@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.js

@@ -0,0 +1,35 @@
+import { simIamPolicyDocumentStatements } from "../../../iam/policy/sim-iam-pol-document-statements.js";
+import { simS3ConditionPinsPrincipal } from "./sim-s3-pinning-condition.js";
+import { simS3PrincipalIsWildcard } from "./sim-s3-public-principal.js";
+/**
+ * Decides whether a Bucket policy allows public access, which is what S3 Block
+ * Public Access judges a PutBucketPolicy call against.
+ *
+ * Real S3 starts by assuming a policy is public and looks for a reason it is
+ * not: a statement qualifies as non-public only when it grants access to fixed
+ * values. The simulator follows the same direction, so anything it cannot
+ * classify stays public and gets refused.
+ */
+export class SimS3PublicPolicy {
+    /**
+     * Whether any statement in the document grants public access.
+     */
+    isPublic(document) {
+        return simIamPolicyDocumentStatements(document).some((statement) => this.statementIsPublic(statement));
+    }
+    statementIsPublic(statement) {
+        if (statement.Effect !== "Allow") {
+            return false;
+        }
+        // NotPrincipal grants to everyone except the listed identities, which is
+        // public by any reading.
+        if (statement.NotPrincipal !== undefined) {
+            return true;
+        }
+        if (!simS3PrincipalIsWildcard(statement.Principal)) {
+            return false;
+        }
+        return !simS3ConditionPinsPrincipal(statement.Condition);
+    }
+}
+//# sourceMappingURL=sim-s3-public-policy.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wDAAwD,CAAC;AAKxG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAA8B;QACrC,OAAO,8BAA8B,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAClC,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,SAAwC;QAChE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yEAAyE;QACzE,yBAAyB;QACzB,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,2BAA2B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.d.ts

@@ -0,0 +1,11 @@
+import type { SimIamPolicyDocumentPrincipal } from "../../../iam/policy/sim-iam-policy.js";
+/**
+ * Whether a policy statement Principal names everyone rather than fixed
+ * identities.
+ *
+ * Only the `AWS` principal type can be a wildcard that opens a Bucket to the
+ * world. A `Service`, `Federated` or `CanonicalUser` principal names something
+ * specific, so a statement granting one of those is not public.
+ */
+export declare function simS3PrincipalIsWildcard(principal: SimIamPolicyDocumentPrincipal | undefined): boolean;
+//# sourceMappingURL=sim-s3-public-principal.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-principal.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,uCAAuC,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,6BAA6B,GAAG,SAAS,GACnD,OAAO,CAkBT"}

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.js

@@ -0,0 +1,34 @@
+/**
+ * Whether a policy statement Principal names everyone rather than fixed
+ * identities.
+ *
+ * Only the `AWS` principal type can be a wildcard that opens a Bucket to the
+ * world. A `Service`, `Federated` or `CanonicalUser` principal names something
+ * specific, so a statement granting one of those is not public.
+ */
+export function simS3PrincipalIsWildcard(principal) {
+    if (principal === undefined) {
+        // A Bucket policy statement must name a Principal. One that does not is
+        // not something the simulator can classify, so it counts as public.
+        return true;
+    }
+    if (typeof principal === "string") {
+        return principal === "*";
+    }
+    if (Array.isArray(principal)) {
+        return principal.includes("*");
+    }
+    return awsPrincipalIsWildcard(principal);
+}
+function awsPrincipalIsWildcard(principal) {
+    for (const [principalType, value] of Object.entries(principal)) {
+        if (principalType.toLowerCase() !== "aws") {
+            continue;
+        }
+        if (typeof value === "string" ? value === "*" : value.includes("*")) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=sim-s3-public-principal.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-principal.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-principal.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAoD;IAEpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,wEAAwE;QACxE,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,SAAS,KAAK,GAAG,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,sBAAsB,CAC3B,SAAgD,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8C;IAE9C,KAAK,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/s3/bucket/sim-s3-bucket-arn.d.ts

@@ -0,0 +1,9 @@
+import type { SimS3BucketName } from "./sim-s3-bucket.js";
+/**
+ * The ARN of a simulated S3 Bucket.
+ *
+ * S3 Bucket ARNs name no Account and no Region, because Bucket names are
+ * globally unique in S3. Object ARNs are this with `/<key>` appended.
+ */
+export declare function simS3BucketArn(bucketName: SimS3BucketName | string): string;
+//# sourceMappingURL=sim-s3-bucket-arn.d.ts.map

package/dist/service/s3/bucket/sim-s3-bucket-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAE3E"}

package/dist/service/s3/bucket/sim-s3-bucket-arn.js

@@ -0,0 +1,10 @@
+/**
+ * The ARN of a simulated S3 Bucket.
+ *
+ * S3 Bucket ARNs name no Account and no Region, because Bucket names are
+ * globally unique in S3. Object ARNs are this with `/<key>` appended.
+ */
+export function simS3BucketArn(bucketName) {
+    return `arn:aws:s3:::${bucketName}`;
+}
+//# sourceMappingURL=sim-s3-bucket-arn.js.map

package/dist/service/s3/bucket/sim-s3-bucket-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-arn.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket-arn.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,UAAoC;IACjE,OAAO,gBAAgB,UAAU,EAAE,CAAC;AACtC,CAAC"}

package/dist/service/s3/bucket/sim-s3-bucket.d.ts

@@ -2,6 +2,7 @@ import type { Brand } from "../../../util/brand.type.js";
 import type { SimS3BucketStorage } from "../storage/s3-bucket-storage.js";
 import type { SimS3Object } from "../object/s3-object.js";
 import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
+import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
 export type SimS3BucketName = Brand<string, "SimS3BucketName">;
@@ -11,6 +12,7 @@ interface SimS3BucketProperties {
     readonly storage?: SimS3BucketStorage;
     readonly website?: SimS3BucketWebsite;
     readonly policy?: SimIamPolicyDocument | undefined;
+    readonly publicAccessBlock?: SimS3PublicAccessBlock;
 }
 /**
  * Simulated S3 Bucket.
@@ -21,6 +23,7 @@ export declare class SimS3Bucket {
     private storage;
     private website;
     private policy;
+    private publicAccessBlock;
     constructor(properties: SimS3BucketProperties);
     /**
      * Put a simulated S3 Object into storage.
@@ -54,6 +57,28 @@ export declare class SimS3Bucket {
      * Get the Bucket resource policy.
      */
     getPolicy(): SimIamPolicyDocument | undefined;
+    /**
+     * Remove the Bucket resource policy.
+     *
+     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
+     * whether there was a policy to remove.
+     */
+    deletePolicy(): void;
+    /**
+     * Replace this Bucket's Block Public Access settings.
+     */
+    configurePublicAccessBlock(publicAccessBlock: SimS3PublicAccessBlock): void;
+    /**
+     * Get this Bucket's Block Public Access settings.
+     */
+    getPublicAccessBlock(): SimS3PublicAccessBlock;
+    /**
+     * Remove this Bucket's Block Public Access settings.
+     *
+     * Removing the configuration returns the Bucket to the all-enabled state a
+     * new Bucket starts in, rather than leaving it unprotected.
+     */
+    deletePublicAccessBlock(): void;
     /**
      * Get the simulated AWS account Region scope for this Bucket.
      */

package/dist/service/s3/bucket/sim-s3-bucket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-bucket.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAK/E,MAAM,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE/D,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACpD;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,SAAgB,UAAU,EAAE,eAAe,CAAC;IAE5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAmC;IAEjD,YAAY,UAAU,EAAE,qBAAqB,EAgB5C;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;IAED;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7D;IAED;;OAEG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEzD;IAED;;OAEG;IACH,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAErD;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,UAAU,IAAI,kBAAkB,CAE/B;IAED;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAE5C;IAED;;OAEG;IACH,qBAAqB,IAAI,wBAAwB,CAEhD;IAED;;OAEG;IACH,aAAa,IAAI,GAAG,CAMnB;CACF"}
+{"version":3,"file":"sim-s3-bucket.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAK/E,MAAM,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE/D,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,SAAgB,UAAU,EAAE,eAAe,CAAC;IAE5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,iBAAiB,CAAyB;IAElD,YAAY,UAAU,EAAE,qBAAqB,EAkB5C;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;IAED;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7D;IAED;;OAEG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEzD;IAED;;OAEG;IACH,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAErD;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,UAAU,IAAI,kBAAkB,CAE/B;IAED;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAE5C;IAED;;;;;OAKG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,0BAA0B,CAAC,iBAAiB,EAAE,sBAAsB,GAAG,IAAI,CAE1E;IAED;;OAEG;IACH,oBAAoB,IAAI,sBAAsB,CAE7C;IAED;;;;;OAKG;IACH,uBAAuB,IAAI,IAAI,CAE9B;IAED;;OAEG;IACH,qBAAqB,IAAI,wBAAwB,CAEhD;IAED;;OAEG;IACH,aAAa,IAAI,GAAG,CAMnB;CACF"}

package/dist/service/s3/bucket/sim-s3-bucket.js

@@ -1,5 +1,6 @@
 import { MemoryS3BucketStorage } from "../storage/s3-memory-storage.js";
 import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
+import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
 import { simS3BucketWebsiteUrl } from "./website/sim-s3-bucket-website-url.js";
 import { validateS3BucketName } from "./validate/validate-s3-bucket-name.js";
 import { simAwsAccountRegionScopeFactory } from "../../aws/sim-aws-account-region-scope.factory.js";
@@ -12,14 +13,16 @@ export class SimS3Bucket {
     storage;
     website;
     policy;
+    publicAccessBlock;
     constructor(properties) {
-        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), website = new SimS3BucketWebsite(), policy, } = properties;
+        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), website = new SimS3BucketWebsite(), policy, publicAccessBlock = SimS3PublicAccessBlock.blockingAll(), } = properties;
         validateS3BucketName(bucketName);
         this.bucketName = bucketName;
         this.accountRegionScope = accountRegionScope;
         this.storage = storage;
         this.website = website;
         this.policy = policy;
+        this.publicAccessBlock = publicAccessBlock;
     }
     /**
      * Put a simulated S3 Object into storage.
@@ -69,6 +72,36 @@ export class SimS3Bucket {
     getPolicy() {
         return this.policy;
     }
+    /**
+     * Remove the Bucket resource policy.
+     *
+     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
+     * whether there was a policy to remove.
+     */
+    deletePolicy() {
+        this.policy = undefined;
+    }
+    /**
+     * Replace this Bucket's Block Public Access settings.
+     */
+    configurePublicAccessBlock(publicAccessBlock) {
+        this.publicAccessBlock = publicAccessBlock;
+    }
+    /**
+     * Get this Bucket's Block Public Access settings.
+     */
+    getPublicAccessBlock() {
+        return this.publicAccessBlock;
+    }
+    /**
+     * Remove this Bucket's Block Public Access settings.
+     *
+     * Removing the configuration returns the Bucket to the all-enabled state a
+     * new Bucket starts in, rather than leaving it unprotected.
+     */
+    deletePublicAccessBlock() {
+        this.publicAccessBlock = SimS3PublicAccessBlock.blockingAll();
+    }
     /**
      * Get the simulated AWS account Region scope for this Bucket.
      */

package/dist/service/s3/bucket/sim-s3-bucket.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-bucket.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAGxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AAYpG;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,UAAU,CAAkB;IAE3B,kBAAkB,CAA2B;IACtD,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAC5B,MAAM,CAAmC;IAEjD,YAAY,UAAiC;QAC3C,MAAM,EACJ,UAAU,EACV,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,OAAO,GAAG,IAAI,qBAAqB,EAAE,EACrC,OAAO,GAAG,IAAI,kBAAkB,EAAE,EAClC,MAAM,GACP,GAAG,UAAU,CAAC;QAEf,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAe;QAC/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,OAA2B;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAA2B;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAA4B;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,qBAAqB,CAC1B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-s3-bucket.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-bucket.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAGvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AAapG;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,UAAU,CAAkB;IAE3B,kBAAkB,CAA2B;IACtD,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAC5B,MAAM,CAAmC;IACzC,iBAAiB,CAAyB;IAElD,YAAY,UAAiC;QAC3C,MAAM,EACJ,UAAU,EACV,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,OAAO,GAAG,IAAI,qBAAqB,EAAE,EACrC,OAAO,GAAG,IAAI,kBAAkB,EAAE,EAClC,MAAM,EACN,iBAAiB,GAAG,sBAAsB,CAAC,WAAW,EAAE,GACzD,GAAG,UAAU,CAAC;QAEf,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAe;QAC/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,OAA2B;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAA2B;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAA4B;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,0BAA0B,CAAC,iBAAyC;QAClE,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,uBAAuB;QACrB,IAAI,CAAC,iBAAiB,GAAG,sBAAsB,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,qBAAqB,CAC1B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/bucket/sim-s3-endpoint-url.d.ts

@@ -0,0 +1,16 @@
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+import type { SimS3BucketName } from "./sim-s3-bucket.js";
+/**
+ * The simulated S3 REST API endpoint for a Region.
+ *
+ * This is the URL an AWS SDK client is pointed at, and the client adds the
+ * Bucket to it for itself, as it does against real S3. Handing out the service
+ * endpoint rather than a Bucket one is therefore what lets the real SDK, and
+ * the real presigner, build simulated S3 URLs without being told how.
+ */
+export declare function simS3ServiceUrl(regionName: AwsRegionName): URL;
+/**
+ * The simulated S3 REST API endpoint for one Bucket, in virtual-hosted style.
+ */
+export declare function simS3BucketUrl(bucketName: SimS3BucketName, regionName: AwsRegionName): URL;
+//# sourceMappingURL=sim-s3-endpoint-url.d.ts.map

package/dist/service/s3/bucket/sim-s3-endpoint-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-endpoint-url.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-endpoint-url.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,aAAa,GAAG,GAAG,CAE9D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,eAAe,EAC3B,UAAU,EAAE,aAAa,GACxB,GAAG,CAIL"}

package/dist/service/s3/bucket/sim-s3-endpoint-url.js

@@ -0,0 +1,19 @@
+import { simAwsLocalConfig } from "../../../serve/http/local-server/sim-aws-local.config.js";
+/**
+ * The simulated S3 REST API endpoint for a Region.
+ *
+ * This is the URL an AWS SDK client is pointed at, and the client adds the
+ * Bucket to it for itself, as it does against real S3. Handing out the service
+ * endpoint rather than a Bucket one is therefore what lets the real SDK, and
+ * the real presigner, build simulated S3 URLs without being told how.
+ */
+export function simS3ServiceUrl(regionName) {
+    return new URL(`http://s3.${regionName}.${simAwsLocalConfig.hostname}/`);
+}
+/**
+ * The simulated S3 REST API endpoint for one Bucket, in virtual-hosted style.
+ */
+export function simS3BucketUrl(bucketName, regionName) {
+    return new URL(`http://${bucketName}.s3.${regionName}.${simAwsLocalConfig.hostname}/`);
+}
+//# sourceMappingURL=sim-s3-endpoint-url.js.map

package/dist/service/s3/bucket/sim-s3-endpoint-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-endpoint-url.js","sourceRoot":"","sources":["../../../../src/service/s3/bucket/sim-s3-endpoint-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAI7F;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAAyB;IACvD,OAAO,IAAI,GAAG,CAAC,aAAa,UAAU,IAAI,iBAAiB,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,UAA2B,EAC3B,UAAyB;IAEzB,OAAO,IAAI,GAAG,CACZ,UAAU,UAAU,OAAO,UAAU,IAAI,iBAAiB,CAAC,QAAQ,GAAG,CACvE,CAAC;AACJ,CAAC"}

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.d.ts

@@ -0,0 +1,13 @@
+import type { SimS3 } from "../../sim-s3.js";
+/**
+ * Make a Bucket's Objects publicly readable, as a static website Bucket must
+ * be.
+ *
+ * Real S3 serves a website endpoint only what the Bucket policy has made
+ * readable, and blocks a public Bucket policy on a new Bucket, so a website
+ * needs both steps. This issues exactly the two commands a real deployment
+ * issues rather than reaching around them, so a test using it exercises the
+ * same path a user's own setup would.
+ */
+export declare function grantPublicWebsiteRead(simS3: SimS3, bucketName: string): Promise<void>;
+//# sourceMappingURL=sim-s3-public-website.fixture.d.ts.map

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-website.fixture.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/website/sim-s3-public-website.fixture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.js

@@ -0,0 +1,36 @@
+/**
+ * Make a Bucket's Objects publicly readable, as a static website Bucket must
+ * be.
+ *
+ * Real S3 serves a website endpoint only what the Bucket policy has made
+ * readable, and blocks a public Bucket policy on a new Bucket, so a website
+ * needs both steps. This issues exactly the two commands a real deployment
+ * issues rather than reaching around them, so a test using it exercises the
+ * same path a user's own setup would.
+ */
+export async function grantPublicWebsiteRead(simS3, bucketName) {
+    await simS3.putPublicAccessBlock({
+        input: {
+            Bucket: bucketName,
+            PublicAccessBlockConfiguration: {
+                BlockPublicAcls: true,
+                IgnorePublicAcls: true,
+            },
+        },
+    });
+    await simS3.putBucketPolicy({
+        input: {
+            Bucket: bucketName,
+            Policy: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: {
+                    Effect: "Allow",
+                    Principal: "*",
+                    Action: "s3:GetObject",
+                    Resource: `arn:aws:s3:::${bucketName}/*`,
+                },
+            }),
+        },
+    });
+}
+//# sourceMappingURL=sim-s3-public-website.fixture.js.map

package/dist/service/s3/bucket/website/sim-s3-public-website.fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-website.fixture.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/website/sim-s3-public-website.fixture.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAY,EACZ,UAAkB;IAElB,MAAM,KAAK,CAAC,oBAAoB,CAAC;QAC/B,KAAK,EAAE;YACL,MAAM,EAAE,UAAU;YAClB,8BAA8B,EAAE;gBAC9B,eAAe,EAAE,IAAI;gBACrB,gBAAgB,EAAE,IAAI;aACvB;SACF;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE;YACL,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;gBACrB,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,GAAG;oBACd,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,gBAAgB,UAAU,IAAI;iBACzC;aACF,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.d.ts

@@ -0,0 +1,27 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3 } from "../../sim-s3.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface SimCfnS3BucketCreatorProperties {
+    readonly simS3: SimS3;
+}
+/**
+ * Creates simulated S3 Buckets from AWS::S3::Bucket CloudFormation Resources.
+ */
+export declare class SimCfnS3BucketCreator {
+    private readonly simS3;
+    constructor(properties: SimCfnS3BucketCreatorProperties);
+    /**
+     * Create a simulated Bucket, with its website configuration when declared.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimS3Bucket>;
+    /**
+     * Read PublicAccessBlockConfiguration, which a template uses to open a
+     * Bucket up from the all-blocked state a new Bucket starts in.
+     */
+    private publicAccessConfigurationForResource;
+    private bucketNameForResource;
+    private websiteConfigurationForResource;
+}
+export {};
+//# sourceMappingURL=sim-cfn-s3-bucket-creator.d.ts.map

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAMjE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,WAAW,CAAC,CAwCtB;IAED;;;OAGG;IACH,OAAO,CAAC,oCAAoC;IAiB5C,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,+BAA+B;CAqCxC"}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.js

@@ -0,0 +1,92 @@
+import { validateS3BucketName } from "../../bucket/validate/validate-s3-bucket-name.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/**
+ * Creates simulated S3 Buckets from AWS::S3::Bucket CloudFormation Resources.
+ */
+export class SimCfnS3BucketCreator {
+    simS3;
+    constructor(properties) {
+        this.simS3 = properties.simS3;
+    }
+    /**
+     * Create a simulated Bucket, with its website configuration when declared.
+     */
+    async create(resource, properties) {
+        const bucketName = this.bucketNameForResource(resource, properties);
+        validateS3BucketName(bucketName);
+        await this.simS3.createBucket({
+            input: {
+                Bucket: bucketName,
+            },
+        });
+        const bucket = this.simS3.getSimBucketByName(bucketName);
+        assertDefined(bucket, `sim S3 Bucket ${bucketName} after CloudFormation creation`);
+        const websiteConfig = this.websiteConfigurationForResource(properties);
+        if (websiteConfig !== undefined) {
+            await this.simS3.putBucketWebsite({
+                input: {
+                    Bucket: bucketName,
+                    WebsiteConfiguration: websiteConfig,
+                },
+            });
+        }
+        const publicAccessConfig = this.publicAccessConfigurationForResource(properties);
+        if (publicAccessConfig !== undefined) {
+            await this.simS3.putPublicAccessBlock({
+                input: {
+                    Bucket: bucketName,
+                    PublicAccessBlockConfiguration: publicAccessConfig,
+                },
+            });
+        }
+        return bucket;
+    }
+    /**
+     * Read PublicAccessBlockConfiguration, which a template uses to open a
+     * Bucket up from the all-blocked state a new Bucket starts in.
+     */
+    publicAccessConfigurationForResource(properties) {
+        const publicAccessConfig = properties["PublicAccessBlockConfiguration"];
+        if (publicAccessConfig === undefined ||
+            publicAccessConfig === null ||
+            typeof publicAccessConfig !== "object" ||
+            Array.isArray(publicAccessConfig)) {
+            return undefined;
+        }
+        return publicAccessConfig;
+    }
+    bucketNameForResource(resource, properties) {
+        const bucketName = properties["BucketName"];
+        if (typeof bucketName === "string") {
+            return bucketName;
+        }
+        return resource.logicalId.toLowerCase();
+    }
+    websiteConfigurationForResource(properties) {
+        const websiteConfig = properties["WebsiteConfiguration"];
+        if (websiteConfig === undefined ||
+            websiteConfig === null ||
+            typeof websiteConfig !== "object" ||
+            Array.isArray(websiteConfig)) {
+            return undefined;
+        }
+        if ("RoutingRules" in websiteConfig &&
+            !Array.isArray(websiteConfig["RoutingRules"])) {
+            return undefined;
+        }
+        return {
+            ...websiteConfig,
+            IndexDocument: typeof websiteConfig["IndexDocument"] === "string"
+                ? {
+                    Suffix: websiteConfig["IndexDocument"],
+                }
+                : websiteConfig["IndexDocument"],
+            ErrorDocument: typeof websiteConfig["ErrorDocument"] === "string"
+                ? {
+                    Key: websiteConfig["ErrorDocument"],
+                }
+                : websiteConfig["ErrorDocument"],
+        };
+    }
+}
+//# sourceMappingURL=sim-cfn-s3-bucket-creator.js.map

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-creator.js","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAQ;IAE9B,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5B,KAAK,EAAE;gBACL,MAAM,EAAE,UAAU;aACnB;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzD,aAAa,CACX,MAAM,EACN,iBAAiB,UAAU,gCAAgC,CAC5D,CAAC;QAEF,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAEvE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAChC,KAAK,EAAE;oBACL,MAAM,EAAE,UAAU;oBAClB,oBAAoB,EAAE,aAAa;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GACtB,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;gBACpC,KAAK,EAAE;oBACL,MAAM,EAAE,UAAU;oBAClB,8BAA8B,EAAE,kBAAkB;iBACnD;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,oCAAoC,CAC1C,UAAqC;QAErC,MAAM,kBAAkB,GAAG,UAAU,CAAC,gCAAgC,CAAC,CAAC;QAExE,IACE,kBAAkB,KAAK,SAAS;YAChC,kBAAkB,KAAK,IAAI;YAC3B,OAAO,kBAAkB,KAAK,QAAQ;YACtC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EACjC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAEO,qBAAqB,CAC3B,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAEO,+BAA+B,CACrC,UAAqC;QAErC,MAAM,aAAa,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAEzD,IACE,aAAa,KAAK,SAAS;YAC3B,aAAa,KAAK,IAAI;YACtB,OAAO,aAAa,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,cAAc,IAAI,aAAa;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,EAC7C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,GAAG,aAAa;YAChB,aAAa,EACX,OAAO,aAAa,CAAC,eAAe,CAAC,KAAK,QAAQ;gBAChD,CAAC,CAAC;oBACE,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC;iBACvC;gBACH,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;YACpC,aAAa,EACX,OAAO,aAAa,CAAC,eAAe,CAAC,KAAK,QAAQ;gBAChD,CAAC,CAAC;oBACE,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC;iBACpC;gBACH,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;SACf,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/s3/cfn/bucket-policy/sim-cfn-s3-bucket-policy-creator.d.ts

@@ -0,0 +1,32 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3 } from "../../sim-s3.js";
+interface SimCfnS3BucketPolicyCreatorProperties {
+    readonly simS3: SimS3;
+}
+/**
+ * Creates simulated S3 Bucket policies from AWS::S3::BucketPolicy Resources.
+ *
+ * This is what CDK emits for every `grantRead`, `grantPut` and
+ * `addToResourcePolicy`, so a synthesized template reaches it whether or not
+ * the app mentions a Bucket policy itself. Creation goes through the normal
+ * PutBucketPolicy command path, so a policy declared in a template is validated
+ * and enforced exactly as one applied through the SDK.
+ */
+export declare class SimCfnS3BucketPolicyCreator {
+    private readonly simS3;
+    constructor(properties: SimCfnS3BucketPolicyCreatorProperties);
+    /**
+     * Attach a policy to the Bucket named by the Resource.
+     *
+     * The simulated Bucket is returned as the Resource's simulated object,
+     * because a Bucket policy has no existence of its own in S3: it is state on
+     * the Bucket it is attached to.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimS3Bucket>;
+    private bucketNameForResource;
+    private policyDocumentForResource;
+}
+export {};
+//# sourceMappingURL=sim-cfn-s3-bucket-policy-creator.d.ts.map

package/dist/service/s3/cfn/bucket-policy/sim-cfn-s3-bucket-policy-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket-policy/sim-cfn-s3-bucket-policy-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAG7C,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;;OAMG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,WAAW,CAAC,CAkBtB;IAED,OAAO,CAAC,qBAAqB;IAe7B,OAAO,CAAC,yBAAyB;CAmBlC"}

package/dist/service/s3/cfn/bucket-policy/sim-cfn-s3-bucket-policy-creator.js

@@ -0,0 +1,55 @@
+import { jsonStringify } from "../../../../util/type-guard/json.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/**
+ * Creates simulated S3 Bucket policies from AWS::S3::BucketPolicy Resources.
+ *
+ * This is what CDK emits for every `grantRead`, `grantPut` and
+ * `addToResourcePolicy`, so a synthesized template reaches it whether or not
+ * the app mentions a Bucket policy itself. Creation goes through the normal
+ * PutBucketPolicy command path, so a policy declared in a template is validated
+ * and enforced exactly as one applied through the SDK.
+ */
+export class SimCfnS3BucketPolicyCreator {
+    simS3;
+    constructor(properties) {
+        this.simS3 = properties.simS3;
+    }
+    /**
+     * Attach a policy to the Bucket named by the Resource.
+     *
+     * The simulated Bucket is returned as the Resource's simulated object,
+     * because a Bucket policy has no existence of its own in S3: it is state on
+     * the Bucket it is attached to.
+     */
+    async create(resource, properties) {
+        const bucketName = this.bucketNameForResource(resource, properties);
+        const policyDocument = this.policyDocumentForResource(resource, properties);
+        await this.simS3.putBucketPolicy({
+            input: {
+                Bucket: bucketName,
+                Policy: jsonStringify(policyDocument),
+            },
+        });
+        const bucket = this.simS3.getSimBucketByName(bucketName);
+        assertDefined(bucket, `sim S3 Bucket ${bucketName} after CloudFormation Bucket policy creation`);
+        return bucket;
+    }
+    bucketNameForResource(resource, properties) {
+        const bucketName = properties["Bucket"];
+        if (typeof bucketName !== "string") {
+            throw new TypeError(`AWS::S3::BucketPolicy ${resource.logicalId} requires a Bucket name string, got ${typeof bucketName}`);
+        }
+        return bucketName;
+    }
+    policyDocumentForResource(resource, properties) {
+        const policyDocument = properties["PolicyDocument"];
+        if (policyDocument === undefined ||
+            policyDocument === null ||
+            typeof policyDocument !== "object" ||
+            Array.isArray(policyDocument)) {
+            throw new TypeError(`AWS::S3::BucketPolicy ${resource.logicalId} requires a PolicyDocument object`);
+        }
+        return policyDocument;
+    }
+}
+//# sourceMappingURL=sim-cfn-s3-bucket-policy-creator.js.map

package/dist/service/s3/cfn/bucket-policy/sim-cfn-s3-bucket-policy-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket-policy/sim-cfn-s3-bucket-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAKpE,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,KAAK,CAAQ;IAE9B,YAAY,UAAiD;QAC3D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE5E,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;YAC/B,KAAK,EAAE;gBACL,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC;aACtC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzD,aAAa,CACX,MAAM,EACN,iBAAiB,UAAU,8CAA8C,CAC1E,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAC3B,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,yBAAyB,QAAQ,CAAC,SAAS,uCAAuC,OAAO,UAAU,EAAE,CACtG,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,yBAAyB,CAC/B,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,cAAc,KAAK,IAAI;YACvB,OAAO,cAAc,KAAK,QAAQ;YAClC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,yBAAyB,QAAQ,CAAC,SAAS,mCAAmC,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;CACF"}

package/dist/service/s3/cfn/sim-cfn-s3-resource-factory.d.ts

@@ -5,14 +5,12 @@ import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource
  * CloudFormation Resource factory for simulated S3 resources.
  */
 export declare class SimS3CloudFormationResourceFactory implements SimCfnServiceResourceFactory {
-    private readonly simS3;
+    private readonly bucketCreator;
+    private readonly bucketPolicyCreator;
     constructor(simS3: SimS3);
     /**
      * Create a simulated S3 resource from a CloudFormation Resource.
      */
     create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
-    private createBucket;
-    private bucketNameForResource;
-    private websiteConfigurationForResource;
 }
 //# sourceMappingURL=sim-cfn-s3-resource-factory.d.ts.map

package/dist/service/s3/cfn/sim-cfn-s3-resource-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-s3-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/cfn/sim-cfn-s3-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAM3H;;GAEG;AACH,qBAAa,kCAAmC,YAAW,4BAA4B;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAlC,YAA6B,KAAK,EAAE,KAAK,EAAI;IAE7C;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;YAEa,YAAY;IAoC1B,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,+BAA+B;CAuCxC"}
+{"version":3,"file":"sim-cfn-s3-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/cfn/sim-cfn-s3-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAI3H;;GAEG;AACH,qBAAa,kCAAmC,YAAW,4BAA4B;IACrF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA8B;IAElE,YAAY,KAAK,EAAE,KAAK,EAGvB;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoB7B;CACF"}