@kensio/yulin 0.34.0 → 0.35.0

package/dist/service/iam/sim-iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,2DAA2D,CAAC;AAKnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,yDAAyD,CAAC;AAEjE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qEAAqE,CAAC;AACxH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,UAAU,gBAAgB;IACxB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;CAClE;AAED;;;;;;;GAOG;AACH,qBAAa,MAAO,YAAW,uBAAuB;IACpD;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;IAEtD,SAAgB,QAAQ,wFAA0C;IAClE,SAAgB,KAAK,kCAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,YAAY,UAAU,GAAE,gBAAqB,EA+C5C;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAE3C;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAElC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAE1C;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AACrE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,iEAAiE,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AAErE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qEAAqE,CAAC;AACxH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,UAAU,gBAAgB;IACxB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;CAClE;AAED;;;;;;;GAOG;AACH,qBAAa,MAAO,YAAW,uBAAuB;IACpD;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;IAEtD,SAAgB,QAAQ,wFAA0C;IAClE,SAAgB,KAAK,kCAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,YAAY,UAAU,GAAE,gBAAqB,EA+C5C;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAE3C;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAElC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAE1C;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/iam/user/sim-iam-user.d.ts

@@ -0,0 +1,31 @@
+import type { JSONString } from "../../../util/type-guard/json.js";
+import type { Brand } from "../../../util/brand.type.js";
+import type { SimArn } from "../../aws/arn.js";
+import type { SimIamAccessKey } from "../credential/sim-iam-access-key.js";
+import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+import type { SimIamPrincipal } from "../principal/sim-iam-principal.js";
+export type SimIamUsername = Brand<string, "SimIamUsername">;
+export type SimIamUserId = Brand<string, "SimIamUserId">;
+/**
+ * Account-scoped simulated IAM user.
+ */
+export interface SimIamUser extends SimIamPrincipal {
+    readonly principalType: "user";
+    readonly userId: SimIamUserId;
+    readonly userName: SimIamUsername;
+    readonly path: string;
+    readonly creationDate: Date;
+    /**
+     * Long-lived access keys owned by this user.
+     */
+    readonly accessKeys: Map<string, SimIamAccessKey>;
+    /**
+     * Inline identity policies stored directly on the user.
+     */
+    readonly inlinePolicies: Map<string, JSONString<SimIamPolicyDocument>>;
+    /**
+     * Managed identity policies attached to the user.
+     */
+    readonly attachedPolicyArns: Set<SimArn>;
+}
+//# sourceMappingURL=sim-iam-user.d.ts.map

package/dist/service/iam/user/sim-iam-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/user/sim-iam-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC7D,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAW,SAAQ,eAAe;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAElD;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvE;;OAEG;IACH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1C"}

package/dist/service/iam/validate/sim-iam-policy-document-validator.d.ts

@@ -0,0 +1,18 @@
+import { type JSONString } from "../../../util/type-guard/json.js";
+import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+/**
+ * Performs basic IAM policy document validation shared by IAM policy commands.
+ */
+export declare class SimIamPolicyDocumentValidator {
+    /**
+     * Validate a required JSON IAM policy document string.
+     */
+    validateRequired(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument>;
+    /**
+     * Validate an optional JSON IAM policy document string when present.
+     */
+    validateOptional(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument> | undefined;
+    private validate;
+    private validateParsed;
+}
+//# sourceMappingURL=sim-iam-policy-document-validator.d.ts.map

package/dist/service/iam/validate/sim-iam-policy-document-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-document-validator.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/validate/sim-iam-policy-document-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAG9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;GAEG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,gBAAgB,CACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAM5D;IAED;;OAEG;IACH,gBAAgB,CACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAMxE;IAED,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,cAAc;CAyBvB"}

package/dist/service/iam/validate/sim-iam-policy-document-validator.js

@@ -0,0 +1,46 @@
+import { jsonParse } from "../../../util/type-guard/json.js";
+import { SimIamMalformedPolicyDocument } from "../error/sim-iam.error.js";
+import { simIamPolicyDocumentStatements } from "../policy/sim-iam-pol-document-statements.js";
+/**
+ * Performs basic IAM policy document validation shared by IAM policy commands.
+ */
+export class SimIamPolicyDocumentValidator {
+    /**
+     * Validate a required JSON IAM policy document string.
+     */
+    validateRequired(policyDocument) {
+        if (policyDocument === undefined || policyDocument.length === 0) {
+            throw new Error("PolicyDocument is required");
+        }
+        this.validate(policyDocument);
+    }
+    /**
+     * Validate an optional JSON IAM policy document string when present.
+     */
+    validateOptional(policyDocument) {
+        if (policyDocument === undefined || policyDocument.length === 0) {
+            return;
+        }
+        this.validate(policyDocument);
+    }
+    validate(policyDocument) {
+        const parsedPolicyDocument = jsonParse(policyDocument);
+        this.validateParsed(parsedPolicyDocument);
+    }
+    validateParsed(policyDocument) {
+        for (const statement of simIamPolicyDocumentStatements(policyDocument)) {
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+            if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
+                throw new SimIamMalformedPolicyDocument('IAM policy statement Effect must be either "Allow" or "Deny"');
+            }
+            if (statement.Action === undefined && statement.NotAction === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Action or NotAction");
+            }
+            if (statement.Resource === undefined &&
+                statement.NotResource === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Resource or NotResource");
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-iam-policy-document-validator.js.map

package/dist/service/iam/validate/sim-iam-policy-document-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-document-validator.js","sourceRoot":"","sources":["../../../../src/service/iam/validate/sim-iam-policy-document-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAmB,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAG9F;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAEO,QAAQ,CACd,cAAsB;QAEtB,MAAM,oBAAoB,GAAG,SAAS,CACpC,cAAkD,CACnD,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAEO,cAAc,CAAC,cAAoC;QACzD,KAAK,MAAM,SAAS,IAAI,8BAA8B,CAAC,cAAc,CAAC,EAAE,CAAC;YACvE,uEAAuE;YACvE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChE,MAAM,IAAI,6BAA6B,CACrC,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,6BAA6B,CACrC,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAChC,SAAS,CAAC,WAAW,KAAK,SAAS,EACnC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,iEAAiE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/validate/trust/sim-iam-trust-policy-document-validator.d.ts

@@ -0,0 +1,22 @@
+import type { JSONString } from "../../../../util/type-guard/json.js";
+import type { SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+/**
+ * Validates an IAM Role trust policy.
+ *
+ * Trust policies differ from identity policies:
+ *
+ * - they require Principal or NotPrincipal;
+ * - they require Action or NotAction;
+ * - Resource and NotResource are not valid because the policy is implicitly
+ *   attached to its owning Role.
+ */
+export declare class SimIamTrustPolicyDocumentValidator {
+    /**
+     * Validate a required JSON Role trust-policy document.
+     */
+    validateRequired(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument>;
+    private validateParsed;
+    private validatePrincipal;
+    private validatePrincipalValue;
+}
+//# sourceMappingURL=sim-iam-trust-policy-document-validator.d.ts.map

package/dist/service/iam/validate/trust/sim-iam-trust-policy-document-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-trust-policy-document-validator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/validate/trust/sim-iam-trust-policy-document-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAGtE,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,gCAAgC,CAAC;AAGxC;;;;;;;;;GASG;AACH,qBAAa,kCAAkC;IAC7C;;OAEG;IACH,gBAAgB,CACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAU5D;IAED,OAAO,CAAC,cAAc;IAqDtB,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,sBAAsB;CAO/B"}

package/dist/service/iam/validate/trust/sim-iam-trust-policy-document-validator.js

@@ -0,0 +1,85 @@
+import { jsonParse } from "../../../../util/type-guard/json.js";
+import { SimIamMalformedPolicyDocument } from "../../error/sim-iam.error.js";
+import { simIamPolicyDocumentStatements } from "../../policy/sim-iam-pol-document-statements.js";
+/**
+ * Validates an IAM Role trust policy.
+ *
+ * Trust policies differ from identity policies:
+ *
+ * - they require Principal or NotPrincipal;
+ * - they require Action or NotAction;
+ * - Resource and NotResource are not valid because the policy is implicitly
+ *   attached to its owning Role.
+ */
+export class SimIamTrustPolicyDocumentValidator {
+    /**
+     * Validate a required JSON Role trust-policy document.
+     */
+    validateRequired(policyDocument) {
+        if (policyDocument === undefined || policyDocument.length === 0) {
+            throw new Error("AssumeRolePolicyDocument is required");
+        }
+        const parsedPolicyDocument = jsonParse(policyDocument);
+        this.validateParsed(parsedPolicyDocument);
+    }
+    validateParsed(policyDocument) {
+        for (const statement of simIamPolicyDocumentStatements(policyDocument)) {
+            // JSON parsing could produce any value so we have to runtime validate.
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+            if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
+                throw new SimIamMalformedPolicyDocument('IAM trust policy statement Effect must be either "Allow" or "Deny"');
+            }
+            if (statement.Action === undefined && statement.NotAction === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement must define either Action or NotAction");
+            }
+            if (statement.Principal === undefined &&
+                statement.NotPrincipal === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement must define either Principal or NotPrincipal");
+            }
+            if (statement.Principal !== undefined &&
+                statement.NotPrincipal !== undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement cannot define both Principal and NotPrincipal");
+            }
+            if (statement.Resource !== undefined ||
+                statement.NotResource !== undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement cannot define Resource or NotResource");
+            }
+            if (statement.Principal !== undefined) {
+                this.validatePrincipal(statement.Principal);
+            }
+            if (statement.NotPrincipal !== undefined) {
+                this.validatePrincipal(statement.NotPrincipal);
+            }
+        }
+    }
+    validatePrincipal(principal) {
+        if (typeof principal === "string") {
+            this.validatePrincipalValue(principal);
+            return;
+        }
+        if (Array.isArray(principal)) {
+            for (const value of principal) {
+                this.validatePrincipalValue(value);
+            }
+            return;
+        }
+        for (const [principalType, values] of Object.entries(principal)) {
+            if (principalType !== "AWS" && principalType !== "Service") {
+                throw new SimIamMalformedPolicyDocument(`Unsupported IAM trust policy principal type: ${principalType}`);
+            }
+            if (typeof values === "string") {
+                this.validatePrincipalValue(values);
+                continue;
+            }
+            for (const value of values) {
+                this.validatePrincipalValue(value);
+            }
+        }
+    }
+    validatePrincipalValue(value) {
+        if (value.length === 0) {
+            throw new SimIamMalformedPolicyDocument("IAM trust policy principal cannot be empty");
+        }
+    }
+}
+//# sourceMappingURL=sim-iam-trust-policy-document-validator.js.map

package/dist/service/iam/validate/trust/sim-iam-trust-policy-document-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-trust-policy-document-validator.js","sourceRoot":"","sources":["../../../../../src/service/iam/validate/trust/sim-iam-trust-policy-document-validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAK7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,OAAO,kCAAkC;IAC7C;;OAEG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,oBAAoB,GAAG,SAAS,CACpC,cAAkD,CACnD,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAEO,cAAc,CAAC,cAAoC;QACzD,KAAK,MAAM,SAAS,IAAI,8BAA8B,CAAC,cAAc,CAAC,EAAE,CAAC;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChE,MAAM,IAAI,6BAA6B,CACrC,oEAAoE,CACrE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,6BAA6B,CACrC,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,EACpC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,EACpC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAChC,SAAS,CAAC,WAAW,KAAK,SAAS,EACnC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,kEAAkE,CACnE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACzC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,SAAwC;QAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,sBAAsB,CAAC,KAAe,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,IAAI,6BAA6B,CACrC,gDAAgD,aAAa,EAAE,CAChE,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,KAAa;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,6BAA6B,CACrC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-code-input.d.ts

@@ -1,6 +1,6 @@
 import type { SimCfnExecutableResourceBinding } from "../../../cloudformation/bind/sim-cfn-exec-binding.type.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
-import type { SimLambdaFunctionCode } from "../../command/create-function/create-function.cmd.js";
+import type { SimLambdaFunctionCode } from "../../command/create-function/create-function.command.js";
 import type { SimCfnLambdaFunctionProperties } from "./sim-cfn-lambda-function-properties-parser.js";
 interface SimCfnLambdaCodeInputProperties {
     readonly resource: SimCfnResource;

package/dist/service/lambda/cfn/function/sim-cfn-lambda-code-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-code-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-code-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAEjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAIlG,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAErG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,+BAA+B,EAAE,GAAG,SAAS,CAAC;CAC5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,+BAA+B,GAC1C,qBAAqB,GAAG,SAAS,CAoBnC"}
+{"version":3,"file":"sim-cfn-lambda-code-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-code-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAEjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAItG,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAErG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,+BAA+B,EAAE,GAAG,SAAS,CAAC;CAC5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,+BAA+B,GAC1C,qBAAqB,GAAG,SAAS,CAoBnC"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-environment-parser.d.ts

@@ -0,0 +1,18 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValue } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimLambdaFunctionEnvironment } from "../../command/create-function/create-function.command.js";
+/**
+ * Parses the nested AWS::Lambda::Function Environment property.
+ *
+ * Its own parser because Environment is the one function property with a
+ * shape of its own rather than a plain scalar: an object holding a map of
+ * variables, each of which has to be checked individually.
+ */
+export declare class SimCfnLambdaEnvironmentParser {
+    private readonly propertyParser;
+    /**
+     * Parse the Environment property into the declared function environment.
+     */
+    parse(resource: SimCfnResource, environment: SimCfnTemplateValue | undefined): SimLambdaFunctionEnvironment | undefined;
+}
+//# sourceMappingURL=sim-cfn-lambda-environment-parser.d.ts.map

package/dist/service/lambda/cfn/function/sim-cfn-lambda-environment-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-environment-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-environment-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AAG7G;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IAEnE;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,mBAAmB,GAAG,SAAS,GAC3C,4BAA4B,GAAG,SAAS,CAuB1C;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-environment-parser.js

@@ -0,0 +1,29 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimCfnLambdaPropertyParser } from "./sim-cfn-lambda-property-parser.js";
+/**
+ * Parses the nested AWS::Lambda::Function Environment property.
+ *
+ * Its own parser because Environment is the one function property with a
+ * shape of its own rather than a plain scalar: an object holding a map of
+ * variables, each of which has to be checked individually.
+ */
+export class SimCfnLambdaEnvironmentParser {
+    propertyParser = new SimCfnLambdaPropertyParser();
+    /**
+     * Parse the Environment property into the declared function environment.
+     */
+    parse(resource, environment) {
+        if (environment === undefined) {
+            return undefined;
+        }
+        if (!isRecord(environment)) {
+            throw this.propertyParser.invalidPropertyError(resource, "Environment", "an object");
+        }
+        const variables = this.propertyParser.optionalStringRecord(resource, environment["Variables"], "Environment.Variables");
+        if (variables === undefined) {
+            return undefined;
+        }
+        return { Variables: variables };
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-environment-parser.js.map

package/dist/service/lambda/cfn/function/sim-cfn-lambda-environment-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-environment-parser.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-environment-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAIjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,cAAc,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAEnE;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,WAA4C;QAE5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAC5C,QAAQ,EACR,aAAa,EACb,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,CACxD,QAAQ,EACR,WAAW,CAAC,WAAW,CAAC,EACxB,uBAAuB,CACxB,CAAC;QACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-code-parser.d.ts

@@ -1,6 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValue } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
-import type { SimLambdaFunctionCode } from "../../command/create-function/create-function.cmd.js";
+import type { SimLambdaFunctionCode } from "../../command/create-function/create-function.command.js";
 /**
  * Parses the AWS::Lambda::Function Code property into sim Lambda
  * CreateFunction code input.

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-code-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-function-code-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-code-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAIlG;;;;;;;;GAQG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IAEnE;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,qBAAqB,GAAG,SAAS,CA+BnC;IAED,OAAO,CAAC,YAAY;CAerB"}
+{"version":3,"file":"sim-cfn-lambda-function-code-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-code-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAItG;;;;;;;;GAQG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IAEnE;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,qBAAqB,GAAG,SAAS,CA+BnC;IAED,OAAO,CAAC,YAAY;CAerB"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.d.ts

@@ -1,6 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
-import type { SimCreateFunctionCommandInput, SimLambdaFunctionCode } from "../../command/create-function/create-function.cmd.js";
+import type { SimCreateFunctionCommandInput, SimLambdaFunctionCode, SimLambdaFunctionEnvironment } from "../../command/create-function/create-function.command.js";
 export interface SimCfnLambdaFunctionProperties {
     readonly functionName: string;
     readonly roleArn: string;
@@ -10,6 +10,7 @@ export interface SimCfnLambdaFunctionProperties {
     readonly description: string | undefined;
     readonly timeoutSeconds: number | undefined;
     readonly memorySizeMb: number | undefined;
+    readonly environment: SimLambdaFunctionEnvironment | undefined;
 }
 /**
  * Map parsed AWS::Lambda::Function properties onto the sim Lambda
@@ -27,6 +28,7 @@ export declare function simCfnLambdaCreateFunctionInput(functionProperties: SimC
 export declare class SimCfnLambdaFunctionPropertiesParser {
     private readonly propertyParser;
     private readonly codeParser;
+    private readonly environmentParser;
     /**
      * Parse the resolved CloudFormation properties for an AWS::Lambda::Function.
      */

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-function-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAGlH,OAAO,KAAK,EACV,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,sDAAsD,CAAC;AAI9D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,kBAAkB,EAAE,8BAA8B,EAClD,IAAI,EAAE,qBAAqB,GAAG,SAAS,GACtC,6BAA6B,CAW/B;AAED;;;;;;GAMG;AACH,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwC;IAEnE;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,8BAA8B,CA+BhC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAqBf;;;OAGG;IACH,OAAO,CAAC,YAAY;CAYrB"}
+{"version":3,"file":"sim-cfn-lambda-function-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAGlH,OAAO,KAAK,EACV,6BAA6B,EAC7B,qBAAqB,EACrB,4BAA4B,EAC7B,MAAM,0DAA0D,CAAC;AAKlE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,4BAA4B,GAAG,SAAS,CAAC;CAChE;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,kBAAkB,EAAE,8BAA8B,EAClD,IAAI,EAAE,qBAAqB,GAAG,SAAS,GACtC,6BAA6B,CAY/B;AAED;;;;;;GAMG;AACH,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwC;IACnE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAuC;IAEzE;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,8BAA8B,CAmChC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAqBf;;;OAGG;IACH,OAAO,CAAC,YAAY;CAYrB"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.js

@@ -1,4 +1,5 @@
 import { makeSimRoleArn } from "../../../iam/role/arn/sim-iam-role-arn.js";
+import { SimCfnLambdaEnvironmentParser } from "./sim-cfn-lambda-environment-parser.js";
 import { SimCfnLambdaFunctionCodeParser } from "./sim-cfn-lambda-function-code-parser.js";
 import { SimCfnLambdaPropertyParser } from "./sim-cfn-lambda-property-parser.js";
 /**
@@ -16,6 +17,7 @@ export function simCfnLambdaCreateFunctionInput(functionProperties, code) {
         Description: functionProperties.description,
         Timeout: functionProperties.timeoutSeconds,
         MemorySize: functionProperties.memorySizeMb,
+        Environment: functionProperties.environment,
     };
 }
 /**
@@ -28,6 +30,7 @@ export function simCfnLambdaCreateFunctionInput(functionProperties, code) {
 export class SimCfnLambdaFunctionPropertiesParser {
     propertyParser = new SimCfnLambdaPropertyParser();
     codeParser = new SimCfnLambdaFunctionCodeParser();
+    environmentParser = new SimCfnLambdaEnvironmentParser();
     /**
      * Parse the resolved CloudFormation properties for an AWS::Lambda::Function.
      */
@@ -41,6 +44,7 @@ export class SimCfnLambdaFunctionPropertiesParser {
             description: this.propertyParser.optionalString(resource, properties["Description"], "Description"),
             timeoutSeconds: this.propertyParser.optionalNumber(resource, properties["Timeout"], "Timeout"),
             memorySizeMb: this.propertyParser.optionalNumber(resource, properties["MemorySize"], "MemorySize"),
+            environment: this.environmentParser.parse(resource, properties["Environment"]),
         };
     }
     /**

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-function-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAM3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAajF;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,kBAAkD,EAClD,IAAuC;IAEvC,OAAO;QACL,YAAY,EAAE,kBAAkB,CAAC,YAAY;QAC7C,IAAI,EAAE,kBAAkB,CAAC,OAAO;QAChC,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,kBAAkB,CAAC,WAAW;QACvC,OAAO,EAAE,kBAAkB,CAAC,WAAW;QACvC,WAAW,EAAE,kBAAkB,CAAC,WAAW;QAC3C,OAAO,EAAE,kBAAkB,CAAC,cAAc;QAC1C,UAAU,EAAE,kBAAkB,CAAC,YAAY;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oCAAoC;IAC9B,cAAc,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAClD,UAAU,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAEnE;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,SAAS,CAAC,EACrB,SAAS,CACV;YACD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,SAAS,CAAC,EACrB,SAAS,CACV;YACD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,EACzB,aAAa,CACd;YACD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAChD,QAAQ,EACR,UAAU,CAAC,SAAS,CAAC,EACrB,SAAS,CACV;YACD,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC9C,QAAQ,EACR,UAAU,CAAC,YAAY,CAAC,EACxB,YAAY,CACb;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,OAAO,CACb,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,MAAM,CAAC,EAClB,MAAM,CACP,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,cAAc,CAAC;YACpB,SAAS,EAAE,QAAQ,CAAC,kBAAkB,CAAC,SAAS;YAChD,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAsB;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,YAAY,CAClB,QAAwB,EACxB,UAAqC;QAErC,OAAO,CACL,IAAI,CAAC,cAAc,CAAC,cAAc,CAChC,QAAQ,EACR,UAAU,CAAC,cAAc,CAAC,EAC1B,cAAc,CACf,IAAI,QAAQ,CAAC,SAAS,CACxB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-lambda-function-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-properties-parser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAO3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAcjF;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,kBAAkD,EAClD,IAAuC;IAEvC,OAAO;QACL,YAAY,EAAE,kBAAkB,CAAC,YAAY;QAC7C,IAAI,EAAE,kBAAkB,CAAC,OAAO;QAChC,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,kBAAkB,CAAC,WAAW;QACvC,OAAO,EAAE,kBAAkB,CAAC,WAAW;QACvC,WAAW,EAAE,kBAAkB,CAAC,WAAW;QAC3C,OAAO,EAAE,kBAAkB,CAAC,cAAc;QAC1C,UAAU,EAAE,kBAAkB,CAAC,YAAY;QAC3C,WAAW,EAAE,kBAAkB,CAAC,WAAW;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oCAAoC;IAC9B,cAAc,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAClD,UAAU,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAClD,iBAAiB,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAEzE;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,SAAS,CAAC,EACrB,SAAS,CACV;YACD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,SAAS,CAAC,EACrB,SAAS,CACV;YACD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,EACzB,aAAa,CACd;YACD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAChD,QAAQ,EACR,UAAU,CAAC,SAAS,CAAC,EACrB,SAAS,CACV;YACD,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC9C,QAAQ,EACR,UAAU,CAAC,YAAY,CAAC,EACxB,YAAY,CACb;YACD,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CACvC,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,CAC1B;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,OAAO,CACb,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,QAAQ,EACR,UAAU,CAAC,MAAM,CAAC,EAClB,MAAM,CACP,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,cAAc,CAAC;YACpB,SAAS,EAAE,QAAQ,CAAC,kBAAkB,CAAC,SAAS;YAChD,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAsB;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,YAAY,CAClB,QAAwB,EACxB,UAAqC;QAErC,OAAO,CACL,IAAI,CAAC,cAAc,CAAC,cAAc,CAChC,QAAQ,EACR,UAAU,CAAC,cAAc,CAAC,EAC1B,cAAc,CACf,IAAI,QAAQ,CAAC,SAAS,CACxB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-property-parser.d.ts

@@ -17,6 +17,14 @@ export declare class SimCfnLambdaPropertyParser {
      * Parse a property value that must be a number when present.
      */
     optionalNumber(resource: SimCfnResource, value: SimCfnTemplateValue | undefined, label: string): number | undefined;
+    /**
+     * Parse a property value that must be a record of strings when present.
+     *
+     * CloudFormation has no typed map, so every value has to be checked: a
+     * template that puts a number or a nested object where a string belongs
+     * should fail here rather than reach the function as a non-string.
+     */
+    optionalStringRecord(resource: SimCfnResource, value: SimCfnTemplateValue | undefined, label: string): Record<string, string> | undefined;
     /**
      * Build the diagnostic error for a malformed property value.
      */

package/dist/service/lambda/cfn/function/sim-cfn-lambda-property-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-property-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-property-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAE5G;;;GAGG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,CAMR;IAED;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAMpB;IAED;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAUpB;IAED;;OAEG;IACH,oBAAoB,CAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,SAAS,CAIX;CACF"}
+{"version":3,"file":"sim-cfn-lambda-property-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-property-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAE5G;;;GAGG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,CAMR;IAED;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAMpB;IAED;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAUpB;IAED;;;;;;OAMG;IACH,oBAAoB,CAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAiBpC;IAED;;OAEG;IACH,oBAAoB,CAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,SAAS,CAIX;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-property-parser.js

@@ -1,3 +1,4 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
 /**
  * Validates individual AWS::Lambda::Function CloudFormation property values,
  * failing with a diagnostic naming the property and the logical ID.
@@ -33,6 +34,26 @@ export class SimCfnLambdaPropertyParser {
         }
         return value;
     }
+    /**
+     * Parse a property value that must be a record of strings when present.
+     *
+     * CloudFormation has no typed map, so every value has to be checked: a
+     * template that puts a number or a nested object where a string belongs
+     * should fail here rather than reach the function as a non-string.
+     */
+    optionalStringRecord(resource, value, label) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (!isRecord(value)) {
+            throw this.invalidPropertyError(resource, label, "an object");
+        }
+        const entries = Object.entries(value).map(([key, entryValue]) => [
+            key,
+            this.requiredString(resource, entryValue, `${label}.${key}`),
+        ]);
+        return Object.fromEntries(entries);
+    }
     /**
      * Build the diagnostic error for a malformed property value.
      */

package/dist/service/lambda/cfn/function/sim-cfn-lambda-property-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-property-parser.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-property-parser.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,oBAAoB,CAClB,QAAwB,EACxB,KAAa,EACb,QAAgB;QAEhB,OAAO,IAAI,SAAS,CAClB,iCAAiC,QAAQ,CAAC,SAAS,KAAK,KAAK,YAAY,QAAQ,EAAE,CACpF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-lambda-property-parser.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-property-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAIjE;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAClB,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,GAAuB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAC3D,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YACrB,GAAG;YACH,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;SAC7D,CACF,CAAC;QAEF,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,oBAAoB,CAClB,QAAwB,EACxB,KAAa,EACb,QAAgB;QAEhB,OAAO,IAAI,SAAS,CAClB,iCAAiC,QAAQ,CAAC,SAAS,KAAK,KAAK,YAAY,QAAQ,EAAE,CACpF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/command/create-function/create-function-environment-names.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Validate the declared environment variable names.
+ *
+ * Applies AWS's two stages in its order: the API name-pattern constraint
+ * first, then the service-level reserved-name rule. The order is what a
+ * caller sees for a name breaking both, such as the reserved `_HANDLER`,
+ * which is also an illegal name shape.
+ */
+export declare function requireValidVariableNames(declared: ReadonlyMap<string, string>): void;
+//# sourceMappingURL=create-function-environment-names.d.ts.map

package/dist/service/lambda/command/create-function/create-function-environment-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment-names.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment-names.ts"],"names":[],"mappings":"AA2EA;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,IAAI,CAGN"}

package/dist/service/lambda/command/create-function/create-function-environment-names.js

@@ -0,0 +1,60 @@
+import { SimLambdaInvalidParameterValueException, SimLambdaValidationException, } from "../../error/sim-lambda.error.js";
+import { lambdaReservedVariableNames } from "./lambda-reserved-variable-names.js";
+/**
+ * The pattern real Lambda requires an environment variable name to match: a
+ * letter, then at least one more letter, digit or underscore.
+ *
+ * The trailing `+` is why a single-character name is rejected too, and why
+ * the reserved names starting with an underscore fail this before they ever
+ * reach the reserved-name check.
+ */
+const variableNamePattern = /^[a-zA-Z][a-zA-Z0-9_]+$/;
+/**
+ * The declared names failing a check, in a stable order for reporting.
+ */
+function namesFailing(declared, fails) {
+    return declared
+        .keys()
+        .filter(fails)
+        .toArray()
+        .toSorted((left, right) => left.localeCompare(right));
+}
+/**
+ * Reject variable names that break the AWS name pattern.
+ */
+function requireMatchingVariableNames(declared) {
+    const invalid = namesFailing(declared, (name) => !variableNamePattern.test(name));
+    if (invalid.length === 0) {
+        return;
+    }
+    throw new SimLambdaValidationException("1 validation error detected: Value at 'environment.variables' failed " +
+        "to satisfy constraint: Map keys must satisfy constraint: [Member " +
+        "must satisfy regular expression pattern: [a-zA-Z]([a-zA-Z0-9_])+]. " +
+        `Invalid keys used in this request: ${invalid.join(", ")}`);
+}
+/**
+ * Reject reserved variable names AWS-style, naming the offenders.
+ */
+function requireUnreservedVariableNames(declared) {
+    const reserved = namesFailing(declared, (name) => lambdaReservedVariableNames.has(name));
+    if (reserved.length === 0) {
+        return;
+    }
+    throw new SimLambdaInvalidParameterValueException("Lambda was unable to configure your environment variables because " +
+        "the environment variables you have provided contains reserved keys " +
+        "that are currently not supported for modification. Reserved keys " +
+        `used in this request: ${reserved.join(", ")}`);
+}
+/**
+ * Validate the declared environment variable names.
+ *
+ * Applies AWS's two stages in its order: the API name-pattern constraint
+ * first, then the service-level reserved-name rule. The order is what a
+ * caller sees for a name breaking both, such as the reserved `_HANDLER`,
+ * which is also an illegal name shape.
+ */
+export function requireValidVariableNames(declared) {
+    requireMatchingVariableNames(declared);
+    requireUnreservedVariableNames(declared);
+}
+//# sourceMappingURL=create-function-environment-names.js.map

package/dist/service/lambda/command/create-function/create-function-environment-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment-names.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment-names.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD;;GAEG;AACH,SAAS,YAAY,CACnB,QAAqC,EACrC,KAAgC;IAEhC,OAAO,QAAQ;SACZ,IAAI,EAAE;SACN,MAAM,CAAC,KAAK,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,4BAA4B,CACnC,QAAqC;IAErC,MAAM,OAAO,GAAG,YAAY,CAC1B,QAAQ,EACR,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,4BAA4B,CACpC,uEAAuE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,8BAA8B,CACrC,QAAqC;IAErC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAC/C,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CACtC,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uCAAuC,CAC/C,oEAAoE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAqC;IAErC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACvC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/service/lambda/command/create-function/create-function-environment.d.ts

@@ -0,0 +1,6 @@
+import type { SimLambdaFunctionEnvironment } from "./create-function.command.js";
+/**
+ * Validate the Environment input into the variables declared for a function.
+ */
+export declare function requireLambdaEnvironmentVariables(environment: SimLambdaFunctionEnvironment | undefined): ReadonlyMap<string, string>;
+//# sourceMappingURL=create-function-environment.d.ts.map

package/dist/service/lambda/command/create-function/create-function-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAEjF;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,4BAA4B,GAAG,SAAS,GACpD,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAU7B"}

package/dist/service/lambda/command/create-function/create-function-environment.js

@@ -0,0 +1,14 @@
+import { requireValidVariableNames } from "./create-function-environment-names.js";
+/**
+ * Validate the Environment input into the variables declared for a function.
+ */
+export function requireLambdaEnvironmentVariables(environment) {
+    const variables = environment?.Variables;
+    if (variables === undefined) {
+        return new Map();
+    }
+    const declared = new Map(Object.entries(variables));
+    requireValidVariableNames(declared);
+    return declared;
+}
+//# sourceMappingURL=create-function-environment.js.map

package/dist/service/lambda/command/create-function/create-function-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAGnF;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAAqD;IAErD,MAAM,SAAS,GAAG,WAAW,EAAE,SAAS,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAEpC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/service/lambda/command/create-function/create-function-input.d.ts

@@ -1,5 +1,5 @@
 import { type SimLambdaCodeSource } from "../../function/code/lambda-code-source.js";
-import type { SimCreateFunctionCommand } from "./create-function.cmd.js";
+import type { SimCreateFunctionCommand } from "./create-function.command.js";
 /**
  * Validated CreateFunction input, in sim Lambda function model terms.
  */
@@ -12,6 +12,7 @@ export interface CreateFunctionInput {
     description: string | undefined;
     timeoutSeconds: number | undefined;
     memorySizeMb: number | undefined;
+    environmentVariables: ReadonlyMap<string, string>;
 }
 /**
  * Require the AWS-required CreateFunction input fields, and validate the