,EAAE,2DAA2D,YAAY,EAAE;YACnF,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"create-hosted-zone.handler.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/create-hosted-zone/create-hosted-zone.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,0BAA0B,GAE3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAahF;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,WAAW,CAG1B;IACe,UAAU,CAA6B;IACvC,UAAU,CAAsB;IAChC,eAAe,CAAqB;IAErD,YAAY,UAAoD;QAC9D,MAAM,EACJ,WAAW,EACX,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,eAAe,GAAG,IAAI,kBAAkB,EAAE,GAC3C,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,OAAmC,EACnC,OAA+C;QAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,aAAa,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QAEzD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACtD,aAAa,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;QAE1E,MAAM,YAAY,GAAG,0BAA0B,CAC7C,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CACjC,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAE/B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW;aACxC,MAAM,EAAE;aACR,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,eAAe,CAAC,CAAC;QACxE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,iCAAiC,CACzC,mDAAmD,eAAe,iBAAiB,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAC;YAC1C,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,SAAS;YACf,eAAe;YACf,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB;SACvC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAElE,wEAAwE;QACxE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAErE,OAAO;YACL,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;aACjD;YACD,UAAU,EAAE;gBACV,EAAE,EAAE,WAAW,YAAY,EAAE;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,WAAW;aACzB;YACD,aAAa,EAAE;gBACb,WAAW,EAAE;oBACX,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;iBACzB;aACF;YACD,QAAQ,EAAE,2DAA2D,YAAY,EAAE;YACnF,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.d.ts

@@ -0,0 +1,30 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface GetHostedZoneAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to a Route53 GetHostedZone request.
+ *
+ * GetHostedZone authorizes against the specific hosted zone ARN. A policy can
+ * therefore grant access to one hosted zone without granting access to every
+ * hosted zone in the Account.
+ *
+ * Authorization occurs before Route53 looks up the Hosted Zone. An unauthorized
+ * caller receives AccessDenied whether the requested ID exists or not, which
+ * prevents the operation from exposing hosted zone existence.
+ */
+export declare class GetHostedZoneAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(properties: GetHostedZoneAuthorizerProperties);
+    /**
+     * Ensure the caller may get the hosted zone identified by the ARN.
+     *
+     * The caller is passed through unchanged so sim IAM can apply the account-root
+     * fallback only for an omitted caller and preserve explicit anonymous callers.
+     */
+    authorize(hostedZoneArn: string, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=get-hosted-zone-authorizer.d.ts.map

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-hosted-zone-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,iCAAiC;IACzC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAEzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,iCAAiC,EAExD;IAED;;;;;OAKG;IACH,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAc5D;CACF"}

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.js

@@ -0,0 +1,40 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to a Route53 GetHostedZone request.
+ *
+ * GetHostedZone authorizes against the specific hosted zone ARN. A policy can
+ * therefore grant access to one hosted zone without granting access to every
+ * hosted zone in the Account.
+ *
+ * Authorization occurs before Route53 looks up the Hosted Zone. An unauthorized
+ * caller receives AccessDenied whether the requested ID exists or not, which
+ * prevents the operation from exposing hosted zone existence.
+ */
+export class GetHostedZoneAuthorizer {
+    static action = "route53:GetHostedZone";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may get the hosted zone identified by the ARN.
+     *
+     * The caller is passed through unchanged so sim IAM can apply the account-root
+     * fallback only for an omitted caller and preserve explicit anonymous callers.
+     */
+    authorize(hostedZoneArn, caller) {
+        const decision = this.iam.authorize({
+            action: GetHostedZoneAuthorizer.action,
+            resource: hostedZoneArn,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: GetHostedZoneAuthorizer.action,
+                resource: hostedZoneArn,
+            });
+        }
+    }
+}
+//# sourceMappingURL=get-hosted-zone-authorizer.js.map

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-hosted-zone-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAMzE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,uBAAuB;IAC1B,MAAM,CAAU,MAAM,GAAG,uBAAuB,CAAC;IAExC,GAAG,CAA0B;IAE9C,YAAY,UAA6C;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,aAAqB,EAAE,MAAqB;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,uBAAuB,CAAC,MAAM;YACtC,QAAQ,EAAE,aAAa;YACvB,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,uBAAuB,CAAC,MAAM;gBACtC,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone.handler.d.ts

@@ -3,10 +3,16 @@ import { type BackgroundScheduler } from "../../../../util/background/background
 import { type SimRoute53HostedZoneId } from "../create-hosted-zone/sim-route53-zone-id.js";
 import type { SimRoute53HostedZone } from "../../hosted-zone/sim-route53-hosted-zone.js";
 import type { SimGetHostedZoneCommand, SimGetHostedZoneCommandOutput } from "./get-hosted-zone.cmd.js";
-interface GetHostedZoneCommandHandlerProps {
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+interface GetHostedZoneCommandHandlerProperties {
     readonly hostedZones: Map<SimRoute53HostedZoneId, SimRoute53HostedZone>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface GetHostedZoneCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Route53 GetHostedZoneCommand handler.
  *
@@ -14,12 +20,18 @@ interface GetHostedZoneCommandHandlerProps {
  */
 export declare class GetHostedZoneCommandHandler implements CommandHandler<SimGetHostedZoneCommand, SimGetHostedZoneCommandOutput> {
     private readonly hostedZones;
+    private readonly authorizer;
     private readonly background;
-    constructor(props: GetHostedZoneCommandHandlerProps);
+    constructor(properties: GetHostedZoneCommandHandlerProperties);
     /**
      * Handle getting a Route53 Hosted Zone.
+     *
+     * The hosted zone ID is normalized before authorization because it is the
+     * resource identifier used in the IAM decision. Authorization happens before
+     * the hosted zone store is read so unauthorized callers cannot learn whether
+     * the requested ID exists.
      */
-    handle(cmd: SimGetHostedZoneCommand): Promise<SimGetHostedZoneCommandOutput>;
+    handle(command: SimGetHostedZoneCommand, options?: GetHostedZoneCommandHandlerOptions): Promise<SimGetHostedZoneCommandOutput>;
 }
 export {};
 //# sourceMappingURL=get-hosted-zone.handler.d.ts.map

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-hosted-zone.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/get-hosted-zone/get-hosted-zone.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AAEzF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,0BAA0B,CAAC;AAElC,UAAU,gCAAgC;IACxC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,2BAA4B,YAAW,cAAc,CAChE,uBAAuB,EACvB,6BAA6B,CAC9B;IACC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG1B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,KAAK,EAAE,gCAAgC,EAIlD;IAED;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,CA+BxC;CACF"}
+{"version":3,"file":"get-hosted-zone.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/get-hosted-zone/get-hosted-zone.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AAEzF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,2BAA4B,YAAW,cAAc,CAChE,uBAAuB,EACvB,6BAA6B,CAC9B;IACC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG1B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,qCAAqC,EAS5D;IAED;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,kCAAkC,GAC3C,OAAO,CAAC,6BAA6B,CAAC,CAkCxC;CACF"}

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone.handler.js

@@ -1,6 +1,8 @@
 import { BackgroundTasks, } from "../../../../util/background/background.js";
 import { normalizeSimRoute53HostedZoneId, } from "../create-hosted-zone/sim-route53-zone-id.js";
 import { SimRoute53NoSuchHostedZone } from "../../error/sim-route53.error.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { GetHostedZoneAuthorizer } from "./get-hosted-zone-authorizer.js";
 /**
  * Route53 GetHostedZoneCommand handler.
  *
@@ -8,19 +10,28 @@ import { SimRoute53NoSuchHostedZone } from "../../error/sim-route53.error.js";
  */
 export class GetHostedZoneCommandHandler {
     hostedZones;
+    authorizer;
     background;
-    constructor(props) {
-        const { hostedZones, background = new BackgroundTasks() } = props;
+    constructor(properties) {
+        const { hostedZones, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
         this.hostedZones = hostedZones;
+        this.authorizer = new GetHostedZoneAuthorizer({ iam });
         this.background = background;
     }
     /**
      * Handle getting a Route53 Hosted Zone.
+     *
+     * The hosted zone ID is normalized before authorization because it is the
+     * resource identifier used in the IAM decision. Authorization happens before
+     * the hosted zone store is read so unauthorized callers cannot learn whether
+     * the requested ID exists.
      */
-    async handle(cmd) {
-        const hostedZoneId = normalizeSimRoute53HostedZoneId(cmd.input.Id);
+    async handle(command, options) {
+        const hostedZoneId = normalizeSimRoute53HostedZoneId(command.input.Id);
+        const hostedZoneArn = `arn:aws:route53:::hostedzone/${hostedZoneId}`;
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
+        this.authorizer.authorize(hostedZoneArn, options?.caller);
         const hostedZone = this.hostedZones.get(hostedZoneId);
         if (hostedZone === undefined) {
             throw new SimRoute53NoSuchHostedZone(`No sim Route53 Hosted Zone with ID ${hostedZoneId}`);

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-hosted-zone.handler.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/get-hosted-zone/get-hosted-zone.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAW9E;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAIrB,WAAW,CAG1B;IACe,UAAU,CAAsB;IAEjD,YAAY,KAAuC;QACjD,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,KAAK,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA4B;QAE5B,MAAM,YAAY,GAAG,+BAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEnE,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,0BAA0B,CAClC,sCAAsC,YAAY,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;aACjD;YACD,aAAa,EAAE;gBACb,WAAW,EAAE;oBACX,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;iBACzB;aACF;YACD,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"get-hosted-zone.handler.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/get-hosted-zone/get-hosted-zone.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAK9E,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAY1E;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAIrB,WAAW,CAG1B;IACe,UAAU,CAA0B;IACpC,UAAU,CAAsB;IAEjD,YAAY,UAAiD;QAC3D,MAAM,EACJ,WAAW,EACX,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,OAAgC,EAChC,OAA4C;QAE5C,MAAM,YAAY,GAAG,+BAA+B,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,gCAAgC,YAAY,EAAE,CAAC;QAErE,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,0BAA0B,CAClC,sCAAsC,YAAY,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;aACjD;YACD,aAAa,EAAE;gBACb,WAAW,EAAE;oBACX,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;oBACxB,wBAAwB;iBACzB;aACF;YACD,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/route53/command/list-hosted-zones-by-name/list-hosted-zones-by-name-authorizer.d.ts

@@ -0,0 +1,29 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface ListHostedZonesByNameAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to a Route53 ListHostedZonesByName request.
+ *
+ * ListHostedZonesByName is an account-level list operation. Its authorization
+ * resource is "*" because the operation is not scoped to any individual hosted
+ * zone. A denied caller receives AccessDenied rather than an empty or filtered
+ * listing.
+ */
+export declare class ListHostedZonesByNameAuthorizer {
+    private static readonly action;
+    private static readonly resource;
+    private readonly iam;
+    constructor(properties: ListHostedZonesByNameAuthorizerProperties);
+    /**
+     * Ensure the caller may list hosted zones.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit anonymous
+     * caller.
+     */
+    authorize(caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=list-hosted-zones-by-name-authorizer.d.ts.map

package/dist/service/route53/command/list-hosted-zones-by-name/list-hosted-zones-by-name-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-hosted-zones-by-name-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/list-hosted-zones-by-name/list-hosted-zones-by-name-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,yCAAyC;IACjD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAmC;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAO;IAEvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,yCAAyC,EAEhE;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcrC;CACF"}